Download to read offline
Kubernetes_Security_In_Depth_Practical r
- 1. Kubernetes Security –Practical & In Depth ‑ Hands on Security Concepts, Attacks ‑ & Defenses Designed for DevOps, SRE & Security Engineers
- 2. Why Kubernetes Securityis Critical • Kubernetes is an API driven control plane ‑ • If API access is compromised → entire cluster is compromised • Most attacks exploit misconfigurations, not zero days ‑ • Security must be enforced continuously
- 3. Kubernetes Attack Surface •Kube API Server ‑ • etcd (cluster brain) • Worker nodes & kubelet • Container runtime • Ingress & exposed services
- 4. Real World KubernetesAttacks ‑ • Exposed dashboard → cluster takeover • Compromised pod → service account abuse • Crypto mining via privileged containers ‑ • etcd exposed without authentication
- 5. Kubernetes Security Pillars •Cluster infrastructure security • API & access security • Workload security • Network security • Runtime & monitoring
- 6. API Server Security(Most Important) • Enable TLS everywhere • Disable anonymous access • Use strong authentication • Audit all API requests • Restrict access using RBAC
- 7. Authentication – HowUsers Get In • Certificates (kubectl, admins) • OIDC (SSO, IAM) • Service Accounts (pods) • Never use static tokens
- 8. RBAC – RealAccess Control • RBAC decides WHO can do WHAT • Avoid wildcard permissions • No cluster admin for applications ‑ • Use least privilege
- 9. RBAC Misconfiguration Example •Giving cluster admin to CI/CD pipelines ‑ • Binding default service account to admin • Over privileged roles enable lateral movement ‑
- 10. Service Account Attacks •Pods get tokens automatically • Attackers steal token from pod • Token used to call Kubernetes API • Leads to cluster takeover
- 11. Service Account Hardening •Disable auto mounting when not required ‑ • Use dedicated service accounts • Restrict RBAC permissions • Short lived tokens ‑
- 12. Pod Security Standards(PSS) • Replaces PodSecurityPolicy • Three modes: Privileged, Baseline, Restricted • Namespace level enforcement ‑ • Must have for production ‑
- 13. Pod Security –Practical Controls • No privileged containers • No hostPath mounts • Run as non root ‑ • Read only root filesystem ‑
- 14. Admission Controllers (Policy Enforcement) •Validate requests before pod creation • Block insecure configurations • Examples: Pod Security, Kyverno, OPA Gatekeeper
- 15. Kyverno – PracticalSecurity Example • Block containers running as root • Enforce image registries • Auto mutate securityContext ‑ • Policy as code for Kubernetes ‑ ‑
- 16. Network Policies –Zero Trust Networking • By default, all pods can talk to each other • NetworkPolicy enforces isolation • Limit blast radius • Mandatory for multi tenant clusters ‑
- 17. NetworkPolicy Attack Scenario •Compromised frontend pod • Without NetworkPolicy → access DB directly • With NetworkPolicy → attack blocked
- 18. Secrets Management in Kubernetes •Avoid plaintext secrets • Use external secret managers • Restrict secret access via RBAC • Enable encryption at rest
- 19. etcd Security (OftenIgnored) • Contains all cluster state • Encrypt data at rest • Restrict network access • Never expose etcd publicly
- 20. Node Security &Kubelet • Harden worker nodes • Protect kubelet API • Disable anonymous kubelet access • Use minimal OS images
- 21. Container Runtime Security •Containers share host kernel • Use seccomp, AppArmor, SELinux • Drop Linux capabilities • Prevent container escape
- 22. Runtime Threat Detection •Detect suspicious behavior at runtime • Tools: Falco, Tetragon • Alert on crypto mining, shell spawn ‑ • Essential for production
- 23. Supply Chain Security •Scan container images • Use signed images • Trusted registries only • Prevent image poisoning attacks
- 24. CI/CD Pipeline Security •Scan images before deployment • Enforce security gates • No direct kubectl from pipelines • Use GitOps (ArgoCD / Flux)
- 25. Logging & Auditing •Enable Kubernetes audit logs • Centralize logs • Track RBAC abuse • Forensics after incidents
- 26. Common Kubernetes Security Mistakes •cluster admin everywhere ‑ • No NetworkPolicies • Privileged pods • Secrets in YAML files • No runtime monitoring
- 27. Kubernetes Security Checklist •RBAC locked down • PSS enforced • NetworkPolicy enabled • Secrets protected • Runtime monitoring active
- 28. Real World SecurityMindset ‑ • Assume breach • Limit blast radius • Detect early • Respond fast
- 29. Key Takeaways • Kubernetessecurity is configuration driven ‑ • Most breaches are preventable • Policies > tools • Security is continuous