Get in Touch
 Duration 14 hours

Course Outline

Introduction

Deep Dive into the Kubernetes API and Security Architecture

  • Managing access to HTTPS endpoints, the Kubernetes API, nodes, and containers
  • Exploring Kubernetes Authentication and Authorization mechanisms

Understanding Attack Vectors

  • How adversaries discover etcd ports, the Kubernetes API, and other exposed services
  • Methods for executing code within containers
  • Techniques used for privilege escalation
  • Case Study: The exposure of Tesla’s Kubernetes cluster

Kubernetes Deployment Strategies

  • Selecting the appropriate distribution
  • Installation procedures

Managing Credentials and Secrets

  • The full lifecycle of credentials
  • In-depth understanding of secrets
  • Strategies for secure credential distribution

API Access Control

  • Securing API traffic via TLS encryption
  • Configuring authentication for API servers
  • Implementing role-based authorization

Restricting User and Workload Permissions

  • Navigating Kubernetes policies
  • Setting resource usage limits
  • Constraining container privileges
  • Regulating network access

Node Access Governance

  • Isolating workload access

Hardening Cluster Components

  • Limiting access to etcd
  • Disabling non-essential features
  • Rotation, revocation, and management of credentials and tokens

Container Image Security

  • Managing Docker and Kubernetes images
  • Best practices for building secure images

Cloud Resource Access Management

  • Interpreting cloud platform metadata
  • Restricting permissions on cloud resources

Assessing Third-Party Integrations

  • Minimizing the scope of permissions granted to third-party software
  • Evaluating components capable of spawning pods

Defining a Security Policy

  • Auditing the current security profile
  • Constructing a tailored security model
  • Key considerations for cloud-native security
  • Additional best practices

Data Encryption at Rest

  • Securing backup data
  • Full disk encryption
  • Encrypting secret resources stored in etcd

Activity Monitoring

  • Activating audit logging
  • Governing and auditing the software supply chain
  • Monitoring security alerts and updates

Summary and Conclusion

Requirements

  • Practical experience with Kubernetes is required.

Target Audience

  • DevOps Engineers
  • Software Developers

Number of participants


Price per participant

Testimonials (2)

Upcoming Courses

Related Categories