Link: https://youtu.be/O0jfQrctYEs https://go.dok.community/slack https://dok.community/ From the DoK Day EU 2022 (https://youtu.be/Xi-h4XNd5tE) How can you keep your data secure and how can you transfer them on a secure way? You will learn to encrypt your data, that you can use them Kubernetes based in a Multi Cloud environment. ----- Sarah Julia Kriesch is working as a DevOps Consultant for Accenture in Germany. She has studied Computer Science at the TH Nürnberg and worked as a Linux System Administrator/ System Engineer for an ISP and in the area of Cloud Computing before. She is also contributing to Open Source since around 10 years.

1. Sarah Julia Kriesch
DoK Day Europe 2022 @ KubeCon
“How to protect your Data”

2. Agenda
• About me
• Critical data in applications
• Namespaces
• Network Policies
• Kubernetes Secrets
• Security Validation
DoK Day North America 2021 @ KubeCon

3. About me
• Sarah Julia Kriesch
• 35 years old
• DevOps Consultant@Accenture
• Kubernetes specialization
• Customers with critical data in banking/public sector
• Open Source Contributor
DoK Day North America 2021 @ KubeCon

4. Critical Data and Applications
• Modern applications are split into microservices for Kubernetes
• Not every application should be accessible from everywhere
• Critical data should be encrypted
• Only required communications between applications should be possible
DoK Day North America 2021 @ KubeCon

5. namespaces
• Splitting of Kubernetes into
multiple areas
• Pod communication within
namespaces possible
• App in namespace Single-App can
not communicate with apps in
namespace App-connection
DoK Day North America 2021 @ KubeCon

6. network policies
• Access from applications between
namespaces
• Network policies required for
communication
• Whitelisting of traffic
DoK Day North America 2021 @ KubeCon

7. configuration
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: ingress-deny-all-default
spec:
podSelector: {}
policyTypes:
- Ingress
apiVersion: networking.k8s.io/v1
metadata:
name: ingress-allow-prometheus-to-app1
namespace: App-connection
spec:
podSelector:
matchLabels:
app: a
component: banking1
ingress:
- ports:
- port: 9080
from:
- namespaceSelector:
matchLabels:
namespace: monitoring
podSelector:
matchLabels:
app: prometheus
component: server
DoK Day North America 2021 @ KubeCon

8. Kubernetes Secrets
• Encryption of passwords and data
• Tool kustomize to create secret credentials
DoK Day North America 2021 @ KubeCon
$ kubectl get secret example-secret-1

9. Kubesec
• Security validation of yaml files
• Available as:
• SaaS: curl -sSX POST --data-binary @"k8s-deployment.yaml" https://v2.kubesec.io/scan
• Docker Image: docker.io/kubesec/kubesec:v2
• Kubectl plugin: kubesec scan k8s-deployment.yaml
• Binaries: https://github.com/controlplaneio/kubesec/releases
DoK Day North America 2021 @ KubeCon
Source: https://kubesec.io/

10. References
• Martin, Andrew: Hacking Kubernetes – Threat-Driven Analysis and Defense
• https://kubernetes.io/docs/concepts/configuration/secret/
• https://kubernetes.io/docs/tasks/manage-kubernetes-
objects/kustomization/
DoK Day North America 2021 @ KubeCon

11. DoK Day North America 2021 @ KubeCon
Thank you!
Sarah Julia Kriesch
“How to protect your Data”
sarah.julia.kriesch@accenture.com