Kubernetes Security and Observability

Description

Preface The Stages of Kubernetes Adoption Who This Book Is For The Platform Team The Networking Team The Security Team The Compliance Team The Operations Team What You Will Learn Conventions Used in This Book Using Code Examples O’Reilly Online Learning How to Contact Us Acknowledgments 1. Security and Observability Strategy Security for Kubernetes: A New and Different World Deploying a Workload in Kubernetes: Security at Each Stage Build-Time Security: Shift Left Deploy-Time Security Runtime Security Observability Security Frameworks Security and Observability Conclusion 2. Infrastructure Security Host Hardening Choice of Operating System Nonessential Processes Host-Based Firewalling Always Research the Latest Best Practices Cluster Hardening Secure the Kubernetes Datastore Secure the Kubernetes API Server Encrypt Kubernetes Secrets at Rest Rotate Credentials Frequently Authentication and RBAC Restricting Cloud Metadata API Access Enable Auditing Restrict Access to Alpha or Beta Features Upgrade Kubernetes Frequently Use a Managed Kubernetes Service CIS Benchmarks Network Security Conclusion 3. Workload Deployment Controls Image Building and Scanning Choice of a base image Container Image Hardening Container Image Scanning Solution Privacy Concerns Container Threat Analysis CI/CD Scan Images by Registry Scanning Services Scan Images After Builds Inline Image Scanning Kubernetes Admission Controller Securing the CI/CD pipeline Organization Policy Secrets Management etcd to Store Secrets Secrets Management Service Kubernetes Secrets Store CSI Driver Secrets Management Best Practices Authentication X509 Client Certificates Bearer Token OIDC Tokens Authentication Proxy Anonymous Requests User impersonation Authorization Node ABAC AlwaysDeny/AlwaysAllow RBAC Namespaced RBAC Privilege escalation mitigation Conclusion 4. Workload runtime security Pod Security Policies (PSPs) Using Pod Security Policies Pod Security Policy Capabilities Pod Security Context Limitations of PSPs Process Monitoring Kubernetes Native Monitoring Seccomp SELinux AppArmor Sysctl Conclusion 5. Observability Monitoring Observability How Observability Works for Kubernetes Implementing Observability for Kubernetes Linux Kernel Tools Observability Components Aggregation and Correlation Visualization Service Graph Visualization of Network Flows Analytics and Troubleshooting Distributed Tracing Packet Capture Conclusion 6. Observability and Security Alerting Machine Learning Security Operations Center User and Entity Behavior Analytics Conclusion 7. Network Policy What Is Network Policy? Why Is Network Policy Important? Network Policy Implementations Network Policy Best Practices Ingress and egress Not Just Mission-Critical Workloads Policy and Label Schemas Default Deny and Default App Policy Policy Tooling Development Processes and Microservices Benefits Policy Recommendations Policy Impact Previews Policy Staging and Audit Modes Conclusion 8. Managing Trust Across Teams Role-Based Access Control Limitations with Kubernetes Network Policies Richer Network Policy Implementations Admissions Controllers Conclusion 9. Exposing Services to External Clients Understanding Direct Pod Connections Understanding Kubernetes Services Cluster IP Services Node Port Services Load Balancer Services externalTrafficPolicy:local Network Policy Extensions Alternatives to kube-proxy Direct Server Return Limiting Service External IPs Advertising Service IPs Understanding Kubernetes Ingress Conclusion 10. Encryption of Data in Transit Building Encryption into Your Ccode Sidecar or Service Mesh Encryption Network-Layer Encryption Conclusion 11. Threat Defense and Intrusion Detection Threat Defense for Kubernetes (Stages of an Attack) Intrusion Detection Intrusion Detection Systems IP Address and Domain Name Threat feeds Special Considerations for Domain Name Feeds Advanced Threat Defense techniques Canary Pods/Resources DNS-Based Attacks and Defense Conclusion Conclusion