SlideShare una empresa de Scribd logo

KubeSecOps: Securing Kubernetes Clusters and Applications

•Descargar como PPTX, PDF•
•
Karthik Gaekwad
Karthik Gaekwad

Karthik Gaekwad gave a presentation on securing Kubernetes clusters. He discussed reducing the attack surface by hardening hosts, using official container images with specific versions, limiting privileges, and periodically checking for vulnerabilities. He explained how Kubernetes features like TLS, authentication, authorization, auditing, network policies and pod security policies can help. Open source tools like Clair, Kube-bench, Kubesec and Kubeaudit were presented to analyze vulnerabilities and check configuration best practices. The overall message was to take a layered approach to security using the platform capabilities and tooling available.

Tecnología
1 de 74
October 17, 2018 KubeSecOps Karthik Gaekwad Principal Engineer Oracle Inc
October 17, 2018October 17, 2018 • I’m Karthik Gaekwad • NOT a DBA • https://cloudnative.oracle.com/ • Cloud Native evangelist at Oracle Cloud Infrastructure • Used to be a developer on the OKE Team. Hello! @iteration1
October 17, 2018October 17, 2018 •Been in Industry 15 years. •In general, I like building stuff with friends. –A maintainer for Gauntlt- Open source security scanner. •Love Teaching and building community. –Run Devopsdays Austin, Container Days, Cloud Austin. –Chair All Day Devops Cloud Native track. –LinkedIn Learning Author for Learning Kubernetes (and more). Hello!
October 17, 2018October 17, 2018 Need an OCI Trial Account? http://bitly.com/ocicloud
October 17, 2018October 17, 2018 The Cloud Native Journey Phase I Developer Focus Phase II DevOps Focus Phase III Business Focus (end-to-end) Container Adoption Application Deployment Intelligent Operations SpeedEfficiencyAgility Docker Kubernetes Core to Edge Developer adoption Dev/Test apps Simple orchestration Individual developers DevOps deployment Production apps Advanced orchestration Teams & lines of business End-to-end integration Digital business apps Serverless, DevSecOps, & ML Cloud native enterprises Focus Applications Automation Community
October 17, 2018October 17, 2018 Latest CNCF Survey: August 2018 Where Does Your Company Use Containers?
October 17, 2018October 17, 2018 Latest CNCF Survey: August 2018 Where Does Your Company Use Containers?
October 17, 2018October 17, 2018 Container Management IS Kubernetes Your company/organization manages containers with?
October 17, 2018October 17, 2018 Good News, Bad News… Good: On average, CNCF project usage is up over 200% since the Dec 2017! But...
October 17, 2018October 17, 2018 Complexity, Culture, Training, & Security Issues Remain
October 17, 2018October 17, 2018 • Managing, maintaining, upgrading Kubernetes Control Plane – API Server, etcd, scheduler etc…. • Managing, maintaining, upgrading Kubernetes Data Plane – In place upgrades, deploy parallel cluster etc…. • Figuring out container networking & storage – Overlays, persistent storage etc… - it should just work • Managing Teams – How do I manage & control team access to my clusters? • Security, security, security Kubernetes & Cloud Native Challenges Source: Oracle Customer Survey 2018
October 17, 2018October 17, 2018 How Teams Address Issues? App Management Upgrades & Patching Platform Backup & Recovery High Availability Scaling App Deployment Power, HVAC Rack and Stack Server Provisioning Software Installation Customer Managed Fully-Managed App Management Upgrades & Patching Platform Backup & Recovery High Availability Scaling App Deployment Power, HVAC Rack and Stack Server Provisioning Software Installation  Faster Time to Deploy  Lower Risk  Accelerate Innovation Benefits YOU
October 17, 2018October 17, 2018 Which brings us to security…
October 17, 2018October 17, 2018 Where no news, is good news! Security….
October 17, 2018October 17, 2018 Unsecured K8s dashboards • Unsecured Kubernetes Dashboard with account creds. • Used this to mine cryptocurrency. • 2017: Aviva • 2018: Tesla, Weight Watchers • https://redlock.io/blog/cryptojacking-tesla
October 17, 2018October 17, 2018 Kubelet credentials hack • Shopify: Server Side request Forgery • Get kubelet certs/private key • Root access to any container in part of infrastructure. • https://hackerone.com/reports/341876
October 17, 2018October 17, 2018
October 17, 2018October 17, 2018
October 17, 2018October 17, 2018
October 17, 2018October 17, 2018
October 17, 2018October 17, 2018 WAT?
October 17, 2018October 17, 2018 How did we get here?
October 17, 2018October 17, 2018 “Kubernetes is too complicated”
October 17, 2018October 17, 2018 “We hope it’ll get easier” “Kubernetes is too complicated”
October 17, 2018October 17, 2018 What is your strate
October 17, 2018October 17, 2018 Attack Surface –More importantly, how to limit damage Security related features in K8s –The more you know, the better you build Opensource Tooling to help –Because we all need help Let’s look at:
October 17, 2018October 17, 2018 Attack Surface
October 17, 2018October 17, 2018 Goal: Reduce the attack surface Analysis for: –Host –Container (Images and running) –Kubernetes Cluster Attack Surface
October 17, 2018October 17, 2018 • These are the machines you’re running Kubernetes on. • Age old principles of Linux still apply: –Enable SELinux –AppArmor –Seccomp –Hardened Images • Goal: Minimize privilege to applications running on the host • Good news: Already a wealth of information on this subject! –http://lmgtfy.com/?q=how+to+reduce+attack+surface+linux Attack Surface: Host
October 17, 2018October 17, 2018 GOAL: Know your base image when building containers Attack Surface: Container Images
October 17, 2018October 17, 2018 GOAL: Know your base image when building containers Attack Surface: Container Images **BTW, this is just a ruby helloworld app
October 17, 2018October 17, 2018 Full disclosure: I’m karthequian; I created this as a ruby 101 container for learning purposes only Attack Surface: Container Images GOAL: Know your base image when building containers
October 17, 2018October 17, 2018 GOAL: Know your base image when building containers When in doubt, stick to an official images! Or start from a sane base image (example: alpine linux) Attack Surface: Container Images
October 17, 2018October 17, 2018 GOAL: Smaller the image, the better •Less things for an attacker to exploit. •Quicker to push, quicker to pull. Attack Surface: Container Images
October 17, 2018October 17, 2018 GOAL: Don’t rely on :latest tag • :latest image yesterday might not be :latest image tomorrow • Instead, you’d want to know what specific version you’re operating with. • Side benefit: If there is a new vulnerability announced for OS version x.y.z, you know immediately whether you’re running that version! Attack Surface: Container Images
October 17, 2018October 17, 2018 GOAL: Check for vulnerabilities periodically •Plenty of ways to do this in registries. We’ll cover more in the tooling section Attack Surface: Container Images
October 17, 2018October 17, 2018 GOAL: Don’t run as root •Containers running as root might be completely unnecessary for the actual application. •If compromised, attacker can do a lot more things.. •Pod security policies can help (we’ll see how later). Attack Surface: Running Containers
October 17, 2018October 17, 2018 GOAL: Limit host mounts •Be wary of images that require broad access to paths on the host •Limit your host mount to a smaller subset of directories •Reduces blast radius on compromise Attack Surface: Running Containers
October 17, 2018October 17, 2018 Attack Surface: Kubernetes Cluster
October 17, 2018October 17, 2018 Kubernetes Cluster- TLS TLS ALL THE THINGS
October 17, 2018October 17, 2018 Kubernetes Cluster- TLS
October 17, 2018October 17, 2018 TLS Checklist: 1. User and Master 2. Nodes and Master 3. Everything etcd 4. Kubelet to API Server Kubernetes Cluster- TLS
October 17, 2018October 17, 2018 We’re a little better off now. But what else to do?
October 17, 2018October 17, 2018 K8s Features How can the platform help me make secure choices?
October 17, 2018October 17, 2018 K8s Features Authentication Authorization Audit Logging Network Policies Pod security policies Kubernetes Secrets
October 17, 2018October 17, 2018 Do you know how you are authenticating with Kubernetes? Many ways to Authenticate –Client Certs –Static token file –Service Account tokens –OpenID –Webhook Mode –And more (https://kubernetes.io/docs/reference/access-authn- authz/authentication/) Authentication and Authorization
October 17, 2018October 17, 2018 Whatever you do, DO NOT YOLO! Goal: Pick a strategy that fits your use case
October 17, 2018October 17, 2018You can pick an authz strategy.. If you DO NOT YOLO…
October 17, 2018October 17, 2018 Authentication and Authorization https://kubernetes.io/docs/reference/access-authn-authz/authorization/
October 17, 2018October 17, 2018 • Pro tip: Nobody uses ABAC anymore. Don’t be that guy…. • RBAC is the defacto standard –Based on roles and role bindings –Good set of defaults: https://github.com/uruddarraju/kubernetes-rbac- policies • Can use multiple authorizers together, but can get confusing. –1st authorizer to authorize passes authz Authentication and Authorization
October 17, 2018October 17, 2018 • Wat? • “Kubernetes auditing provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system.” • Answers: What/when/who/where information on security events. • Your job: Periodically watch Kubernetes Audit logs • https://kubernetes.io/docs/tasks/debug-application-cluster/audit/ Kubernetes Cluster- Audit Logs
October 17, 2018October 17, 2018
October 17, 2018October 17, 2018 •Consider adding a network policy to the cluster… •Default Policy: All pods can talk to all other pods. •Consider limiting this with a Network Policy • https://kubernetes.io/docs/concepts/services-networking/network-policies/ Kubernetes Cluster- Network Policies
October 17, 2018October 17, 2018 •Consider adding Pod Security policies •PodSecurityPolicy: A Defined set of conditions a pod must run with. •Think of this as authorization for pods. Kubernetes Cluster- Pod Security Policies
October 17, 2018October 17, 2018 Kubernetes Cluster: Pod Security Policies https://kubernetes.io/docs/concepts/policy/pod- security-policy/#what-is-a-pod-security-policy Capability for an admin to control specific actions
October 17, 2018October 17, 2018 •GOAL: Use Kubernetes secrets to store sensitive data instead of config maps. •Also look at: secrets encryption provider. –Controls how etcd encrypts API data –--experimental-encryption-provider-config •https://kubernetes.io/docs/tasks/administer- cluster/encrypt-data/ Kubernetes Secrets
October 17, 2018October 17, 2018 ToolingOpensource Tooling
October 17, 2018October 17, 2018 Keep tabs on the CNCF Security landscape https://landscape.cncf.io/landscape=security-compliance
October 17, 2018October 17, 2018 • “The Update Framework” • Is a framework or a methodology. • Used for secure software updates. • Based on ideas surrounding trust and integrity. • Is a project. • Based on TUF. • A solution to secure software updates and distribution. • Used in Docker Trusted Registry. CNCF Projects
October 17, 2018October 17, 2018 •Open source project for the static analysis of vulnerabilities in containers. •Find vulnerable images in your repo. •Built into quay.io, but you can add to your own repo. •https://github.com/coreos/clair Clair
October 17, 2018October 17, 2018
October 17, 2018October 17, 2018 • Checks whether a Kubernetes cluster is deployed according to security best practices. • Run this after creating your K8s cluster. • https://github.com/aquasecurity/kube-bench • Defined by the CIS Benchmarks Docs: https://www.cisecurity.org/cis-benchmarks/ • Run it against your Kubernetes Master, or Kubernetes node. Kube-bench
October 17, 2018October 17, 2018 Kube-bench example
October 17, 2018October 17, 2018 •Helps you quantify risk for Kubernetes resources. •Run against your K8s applications (deployments/pods/daemonsets etc) •https://kubesec.io/ from controlplane •Can be used standalone, or as a kubectl plugin (https://github.com/stefanprodan/kubectl-kubesec) Kubesec
October 17, 2018October 17, 2018 Kubesec example
October 17, 2018October 17, 2018 •Opensourced from Shopify. •Auditing your applications in your K8s cluster. •https://github.com/Shopify/kubeaudit •Little more targeted than Kubesec. Kubeaudit
October 17, 2018October 17, 2018
October 17, 2018October 17, 2018 Kubeaudit example
October 17, 2018October 17, 2018 “So much time and so little to do.”
October 17, 2018October 17, 2018 •11 ways not to get hacked: https://kubernetes.io/blog/2018/07/18/11-ways-not-to- get-hacked •K8s security (from Image Hygiene to Network Policy): https://speakerdeck.com/mhausenblas/kubernetes- security-from-image-hygiene-to-network-policies Couple more resources to look at:
October 17, 2018October 17, 2018 KEEP CALM AND KUBE ON @iteration1
October 17, 2018
October 17, 2018 Thank You Supporters
October 17, 2018 Meet me in the Slack channel for Q&A bit.ly/addo-slack

Recomendados

Kube Apps in action
Kube Apps in actionKube Apps in action
Kube Apps in actionKarthik Gaekwad
 
DevSecOps in a cloudnative world
DevSecOps in a cloudnative worldDevSecOps in a cloudnative world
DevSecOps in a cloudnative worldKarthik Gaekwad
 
Practical Approaches to Cloud Native Security
Practical Approaches to Cloud Native SecurityPractical Approaches to Cloud Native Security
Practical Approaches to Cloud Native SecurityKarthik Gaekwad
 
Kubernetes Security
Kubernetes SecurityKubernetes Security
Kubernetes SecurityKarthik Gaekwad
 
Kubernetes security and you
Kubernetes security and youKubernetes security and you
Kubernetes security and youKarthik Gaekwad
 
Introduction to Kubernetes Security (Aqua & Weaveworks)
Introduction to Kubernetes Security (Aqua & Weaveworks)Introduction to Kubernetes Security (Aqua & Weaveworks)
Introduction to Kubernetes Security (Aqua & Weaveworks)Weaveworks
 
Kubernetes - security you need to know about it
Kubernetes - security you need to know about itKubernetes - security you need to know about it
Kubernetes - security you need to know about itHaydn Johnson
 
Deploying Kubernetes without scaring off your security team - KubeCon 2017
Deploying Kubernetes without scaring off your security team - KubeCon 2017Deploying Kubernetes without scaring off your security team - KubeCon 2017
Deploying Kubernetes without scaring off your security team - KubeCon 2017Major Hayden
 

Recomendados

Kube Apps in action
Kube Apps in actionKube Apps in action
Kube Apps in actionKarthik Gaekwad
 
DevSecOps in a cloudnative world
DevSecOps in a cloudnative worldDevSecOps in a cloudnative world
DevSecOps in a cloudnative worldKarthik Gaekwad
 
Practical Approaches to Cloud Native Security
Practical Approaches to Cloud Native SecurityPractical Approaches to Cloud Native Security
Practical Approaches to Cloud Native SecurityKarthik Gaekwad
 
Kubernetes Security
Kubernetes SecurityKubernetes Security
Kubernetes SecurityKarthik Gaekwad
 
Kubernetes security and you
Kubernetes security and youKubernetes security and you
Kubernetes security and youKarthik Gaekwad
 
Introduction to Kubernetes Security (Aqua & Weaveworks)
Introduction to Kubernetes Security (Aqua & Weaveworks)Introduction to Kubernetes Security (Aqua & Weaveworks)
Introduction to Kubernetes Security (Aqua & Weaveworks)Weaveworks
 
Kubernetes - security you need to know about it
Kubernetes - security you need to know about itKubernetes - security you need to know about it
Kubernetes - security you need to know about itHaydn Johnson
 
Deploying Kubernetes without scaring off your security team - KubeCon 2017
Deploying Kubernetes without scaring off your security team - KubeCon 2017Deploying Kubernetes without scaring off your security team - KubeCon 2017
Deploying Kubernetes without scaring off your security team - KubeCon 2017Major Hayden
 
The elements of kubernetes
The elements of kubernetesThe elements of kubernetes
The elements of kubernetesAaron Schlesinger
 
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...Docker, Inc.
 
Immutable Awesomeness by John Willis and Josh Corman
Immutable Awesomeness by John Willis and Josh CormanImmutable Awesomeness by John Willis and Josh Corman
Immutable Awesomeness by John Willis and Josh CormanDocker, Inc.
 
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17Mario-Leander Reimer
 
Keeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureKeeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureGene Gotimer
 
Security threats with Kubernetes - Igor Khoroshchenko
Security threats with Kubernetes - Igor Khoroshchenko Security threats with Kubernetes - Igor Khoroshchenko
Security threats with Kubernetes - Igor KhoroshchenkoKuberton
 
Kubernetes Networking 101
Kubernetes Networking 101Kubernetes Networking 101
Kubernetes Networking 101Kublr
 
DockerCon SF 2015: Faster, Cheaper, Safer
DockerCon SF 2015: Faster, Cheaper, SaferDockerCon SF 2015: Faster, Cheaper, Safer
DockerCon SF 2015: Faster, Cheaper, SaferDocker, Inc.
 
Running Kubernetes in Kubernetes
Running Kubernetes in KubernetesRunning Kubernetes in Kubernetes
Running Kubernetes in KubernetesQAware GmbH
 
Netflix OSS Meetup Season 5 Episode 1
Netflix OSS Meetup Season 5 Episode 1Netflix OSS Meetup Season 5 Episode 1
Netflix OSS Meetup Season 5 Episode 1aspyker
 
Practical Container Security by Mrunal Patel and Thomas Cameron, Red Hat
Practical Container Security by Mrunal Patel and Thomas Cameron, Red HatPractical Container Security by Mrunal Patel and Thomas Cameron, Red Hat
Practical Container Security by Mrunal Patel and Thomas Cameron, Red HatDocker, Inc.
 
Open Source Applied - Real World Use Cases
Open Source Applied - Real World Use CasesOpen Source Applied - Real World Use Cases
Open Source Applied - Real World Use CasesAll Things Open
 
Rohit yadav cloud stack internals
Rohit yadav cloud stack internalsRohit yadav cloud stack internals
Rohit yadav cloud stack internalsShapeBlue
 
Keeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureKeeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureGene Gotimer
 
Containers & Security
Containers & SecurityContainers & Security
Containers & SecurityAll Things Open
 
Neues aus dem Docker-Universum
Neues aus dem Docker-UniversumNeues aus dem Docker-Universum
Neues aus dem Docker-UniversumNicholas Dille
 
Continuous Delivery With Containers
Continuous Delivery With ContainersContinuous Delivery With Containers
Continuous Delivery With ContainersAll Things Open
 
Continuous Delivery the Hard Way with Kubernetes
Continuous Delivery the Hard Way with Kubernetes Continuous Delivery the Hard Way with Kubernetes
Continuous Delivery the Hard Way with Kubernetes Weaveworks
 
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...Docker, Inc.
 
DCSF19 Kubernetes Security with OPA
DCSF19 Kubernetes Security with OPA DCSF19 Kubernetes Security with OPA
DCSF19 Kubernetes Security with OPA Docker, Inc.
 
Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevops
Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevopsCommon vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevops
Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevopsJose Manuel Ortega Candel
 
10 tips for Cloud Native Security
10 tips for Cloud Native Security10 tips for Cloud Native Security
10 tips for Cloud Native SecurityKarthik Gaekwad
 

Más contenido relacionado

La actualidad más candente

Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...Docker, Inc.
 
Immutable Awesomeness by John Willis and Josh Corman
Immutable Awesomeness by John Willis and Josh CormanImmutable Awesomeness by John Willis and Josh Corman
Immutable Awesomeness by John Willis and Josh CormanDocker, Inc.
 
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17Mario-Leander Reimer
 
Keeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureKeeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureGene Gotimer
 
Security threats with Kubernetes - Igor Khoroshchenko
Security threats with Kubernetes - Igor Khoroshchenko Security threats with Kubernetes - Igor Khoroshchenko
Security threats with Kubernetes - Igor KhoroshchenkoKuberton
 
Kubernetes Networking 101
Kubernetes Networking 101Kubernetes Networking 101
Kubernetes Networking 101Kublr
 
DockerCon SF 2015: Faster, Cheaper, Safer
DockerCon SF 2015: Faster, Cheaper, SaferDockerCon SF 2015: Faster, Cheaper, Safer
DockerCon SF 2015: Faster, Cheaper, SaferDocker, Inc.
 
Running Kubernetes in Kubernetes
Running Kubernetes in KubernetesRunning Kubernetes in Kubernetes
Running Kubernetes in KubernetesQAware GmbH
 
Netflix OSS Meetup Season 5 Episode 1
Netflix OSS Meetup Season 5 Episode 1Netflix OSS Meetup Season 5 Episode 1
Netflix OSS Meetup Season 5 Episode 1aspyker
 
Practical Container Security by Mrunal Patel and Thomas Cameron, Red Hat
Practical Container Security by Mrunal Patel and Thomas Cameron, Red HatPractical Container Security by Mrunal Patel and Thomas Cameron, Red Hat
Practical Container Security by Mrunal Patel and Thomas Cameron, Red HatDocker, Inc.
 
Open Source Applied - Real World Use Cases
Open Source Applied - Real World Use CasesOpen Source Applied - Real World Use Cases
Open Source Applied - Real World Use CasesAll Things Open
 
Rohit yadav cloud stack internals
Rohit yadav cloud stack internalsRohit yadav cloud stack internals
Rohit yadav cloud stack internalsShapeBlue
 
Keeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureKeeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureGene Gotimer
 
Neues aus dem Docker-Universum
Neues aus dem Docker-UniversumNeues aus dem Docker-Universum
Neues aus dem Docker-UniversumNicholas Dille
 
Continuous Delivery With Containers
Continuous Delivery With ContainersContinuous Delivery With Containers
Continuous Delivery With ContainersAll Things Open
 
Continuous Delivery the Hard Way with Kubernetes
Continuous Delivery the Hard Way with Kubernetes Continuous Delivery the Hard Way with Kubernetes
Continuous Delivery the Hard Way with Kubernetes Weaveworks
 
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...Docker, Inc.
 
DCSF19 Kubernetes Security with OPA
DCSF19 Kubernetes Security with OPA DCSF19 Kubernetes Security with OPA
DCSF19 Kubernetes Security with OPA Docker, Inc.
 

La actualidad más candente (20)

The elements of kubernetes
The elements of kubernetesThe elements of kubernetes
The elements of kubernetes
 
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...
Using the SDACK Architecture on Security Event Inspection by Yu-Lun Chen and ...
 
Immutable Awesomeness by John Willis and Josh Corman
Immutable Awesomeness by John Willis and Josh CormanImmutable Awesomeness by John Willis and Josh Corman
Immutable Awesomeness by John Willis and Josh Corman
 
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17
A Hitchhiker’s Guide to the Cloud Native Stack. #CDS17
 
Keeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureKeeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster Secure
 
Security threats with Kubernetes - Igor Khoroshchenko
Security threats with Kubernetes - Igor Khoroshchenko Security threats with Kubernetes - Igor Khoroshchenko
Security threats with Kubernetes - Igor Khoroshchenko
 
Kubernetes Networking 101
Kubernetes Networking 101Kubernetes Networking 101
Kubernetes Networking 101
 
DockerCon SF 2015: Faster, Cheaper, Safer
DockerCon SF 2015: Faster, Cheaper, SaferDockerCon SF 2015: Faster, Cheaper, Safer
DockerCon SF 2015: Faster, Cheaper, Safer
 
Running Kubernetes in Kubernetes
Running Kubernetes in KubernetesRunning Kubernetes in Kubernetes
Running Kubernetes in Kubernetes
 
Netflix OSS Meetup Season 5 Episode 1
Netflix OSS Meetup Season 5 Episode 1Netflix OSS Meetup Season 5 Episode 1
Netflix OSS Meetup Season 5 Episode 1
 
Practical Container Security by Mrunal Patel and Thomas Cameron, Red Hat
Practical Container Security by Mrunal Patel and Thomas Cameron, Red HatPractical Container Security by Mrunal Patel and Thomas Cameron, Red Hat
Practical Container Security by Mrunal Patel and Thomas Cameron, Red Hat
 
Open Source Applied - Real World Use Cases
Open Source Applied - Real World Use CasesOpen Source Applied - Real World Use Cases
Open Source Applied - Real World Use Cases
 
Rohit yadav cloud stack internals
Rohit yadav cloud stack internalsRohit yadav cloud stack internals
Rohit yadav cloud stack internals
 
Keeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster SecureKeeping your Kubernetes Cluster Secure
Keeping your Kubernetes Cluster Secure
 
Containers & Security
Containers & SecurityContainers & Security
Containers & Security
 
Neues aus dem Docker-Universum
Neues aus dem Docker-UniversumNeues aus dem Docker-Universum
Neues aus dem Docker-Universum
 
Continuous Delivery With Containers
Continuous Delivery With ContainersContinuous Delivery With Containers
Continuous Delivery With Containers
 
Continuous Delivery the Hard Way with Kubernetes
Continuous Delivery the Hard Way with Kubernetes Continuous Delivery the Hard Way with Kubernetes
Continuous Delivery the Hard Way with Kubernetes
 
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
 
DCSF19 Kubernetes Security with OPA
DCSF19 Kubernetes Security with OPA DCSF19 Kubernetes Security with OPA
DCSF19 Kubernetes Security with OPA
 

Similar a KubeSecOps: Securing Kubernetes Clusters and Applications

Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevops
Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevopsCommon vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevops
Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevopsJose Manuel Ortega Candel
 
10 tips for Cloud Native Security
10 tips for Cloud Native Security10 tips for Cloud Native Security
10 tips for Cloud Native SecurityKarthik Gaekwad
 
Building CI from scratch
Building CI from scratchBuilding CI from scratch
Building CI from scratchArtem Nikitin
 
DevSecCon London 2018: Is your supply chain your achille's heel
DevSecCon London 2018: Is your supply chain your achille's heelDevSecCon London 2018: Is your supply chain your achille's heel
DevSecCon London 2018: Is your supply chain your achille's heelDevSecCon
 
2018 alldaydevops presentation
2018 alldaydevops presentation2018 alldaydevops presentation
2018 alldaydevops presentationMirco Hering
 
Security in a containerized world - Jessie Frazelle
Security in a containerized world - Jessie FrazelleSecurity in a containerized world - Jessie Frazelle
Security in a containerized world - Jessie FrazelleParis Container Day
 
DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...
DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...
DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...DevSecCon
 
Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016Opsta
 
Kubernetes for Docker Users
Kubernetes for Docker UsersKubernetes for Docker Users
Kubernetes for Docker UsersWilliam Jimenez
 
Kubernetes Architecture - beyond a black box - Part 1
Kubernetes Architecture - beyond a black box - Part 1Kubernetes Architecture - beyond a black box - Part 1
Kubernetes Architecture - beyond a black box - Part 1Hao H. Zhang
 
It's 2018. Are My Containers Secure Yet!?
It's 2018. Are My Containers Secure Yet!?It's 2018. Are My Containers Secure Yet!?
It's 2018. Are My Containers Secure Yet!?Phil Estes
 
Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)
Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)
Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)Lee Myring
 
Container-Based Platforms and Kubernetes
Container-Based Platforms and KubernetesContainer-Based Platforms and Kubernetes
Container-Based Platforms and KubernetesAlex Glikson
 
Social connections14: Super charge your API’s with Reactive streams
Social connections14: Super charge your API’s with Reactive streamsSocial connections14: Super charge your API’s with Reactive streams
Social connections14: Super charge your API’s with Reactive streamsFrank van der Linden
 
Deep dive into Kubernetes monitoring with Elastic Observability.pptx
Deep dive into Kubernetes monitoring with Elastic Observability.pptxDeep dive into Kubernetes monitoring with Elastic Observability.pptx
Deep dive into Kubernetes monitoring with Elastic Observability.pptxChris Markou
 
Intro elasticsearch taswarbhatti
Intro elasticsearch taswarbhattiIntro elasticsearch taswarbhatti
Intro elasticsearch taswarbhattiTaswar Bhatti
 
Options for running Kubernetes at scale across multiple cloud providers
Options for running Kubernetes at scale across multiple cloud providersOptions for running Kubernetes at scale across multiple cloud providers
Options for running Kubernetes at scale across multiple cloud providersSAP HANA Cloud Platform
 
Containers and Kubernetes without limits
Containers and Kubernetes without limitsContainers and Kubernetes without limits
Containers and Kubernetes without limitsAntje Barth
 

Similar a KubeSecOps: Securing Kubernetes Clusters and Applications (20)

Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevops
Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevopsCommon vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevops
Common vulnerabilities & exposures (cve) in docker containers- 2018 alldaydevops
 
10 tips for Cloud Native Security
10 tips for Cloud Native Security10 tips for Cloud Native Security
10 tips for Cloud Native Security
 
7 Container Design Patterns
7 Container Design Patterns7 Container Design Patterns
7 Container Design Patterns
 
Csa container-security-in-aws-dw
Csa container-security-in-aws-dwCsa container-security-in-aws-dw
Csa container-security-in-aws-dw
 
Building CI from scratch
Building CI from scratchBuilding CI from scratch
Building CI from scratch
 
DevSecCon London 2018: Is your supply chain your achille's heel
DevSecCon London 2018: Is your supply chain your achille's heelDevSecCon London 2018: Is your supply chain your achille's heel
DevSecCon London 2018: Is your supply chain your achille's heel
 
2018 alldaydevops presentation
2018 alldaydevops presentation2018 alldaydevops presentation
2018 alldaydevops presentation
 
Security in a containerized world - Jessie Frazelle
Security in a containerized world - Jessie FrazelleSecurity in a containerized world - Jessie Frazelle
Security in a containerized world - Jessie Frazelle
 
DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...
DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...
DevSecCon London 2018: Enabling shift-left for 12k banking developers from sc...
 
Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016
 
Kubernetes for Docker Users
Kubernetes for Docker UsersKubernetes for Docker Users
Kubernetes for Docker Users
 
Kubernetes Architecture - beyond a black box - Part 1
Kubernetes Architecture - beyond a black box - Part 1Kubernetes Architecture - beyond a black box - Part 1
Kubernetes Architecture - beyond a black box - Part 1
 
It's 2018. Are My Containers Secure Yet!?
It's 2018. Are My Containers Secure Yet!?It's 2018. Are My Containers Secure Yet!?
It's 2018. Are My Containers Secure Yet!?
 
Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)
Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)
Log aggregation: using Elasticsearch, Fluentd/Fluentbit and Kibana (EFK)
 
Container-Based Platforms and Kubernetes
Container-Based Platforms and KubernetesContainer-Based Platforms and Kubernetes
Container-Based Platforms and Kubernetes
 
Social connections14: Super charge your API’s with Reactive streams
Social connections14: Super charge your API’s with Reactive streamsSocial connections14: Super charge your API’s with Reactive streams
Social connections14: Super charge your API’s with Reactive streams
 
Deep dive into Kubernetes monitoring with Elastic Observability.pptx
Deep dive into Kubernetes monitoring with Elastic Observability.pptxDeep dive into Kubernetes monitoring with Elastic Observability.pptx
Deep dive into Kubernetes monitoring with Elastic Observability.pptx
 
Intro elasticsearch taswarbhatti
Intro elasticsearch taswarbhattiIntro elasticsearch taswarbhatti
Intro elasticsearch taswarbhatti
 
Options for running Kubernetes at scale across multiple cloud providers
Options for running Kubernetes at scale across multiple cloud providersOptions for running Kubernetes at scale across multiple cloud providers
Options for running Kubernetes at scale across multiple cloud providers
 
Containers and Kubernetes without limits
Containers and Kubernetes without limitsContainers and Kubernetes without limits
Containers and Kubernetes without limits
 

Más de Karthik Gaekwad

Mental Health studies and devops
Mental Health studies and devopsMental Health studies and devops
Mental Health studies and devopsKarthik Gaekwad
 
Kube applications in action
Kube applications in actionKube applications in action
Kube applications in actionKarthik Gaekwad
 
Containers, microservices and serverless for realists
Containers, microservices and serverless for realistsContainers, microservices and serverless for realists
Containers, microservices and serverless for realistsKarthik Gaekwad
 
Containers and microservices for realists
Containers and microservices for realistsContainers and microservices for realists
Containers and microservices for realistsKarthik Gaekwad
 
13 practical tips for writing secure golang applications
13 practical tips for writing secure golang applications13 practical tips for writing secure golang applications
13 practical tips for writing secure golang applicationsKarthik Gaekwad
 
Agile 2014- Metrics driven development and devops
Agile 2014- Metrics driven development and devopsAgile 2014- Metrics driven development and devops
Agile 2014- Metrics driven development and devopsKarthik Gaekwad
 
Devopsdays Austin 2014 Ignite: Keep devops weird
Devopsdays Austin 2014 Ignite: Keep devops weirdDevopsdays Austin 2014 Ignite: Keep devops weird
Devopsdays Austin 2014 Ignite: Keep devops weirdKarthik Gaekwad
 
Cloud Austin 2013: Conferenced2013
Cloud Austin 2013: Conferenced2013Cloud Austin 2013: Conferenced2013
Cloud Austin 2013: Conferenced2013Karthik Gaekwad
 
LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!
LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!
LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!Karthik Gaekwad
 
Agile 2013 Talk: How DevOps Changes Everything
Agile 2013 Talk: How DevOps Changes EverythingAgile 2013 Talk: How DevOps Changes Everything
Agile 2013 Talk: How DevOps Changes EverythingKarthik Gaekwad
 
Sexy HTML with Twitter Bootstrap
Sexy HTML with Twitter BootstrapSexy HTML with Twitter Bootstrap
Sexy HTML with Twitter BootstrapKarthik Gaekwad
 
12 Clouds of Christmas 2012- Stormpath
12 Clouds of Christmas 2012- Stormpath12 Clouds of Christmas 2012- Stormpath
12 Clouds of Christmas 2012- StormpathKarthik Gaekwad
 
We built this city on Dev and Ops
We built this city on Dev and OpsWe built this city on Dev and Ops
We built this city on Dev and OpsKarthik Gaekwad
 
30 days or less: New Features to Production
30 days or less: New Features to Production30 days or less: New Features to Production
30 days or less: New Features to ProductionKarthik Gaekwad
 

Más de Karthik Gaekwad (20)

Why to Cloud Native
Why to Cloud NativeWhy to Cloud Native
Why to Cloud Native
 
Mental Health studies and devops
Mental Health studies and devopsMental Health studies and devops
Mental Health studies and devops
 
This is your community
This is your communityThis is your community
This is your community
 
Kube applications in action
Kube applications in actionKube applications in action
Kube applications in action
 
Devops and Dadops
Devops and DadopsDevops and Dadops
Devops and Dadops
 
Containers, microservices and serverless for realists
Containers, microservices and serverless for realistsContainers, microservices and serverless for realists
Containers, microservices and serverless for realists
 
Containers and microservices for realists
Containers and microservices for realistsContainers and microservices for realists
Containers and microservices for realists
 
13 practical tips for writing secure golang applications
13 practical tips for writing secure golang applications13 practical tips for writing secure golang applications
13 practical tips for writing secure golang applications
 
Why to docker
Why to dockerWhy to docker
Why to docker
 
Docker management
Docker managementDocker management
Docker management
 
Agile 2014- Metrics driven development and devops
Agile 2014- Metrics driven development and devopsAgile 2014- Metrics driven development and devops
Agile 2014- Metrics driven development and devops
 
Devopsdays Austin 2014 Ignite: Keep devops weird
Devopsdays Austin 2014 Ignite: Keep devops weirdDevopsdays Austin 2014 Ignite: Keep devops weird
Devopsdays Austin 2014 Ignite: Keep devops weird
 
Cloud Austin 2013: Conferenced2013
Cloud Austin 2013: Conferenced2013Cloud Austin 2013: Conferenced2013
Cloud Austin 2013: Conferenced2013
 
LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!
LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!
LASCON 2013 Talk: User Auth for Winners, how to get it right the first time!
 
Agile 2013 Talk: How DevOps Changes Everything
Agile 2013 Talk: How DevOps Changes EverythingAgile 2013 Talk: How DevOps Changes Everything
Agile 2013 Talk: How DevOps Changes Everything
 
DevOps at the CIA
DevOps at the CIADevOps at the CIA
DevOps at the CIA
 
Sexy HTML with Twitter Bootstrap
Sexy HTML with Twitter BootstrapSexy HTML with Twitter Bootstrap
Sexy HTML with Twitter Bootstrap
 
12 Clouds of Christmas 2012- Stormpath
12 Clouds of Christmas 2012- Stormpath12 Clouds of Christmas 2012- Stormpath
12 Clouds of Christmas 2012- Stormpath
 
We built this city on Dev and Ops
We built this city on Dev and OpsWe built this city on Dev and Ops
We built this city on Dev and Ops
 
30 days or less: New Features to Production
30 days or less: New Features to Production30 days or less: New Features to Production
30 days or less: New Features to Production
 

Último

What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxBkGupta21
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embeddingZilliz
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity PlanDatabarracks
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersNicole Novielli
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demoHarshalMandlekar2
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfLoriGlavin3
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????blackmambaettijean
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsNathaniel Shimoni
 

Último (20)

What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptx
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embedding
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine Tuning
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity Plan
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software Developers
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demo
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdf
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directions
 

KubeSecOps: Securing Kubernetes Clusters and Applications

  • 1. October 17, 2018 KubeSecOps Karthik Gaekwad Principal Engineer Oracle Inc
  • 2. October 17, 2018October 17, 2018 • I’m Karthik Gaekwad • NOT a DBA • https://cloudnative.oracle.com/ • Cloud Native evangelist at Oracle Cloud Infrastructure • Used to be a developer on the OKE Team. Hello! @iteration1
  • 3. October 17, 2018October 17, 2018 •Been in Industry 15 years. •In general, I like building stuff with friends. –A maintainer for Gauntlt- Open source security scanner. •Love Teaching and building community. –Run Devopsdays Austin, Container Days, Cloud Austin. –Chair All Day Devops Cloud Native track. –LinkedIn Learning Author for Learning Kubernetes (and more). Hello!
  • 4. October 17, 2018October 17, 2018 Need an OCI Trial Account? http://bitly.com/ocicloud
  • 5. October 17, 2018October 17, 2018 The Cloud Native Journey Phase I Developer Focus Phase II DevOps Focus Phase III Business Focus (end-to-end) Container Adoption Application Deployment Intelligent Operations SpeedEfficiencyAgility Docker Kubernetes Core to Edge Developer adoption Dev/Test apps Simple orchestration Individual developers DevOps deployment Production apps Advanced orchestration Teams & lines of business End-to-end integration Digital business apps Serverless, DevSecOps, & ML Cloud native enterprises Focus Applications Automation Community
  • 6. October 17, 2018October 17, 2018 Latest CNCF Survey: August 2018 Where Does Your Company Use Containers?
  • 7. October 17, 2018October 17, 2018 Latest CNCF Survey: August 2018 Where Does Your Company Use Containers?
  • 8. October 17, 2018October 17, 2018 Container Management IS Kubernetes Your company/organization manages containers with?
  • 9. October 17, 2018October 17, 2018 Good News, Bad News… Good: On average, CNCF project usage is up over 200% since the Dec 2017! But...
  • 10. October 17, 2018October 17, 2018 Complexity, Culture, Training, & Security Issues Remain
  • 11. October 17, 2018October 17, 2018 • Managing, maintaining, upgrading Kubernetes Control Plane – API Server, etcd, scheduler etc…. • Managing, maintaining, upgrading Kubernetes Data Plane – In place upgrades, deploy parallel cluster etc…. • Figuring out container networking & storage – Overlays, persistent storage etc… - it should just work • Managing Teams – How do I manage & control team access to my clusters? • Security, security, security Kubernetes & Cloud Native Challenges Source: Oracle Customer Survey 2018
  • 12. October 17, 2018October 17, 2018 How Teams Address Issues? App Management Upgrades & Patching Platform Backup & Recovery High Availability Scaling App Deployment Power, HVAC Rack and Stack Server Provisioning Software Installation Customer Managed Fully-Managed App Management Upgrades & Patching Platform Backup & Recovery High Availability Scaling App Deployment Power, HVAC Rack and Stack Server Provisioning Software Installation  Faster Time to Deploy  Lower Risk  Accelerate Innovation Benefits YOU
  • 13. October 17, 2018October 17, 2018 Which brings us to security…
  • 14. October 17, 2018October 17, 2018 Where no news, is good news! Security….
  • 15. October 17, 2018October 17, 2018 Unsecured K8s dashboards • Unsecured Kubernetes Dashboard with account creds. • Used this to mine cryptocurrency. • 2017: Aviva • 2018: Tesla, Weight Watchers • https://redlock.io/blog/cryptojacking-tesla
  • 16. October 17, 2018October 17, 2018 Kubelet credentials hack • Shopify: Server Side request Forgery • Get kubelet certs/private key • Root access to any container in part of infrastructure. • https://hackerone.com/reports/341876
  • 21. October 17, 2018October 17, 2018 WAT?
  • 22. October 17, 2018October 17, 2018 How did we get here?
  • 23. October 17, 2018October 17, 2018 “Kubernetes is too complicated”
  • 24. October 17, 2018October 17, 2018 “We hope it’ll get easier” “Kubernetes is too complicated”
  • 25. October 17, 2018October 17, 2018 What is your strate
  • 26. October 17, 2018October 17, 2018 Attack Surface –More importantly, how to limit damage Security related features in K8s –The more you know, the better you build Opensource Tooling to help –Because we all need help Let’s look at:
  • 27. October 17, 2018October 17, 2018 Attack Surface
  • 28. October 17, 2018October 17, 2018 Goal: Reduce the attack surface Analysis for: –Host –Container (Images and running) –Kubernetes Cluster Attack Surface
  • 29. October 17, 2018October 17, 2018 • These are the machines you’re running Kubernetes on. • Age old principles of Linux still apply: –Enable SELinux –AppArmor –Seccomp –Hardened Images • Goal: Minimize privilege to applications running on the host • Good news: Already a wealth of information on this subject! –http://lmgtfy.com/?q=how+to+reduce+attack+surface+linux Attack Surface: Host
  • 30. October 17, 2018October 17, 2018 GOAL: Know your base image when building containers Attack Surface: Container Images
  • 31. October 17, 2018October 17, 2018 GOAL: Know your base image when building containers Attack Surface: Container Images **BTW, this is just a ruby helloworld app
  • 32. October 17, 2018October 17, 2018 Full disclosure: I’m karthequian; I created this as a ruby 101 container for learning purposes only Attack Surface: Container Images GOAL: Know your base image when building containers
  • 33. October 17, 2018October 17, 2018 GOAL: Know your base image when building containers When in doubt, stick to an official images! Or start from a sane base image (example: alpine linux) Attack Surface: Container Images
  • 34. October 17, 2018October 17, 2018 GOAL: Smaller the image, the better •Less things for an attacker to exploit. •Quicker to push, quicker to pull. Attack Surface: Container Images
  • 35. October 17, 2018October 17, 2018 GOAL: Don’t rely on :latest tag • :latest image yesterday might not be :latest image tomorrow • Instead, you’d want to know what specific version you’re operating with. • Side benefit: If there is a new vulnerability announced for OS version x.y.z, you know immediately whether you’re running that version! Attack Surface: Container Images
  • 36. October 17, 2018October 17, 2018 GOAL: Check for vulnerabilities periodically •Plenty of ways to do this in registries. We’ll cover more in the tooling section Attack Surface: Container Images
  • 37. October 17, 2018October 17, 2018 GOAL: Don’t run as root •Containers running as root might be completely unnecessary for the actual application. •If compromised, attacker can do a lot more things.. •Pod security policies can help (we’ll see how later). Attack Surface: Running Containers
  • 38. October 17, 2018October 17, 2018 GOAL: Limit host mounts •Be wary of images that require broad access to paths on the host •Limit your host mount to a smaller subset of directories •Reduces blast radius on compromise Attack Surface: Running Containers
  • 39. October 17, 2018October 17, 2018 Attack Surface: Kubernetes Cluster
  • 40. October 17, 2018October 17, 2018 Kubernetes Cluster- TLS TLS ALL THE THINGS
  • 41. October 17, 2018October 17, 2018 Kubernetes Cluster- TLS
  • 42. October 17, 2018October 17, 2018 TLS Checklist: 1. User and Master 2. Nodes and Master 3. Everything etcd 4. Kubelet to API Server Kubernetes Cluster- TLS
  • 43. October 17, 2018October 17, 2018 We’re a little better off now. But what else to do?
  • 44. October 17, 2018October 17, 2018 K8s Features How can the platform help me make secure choices?
  • 45. October 17, 2018October 17, 2018 K8s Features Authentication Authorization Audit Logging Network Policies Pod security policies Kubernetes Secrets
  • 46. October 17, 2018October 17, 2018 Do you know how you are authenticating with Kubernetes? Many ways to Authenticate –Client Certs –Static token file –Service Account tokens –OpenID –Webhook Mode –And more (https://kubernetes.io/docs/reference/access-authn- authz/authentication/) Authentication and Authorization
  • 47. October 17, 2018October 17, 2018 Whatever you do, DO NOT YOLO! Goal: Pick a strategy that fits your use case
  • 48. October 17, 2018October 17, 2018You can pick an authz strategy.. If you DO NOT YOLO…
  • 49. October 17, 2018October 17, 2018 Authentication and Authorization https://kubernetes.io/docs/reference/access-authn-authz/authorization/
  • 50. October 17, 2018October 17, 2018 • Pro tip: Nobody uses ABAC anymore. Don’t be that guy…. • RBAC is the defacto standard –Based on roles and role bindings –Good set of defaults: https://github.com/uruddarraju/kubernetes-rbac- policies • Can use multiple authorizers together, but can get confusing. –1st authorizer to authorize passes authz Authentication and Authorization
  • 51. October 17, 2018October 17, 2018 • Wat? • “Kubernetes auditing provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system.” • Answers: What/when/who/where information on security events. • Your job: Periodically watch Kubernetes Audit logs • https://kubernetes.io/docs/tasks/debug-application-cluster/audit/ Kubernetes Cluster- Audit Logs
  • 53. October 17, 2018October 17, 2018 •Consider adding a network policy to the cluster… •Default Policy: All pods can talk to all other pods. •Consider limiting this with a Network Policy • https://kubernetes.io/docs/concepts/services-networking/network-policies/ Kubernetes Cluster- Network Policies
  • 54. October 17, 2018October 17, 2018 •Consider adding Pod Security policies •PodSecurityPolicy: A Defined set of conditions a pod must run with. •Think of this as authorization for pods. Kubernetes Cluster- Pod Security Policies
  • 55. October 17, 2018October 17, 2018 Kubernetes Cluster: Pod Security Policies https://kubernetes.io/docs/concepts/policy/pod- security-policy/#what-is-a-pod-security-policy Capability for an admin to control specific actions
  • 56. October 17, 2018October 17, 2018 •GOAL: Use Kubernetes secrets to store sensitive data instead of config maps. •Also look at: secrets encryption provider. –Controls how etcd encrypts API data –--experimental-encryption-provider-config •https://kubernetes.io/docs/tasks/administer- cluster/encrypt-data/ Kubernetes Secrets
  • 57. October 17, 2018October 17, 2018 ToolingOpensource Tooling
  • 58. October 17, 2018October 17, 2018 Keep tabs on the CNCF Security landscape https://landscape.cncf.io/landscape=security-compliance
  • 59. October 17, 2018October 17, 2018 • “The Update Framework” • Is a framework or a methodology. • Used for secure software updates. • Based on ideas surrounding trust and integrity. • Is a project. • Based on TUF. • A solution to secure software updates and distribution. • Used in Docker Trusted Registry. CNCF Projects
  • 60. October 17, 2018October 17, 2018 •Open source project for the static analysis of vulnerabilities in containers. •Find vulnerable images in your repo. •Built into quay.io, but you can add to your own repo. •https://github.com/coreos/clair Clair
  • 62. October 17, 2018October 17, 2018 • Checks whether a Kubernetes cluster is deployed according to security best practices. • Run this after creating your K8s cluster. • https://github.com/aquasecurity/kube-bench • Defined by the CIS Benchmarks Docs: https://www.cisecurity.org/cis-benchmarks/ • Run it against your Kubernetes Master, or Kubernetes node. Kube-bench
  • 63. October 17, 2018October 17, 2018 Kube-bench example
  • 64. October 17, 2018October 17, 2018 •Helps you quantify risk for Kubernetes resources. •Run against your K8s applications (deployments/pods/daemonsets etc) •https://kubesec.io/ from controlplane •Can be used standalone, or as a kubectl plugin (https://github.com/stefanprodan/kubectl-kubesec) Kubesec
  • 65. October 17, 2018October 17, 2018 Kubesec example
  • 66. October 17, 2018October 17, 2018 •Opensourced from Shopify. •Auditing your applications in your K8s cluster. •https://github.com/Shopify/kubeaudit •Little more targeted than Kubesec. Kubeaudit
  • 68. October 17, 2018October 17, 2018 Kubeaudit example
  • 69. October 17, 2018October 17, 2018 “So much time and so little to do.”
  • 70. October 17, 2018October 17, 2018 •11 ways not to get hacked: https://kubernetes.io/blog/2018/07/18/11-ways-not-to- get-hacked •K8s security (from Image Hygiene to Network Policy): https://speakerdeck.com/mhausenblas/kubernetes- security-from-image-hygiene-to-network-policies Couple more resources to look at:
  • 71. October 17, 2018October 17, 2018 KEEP CALM AND KUBE ON @iteration1
  • 73. October 17, 2018 Thank You Supporters
  • 74. October 17, 2018 Meet me in the Slack channel for Q&A bit.ly/addo-slack