book

Learn Kubernetes Security

Name: Learn Kubernetes Security
ISBN: 9781839216503

by Kaizhe Huang, Pranjal Jumde

July 2020

Intermediate to advanced

330 pages

6h 27m

English

Packt Publishing

Read now

Unlock full access

Learn Kubernetes Security
Why subscribe?ForewordContributorsAbout the authorsAbout the reviewerPackt is searching for authors like you
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesCode in ActionDownload the color imagesConventions usedGet in touchReviews
Section 1: Introduction to Kubernetes
Chapter 1: Kubernetes Architecture
The rise of Docker and the trend of microservicesKubernetes adoption statusKubernetes clustersKubernetes components The Kubernetes interfacesKubernetes objectsPodsDeploymentsServicesReplica setsVolumesNamespacesService accountsNetwork policiesPod security policiesKubernetes variationsMinikubeK3sOpenShiftKubernetes and cloud providersKubernetes as a serviceKopsWhy worry about Kubernetes' security?SummaryQuestionsFurther reading
Chapter 2: Kubernetes Networking
Overview of the Kubernetes network modelPort-sharing problemsKubernetes network modelCommunicating inside a podLinux namespaces and the pause containerBeyond network communicationCommunicating between podsThe Kubernetes servicekube-proxyIntroducing the Kubernetes serviceService discoveryService typesIngress for routing external requestsIntroducing the CNI and CNI pluginsCNI specification and pluginsCalicoWrapping upSummaryQuestionsFurther reading
Chapter 3: Threat Modeling
Introduction to threat modelingComponent interactionsThreat actors in Kubernetes environmentsThreats in Kubernetes clustersThreat modeling application in KubernetesSummaryQuestionsFurther reading
Chapter 4: Applying the Principle of Least Privilege in Kubernetes
The principle of least privilegeAuthorization modelRewards of the principle of least privilegeLeast privilege of Kubernetes subjectsIntroduction to RBACService accounts, users, and groupsRoleRoleBindingKubernetes namespacesWrapping up least privilege for Kubernetes subjectsLeast privilege for Kubernetes workloadsLeast privilege for accessing system resourcesWrapping up least privilege for accessing system resourcesLeast privilege for accessing network resourcesLeast privilege for accessing application resourcesSummaryQuestionsFurther reading
Chapter 5: Configuring Kubernetes Security Boundaries
Introduction to security boundariesSecurity boundaries versus trust boundariesKubernetes security domainsKubernetes entities as security boundariesSecurity boundaries in the system layerLinux namespaces as security boundariesLinux capabilities as security boundariesWrapping up security boundaries in the system layerSecurity boundaries in the network layerNetwork policiesSummaryQuestionsFurther references
Section 2: Securing Kubernetes Deployments and Clusters
Chapter 6: Securing Cluster Components
Securing kube-apiserverSecuring kubeletSecuring etcdSecuring kube-schedulerSecuring kube-controller-managerSecuring CoreDNSBenchmarking a cluster's security configurationSummaryQuestionsFurther reading

Chapter 7: Authentication, Authorization, and Admission Control
Requesting a workflow in KubernetesKubernetes authenticationClient certificatesStatic tokensBasic authenticationBootstrap tokensService account tokensWebhook tokensAuthentication proxyUser impersonationKubernetes authorizationRequest attributesAuthorization modesNodeABACRBACWebhooksAdmission controllersAlwaysPullImagesEventRateLimitLimitRangerNodeRestrictionPersistentVolumeClaimResizePodSecurityPolicySecurityContextDenyServiceAccountMutatingAdmissionWebhook and ValidatingAdmissionWebhookIntroduction to OPASummaryQuestionsFurther reading
Chapter 8: Securing Kubernetes Pods
Hardening container imagesContainer images and DockerfilesCIS Docker benchmarksConfiguring the security attributes of podsSetting host-level namespaces for podsSecurity context for containersSecurity context for podsAppArmor profilesThe power of PodSecurityPolicyUnderstanding PodSecurityPolicyKubernetes PodSecurityPolicy AdvisorSummaryQuestionsFurther reading
Chapter 9: Image Scanning in DevOps Pipelines
Introducing container images and vulnerabilitiesContainer imagesDetecting known vulnerabilitiesScanning images with Anchore EngineIntroduction to Anchore EngineScanning images with anchore-cliIntegrating image scanning into the CI/CD pipelineScanning at the build stageScanning at the deployment stageScanning at the runtime stageSummaryQuestionsFurther references
Chapter 10: Real-Time Monitoring and Resource Management of a Kubernetes Cluster
Real-time monitoring and management in monolith environmentsManaging resources in KubernetesResource requests and limitsNamespace resource quotasLimitRangerMonitoring resources in Kubernetes Built-in monitorsThird-party monitoring tools Prometheus and GrafanaSummaryQuestionsFurther references
Chapter 11: Defense in Depth
Introducing Kubernetes auditingKubernetes audit policyConfiguring the audit backendEnabling high availability in a Kubernetes clusterEnabling high availability of Kubernetes workloadsEnabling high availability of Kubernetes componentsEnabling high availability of a cloud infrastructureManaging secrets with VaultSetting up VaultProvisioning and rotating secretsDetecting anomalies with FalcoAn overview of Falco Creating Falco rules to detect anomaliesConducting forensics with Sysdig Inspect and CRIUUsing CRIU to collect dataUsing Sysdig and Sysdig InspectSummaryQuestionsFurther references
Section 3: Learning from Mistakes and Pitfalls
Chapter 12: Analyzing and Detecting Crypto-Mining Attacks
Analyzing crypto-mining attacksAn introduction to crypto-mining attacksThe crypto-mining attack on Tesla's Kubernetes clusterGraboid – a crypto-worm attackLessons learnedDetecting crypto-mining attacksMonitoring CPU utilizationDetecting network traffic to a mining poolDetecting launched crypto-mining processes Checking the binary signature Defending against attacksSecuring Kubernetes cluster provisioning Securing the buildSecuring deploymentSecuring runtimeSummaryQuestionsFurther reading
Chapter 13: Learning from Kubernetes CVEs
The path traversal issue in kubectl cp – CVE-2019-11246Mitigation strategyDoS issues in JSON parsing – CVE-2019-1002100Mitigation strategyA DoS issue in YAML parsing – CVE-2019-11253Mitigation strategyThe Privilege escalation issue in role parsing – CVE-2019-11247Mitigation strategyScanning for known vulnerabilities using kube-hunterSummaryQuestionsFurther references
Assessments
Chapter 1Chapter 2Chapter 3Chapter 4Chapter 5Chapter 6Chapter 7Chapter 8Chapter 9Chapter 10Chapter 11Chapter 12Chapter 13
Other Books You May Enjoy
Leave a review - let other readers know what you think

Overview

Learn Kubernetes Security is your go-to guide for mastering the complexities of securing Kubernetes deployments. Through practical examples and in-depth exploration, this book empowers you to construct robust defenses for your clusters, ensuring optimal protection for your microservices and containerized environments.

What this Book will help me do

Understand the architecture and network model of Kubernetes with security in mind.
Implement strategies to secure clusters, pods, and critical Kubernetes components against known threats.
Leverage open source tools such as Prometheus, Falco, and Anchore for enhanced security and monitoring.
Explore advanced security configurations and apply the principle of least privilege to Kubernetes environments.
Identify and mitigate risks from CVEs, providing defense against contemporary Kubernetes-related vulnerabilities.

Author(s)

Kaizhe Huang and Pranjal Jumde are experts in Kubernetes operations and security. Drawing from years of industry experience, they provide practical insights into securing modern containerized applications. Their hands-on approach makes complex security strategies approachable to a wide range of readers.

Who is it for?

This book is designed for DevOps engineers, security consultants, and system administrators who want to strengthen the security posture of their Kubernetes deployments. It's also valuable for developers seeking to understand how to build secure cloud-native applications. A foundational knowledge of Kubernetes and containerization is recommended.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781839216503

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills