Become a certified Kubernetes security specialist by taking up this complete hands-on course
About This Video
In Detail
This Kubernetes Security Specialist course provides foundational knowledge using concepts and hands-on demonstrations of the Kubernetes Cluster.
In this …
Become a certified Kubernetes security specialist by taking up this complete hands-on course
About This Video
In Detail
This Kubernetes Security Specialist course provides foundational knowledge using concepts and hands-on demonstrations of the Kubernetes Cluster.
In this course, we will be focusing more on the practical side, so make sure you have a running Kubernetes cluster. This course is focused on security. It deals with all aspects of security within the context of a Kubernetes environment. That means securing not only the Kubernetes cluster itself but also the applications running within the cluster.
You will learn how to secure many different components of Kubernetes applications and environments. We are going to cover every topic such as cluster setup, creating an ingress, and securing an ingress. You will also learn cluster hardening, which includes RBAC, role, and role binding for a user.
Further, you will learn system hardening, kernel hardening, minimizing microservice vulnerabilities, supply chain security, monitoring, logging, and runtime security.
By the end of this Kubernetes course, you will gain in-depth knowledge about Kubernetes and be a Kubernetes security specialist.
Audience
This Docker course is designed for Kubernetes administrators, security specialists, and for those who want to master Certified Kubernetes Security Specialist.
You should already have some Kubernetes Administrator knowledge before attending this course.
Chapter 1 : Become a Certified Kubernetes Security Specialist (CKS)
Certified Kubernetes Security Specialist (CKS)
Chapter 2 : Create Kubernetes Cluster
Create Kubernetes Cluster and Look at Some Errors
Chapter 3 : Cluster Setup – Use Network Security Policies to Restrict Cluster Level Access
Introduction to NetworkPolicy
Create Default Deny NetworkPolicy
Create Egress and Ingress Rules
Create Another Network Policy for Different Name Space
Chapter 4 : Cluster Setup – Minimize Use of and Access to GUI Elements
Install Kubernetes Dashboard
Insecure Access from Outside
RBAC for Kubernetes Dashboard
Chapter 5 : Cluster Setup – Properly Set Up Ingress Objects with Security Control
Create an Ingress
Secure an Ingress
Chapter 6 : Protect Node Metadata and Endpoints
Accessing Node Metadata
Protect Node Metadata Through NetworkPolicy
Chapter 7 : Use CIS Benchmark to Review the Security Configuration of Kubernetes Components
kube-bench
Chapter 8 : Verify Platform Binaries before Deploying
How to Delete the Custom Network
Verify apiserver Binary Running in Our Cluster
Chapter 9 : Cluster Hardening - RBAC
RBAC - Role and Rolebinding
Role and Rolebinding for a User
ClusterRole and ClusterRoleBinding
Accounts and Users
CertificateSigningRequests
Chapter 10 : Exercise Caution in Using Service Accounts
Introduction
Pod Uses Custom ServiceAccount
Disable ServiceAccount Mounting
Limit ServiceAccounts Permissions Using RBAC to Edit Resources
Chapter 11 : Cluster Hardening – Restrict API Access
Enable/Disable Anonymous Access
Let’s Perform a Manual API Request
External APIserver Access
NodeRestriction AdmissionController
Chapter 12 : Cluster Hardening – Upgrade Kubernetes
Verify NodeRestriction
Introduction
Create a Cluster with the Old Version
Upgrade Master and Worker Node
Chapter 13 : Microservice Vulnerabilities – Manage Kubernetes Secrets
Create Secret
Hack Secrets in Docker
Hack Secrets in ETCD
ETCD Encryption
ETCD Encryption -2
Chapter 14 : Use Container Runtime Sandboxes in a Multi-Tenant Environment
Calling Linux Kernel from Inside a Container
Open Container Initiative (OCI)
Crictl
Create and Use RuntimeClasses
Chapter 15 : Microservices Vulnerabilities – OS Level Security Domains
Set Container User and Group (Security Context)
Force Container Non-Root
Privileged Containers
PrivilegeEscalation
Create and Enable PodSecurityPolicy
Chapter 16 : Microservices Vulnerabilities – mTLS
Introduction
Create a Sidecar Proxy
Chapter 17 : Open Policy Agent (OPA)
Introduction OPA
Install OPA Gatekeeper
Deny All Policy
Enforce Namespace Labels
Chapter 18 : Supply Chain Security – Image Footprint
Reduce Image Footprint with Multi-Stage
Secure and Harden Images
Chapter 19 : Supply Chain Security – Static Analysis
Kubesec
Use kubesec to Perform Static Analysis Using Docker Image
OPA Conftest
OPA Conftest for Dockerfile
Chapter 20 : Supply Chain Security – Image Vulnerability Scanning
Use Trivy to Scan Images
Chapter 21 : Supply Chain Security – Secure Supply Chain
Image Digest
Whitelist Registries with OPA
Chapter 22 : Behavioral Analytics at Host and Container Level
Strace
Strace and /proc on ETCD
Access /proc and env Variables from the Inside Pod
FALCO
Use Falco to Find Malicious Processes
Investigate Falco Rules
Change Falco Rules
Chapter 23 : Runtime Security – Immutability of Containers at Runtime
Introduction
StartupProbe
SecurityContext Renders Container Immutable
Chapter 24 : Runtime Security - Auditing
Introduction
Audit Policy
Enable Audit Logging in Apiserver
Create a Secret and Check Audit Logs
Chapter 25 : System Hardening – Kernel Hardening
AppArmor
AppArmor for Curl
AppArmor for Docker Nginx
AppArmor for Kubernetes Nginx
Seccomp
Seccomp for Docker Nginx
Seccomp for Kubernetes Nginx