Fortifying Kubernetes
summary
Practical checklist for securing clusters: choose managed vs unmanaged with eyes open (managed may not even let you enable Kubernetes audit logs), enforce default-deny network policies and block outbound to 169.254.169.254 to stop metadata-based cloud credential theft, prevent pod-creation privilege escalation (out-of-the-box pods can lead to root on nodes), use telemetry and runtime tools like OpenTelemetry, Falco, Tetragon and retain centralized logs — note there are about 1.7 million exposed clusters online.
AI-written summary · about
chapters (11)
- 0:00Kubernetes security intro
- 1:10Security depends on context
- 3:17Myth of universal standards
- 5:01Resources shape priorities
- 7:51Attackers and surfaces
- 13:29Managed vs unmanaged Kubernetes
- 16:59Developer access models
- 18:44Network security policies
- 21:50Pod security risks
- 22:54Auditing for incident response
- 25:40Conclusion and key takeaways for Kubernetes security
related talks
34mKubernetes Security 101: Best Practices to Secure Your Cluster
29mKubernetes Security Best Practices
22mSecuring Kubernetes
49mCluster Wrangling: How to make Kubernetes clusters secure and usable
43mKubernetes Security: Attacking and Defending Modern Infrastructure
53mFlying Above the Clouds: Securing Kubernetes
33mSecuring Kubernetes in the Cloud
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era