HackBlue

Tools · Workbench

Containers and Kubernetes security

Tutorials on container images, Dockerfile hardening, secrets, Kubernetes RBAC, Pod Security, network policy, and audit logs.

  • 20 lessons
  • 3.5 h of reading
  • 4 topics
Start with lesson 1All workbenches

A container is a process with a narrower view of the machine, and Kubernetes is a scheduler with an API that can create those processes anywhere. These tutorials explain where that isolation is real, where it is a default you have to change, and how to check a cluster you run.

A local cluster such as kind, minikube, or k3d is enough for every lab in this set.

Cluster foundations

4 lessons

  1. 01Kubernetes security architecture for beginners: API server, etcd, kubelet, and the 4CsMap the parts of a Kubernetes cluster that matter for security, understand why every action goes through the API server, and use the cloud, cluster, container, code model to organize defenses.10 min
  2. 02Kubernetes RBAC explained: Roles, ClusterRoles, bindings, and kubectl auth can-iRead RBAC objects, understand namespace versus cluster scope, find who has dangerous verbs like create pods or get secrets, and test permissions with kubectl auth can-i.12 min
  3. 03Kubernetes service account tokens: automount, projected tokens, and least privilegeSee how pods receive API credentials, why most pods should not get one, and how bound projected tokens differ from legacy long-lived Secret tokens.9 min
  4. 04Kubernetes Secrets are base64, not encrypted: encryption at rest and external secret storesSee why base64 is not protection, configure etcd encryption at rest with an EncryptionConfiguration, and decide when to use an external secrets manager.10 min

Workload policy

5 lessons

  1. 01Pod Security Standards and Pod Security Admission: privileged, baseline, and restrictedLearn the three Pod Security Standards levels, apply them to namespaces with labels in enforce, audit, and warn modes, and roll out restricted without breaking deployments.10 min
  2. 02Hardening pods with securityContext: runAsNonRoot, read-only root filesystem, and capabilitiesWrite a pod spec that meets the restricted standard, understand what each securityContext field changes, and fix the common reasons hardened containers fail to start.10 min
  3. 03Kubernetes NetworkPolicy tutorial: default deny and allowing only what you needUnderstand that pods accept traffic from anywhere by default, write a default-deny policy, allow specific ingress and DNS egress, and test the result.11 min
  4. 04Kubernetes requests, limits, ResourceQuota, and LimitRange as security controlsSee how missing limits let one workload starve a node, set requests and limits, and use ResourceQuota and LimitRange to keep namespaces within bounds.8 min
  5. 05Kubernetes policy as code with Kyverno: validate, mutate, and audit modeWrite Kyverno policies that require labels, disallow latest tags, and enforce resource limits, start in Audit mode, and read policy reports.11 min

Auditing and detection

6 lessons

  1. 01Running kube-bench: checking a cluster against the CIS Kubernetes BenchmarkRun kube-bench as a Job, read PASS, FAIL, WARN, and INFO results, and understand which checks apply to managed clusters.9 min
  2. 02Kubernetes audit logs: writing an audit policy and finding suspicious API activityEnable API server audit logging with a sensible policy, understand audit levels and stages, and query the log with jq for exec, secret reads, and RBAC changes.11 min
  3. 03Checking Kubernetes exposure: public API servers, anonymous auth, and kubelet portsVerify from outside and inside that your API server and kubelets do not accept anonymous requests, and restrict who can reach the control plane.9 min
  4. 04Falco runtime security: reading alerts and writing your first ruleInstall Falco on a lab cluster, trigger a built-in alert by opening a shell in a container, read the output fields, and write a custom rule with exceptions.11 min
  5. 05Scanning a Kubernetes cluster’s posture with Kubescape and TrivyRun Kubescape and trivy k8s against a lab cluster, read framework scores such as NSA-CISA and MITRE, and prioritize the controls that fail across many workloads.9 min
  6. 06Responding to a compromised Kubernetes pod: isolate, preserve, investigateA practical sequence for a suspicious pod: isolate it with labels and network policy, preserve evidence before it is rescheduled, check token use in audit logs, and rebuild cleanly.10 min

Images and supply chain

5 lessons

  1. 01Trivy tutorial: scanning container images for vulnerabilities, secrets, and misconfigurationsInstall Trivy, scan an image and a Dockerfile, read severity and fixed-version columns, and add a CI gate that fails only on fixable critical findings.11 min
  2. 02Dockerfile security best practices: non-root users, multi-stage builds, and no secrets in layersRewrite a typical Dockerfile to pin its base, drop build tools with a multi-stage build, run as a numeric non-root user, and keep secrets out of image history.10 min
  3. 03Why the Docker socket and docker group equal root, and safer alternativesUnderstand why access to /var/run/docker.sock gives full control of the host, find containers that mount it, and use rootless or daemonless builders instead.8 min
  4. 04Signing and verifying container images with Sigstore cosignSign an image by digest with cosign, verify it locally, understand keyless signing with OIDC identities, and enforce signatures at admission.10 min
  5. 05Reviewing a Helm chart before installing it: rendered manifests, RBAC, and privilegesRender a third-party chart with helm template, scan the output, and check the RBAC, securityContext, hostPath, and service exposure it would create.9 min