Course Outline
Introduction
Overview of the Kubernetes API and Security Features
- Access to HTTPS endpoints, Kubernetes API, nodes, and containers
- Kubernetes Authentication and Authorization mechanisms
Threat Vectors: How Attackers Target Clusters
- Discovery of etcd ports, Kubernetes API, and other services by attackers
- Techniques for executing code within containers
- Methods for privilege escalation
- Case study: The exposure of Tesla's Kubernetes cluster
Configuring Kubernetes
- Selecting a distribution
- Installing Kubernetes
Managing Credentials and Secrets
- The credential lifecycle
- Comprehending secrets
- Distributing credentials securely
Regulating Access to the Kubernetes API
- Encrypting API traffic using TLS
- Implementing authentication for API servers
- Enforcing authorization for distinct roles
Restricting User and Workload Capabilities
- Understanding Kubernetes policies
- Constraining resource usage
- Limiting container privileges
- Restricting network access
Controlling Node Access
- Isolating workload access
Safeguarding Cluster Components
- Limiting access to etcd
- Disabling non-essential features
- Modifying, revoking, or removing credentials and tokens
Hardening Container Images
- Managing Docker and Kubernetes images
- Constructing secure images
Controlling Cloud Resource Access
- Understanding cloud platform metadata
- Restricting permissions to cloud resources
Assessing Third-Party Integrations
- Minimizing permissions granted to third-party software
- Evaluating components capable of creating pods
Formulating a Security Policy
- Reviewing the current security profile
- Designing a security model
- Cloud-native security considerations
- Additional best practices
Encrypting Inactive Data
- Encrypting backups
- Full-disk encryption
- Encrypting secret resources within etcd
Monitoring Activity
- Enabling audit logging
- Auditing and governing the software supply chain
- Subscribing to security alerts and updates
Summary and Conclusion
Requirements
- Prior experience working with Kubernetes
Audience
- DevOps engineers
- Developers
Testimonials (4)
basic understanding of container/kubernetes and how they interact features of the openshift plattform
Eric Scholze - NOW IT GmbH
Course - Introduction to Containers, Kubernetes & OpenShift
About the microservices and how to maintenance kubernetes
Yufri Isnaini Rochmat Maulana - Bank Indonesia
Course - Advanced Platform Engineering: Scaling with Microservices and Kubernetes
How trainer deliver knowledge so effectively
Vu Thoai Le - Reply Polska sp. z o. o.
Course - Certified Kubernetes Administrator (CKA) - exam preparation
The knowledge and exchanges with Augustin