k8s security
- Description
- Curriculum
- FAQ
- Announcement
- Reviews
![K8s-Security-Policy](https://i0.wp.com/oncloudnative.com/wp-content/uploads/2021/08/K8s-Security-Policy.png?resize=870%2C440&ssl=1)
Docker and Kubernetes is one of the world’s most popular container and container orchestration tools. Established by the Cloud Native Computing Foundation (CNCF),
Developers often struggle when first encountering the cloud. Learning about distributed systems, becoming familiar with technologies such as containers and functions, and knowing how to put everything together can be daunting. With this practical guide, you’ll get up to speed on patterns for building cloud native applications and best practices for common tasks such as messaging, eventing, and DevOps.
Learning Objectives
The Learning Path will prepare you to understand and demonstrate your knowledge in each of the general domains of developing cloud native applications using docker and deploying and kubernetes
- Learn the fundamentals of cloud native applications
- Explore key cloud native communication, connectivity, and composition patterns
- Learn decentralized data management techniques
- Use event-driven architecture to build distributed and scalable cloud native applications
- Explore the most commonly used patterns for API management and consumption
- Examine some of the tools and technologies you’ll need for building cloud native systems
Intended Audience
This Learning Path is intended specifically for Docker and Kubernetes application developers. Anyone interested in learning how to work with Kubernetes will also benefit from this Learning Path.
Prerequisites
A solid understanding of containers, and Docker in particular, will be of value. If you are not comfortable with Docker and Kubernetes , you are encouraged to complete the Docker and Kubernetes Learning Path.
This Learning path helps you to learn from fundamentals to advanced Docker and Kubernetes running on Linux machines. You should be comfortable working with basic Linux commands.
Additional Documentation
-
1The rise of Docker and the trend of microservices
-
2Kubernetes adoption status
-
3Kubernetes clusters
-
4Kubernetes components
-
5The Kubernetes interfaces
-
6Kubernetes objects
-
7Pods
-
8Deployments
-
9Services
-
10Replica sets
-
11Volumes
-
12Namespaces
-
13Service accounts
-
14Network policies
-
15Pod security policies
-
16Kubernetes variations
-
17Minikube
-
18Kubernetes and cloud providers
-
19Kubernetes as a service
-
20Why worry about Kubernetes' security?
-
21Overview of the Kubernetes network model
-
22Port-sharing problems
-
23Kubernetes network model
-
24Communicating inside a pod
-
25Linux namespaces and the pause container
-
26Beyond network communication
-
27Communicating between pods
-
28The Kubernetes service
-
29kube-proxy
-
30Introducing the Kubernetes service
-
31Service discovery
-
32Service types
-
33Ingress for routing external requests
-
34Introducing the CNI and CNI plugins
-
35CNI specification and plugins
-
36Calico
-
45queue
-
4664% of section complete
-
47The principle of least privilege
-
48Authorization model
-
49Rewards of the principle of least privilege
-
50Least privilege of Kubernetes subjects
-
51Introduction to RBAC
-
52Service accounts, users, and groups
-
53Role
-
54RoleBinding
-
55Kubernetes namespaces
-
56Wrapping up least privilege for Kubernetes subjects
-
57Least privilege for Kubernetes workloads
-
58Least privilege for accessing system resources
-
59Wrapping up least privilege for accessing system resources
-
60Least privilege for accessing network resources
-
61Least privilege for accessing application resources
-
62Introduction to security boundaries
-
63Security boundaries versus trust boundaries
-
64Kubernetes security domains
-
65Kubernetes entities as security boundaries
-
66Security boundaries in the system layer
-
67Linux namespaces as security boundaries
-
68Linux capabilities as security boundaries
-
69Wrapping up security boundaries in the system layer
-
70Security boundaries in the network layer
-
71Network policies
-
79Requesting a workflow in Kubernetes
-
80Kubernetes authentication
-
81Client certificates
-
82Static tokens
-
83Basic authentication
-
84Bootstrap tokens
-
85Service account tokens
-
86Webhook tokens
-
87Authentication proxy
-
88User impersonation
-
89Kubernetes authorization
-
90Request attributes
-
91Authorization modes
-
92Node
-
93ABAC
-
94RBAC
-
95Webhooks
-
96Admission controllers
-
97AlwaysPullImages
-
98EventRateLimit
-
99LimitRanger
-
100NodeRestriction
-
101PersistentVolumeClaimResize
-
102PodSecurityPolicy
-
103SecurityContextDeny
-
104ServiceAccount
-
105MutatingAdmissionWebhook and ValidatingAdmissionWebhook
-
106Introduction to OPA
-
107Hardening container images
-
108Container images and Dockerfiles
-
109CIS Docker benchmarks
-
110Configuring the security attributes of pods
-
111Setting host-level namespaces for pods
-
112Security context for containers
-
113Security context for pods
-
114AppArmor profiles
-
115The power of PodSecurityPolicy
-
116Understanding PodSecurityPolicy
-
117Kubernetes PodSecurityPolicy Advisor
-
118Introducing container images and vulnerabilities
-
119Container images
-
120Detecting known vulnerabilities
-
121Scanning images with Anchore Engine
-
122Introduction to Anchore Engine
-
123Scanning images with anchore-cli
-
124Integrating image scanning into the CI/CD pipeline
-
125Scanning at the build stage
-
126Scanning at the deployment stage
-
127Scanning at the runtime stage
-
128Real-time monitoring and management in monolith environments
-
129Managing resources in Kubernetes
-
130Resource requests and limits
-
131Namespace resource quotas
-
132LimitRanger
-
133Monitoring resources in Kubernetes
-
134Built-in monitors
-
135Third-party monitoring tools
-
136Prometheus and Grafana
-
137Introducing Kubernetes auditing
-
138Kubernetes audit policy
-
139Configuring the audit backend
-
140Enabling high availability in a Kubernetes cluster
-
141Enabling high availability of Kubernetes workloads
-
142Enabling high availability of Kubernetes components
-
143Enabling high availability of a cloud infrastructure
-
144Managing secrets with Vault
-
145Setting up Vault
-
146Provisioning and rotating secrets
-
147Detecting anomalies with Falco
-
148An overview of Falco
-
149Creating Falco rules to detect anomalies
-
150Conducting forensics with Sysdig Inspect and CRIU
-
151Using CRIU to collect data
-
152Using Sysdig and Sysdig Inspect
-
153Analyzing crypto-mining attacks
-
154An introduction to crypto-mining attacks
-
155The crypto-mining attack on Tesla's Kubernetes cluster
-
156Graboid – a crypto-worm attack
-
157Lessons learned
-
158Detecting crypto-mining attacks
-
159Monitoring CPU utilization
-
160Detecting network traffic to a mining pool
-
161Detecting launched crypto-mining processes
-
162Checking the binary signature
-
163Defending against attacks
-
164Securing Kubernetes cluster provisioning
-
165Securing the build
-
166Securing deployment
-
167Securing runtime
-
168The path traversal issue in kubectl cp – CVE-2019-11246
-
169Mitigation strategy
-
170DoS issues in JSON parsing – CVE-2019-1002100
-
171Mitigation strategy
-
172A DoS issue in YAML parsing – CVE-2019-11253
-
173Mitigation strategy
-
174The Privilege escalation issue in role parsing – CVE-2019-11247
-
175Mitigation strategy
-
176Scanning for known vulnerabilities using kube-hunter
Coming Soon