An Intro to Kubernetes Hardening
summary
Covers concrete steps: run kube-bench to get pass/warn/fail CIS checks, enable TLS and firewalling for etcd, and enforce PodSecurityAdmission restricted policy at namespace level. Build images with scanners like Triv or Grip in CI, block unsigned images with the image policy webhook, and apply securityContext settings (runAsNonRoot, drop ALL capabilities, readOnlyRootFilesystem) shown in an example pod. Add resource quotas, network policies for zero-trust pod-to-pod traffic, and runtime alerts with Falco with eBPF plus Falco Sidekick for notifications.
AI-written summary · about
chapters (19)
- 0:00Kubernetes hardening intro
- 1:18Why security matters now
- 2:43CIS benchmarks for security
- 4:29Automating checks with Kubebench
- 5:57Kubernetes architecture overview
- 7:21Securing host systems
- 9:05Hardening core components
- 11:10Securing dashboards and apps
- 12:58Role-based access control
- 14:22Admission controllers for policy
- 16:31Securing container images
- 18:37Security context for workloads
- 22:55Resource quotas for stability
- 23:58Implementing network policies
- 26:28Pod security admission
- 29:38Service mesh for microservices
- 31:46Enabling audit logs
- 33:12Threat detection with Falco
- 37:45Summary
related talks
22mSecuring Kubernetes
41mKubernetes Security Jumpstart
24mOne stop talk for kubernetes security !!
46mContinuous Kubernetes Security
02h 42mSecuring Your On-Premise Kubernetes Cluster from Scratch
34mKubernetes Hardening for Regulatory Compliance: A Practical Approach
43mKubernetes Security: Attacking and Defending Modern Infrastructure
38mBuilding for Trust: How to Secure Your Kubernetes Cluster