Certified Kubernetes Security Specialist (CKS) Study Guide

Chapter 5. Minimize Microservice Vulnerabilities

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 5th chapter of the final book. Please note that the GitHub repo will be made active later on.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

Application stacks operated in a Kubernetes cluster often follow a microservices architecture. The domain “minimize microservice vulnerabilities” covers governance and enforcement of security settings on the Pod-level. We’ll touch on Kubernetes’ core features, as well as external tooling, that help with minimizing secuirty vulnerabilities. Additionally, we’ll also talk about encrypted network communication between Pods running microservices.

At a high level, this chapter covers the following concepts:

• Setting up appropriate OS-level security domains with security contexts, Pod Security Admission (PSA), and Open Policy Agent (OPA) Gatekeeper

• Managing Secrets

• Using container runtime sandboxes, such as gVisor and kata containers

• Implementing Pod-to-Pod communication encryption via mutual Transport Layer Security (TLS)

Setting Appropriate OS-Level Security Domains

Both core ...