Kubernetes Security Best Practices
summary
Cluster security focuses on concrete controls: RBAC enforced for pods and nodes, firewall or Master Authorized Networks for the API server, and encrypt etcd so stolen etcd yields only ciphertext. Harden containers by run as non-root, read-only rootfs and NoNewPrivileges plus seccomp/AppArmor/SELinux or sandboxed runtimes. Limit east‑west access with network policy (Calico/Weave) and add service‑level mTLS (service mesh). Rotate node certificates and run kube-bench; prefer managed GKE defaults.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:25Who am I
- 0:48What is Kubernetes
- 1:30Agenda
- 2:38Security 101
- 4:33Layered Defense
- 5:55Least Privilege
- 6:37Example Application
- 7:22Attacking the API Server
- 9:00Kubernetes Roles
- 10:58Firewall
- 11:33Network Policy
- 12:34Network Policy Implementation
- 13:10Cluster Components
- 13:50Exedy Security
- 15:04Container Escape
- 16:40Run Applications as User
- 17:23Make Root File System ReadOnly
- 18:20Set New Previous Frag Flag
- 19:04Sandbox Pods
- 19:48Containers vs Hosts
- 20:32AppArmor
- 20:56Set Comp
- 21:27Primer
- 21:51SELinux
- 22:24RBET
- 23:29Unsecured pods
- 24:04Open Policy Agent
- 24:41Request Forgeries
- 27:00Extra Tips
- 28:29Outro
related talks
34mKubernetes Security 101: Best Practices to Secure Your Cluster
29mKubernetes Security Best Practices - Ian Lewis, Google
24mOne stop talk for kubernetes security !!
38mBuilding for Trust: How to Secure Your Kubernetes Cluster
53mFlying Above the Clouds: Securing Kubernetes
41mKubernetes Security Jumpstart
30mFortifying Kubernetes
35mKubernetes Security - Challenge and Opportunity?