What is Kubernetes? Open-source system for deploying, scaling and managing containerized apps and services
3
Isolating Container Workloads, IRL
4
Container Manifest & Daemon
5
Spoiler: Containers Aren't Sandboxes
6
Container Isolation Models Via cgroups & namespaces
7
Cloud-Native Secure Architecture
8
Cluster and Namespace Scopes • Resources are scoped at the Cluster or Namespace
9
Control Plane & Core Components The Control Plane manages the cluster's state and schedules containers.
10
Authorization Mode
11
Authentication
12
Fixing the Problem Always use a unique service account per pod!
13
Role-Based Access Control
14
Create Roles & Bindings
15
Secrets Management
16
Dynamic Secrets
17
Conclusion Think about security early and anticipate future growth
Description:
Explore the Kubernetes attack surface and learn methods to secure cloud-native systems in this 53-minute conference talk from AppSecUSA 2018. Dive into the complexities of containerized microservices managed by orchestration systems, focusing on authentication, authorization, network segmentation, storage, and logging/auditing. Discover quick security wins and design-level choices for building resilient architectures. Examine container runtime security, underlying cloud infrastructure considerations, and microservice security. Gain insights into deploying secure services and meshes while maintaining development speed. By the end, understand the cloud-native attack surface and approach to hardening infrastructure and deploying secure services with Kubernetes.