Everyone can contribute! Learn DevOps and Cloud Native in our cafe ☕

Highlights

We are learning how to deploy and secure Kubernetes into Hetzner cloud in this series:

• 14. cafe: Provisioned the server and agent VMs with Terraform and Ansible in the first session with Max.
• 15. cafe: Deployed k3s as Kubernetes distribution with Max.
• 16. cafe: Learned about pods and the Hetzner load balancer with Max.
• 17. cafe: Ingress controller for load balancer cost savings with Max.
• 18. cafe: Get to know Kubernetes user authentication and authorization with RBAC with Niclas Mietz.
• 19. cafe: Break into Kubernetes Security with Philip Welz.

In this session, we change the perspective again and secure a Kubernetes cluster with Philip Welz.

• Overview of Cloud Native Security - The 4C’s of Cloud Native security
• Explore and secure the Kubernetes API
• Secure ETCD with encryption at REST
• Debug API server not starting problem
  • crictl with containerd
  • YAML Linter
  • Show whitespaces in vim
• Kyverno
  • Intercepts API requests prior persisting to ETCD as an admission controller with Webhooks:
    • MutatingAdmissionWebhook & ValidatingAdmissionWebhook
  • Extends the API with Custom Resource Definitions
  • General Policy structure
  • Policies can be enforced or audited and will be recorded in reports
  • Policy Reporter

Next week, we’ll explore more Kubernetes topics:

• OpenID Connection of the API Server with Dex and GitLab and multi-tenancy with kiosk
• Hetzner storage volumes
• Monitoring with Prometheus, GitLab CI/CD deployments and much more :)

Insights

• Kubernetes group repos
• Repository with all commands from the session
• Twitter thread
• Kyverno policy examples - best practices
• Test-drive Kyverno with BadPods
• Exploring Kyverno - 3 Part Series 

Recording

Enjoy the session! 🦊

---

Date published: March 10, 2021