Securing Kubernetes and Containerized Applications

Explore how containers package an app with its dependencies, enabling portability and lightweight isolation, and contrast container images, OS virtualization, and the role of the container runtime in security.

Explore how namespaces, cgroups, capabilities, and seccomp isolate containerized processes on Linux, enforce resource limits, and minimize the kernel attack surface through SELinux and AppArmor in container platforms.

See how container runtimes leverage OS security features to run containers, implement high-level image transport with container D, and execute with Run C as the low-level runtime under OCI standards.

Explore how Kubernetes orchestrates containers through pods and a master and worker control plane. Learn to express desired cluster state with YAML objects and manage it with kubectl.

Explore how Kubernetes master and worker nodes interact through the API server, with controllers and scheduler maintaining desired state, while kubelets orchestrate pods via CRI runtimes cri-o and containerd.

Identify the attack surface by mapping the end-to-end architecture of your containerized ecosystem, from source code repositories to Kubernetes orchestration, and enforce security across build, image, and deployment stages.

Integrate code from IDEs through a ci/cd pipeline, using enterprise repositories, container images, and helm charts to deploy, monitor, and scale in kubernetes.

Examine the Kubernetes and container attack surface to identify how secrets in code repositories, API server access, etcd data, and container runtimes create risk, outline mitigations for networks and misconfigurations.

Apply a five-factor security model to protect the attack surface by securing design principles, container images and image registries, running containers, Kubernetes access and networking, and cluster components.

Secure containerized apps by shifting security left across the software development lifecycle, from secure design and threat modeling to static analysis, software composition analysis, and dynamic testing in CI/CD.

Protect container images across creation, transport, and deployment by hardening base images, minimizing layers, scanning for vulnerabilities and secrets, signing images, and enforcing trusted, least-privilege access.

Specify a non-root user and avoid privileged mode. Implement strict port mappings and network policies, and harden hosts with immutable images and read-only file systems.

Explore securing Kubernetes applications and clusters by enforcing pod isolation, access control, and secure communication, using pod security standards, authentication, authorization, and admission controls across namespaces.

Explore Kubernetes authentication options, from service accounts to OpenID Connect, and apply RBAC for authorization, while leveraging admission controllers and webhooks to enforce policies.

Secure Kubernetes with security context and policies, enable pod security admission controls, enforce network policies, and manage secrets via encrypted storage and secure mounting.

Secure a Kubernetes cluster by enforcing authentication, TLS, and encryption for etcd secrets, while applying quotas, namespaces, network policies, and secure API server access.

Secure the underlying infrastructure for Kubernetes by understanding deployment models and shared responsibility. Enforce network isolation, restrict control-plane access, and grant minimal API permissions to protect the CIA triad.

Learn how to log and monitor Kubernetes deployments by collecting container, node, and cluster level logs with external backends such as Fluentd, Elasticsearch, Kibana, Prometheus, Splunk, and SIEM.

Assess your organization's container and Kubernetes security posture and explore the breadth of available security controls, and consult the documentation offered by Linux, Docker, and Kubernetes from day one.