Course Outline
Introduction
Exploring the Kubernetes API and Security Architecture
- Accessing HTTPS endpoints, the Kubernetes API, nodes, and containers
- Kubernetes mechanisms for Authentication and Authorization
Understanding Threat Vectors
- Methods attackers use to discover etcd ports, the Kubernetes API, and exposed services
- Techniques for code execution within containers
- Privilege escalation strategies
- Case study: The exposure of Tesla's Kubernetes cluster
Kubernetes Deployment
- Selecting the appropriate distribution
- Installation procedures
Managing Credentials and Secrets
- The credential lifecycle
- Insights into secret management
- Safe distribution of credentials
Regulating API Access
- Securing API traffic via TLS encryption
- Configuring API server authentication
- Implementing role-based authorization
Managing User and Workload Capabilities
- Interpreting Kubernetes security policies
- Enforcing resource consumption limits
- Restricting container-level privileges
- Constraining network connectivity
Node Access Control
- Isolating workload access
Hardening Cluster Components
- Limiting access to etcd
- Disabling non-essential features
- Revoking, modifying, and retiring credentials and tokens
Container Image Security
- Handling Docker and Kubernetes images
- Constructing hardened images
Cloud Resource Governance
- Analyzing cloud platform metadata
- Restricting permissions on cloud resources
Assessing Third-Party Integrations
- Minimizing permissions granted to external software
- Reviewing components capable of pod creation
Defining a Security Strategy
- Auditing the current security profile
- Designing a comprehensive security model
- Cloud-native security considerations
- Additional industry best practices
Data-at-Rest Encryption
- Encrypting backups
- Full-disk encryption
- Encrypting secret resources stored in etcd
Activity Monitoring
- Activating audit logging
- Overseeing and auditing the software supply chain
- Tracking security alerts and updates
Summary and Wrap-up
Requirements
- Practical experience with Kubernetes
Target Audience
- DevOps engineers
- Software developers
Testimonials (2)
As i said before , for a person like me (no exp. ) this was a gateway to understanding features and functions with these programs/tools & etc. .
Patrick V. Duylovski - UBB + DZI (KBC GROUP)
Course - Docker and Kubernetes
basic understanding of container/kubernetes and how they interact features of the openshift plattform