hands-on lab

Securing Kubernetes Clusters

Difficulty: Advanced

Duration: Up to 2 hours

Students: 1,566

Rating: 4.7/5

Start lab

On average, students complete this lab in1h 10m

Get guided in a real environmentPractice with a step-by-step scenario in a real, provisioned environment.

Learn and validateUse validations to check your solutions every step of the way.

See resultsTrack your knowledge and monitor your progress.

About

Author

Description

Warning:

This lab has been outdated and split into a set of smaller labs covering the topics in an easier-to-consume format.

Lab Overview

There are many facets to security in Kubernetes. One small oversight can leave your cluster vulnerable to leaking sensitive data, running foreign workloads, and a host of other attacks. This Lab shows you how to practice defense in depth in Kubernetes by covering the main security concepts including authentication, authorization, network policies, security contexts, and secrets. Examples of potential exploits from improperly configured clusters are also illustrated followed by guidance on how to prevent the attacks.

This Lab is valuable to anyone working with Kubernetes, but the content has been prepared considering topics described in the Certified Kubernetes Administrator (CKA) Exam Curriculum. Completion of the Lab will help you get hands-on experience, which is essential for passing the CKA exam.

Lab Objectives

Upon completion of this Lab you will be able to:

Understand Kubernetes' authentication model
Create users and groups in Kubernetes and use role-based access control for authorization
Configure network policies to control pod communication
Use pod and container security contexts to harden your environments
Securely store sensitive information using Kubernetes secrets

Lab Prerequisites

You should be familiar with:

Working with Kubernetes to deploy applications
Working at the command line in Linux
Public Key Infrastructure (PKI), particularly using OpenSSL to generate keys and certificates

The following Labs can be used to fulfill the prerequisites: Deploy a Stateless Application in a Kubernetes Cluster, Deploy a Stateful Application in a Kubernetes Cluster, and Best Practices for Deploying SSL/TLS.