Disguise Your Kubernetes Cluster as a Ninja
summary
Shows how to make a Kubernetes control plane and services inaccessible from the public internet by closing all incoming ports and running an identity‑based private network. Uses OpenCity (open source) or Net Foundry, with an identity file/agent and modified SDKs/CLI; demo on Oracle Cloud places the cluster in private subnets while a Java app using the OpenCity library authenticates to the private network to call a ClusterIP session API and Redis, and an agent/modified kubectl from a DigitalOcean host provides admin access to the fully private cluster.
AI-written summary · about
chapters (10)
- 0:00Welcome
- 3:13Ninja meaning
- 7:26Invisible to attacks
- 10:40Cyberattacks context
- 14:16Kubernetes not secure
- 18:06Secure networks intro
- 22:39Common vulnerabilities
- 24:04Demo with Open City
- 37:00Visibility risk
- 38:50Q&A
related talks
26mSecuring Access to Kubernetes Infrastructure with Kubernetes Zero Trust Principles
06mProtecting Kubernetes Workloads from Attacks
45mTurning Kubernetes into a Full-Fledged Private Cloud
33mBuilding a Secure, Multi-Protocol and Multi-Tenant Cluster for Internet-Facing Services [A]
49mCluster Wrangling: How to make Kubernetes clusters secure and usable
35mRunning Isolated VirtualClusters With Kata & Cluster API
53mFlying Above the Clouds: Securing Kubernetes
01h 24mTutorial: Attacking and Defending Kube...