Using Pod Security Policies to harden your Kubernetes cluster
summary
Covers Kubernetes Pod Security Policy (PSP) as a way to harden multi-tenant clusters by restricting pod capabilities and configurations to reduce breakout and secret/network snooping risks. Describes current Kubernetes security practices and common insecure shortcuts, then walks through PSP features and which attack vectors each mitigates, and argues for applying PSP early in development to catch deployment-time issues.
AI-written summary · about
chapters (7)
- 0:00Start
- 7:22Threat Models in Kubernetes
- 12:50Containers don't contain - Dan Walsh
- 14:29CVE-2019-5736
- 30:20PSP attack Demo
- 32:18In helm charts
- 34:08Secure Software Development Lifecycle S-SOLC
related talks
40mKubernetes Security After Pod Security Policies Removal
37mHandsOn PodSecurity Policies
36mKubernetes Security After Pod Security Policies Removal
30mPod Security as an Afterthought
35mPSP is Dead, Long Live PodSecurity
35mMigrating From PodSecurityPolicy
35mPodSecurityPolicy Replacement: Past, Present, and Future
38mAn Intro to Kubernetes Hardening