Certified Kubernetes Security Specialist Masterclass

Cluster Setup

1. Use Community safety insurance policies to limit cluster degree entry
2. Use CIS benchmark to overview the safety configuration of Kubernetes parts (etcd, kubelet, kubedns, kubeapi)
3. Correctly arrange Ingress objects with safety management
4. Shield node metadata and endpoints
5. Reduce use of, and entry to, GUI parts
6. Confirm platform binaries earlier than deploying

Cluster Hardening

1. Limit entry to Kubernetes API
2. Use Function Primarily based Entry Controls to reduce publicity
3. Train warning in utilizing service accounts e.g. disable defaults, reduce permissions on newly created ones
4. Replace Kubernetes steadily

System Hardening

1. Reduce host OS footprint (scale back assault floor)
2. Reduce IAM roles
3. Reduce exterior entry to the community
4. Appropriately use kernel hardening instruments reminiscent of AppArmor, seccomp

Reduce Microservice Vulnerabilities

1. Setup applicable OS degree safety domains
2. Handle Kubernetes secrets and techniques
3. Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
4. Implement pod to pod encryption by use of mTLS

Provide Chain Safety

1. Reduce base picture footprint
2. Safe your provide chain: whitelist allowed registries, signal and validate pictures
3. Use static evaluation of person workloads (e.g.Kubernetes sources, Docker information)
4. Scan pictures for identified vulnerabilities

Monitoring, Logging and Runtime Safety

1. Carry out behavioral analytics of syscall course of and file actions on the host and container degree to detect malicious actions
2. Detect threats inside bodily infrastructure, apps, networks, knowledge, customers and workloads
3. Detect all phases of assault regardless the place it happens and the way it spreads
4. Carry out deep analytical investigation and identification of unhealthy actors inside atmosphere
5. Guarantee immutability of containers at runtime
6. Use Audit Logs to observe entry