Introduction
Understanding the Kubernetes Attack Surface
Cluster Setup and Hardening
- Section Introduction
- What are CIS Benchmarks
- CIS benchmark for Kubernetes
- Kube bench
- Kubernetes Security Primitives
- Authentication
- Service Accounts
- TLS Introduction
- TLS Basics
- TLS in Kubernetes
- TLS in Kubernetes Certificate Creation
- View Certificate Details
- Certificates API
- KubeConfig
- API Groups
- Authorization
- RBAC
- Cluster Roles and Role Bindings
- Kubelet Security
- Kubectl Proxy Port Forward
- Verify platform binaries before deploying
- Kubernetes Releases
- Cluster Upgrade Process
- Demo Cluster Upgrade
- Network Policy
- Developing Network Policies
- Ingress
- Docker Service Configuration
- Docker Securing the Daemon
- Securing Node Metadata in Kubernetes
- Reasons to Secure Node Metadata
- Protection Strategies
- Auditing
System Hardening
- Section Introduction
- Least Privilege Principle
- Reducing the Attack Surface
- Limiting Node Access
- SSH Hardening
- Privilege Escalation in Linux
- Remove Obsolete Packages and Services
- Restrict Kernel Modules
- Identify and Disable Open Ports
- Minimize IAM roles
- Minimize external access to the network
- UFW Firewall Basics
- Linux Syscalls
- AquaSec Tracee
- Restrict syscalls using seccomp
- Implement Seccomp in Kubernetes
- AppArmor
- Creating AppArmor Profiles
- AppArmor in Kubernetes
- Linux Capabilities
Minimize Microservice Vulnerabilities
- Section Introduction
- Security Contexts
- Admission Controllers
- Validating and Mutating Admission Controllers
- Pod Security Policies
- Pod Security Admission and Pod Security Standards
- Open Policy Agent OPA
- OPA in Kubernetes
- Manage Kubernetes secrets
- Demo Encrypting Secret Data at Rest
- Container Sandboxing
- gVisor
- kata Containers
- Container Runtime
- Runtime Class in Kubernetes
- One way SSL vs Mutual SSL
- Overview of Multi Tenancy in Kubernetes
- Different types of Multi Tenancy in Kubernetes
- Levels of Isolation in Kubernetes Namespace Pod Node
- Control Plane Isolation
- Understanding Resource Quotas
- Data Plane Isolation
- Data Plane Isolation Network
- Data Plane Isolation Storage
- Using Node Pools and TaintsTolerations for Isolation
- Additional Considerations API Priority Fairness
- Quality of Service
- DNS in Multi Tenant Environments
- Pod to Pod Encryption
- Implement pod to pod encryption by use of mTLS
- Demo Authentication
- Introduction to Cilium
- Understanding Ciliums Architecture
- Writing Effective Encryption Policies
Supply Chain Security
- Section Introduction
- Overview of Supply Chain Security
- Risks of Inadequate Supply Chain Management
- What is SBOM and Why Its Important
- Minimize base image footprint
- SBOM Format
- SBOM Workflow
- Introduction to KubeLinter
- Image Security
- Whitelist Allowed Registries Image Policy Webhook
- Use Static Analysis of User Workloads
- Scan images for known vulnerabilities Trivy