One interesting challenge with Kubernetes is deploying workloads across several regions.

While you can technically have a cluster with several nodes located in different regions, this is generally regarded as something you should avoid due to the extra latency.

Another popular alternative is to deploy a cluster for each region and find a way to orchestrate them.

In this webinar, Daniele will demo live how to create, connect and operate three Kubernetes clusters in different regions.

You can register here (it's free): https://kube.events/t/a35a3a6f-2d32-458b-aca4-61bb9d8bb1ce

In this tutorial, you'll learn how to use Kyverno to automatically configure annotations that enable access logs for an AWS Network Load Balancer (NLB) to be forwarded to an S3 bucket for a service of type LoadBalancer.

More: https://silvr.medium.com/using-kyverno-to-enforce-aws-load-balancer-annotations-for-centralized-logging-to-s3-af5dc1f1f3e0

k8s-manifest-sigstore is a kubectl plugin that enables developers to sign and verify Kubernetes YAML files.

Also, the integrity of deployed manifests can be confirmed on a Kubernetes cluster.

More: https://github.com/sigstore/k8s-manifest-sigstore

In this tutorial, you will learn how to evaluate wasm-compiled rego policies for the Open Policy Agent with Rust and the burrego crate.

More: https://inspektor.cloud/blog/evaluating-open-policy-agent-in-rust-using-wasm

🗓 Kubernetes events starting in the next 24 hours:

03 Oct 8:00 am GMT - 🔥 GOTO Copenhagen | Trifork - 📍 In-person conference

03 Oct 10:00 am GMT - KubeHuddle | KubeHuddle - 📍 In-person conference

→ See all Kubernetes events

Since Kubescape's launch in August 2021, it has scanned more than 10,000 Kubernetes clusters.

In this report, you will find the aggregated data and analysis to highlight the essential stats on the state of Kubernetes security, risk, and compliance.

More: https://armosec.io/blog/what-we-learned-from-scanning-over-10k-kubernetes-clusters

This tutorial will walk through how Kubernetes Certificate Signing Requests can be utilized to distribute certificates that associate a user with a unique identity that can then be assigned access to a Kubernetes cluster with RBAC.

More: https://lisowski0925.medium.com/using-kubernetes-csrs-and-rbac-for-cluster-user-authentication-and-authorization-9df5498655cd

Kubernetes security scanners are tools that can be used to detect vulnerabilities and security issues in your applications. In this article you will find:

1. Grype.
2. Trivy.
3. Kubesec.
4. Kube-bench.
5. Kubeaudit.

More: https://blog.cloudsecque.com/how-to-improve-the-security-of-your-applications-with-kubernetes-security-scanners-cda97fd2f574

vals-operator syncs secrets from any secrets store supported by vals into Kubernetes.

It works similarly to secrets-manager, but it supports more secret stores other than HashiCorp Vault.

More: https://github.com/digitalis-io/vals-operator

During penetration tests and red team engagements, eBPF-based security tools can make detect and block most attacks.

In this article, you'll learn some of the limitations and bypass techniques.

More: https://form3.tech/engineering/content/bypassing-ebpf-tools

In this article, you will learn how to attack and defend a Kubernetes cluster by solving the challenges of Kubernetes goat — an intentionally vulnerable cluster environment to learn and practice Kubernetes security.

More: https://medium.com/@codingkarma/kubernetes-goat-part-1-8718b1345a42

This report outlines a security engagement of the CRI-O project.

The assessment includes four high-level tasks:

1. Threat model formalisation of CRI-O.
2. Fuzzing integration of CRI-O into OSS-Fuzz.
3. Manual code auditing.
4. Documentation/testing review

More: https://github.com/cri-o/cri-o/blob/main/security/2022_security_audit_adalogics.pdf

There is no standardized method for providing IAM group access to an EKS cluster or namespace.

In this article, you will learn how you can use an IAM role to authenticate the user group automatically and transparently when kubectl is being used.

More: https://eng.grip.security/enabling-aws-iam-group-access-to-an-eks-cluster-using-rbac

This repository contains a set of over 1200 AppArmor profiles that can be used to confine most Linux base applications and processes.

More: https://github.com/roddhjav/apparmor.d

The Security Profiles Operator (SPO) is an out-of-tree Kubernetes enhancement which aims to make it easier for users to use SELinux, seccomp and AppArmor in Kubernetes clusters.

More: https://github.com/kubernetes-sigs/security-profiles-operator

In this three part series, you will deep dive into Seccomp for Kubernetes workloads:

1. 7 things you should know before you even start.
2. crafting custom seccomp profiles for your applications.
3. The new syntax plus some advanced topics.

More: https://itnext.io/seccomp-in-kubernetes-part-i-7-things-you-should-know-before-you-even-start-97502ad6b6d6

KICS stands for Keeping Infrastructure as Code Secure, and it is a tool designed to find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code.

More: https://github.com/Checkmarx/kics

OWASP Kubernetes Top Ten is aimed at helping security practitioners, system administrators, and developers prioritize risks around the Kubernetes ecosystem.

This is a prioritized list of these risks backed by data.

More: https://owasp.org/www-project-kubernetes-top-ten

Master Kubernetes this November with one of our Advanced Kubernetes workshops (London or online)!

What should you expect?

- Learn how to architect and design clusters from the ground up (in the cloud or on-prem).
- Explore the Kubernetes internal component and how the system is designed with resiliency in mind.
- **Deep-dive into the networking components and observe the packets flowing into the cluster.
- Hands-on labs to test the theory with real-world scenarios!

You can sign up here: https://learnk8s.io/online-advanced-november-2022

Enabling a Kubernetes multi-tenant architecture comes with significant challenges, especially regarding cluster isolation and fair resource allocation.

In this article, you'll learn about ten essential considerations when using Kubernetes multi-tenancy.

More: https://loft.sh/blog/10-essentials-for-kubernetes-multi-tenancy

In this article, you'll learn how to grant access to users of a vcluster using DEX as a federated OpenID provider and kubelogin as a plugin for OIDC integration.

More: https://justinpolidori.it/posts/20220611_vcluster_auth