Course Outline
Introduction
Overview of the Kubernetes API and Security Features
- Accessing HTTPS endpoints, Kubernetes API, nodes, and containers.
- Utilizing Kubernetes Authentication and Authorization features.
Understanding Hacker Attack Vectors
- Methods hackers use to locate your etcd port, Kubernetes API, and other services.
- Techniques for executing code within your containers.
- Privilege escalation strategies employed by attackers.
- Case study: Analysis of the Tesla Kubernetes cluster exposure.
Setting Up Kubernetes Securely
- Choosing an appropriate distribution.
- Installing Kubernetes with security in mind.
Managing Credentials and Secrets
- Understanding the credentials lifecycle.
- Deep dive into secrets management.
- Best practices for distributing credentials.
Controlling Access to the Kubernetes API
- Encrypting API traffic using TLS.
- Implementing robust authentication for API servers.
- Configuring authorization for various roles.
Regulating User and Workload Capabilities
- Understanding Kubernetes policies.
- Implementing resource usage limits.
- Restricting container privileges.
- Controlling network access.
Managing Node Access
- Separating workload access permissions.
Protecting Cluster Components
- Restricting access to etcd.
- Disabling unnecessary features.
- Modifying, removing, and revoking credentials and tokens.
Securing Container Images
- Managing Docker and Kubernetes images.
- Constructing secure container images.
Controlling Access to Cloud Resources
- Understanding cloud platform metadata.
- Limiting permissions for cloud resources.
Evaluating Third-Party Integrations
- Minimizing permissions granted to third-party software.
- Assessing components capable of creating pods.
Establishing a Security Policy
- Reviewing the existing security profile.
- Developing a security model.
- Addressing cloud-native security considerations.
- Adhering to additional best practices.
Encrypting Data at Rest
- Encrypting backups.
- Encrypting the entire disk.
- Encrypting secret resources in etcd.
Monitoring Activity
- Enabling audit logging.
- Auditing and governing the software supply chain.
- Subscribing to security alerts and updates.
Summary and Conclusion
Requirements
- Prior experience working with Kubernetes is required.
Target Audience
- DevOps engineers.
- Developers.
Testimonials (3)
About the microservices and how to maintenance kubernetes
Yufri Isnaini Rochmat Maulana - Bank Indonesia
Course - Advanced Platform Engineering: Scaling with Microservices and Kubernetes
How trainer deliver knowledge so effectively
Vu Thoai Le - Reply Polska sp. z o. o.
Course - Certified Kubernetes Administrator (CKA) - exam preparation
The knowledge and exchanges with Augustin
