A Monitoring Platform for Kubernetes Cluster Security
summary
A centralized audit-log pipeline collects Kubernetes API server JSON logs, parses them with Fluentd, indexes into Elasticsearch and visualizes in Kibana; a Python tool called Kscope labels and alerts on specific events (secret dumps, pod enumeration, privileged pod creation, kubectl exec) and surfaces user, namespace, pod and source IP. Demonstrations show a hostPath privileged pod mounting the node root and gaining a shell, which Kscope flags; websocket interactive shell content remains unlogged and there is a small ingestion delay. Code is planned to be open source.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:51$ ls outline
- 7:16$ cat host-mount.yml
- 7:52$ cat log-architecture.txt
- 8:57$ cat how-to-log.txt
- 16:33$ which limitations
- 17:03$ which future-work
related talks
37m"A Monitoring Platform for Kubernetes...
35mUsing K8s Audit Logs to Secure Your Cluster
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
43mKubernetes Security: Attacking and Defending Modern Infrastructure
30mSecuring^WAttacking Kubernetes
38mKubernetes Security: Attacking and Defending K8s Clusters
37mProactive Kubernetes Security: Anomaly Detection and Runtime Alertin...
20mKubeScope for the Extraordinary World of Containers