Kubernetes Security reading list

Beginner

Minimize Microservices Vulnerabilities

• Pod Security Standards (PSP)
• pod spec
• Kubernetes-API PodSpec
• Pod Security Admission (PSA)

Admission controllers

• ImagePolicyWebhook

Secrets

• Distribute Credentials Securely Using Secrets

Cilium

• Layer 3 Examples
• Transparent Encryption

Istio

• PeerAuthentication

System Hardening

• Restrict a Container’s Access to Resources with AppArmor
• Container Runtimes
• Runtime Class

Supply Chain Security

• kube-bench
• kube-bench installation
• checkov

[!NOTE] Checkov is a static code analysis tool for infrastructure as code (IaC) and also a software composition analysis (SCA) tool for images and open source packages.

• Docker group security

Monitoring, Logging and Runtime Security

• falco
• falco basic rules
• sysdig
• K8s Audit

Footnotes

SELinux

• What is SELinux (Security-Enhanced Linux)
• Check if SELinux is Enabled

Install containerd and k8s 1.32 on ubuntu 24.04

1. Create t3.small ec2 instance based on ubuntu, because we need atleast 2GB RAM for k8s.

https://github.com/zealvora/certified-kubernetes-security-specialist/blob/main/domain-1-cluster-setup/kubeadm-install.md

2. Install containerd

sudo apt-get update
sudo apt-get install containerd

3. Check

# check
ctr

# check runc
runc

4. Install kubeadm

sudo apt-get update

# apt-transport-https may be a dummy package; if so, you can skip that package
sudo apt-get install -y apt-transport-https ca-certificates curl gpg

# If the directory `/etc/apt/keyrings` does not exist, it should be created before the curl command, read the note below.
# sudo mkdir -p -m 755 /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.32/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

# This overwrites any existing configuration in /etc/apt/sources.list.d/kubernetes.list
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.32/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list

sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl


sudo systemctl enable --now kubelet