Latest News
Read all latest blog posts
Learn AWS EKS Kubernetes cluster and devops in AWS (Part 1)
Learn AWS EKS Kubernetes cluster and devops in AWS (Part 1) Starting AWS EKS cluster manually in AWS web console
Read More
CKS simulator
k get pods -A -o jsonpath='{range .items[*]}{.spec.nodeName}{"\t\t\t\t"}{.spec.containers[*].image}{"\t"}{"\n"}{end}' | sort | grep cluster1-worker1
Read MoreCKS Reduce Attack Surface
Overview only purpose (remove unneceassary services) node recycling (should be ephemeral, created from images) ubuntu, centos systemctl list-units | grep <service-name> systemctl list-units --type=service | grep <service-name> systemctl list-units --type=service --state=running | grep <service-name>
Read More
CKS Kernel Hardening Tools
Requirements for Apparmor container runtime needs to support Apparmor Apparmor needs to be installed on every node Apparmor profiles need to be available on every node Apparmor profiles are specified per container (done via annotations) not per pod!
Read MoreCKS Audit logging via kube-api server
Important Kubernetes request stages What events should be recorded Audit log from Mushad course
Read MoreCKS Immutability of containers at runtime
advanced deployment methods easy rollback more reliability better security (on container level) Interesting example of how ‘‘startupProbe’’ can be used to make container a bit more secure root@cks-master:~# cat immutable.
Read MoreCKS behavioral analytics falco
Explore strace root@scw-k8s:~# strace -cw ls / bin etc initrd.
Read More