Course Outline
Introduction
Deep Dive into the Kubernetes API and Security Architecture
- Managing access to HTTPS endpoints, the Kubernetes API, nodes, and containers
- Exploring Kubernetes Authentication and Authorization mechanisms
Understanding Attack Vectors
- How adversaries discover etcd ports, the Kubernetes API, and other exposed services
- Methods for executing code within containers
- Techniques used for privilege escalation
- Case Study: The exposure of Tesla’s Kubernetes cluster
Kubernetes Deployment Strategies
- Selecting the appropriate distribution
- Installation procedures
Managing Credentials and Secrets
- The full lifecycle of credentials
- In-depth understanding of secrets
- Strategies for secure credential distribution
API Access Control
- Securing API traffic via TLS encryption
- Configuring authentication for API servers
- Implementing role-based authorization
Restricting User and Workload Permissions
- Navigating Kubernetes policies
- Setting resource usage limits
- Constraining container privileges
- Regulating network access
Node Access Governance
- Isolating workload access
Hardening Cluster Components
- Limiting access to etcd
- Disabling non-essential features
- Rotation, revocation, and management of credentials and tokens
Container Image Security
- Managing Docker and Kubernetes images
- Best practices for building secure images
Cloud Resource Access Management
- Interpreting cloud platform metadata
- Restricting permissions on cloud resources
Assessing Third-Party Integrations
- Minimizing the scope of permissions granted to third-party software
- Evaluating components capable of spawning pods
Defining a Security Policy
- Auditing the current security profile
- Constructing a tailored security model
- Key considerations for cloud-native security
- Additional best practices
Data Encryption at Rest
- Securing backup data
- Full disk encryption
- Encrypting secret resources stored in etcd
Activity Monitoring
- Activating audit logging
- Governing and auditing the software supply chain
- Monitoring security alerts and updates
Summary and Conclusion
Requirements
- Practical experience with Kubernetes is required.
Target Audience
- DevOps Engineers
- Software Developers
Testimonials (2)
As i said before , for a person like me (no exp. ) this was a gateway to understanding features and functions with these programs/tools & etc. .
Patrick V. Duylovski - UBB + DZI (KBC GROUP)
Course - Docker and Kubernetes
basic understanding of container/kubernetes and how they interact features of the openshift plattform