RodrigTech

Tag: kubernetes

  • Container Scanning in Kubernetes

    —

    by

    rodrigtech
    in

    While the escapades of Certified Kubernetes Security specialist renewal are continued and ongoing I’ve felt it was best to craft another scenario to leverage for the container security portion of the exam. Particularly you’re required to remediate many items in your cluster and ideally these items should be caught in your CI/CD pipeline before deployment.…

  • Hacking Kubernetes via ServiceAccountTokens

    —

    by

    rodrigtech
    in

    Kubernetes has a large amount of advancements and inherent good security principles but these are dependent on configurations that are typically not well-known to end users. Predominantly the constructs of Service Accounts or (Non-human Identities) for the masses are populated in many services as they act as the go-between for service to authenticate and operate…

  • Image Policy Webhook

    —

    by

    rodrigtech
    in

    Image Policy Webhook is a native Kubernetes admission plugin that enforces security policies by validating container images before they are deployed. This ensures that only trusted and compliant images run in your environment. This will take the image that is attempted to be applied compare against predefined policies, and if those policies allow the image…

  • Bill of Materials CKS Refresher

    —

    by

    rodrigtech
    in

    A Software Bill of Materials (SBOM) is like the ingredients list on your food package—it reveals what components, libraries, and dependencies go into building the final software. Just as checking food labels helps you understand nutritional content and potential allergens, an SBOM provides transparency into third-party components, helping identify vulnerabilities early in the software supply…

  • Simulating Kubernetes Attacks with Detection of Falco + Tetragon

    —

    by

    rodrigtech
    in

    Microsoft recently released an open-source repository designed to simulate attacks on Kubernetes clusters, showcasing the detection capabilities of Defender for Cloud sensors. However, this tool can also be extended to work with other Intrusion Detection Systems (IDS) for monitoring Kubernetes environments. As with any detection solution, it is crucial to rigorously test various attack scenarios…

  • ABAC In Kubernetes

    —

    by

    rodrigtech
    in

    Attribute-based access control (ABAC) is a powerful feature in Kubernetes that allows administrators to define fine-grained permissions for users and groups. Unlike traditional role-based access control (RBAC), ABAC enables a more granular approach to specify what actions can and cannot be performed. However, implementing ABAC can become complex as modifications increase over time. This blog…

  • Mutability of FIPS on AKS

    —

    by

    rodrigtech
    in

    Introduction Your in compliance and tasked with identifying which microservice supported supports Federal Information Processing standards. Operations are dynamic and can change from supporting a business unit that might have this requirement, so what are you options if you have to revert and keep the cluster? Currently in Azure Kubernetes Service this has been capable…

  • Defender for Containers (CWPP)

    —

    by

    rodrigtech
    in

    If you’re managing production-grade workloads on a major cloud platform, it’s essential to assess your security framework, particularly as you shift towards microservices and orchestration. A key yet often overlooked solution in this space is Microsoft Defender for Containers. Part of the broader Microsoft Defender for Cloud, this tool provides critical visibility and protection for…

  • SpinKube WASM in Kubernetes

    —

    by

    rodrigtech
    in

    SpinKube is a new open-source project that is tailored to deploying WASM (WebAssembly) workloads on Kubernetes. SpinKube enhances the ability of scalability of WASM applications this tool allows integration with kubernetes primitives and use of conversion of application using the spin-plugin to make it effective conversion of YAML to interpret by the cluster and serve…

  • API Server VNET Integration

    —

    by

    rodrigtech
    in

    Connectivity in AKS If you’re running AKS in production you’ll likely encounter the private link scope and integration of leverage private DNS zones for putting the API server behind private IP’s rather than accessible on port 6443 or you should be doing this. But what about other options? Perhaps you’re spinning up a dev/test cluster…