Category: Security
-
DISCLAIMER: The contents in this article must NOT be considered as official CKS training material by any means and is provided solely for reference. CKS candidates are strongly encouraged to consult official CNCF training content such as LFS260: Kubernetes Security Essentials and study independently for the exam. Encrypting data at rest and in transit…
-
+
+
+
+
+
+
I purchased the LFS260: Kubernetes Security Essentials course about a month ago and was working through the course material recently in preparation for the Certified Kubernetes Security Specialist (CKS) exam. The course included plenty of hands-on lab exercises covering each topic in detail which I followed through by creating a 2-node kubeadm cluster on…
-
Inspired by How eBPF will solve Service Mesh – Goodbye Sidecars | Isovalent Blog Service meshes are an infrastructure layer designed for the microservices era and typically provide the following features on top of microservices-oriented platforms such as Kubernetes: (source: “How eBPF will solve Service Mesh – Goodbye Sidecars | Isovalent Blog”)…
-
Recall that each Kubernetes request goes through 3 stages as it is evaluated by the API server: See also: Controlling Access to the Kubernetes API | Kubernetes While many built-in admission controllers are enabled by default on Kubernetes, it was already possible since the early days of Kubernetes to extend admission control by…
-
Keycloak is an open source identity provider (IdP) with single-sign on (SSO) capabilities. It supports the most widely used enterprise authentication protocols, namely OpenID Connect (OIDC), OAuth 2.0, and SAML. With Keycloak, users sign in once and share the same identity across multiple applications and platforms in a transparent manner. On the other hand, applications defer authentication to…
-
In the past few articles, we saw how to construct a complete DevOps pipeline with GitHub Actions and integrate security-oriented tools such as Grype, Sigstore Cosign and policy-controller into our pipeline to implement an end-to-end DevSecOps workflow providing a comprehensive level of protection for our applications: However, no matter how…
-
+
+
+
+
+
+
Consider your typical CI/CD pipeline as shown below. What are some of the issues associated with the DevOps workflow below, if any? The main issue is that security measures are not integrated into the pipeline as a first-class citizen. Let’s assume the best case where the Kubernetes cluster hosting the…
-
Consider the following component in my personal website responsible for serving static web assets from an OSS bucket to users. subPath may contain zero or more path components. The bucket donaldsebleung-assets is mounted under /mnt/donaldsebleung-assets/ in the container filesystem within the function assets, which appends the request path subPath to the mount point in order to fetch the…
Donald Sebastian Leung 