Securing Containerized Workloads - AWS Community Days

This deck shows Insights on strengthening Kubernetes workloads using Kyverno policies and container image scanning to build resilient and compliant systems. This was created keeping in mind for AWS community day audience.

Transcript

1. AWS USER GROUP PUNE “For the community, By the community!” Annual Edition PUNE 23rd August 2025
2. Annual Edition PUNE 23rd August 2025 Securing Containerized Workloads by Subhash Gehlot Kubernetes & DevSecOps practitioner focused on container security, Kyverno policies, and zero-trust practices.
3. Annual Edition PUNE 23rd August 2025 MISCONFIGURATIONS AND VULNERABLE IMAGES ARE COMMON ATTACK VECTORS CONTAINERS ARE FAST, LIGHTWEIGHT—BUT RISKY IF NOT CONTROLLED POLICIES + SCANNING TOOLS CAN HELP ENFORCE SECURITY STANDARDS Why Container Security Matters
4. Annual Edition PUNE 23rd August 2025 Image Vulnerability Severity Levels Severity Color CVSS Range Description CRITICAL Red 9.0 – 10.0 Easily exploitable can cause full system compromise. Patch-immediately HIGH Red 7.0 – 8.9 Major risk attackers could exploit or cause denial of service. must-fix MEDIUM Yellow 4.0 – 6.9 Moderate risk may need specific conditions to exploit. Good to fix, but less urgent LOW Green 0.1 – 3.9 Low impact or hard to exploit. Fix as time permits. UNKNOWN Gray N/A Severity not yet classified. Needs self investigation.
5. Annual Edition PUNE 23rd August 2025 How Do Images Become Vulnerable? Container images often inherit from a base OS (e.g., alpine, debian, ubuntu) which includes: System packages (glibc, openssl, libxml, etc.) App dependencies (e.g., npm, pip, maven, etc.) If these components are outdated or not patched, the image becomes vulnerable.
6. Annual Edition PUNE 23rd August 2025 Scans container images, filesystems, Git repos Detects: vulnerabilities, misconfigs, secrets Easy CLI: trivy image nginx:1.21 Trivy (Aqua Security) Integrated into Docker Desktop Real-time scanning of local/remote images Shows severity breakdowns, suggestions Docker Scout Grype – Deep SBOM + CVE scanning (CLI) Snyk – DevSecOps scanning + cloud dashboard Clair – Registry-integrated scanning Harbor – Scanning built into image registry Other Tools Tools for Image Vulnerability Scanning
7. Annual Edition PUNE 23rd August 2025 Docker Scout • docker scout quickview nginx:1.21 • docker scout cves nginx:1.21 • Trivy also has admission controller level webhook
8. Annual Edition PUNE 23rd August 2025 Kyverno – Kubernetes Policy Engine Use Cases: • Disallow privileged containers • Enforce read-only filesystems • Require securityContext settings • Block dangerous capabilities Kyverno is a Kubernetes-native policy engine designed to validate, mutate, and generate Kubernetes resources using simple, declarative YAML policies — no need to learn a new language Types of validation: • Validating admission controller • Applies rules on K8s manifests (YAML) • Background scan
9. Annual Edition PUNE 23rd August 2025 Where Can We Enforce Security? Security Level Tool/Concept Description Developer Workstation Trivy, Docker Scout Local image scan before push CI/CD Pipeline Trivy + Policy Checks Block insecure images before deploy Kubernetes Admission Kyverno (validate) Enforce rules before object creation Runtime Kyverno (mutate/verify) Runtime enforcement, background scanning Tip: Use multiple layers to create defense in depth.
10. Annual Edition PUNE 23rd August 2025
11. Annual Edition PUNE 23rd August 2025 Questions? Happy to discuss. Let’s connect & continue the conversation! https://www.linkedin.com/in/subhashgehlot/ A decade full of Strong expertise in Kubernetes Platform development, DevSecOps practices and zero trust security. Having worked as full-stack developer, database architect handling on call operations