Kubernetes Security: Navigating the Real-World Challenges
summary
Highlights a few hard numbers and concrete steps: misconfigurations drive most incidents and fixing a bug in production costs ~640x more (example $25 preprod vs $116,000 in prod); common false comfort is image scanning only or cloud managed = secure by default. Recommends toolchain actions: use Dependabot/SonarQube/Gosec in CI, sign images with cosign and store in Harbor, scan with Trivy/Grype, enforce Kyverno/Gatekeeper admission policies that reject images with high severity and require scan reports <30 days, and run kube-bench/Falco for runtime checks.
AI-written summary · about
chapters (9)
- 0:00Kubernetes security intro
- 1:26Misconceptions about security
- 3:13Cost of security incidents
- 5:21Assessing security maturity
- 7:48Cloud-native security layers
- 9:57Security in dev lifecycle
- 11:41CNCF tools per phase
- 14:11Security policies in manifests
- 16:42Q&A
related talks
19mHow to Secure Your Kubernetes Clusters
26mBoost your security and resiliency in Kubernetes
35mKubernetes Security - Challenge and Opportunity?
26mMulti-layer hardening in Kubernetes
28mKubernetes Security Low-Hanging Fruit
41mKubernetes Security Jumpstart
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
43mKubernetes Security: Attacking and Defending Modern Infrastructure