The book is expected to be published by fall 2018. Here are the links:
- Building container images
- Running containers
- Authentication and authorization
- Communication
- Apps
- Securing the control plane
- References
Building container images
Tooling:
- docs.docker.com/docker-clou…
- github.com/coreos/clai…
- www.open-scap.org/tools/
- www.aquasec.com/use-cases/c…
- neuvector.com/container-c…
- github.com/theupdatefr…
- github.com/in-toto
Further reading:
- Establishing Image Provenance and Security in Kubernetes
- Image Management & Mutability in Docker and Kubernetes
- Container security considerations in a Kubernetes deployment
- Building Container Images Securely on Kubernetes
- The OpenShift Build Process
- Introducing Grafeas: An open-source API to audit and govern your software supply chain
Running containers
Tooling:
- github.com/aquasecurit…
- github.com/docker/dock…
- sysdig.com/opensource/…
- kubesec.io/
- www.twistlock.com/
- github.com/genuinetool…
Further reading:
- Just say no to root (in containers)
- Exploring Container Mechanisms Through the Story of a Syscall (slides | video)
- Improving your Kubernetes Workload Security Container Isolation at Scale (Introducing gVisor) (slides | video)
Authentication and authorization
Tooling:
Further reading:
- Docs: Authentication, Authorization, Controlling Access to the Kubernetes API
- Kubernetes deep dive: API Server – part 1
- Certifik8s: All You Need to Know About Certificates in Kubernetes
- Kubernetes Auth and Access Control
- Effective RBAC
- Single Sign-On for Kubernetes: An Introduction
- Let's Encrypt, OAuth 2, and Kubernetes Ingress
Communication
Tooling:
Further reading:
- Docs: Network policies
- How Kubernetes certificate authorities work
- Securing Kubernetes Cluster Networking
- Tutorials and Recipes for Kubernetes Network Policies feature
- Kubernetes Security Context and Kubernetes Network Policy
- Kubernetes Application Operator Basics
Apps
Tooling:
- github.com/kelseyhight…
- github.com/hashicorp/v…
- github.com/bitnami-lab…
- github.com/shyiko/kube…
- github.com/weaveworks/…
Further reading:
- Docs: Secrets, Configure a Security Context for a Pod or Container, Pod Security Policies
- Shipping in Pirate-Infested Waters: Practical Attack and Defense in Kubernetes
- Exploring container security: Isolation at different layers of the Kubernetes stack
- Security Best Practices for Kubernetes Deployment
- NIST Special Publication 800-190: Application Container Security Guide
- Kubernetes Security Best Practices
- Continuous Kubernetes Security
Securing the control plane
Tooling:
Further reading:
- Docs: Securing a Cluster, Encrypting Secret Data at Rest, Auditing
- Securing Kubernetes components: kubelet, etcd and Docker registry
- K8s security best practices
- Kubernetes Security - Best Practice Guide
- Lessons from the Cryptojacking Attack at Tesla
- Hacking and Hardening Kubernetes Clusters by Example
- What Does “Production Ready” Really Mean for a Kubernetes Cluster
- A Hacker's Guide to Kubernetes and the Cloud
- Kubernetes Container Clustering, Catastrophe
- Hardening Kubernetes from Scratch
References
Kubernetes (v1.10) docs references relevant to security:
- Namespace
- Secret
- ResourceQuota
- ServiceAccount
- Role / ClusterRole
- RoleBinding / ClusterRoleBinding
- PodSecurityPolicy
- NetworkPolicy
Useful kubectl commands:
kubectl create secretkubectl create serviceaccountkubectl create rolekubectl create rolebindingkubectl auth can-i
