This is the code repository for Learn Kubernetes Security, published by Packt.
Securely orchestrate, scale, and manage your microservices in Kubernetes deployments
Kubernetes is an open source orchestration platform for managing containerized applications. Despite widespread adoption of the technology, DevOps engineers might be unaware of the pitfalls of containerized environments. With this comprehensive book, you'll learn how to use the different security integrations available on the Kubernetes platform to safeguard your deployments in a variety of scenarios. Learn Kubernetes Security starts by taking you through the Kubernetes architecture and the networking model. You'll then learn about the Kubernetes threat model and get to grips with securing clusters. Throughout the book, you'll cover various security aspects such as authentication, authorization, image scanning, and resource monitoring. As you advance, you'll learn about securing cluster components (the kube-apiserver, CoreDNS, and kubelet) and pods (hardening image, security context, and PodSecurityPolicy). With the help of hands-on examples, you'll also learn how to use open source tools such as Anchore, Prometheus, OPA, and Falco to protect your deployments.
This book covers the following exciting features:
- Understand the basics of Kubernetes architecture and networking
- Gain insights into different security integrations provided by the Kubernetes platform
- Delve into Kubernetes' threat modeling and security domains
- Explore different security configurations from a variety of practical examples
- Get to grips with using and deploying open source tools to protect your deployments
If you feel this book is for you, get your copy today!
All of the code is organized into folders. For example, Chapter02.
The code will look like the following:
if (test expression)
{
Statement upon condition is true
}
Following is what you need for this book: This book is for security consultants, cloud administrators, system administrators, and DevOps engineers interested in securing their container deployments. If you're looking to secure your Kubernetes clusters and cloud-based deployments, you'll find this book useful. A basic understanding of cloud computing and containerization is necessary to make the most of this book.
With the following software and hardware list you can run all code files present in the book (Chapter 1-13).
| Chapter | Software required | OS required |
|---|---|---|
| 1-13 | Kubernetes 1.14.3 | Linux or macOS |
| 1-13 | Anchore 0.6.1 | Linux or macOS |
| 1-13 | Prometheus 2.17.0 | Linux or macOS |
| 1-13 | Sysdig Inspect 0.5.0 | Linux or macOS |
| 1-13 | Kube-hunter 0.3.1 | Linux or macOS |
| 1-13 | Minikube v1.10.1 | Linux or macOS |
| 1-13 | Falco 0.20.0 | Linux or macOS |
| 1-13 | Grafana 7.0.1 | Linux or macOS |
| 1-13 | Kube-bench 0.3.0 | Linux or macOS |
| 1-13 | Kube-psp-advisor 1.8.0 | Linux or macOS |
We also provide a PDF file that has color images of the screenshots/diagrams used in this book. Click here to download it.
Click on the following link to see the Code in Action:
Kaizhe Huang is a security researcher at Sysdig, where he researches how to defend Kubernetes and containers from attacks ranging from web attacks to kernel attacks. Kaizhe is one of the maintainers of Falco, an incubation-level CNCF project, and the original author of multiple open source projects, such as kube-psp-advisor. Before joining Sysdig, as an employee at Stackrox, Kaizhe helped build a detection data pipeline, conducted security research, and innovated detection based on machine learning. Previously, as a senior security engineer at Oracle, he helped build security products: Database Vault, Database Privilege Analyzer, and Database Assessment Tool. Kaizhe holds an MS degree in information security from Carnegie Mellon University.
Pranjal Jumde is a senior security engineer at Brave Inc. In the security industry, he has worked on different aspects of security, such as browser security, OS/kernel security, DevSecOps, web application security, reverse engineering malware, security automation, and the development of security/privacy features. Before joining Brave, as an employee at Stackrox, Pranjal helped in the development of detection and enforcement features for the runtime detection platform. He has also worked at Apple and Adobe, where he worked on the development of features to harden various platforms. Pranjal holds an MS degree in information security from Carnegie Mellon University. He has also presented his research at different conferences, such as ACM CCS and BSides SF/Delhi.
Click here if you have any feedback or suggestions.
If you have already purchased a print or Kindle version of this book, you can get a DRM-free PDF version at no cost.
Simply click on the link to claim your free PDF.