Securing Managed Kubernetes Clusters

The talk opens with a primer on how Kubernetes is assembled: pods, deployments, services and namespaces, plus control plane parts such as the API server, the etcd data store, the scheduler and the kubelet on each node. It then argues that teams new to the platform should use a managed service rather than build clusters themselves, because the provider takes on much of the control plane's availability and security work.

The threat model centers on three entry points: the API server, the data store and the workloads. The main scenario is an attacker who has compromised an application running in a container. The walkthrough shows how that foothold can reach the instance metadata endpoint, an internal dashboard over cluster networking, and default service account tokens, then escape through a privileged container with host namespaces to the node and its kubelet credentials.

Mitigations include network policies for segmentation, though they only take effect if the network plugin supports them, blocking metadata access, scoping cloud permissions to individual workloads, disabling automatic token mounting, restricting API server exposure, keeping components patched, and enforcing pod security settings. The talk closes with open-source and cloud-native tools for image scanning, runtime monitoring and cluster auditing, along with learning resources.