Defense in Depth: Securing your new Kubernetes cluster from the challenges that lurk within
summary
Advocates a practical defense‑in‑depth posture: assume breach and shrink blast radius with network policies, mutual TLS for east‑west, and per‑pod service accounts. Recommends continuous image scanning with Clair continuous scans and simple npm audit in CI, secrets encrypted with Sops + Google KMS so repo commits are safe, and runtime hygiene like no Docker socket mounted, non‑root containers, read‑only filesystems and restricted capabilities. Notes Helm charts (Tiller) and default images often introduce hidden risks.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:42Defense in depth concept
- 2:27Common security misconceptions
- 5:38Privilege and container risks
- 7:45Secrets management pitfalls
- 9:09Continuous scanning importance
- 10:56Helm chart security risks
- 13:02Container hardening practices
- 14:06Simplified secrets encryption
- 15:16Structured logging benefits
- 16:19Helm 3 security improvements
- 17:44Final security checklist
- 19:09Conclusion and attacker exhaustion
related talks
22mSecuring Kubernetes
21mDefense-in-Depth Security for Mission-Critical Service
19mHow to Secure Your Kubernetes Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
39mThe Art of (Cloud Native) Defense: Pillars of Kubernetes Security
01h 37mLines of Defence – Securing Your Kubernetes Clusters
35mKubernetes Security - Challenge and Opportunity?
53mFlying Above the Clouds: Securing Kubernetes