Rico Komenda

Kubernetes Security Best Practices

Nine out of ten organizations had a container security incident last year. Here's a practical guide to avoid becoming another statistic.

Kubernetes Security Best Practices
#1about 1 minute

The prevalence and impact of Kubernetes security incidents

Most organizations have experienced a Kubernetes security incident in the last year, commonly caused by runtime issues or cluster misconfigurations.

#2about 2 minutes

Applying the 4 Cs model to cloud native security

The 4 Cs model provides a framework for securing the entire stack, from the cloud infrastructure and cluster to the container and code.

#3about 3 minutes

Securing container images against common vulnerabilities

Prevent container breakouts by scanning images for vulnerabilities, using trusted registries, and removing unnecessary dependencies.

#4about 4 minutes

Hardening pods with security contexts and standards

Enhance pod security by running containers as non-root users, disabling privilege escalation, and enforcing policies with Pod Security Standards.

#5about 3 minutes

Implementing the principle of least privilege with RBAC

Use Role-Based Access Control (RBAC) to grant users and service accounts only the specific permissions they need at the namespace level.

#6about 2 minutes

Isolating pod-to-pod traffic with network policies

Restrict communication between pods by default and define explicit allow rules using network policies and CNI plugins like Calico.

#7about 2 minutes

Protecting the critical ETCD datastore from unauthorized access

Secure the cluster's central datastore, etcd, by enforcing TLS communication with the API server and using a separate certificate authority.

#8about 1 minute

Automating policy enforcement with admission controllers

Use tools like Kyverno, Kubewarden, or OPA Gatekeeper as admission controllers to automatically validate and enforce security policies at scale.

#9about 2 minutes

Key takeaways for hardening Kubernetes clusters

A summary of essential practices includes hardening images, using RBAC, isolating traffic, protecting etcd, and automating policy enforcement.

Related jobs
Jobs that call for the skills explored in this talk.

Featured Partners

Related Videos

See all videos
Kubernetes Security - Challenge and Opportunity42:45

Kubernetes Security - Challenge and Opportunity

Marc Nimmerrichter

Hacking Kubernetes: Live Demo Marathon46:36

Hacking Kubernetes: Live Demo Marathon

Andrew Martin

Enhancing Workload Security in Kubernetes44:00

Enhancing Workload Security in Kubernetes

Dimitrij Klesev & Andreas Zeissner

Turning Container security up to 11 with Capabilities28:47

Turning Container security up to 11 with Capabilities

Mathias Tausig

Chaos in Containers - Unleashing Resilience27:52

Chaos in Containers - Unleashing Resilience

Maish Saidel-Keesing

Supply Chain Security and the Real World: Lessons From Incidents24:47

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Mastering Kubernetes – Beginner Edition57:24

Mastering Kubernetes – Beginner Edition

Hannes Norbert Göring

Kubernetes Maestro: Dive Deep into Custom Resources to Unleash Next-Level Orchestration Power!29:21

Kubernetes Maestro: Dive Deep into Custom Resources to Unleash Next-Level Orchestration Power!

Um e Habiba

From learning to earning

Jobs that call for the skills explored in this talk.

Kubernetes Specialist

CompuSafe Data Systems AG
München, Germany

Linux
VMware
Routing
Kubernetes
Load Balancing

Kubernetes Engineer

G-Research
Charing Cross, United Kingdom

€72K
Linux
Python
VMware
Grafana
+5