Kubernetes Security Best Practices - Ian Lewis, Google
summary
Covers concrete steps: enable RBAC everywhere and limit API server access via firewalls or GKE master authorized networks, encrypt etcd with Kubernetes encryption at rest, and rotate kubelet certificates. Use PodSecurityPolicy, run containers non‑root with read‑only rootfs and set allowPrivilegeEscalation=false, add seccomp/AppArmor annotations (seccomp not enabled by default), or move untrusted workloads into sandboxed runtimes. Enforce policies with Open Policy Agent, apply NetworkPolicy to restrict pod‑to‑pod access, run kube-bench and patch frequently (roughly one CVE per quarter).
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:39About Ian
- 1:07Agenda
- 3:16Background on Security
- 5:07Layer of Defense
- 6:12Least Privilege
- 7:05Sample Application
- 9:04Role Based Access Control
- 10:22Role Bindings
- 10:50IP Limits
- 11:52Network Policies
- 12:29Network Policies in Kubernetes
- 13:26Attacking Kubernetes Components
- 15:52Securing the Host
- 18:38ReadOnly Root File System
- 19:23Allow privilege escalation to false
- 20:08Sandbox pods
- 21:21Set comp and apparmor
- 21:52docker set comp
- 22:43areback mode
- 23:34use policy
- 24:22sniffing traffic
- 25:10sto
- 26:39general tips
related talks
29mKubernetes Security Best Practices
34mKubernetes Security 101: Best Practices to Secure Your Cluster
24mOne stop talk for kubernetes security !!
41mKubernetes Security Jumpstart
35mKubernetes Security - Challenge and Opportunity?
43mKubernetes Security: Attacking and Defending Modern Infrastructure
46mContinuous Kubernetes Security
25mMastering K8s Security