Kubernetes Tower Defense_Javier Provecho_Codemotion

In this live coding session, we'll create a secure cluster to deploy our apps safely. As in the popular game Tower Defense, we'll build lines of defense based on Pod Security Policies, Network Policies, and Webhooks to achieve the highest level of Defense In Depth approach.

About:
Javier Provecho Fernandez, Platform Engineer - Telefonica

Javier Provecho works at Telefónica, at the core of the 4th Platform, and engage with the community as a Google Developer Expert (Cloud GDE) and open source maintainer. He is passionate about new technologies and methodologies around the CNCF.

Transcript

1. Kubernetes Tower Defense Javier Provecho 12-13 November, 2019
2. $ ./kubernetes-tower-defense @javierprovecho
3. $ whoami # @javierprovecho - Google Developer Expert (Cloud) - Platform Engineer in Telefónica - Meetup organizer - - Docker (Madrid) - Cloud Native (Madrid) - Cylicon Valley (Valladolid)
4. $ open tower-defense.png
5. $ man defense_in_depth
6. $ man defense_in_depth
7. Platform Engineering Big Data
8. $ cat ./checklist - External traffic - oAuth2 / OIDC - JWT / JWK - Internal traffic - Firewalled - Encrypted - Authorized
9. $ rm single_line_of_defense
10. $ internal-traffic - - Your business software - - API gateways - Backend Auth / Admin APIs - Other tools - - Monitoring
11. $ find . -name features - - Pod Security Policies (1.4 BETA) - Network Policies (1.7 GA, 1.8 improved) - Role Based Access Control (1.8 GA)
12. $ find . -name patches - - CVE-2017-1002101 subPath, fixed at 1.7 - CVE-2018-1002105 proxy upgrade, fixed at 1.10 - CVE-2019-11247 cluster scoped resources, fixed at 1.13
14. $ find . -name patches | grep cloud - - GKE - - Service account scopes
15. $ find . -name patches | grep cloud - - GKE - - Service account scopes - - Metadata API still requires manual toggling of “--metadata disable-legacy-endpoints=true”
16. $ find . -name patches | grep cloud - - GKE - - Service account scopes - - Metadata API still requires manual toggling of “--metadata disable-legacy-endpoints=true” - - Kubelet Read Only port Restrict with Network Policy
17. $ find . -name patches | grep cloud - - EKS - - Metadata API use Kube2IAM or restrict using Network Policy
18. $ find . -name patches | grep cloud - - EKS - - Metadata API use Kube2IAM or restrict using Network Policy - - Kubelet Read Only port
19. $ man kubelet-readonly-port - - Deprecated - - List all PodSpecs running on the Node - - Sensitive leak: environment variables - - env -> name/value - env -> name/valueFrom - envFrom
20. $ man metadata-api - - Used for Node bootstrapping - - Can be reused for new CSRs, therefore impersonating any Node - - List and retrieve all secrets for the corresponding Node - - List and retrieve all PodSpecs of the Cluster
22. $ ./eks-cluster-takedown
23. $ thanks