Tutorial: Reducing the Sticker Price Of Kubernetes Security
Talkat KubeCon + CloudNativeCon North America 2022 · on Friday, 2022-10-28· at 11:00· 330 AB, Huntington Place: 1 Washington Blvd·
summary
Shows how to verify Kubernetes release images from sbom.k8s.io by running cosign keyless verification over ~15 images (uses sigstore transparency logs), how to create kind clusters that apply Pod Security Admission Baseline enforced at cluster level (with restricted as warn/audit and namespace exemptions), and how to enable the runtime seccomp profile via kubelet extraArgs so runtime seccomp default blocks syscalls (demo: changing container date is denied). All demos run locally with kind and Docker, and they work in the session.
AI-written summary · about
chapters (7)
- 0:00Kubernetes security tutorial
- 2:26Prerequisites and environment
- 7:24Verifying signed container images
- 34:13Enforcing pod security standards
- 1:00:36Enabling runtime seccomp profiles
- 1:20:13PSA and seccomp in cluster
- 1:27:11Q&A
related talks
37mSupply Chain Security in Kubernetes
38mTutorial: Building Security into Kubernetes Deployment Pipelines
36mEnforcing a Secure Supply Chain on Kubernetes
28mKubernetes Security Low-Hanging Fruit
30mA secure journey on Kubernetes
17mImprove Security in Kubernetes
33mKubernetes Security Jumpstart
30mSecuring Kubernetes Multi-Tenancy