KAppArmor: Cage Your Pods!
summary
KAppArmor presents using Linux AppArmor to confine Kubernetes pods by deploying AppArmor profiles to them. It explains how applying these low-level kernel access restrictions (preventing unexpected networking or filesystem access) complements firewalls and regular container scanning/updates to significantly harden cluster security.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:47Client context and requests
- 3:36What is AppArmor
- 6:03AppArmor profiling
- 8:08Profile creation
- 12:22KAppArmor DaemonSet setup
- 15:54Demo: deployment and analysis
- 19:30Blocking malicious behavior
- 22:29From project to community
- 24:14Kubernetes security basics
- 25:16Q&A: privileges
- 26:39Q&A: deployment lifecycle
- 28:04Q&A: OS compatibility
- 29:26Q&A: isolation
- 30:52Comparison with alternatives
- 33:20Q&A: OpenShift compatibility
- 33:42Closing
related talks
28mKubeArmor: Applying Security Policies with Practical Examples in K8S
21mArmoring Cloud Native Workloads With LSM Superpowers
29mOverview and Recent Developments: AppArmor
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
38mAn Intro to Kubernetes Hardening
38mContainer Security, capabilities an seccomp profiles
29mLayers of Isolation in Kubernetes
39mThe Art of (Cloud Native) Defense: Pillars of Kubernetes Security