►
Description
Kubernetes Community Days Bengaluru'21
To begin with we all know that Kubernetes is dominating the container orchestration market nowadays. Enterprise organizations across nearly all verticals, including those with strong security requirements, such as financial services, healthcare, government, and telecommunications, are deploying production applications to Kubernetes clusters.
While this rapid adoption of Kubernetes shows just how disruptive these technologies have been, they have also led to new security problems. Their widespread popularity and many organizations without proper security measures in place have made Kubernetes infra the perfect target for attackers.
This hand-on Security workshop teaches the attack techniques on prime targets of the cluster and basics of Kubernetes Security and secure configuration of the numerous moving parts within the Kubernetes cluster that must be properly hardened.
A
Hello,
everyone
thank
you
for
joining
this
afternoon,
welcome
to
the
workshop
on
attacking,
defining
and
monitoring
kubernetes
ecosystem.
So
let
me
begin
by
introducing
myself.
My
name
is
wassan
chunnipili.
I
am
a
security
enthusiast
currently
working
as
a
security
architect
and
a
devsecops
practitioner.
A
My
technical
abilities
and
passions
span
wide
range
of
technology
across
various
domains
of
information
security,
including
cloud
container
security,
penetration
testing,
devsecops
and
security
automation.
I'm
also
like
the
developer
of
the
tool
named
cube
striker.
It's
an
open
source
platform.
Agnostic
security
auditing
tool
is
specifically
designed
to
secure
the
cloud
native
and
tackle
kubernetes
cluster
security
issues
and
before
we
get
into
like
the
fascinating
world
of
kubernetes,
I
want
to
tell
you
what's
in
store
for
today,
so
we
will
start
by
setting
up.
A
Usually
these
workshops
are
designed
to
go
for
longer
than
four
hours,
but
I
have
slightly
modified
to
fit
our
schedule
today
in
the
even
there
is
insufficient
time
to
go
through
all
the
scenarios
or
if
some
scenario
doesn't
work
as
expected.
I
just
wanted
to
let
you
know
beforehand
that
you
will
have
access
to
the
playground,
and
you
can
also
download
this
digital
guide.
A
So
you
can
test
these
scenarios
in
your
own
time
and
you
can
reach
out
to
me
with
any
questions
through
linkedin
or
my
email
address
and
needless
to
say,
I
want
this
workshop
to
be
as
interactive
as
possible.
So
please
get
involved,
share
your
experiences
and
insights
and
please
ask
and
answer
questions
and
just
have
fun.
A
A
You
can
either
use
a
virtual
box
or
vmware
workstation.
Anything
should
be
fine
in
case.
If
you
feel
that
I'm
going
at
very
high
pace,
let
me
know
so
that
I
will
slow
down
and
if
you
have
any
questions,
make
sure
you
erase
them
or
instead
of
messaging
them
just
speak
out,
so
that
I
don't
need
to
check
this
live
channel.
Frequently.
A
A
A
The
first
one
make
sure
always
host
only
the
first
one
has
to
be
host
only
otherwise.
The
workshop
will
not
work,
then
hello,
all
and
then
under
adapter
to
make
sure
you
choose
nat.
This
is
the
only
setting
that
you've
got
to
do
so.
The
first
one
host
only
and
choose
whatever
name
that
you
have
created,
or
there
should
be
one
in
your
box.
Otherwise
you
can
simply
create
from
your
host
network
manager
and
create
one
and
adapter
two
should
be
like
nat.
A
D
A
A
F
A
A
A
A
A
A
A
F
A
Yep
perfect
and
then
let's
run
this
command,
just
make
sure
you
copy
and
paste
this
command
as
us,
it's
create
iphone
n
workshop,
iphone
w2,
and
this
setup
is
like
the
main
setup
guys
if
you
want
to
go
ahead
with
the
rest
of
the
workshop,
ensure
it
is
all
working
up
and
fine
and
this
setup
may
take
anywhere
close
to
five
to
ten
minutes
depending
on
your
internet
connection.
Don't
worry
even
if
it
takes
time.
D
A
Can
you
look
at
my
screen?
Can
you
see
my
screen
so
I
have
highlighted
the
command
and
then
again
the
same
command
create
ifn
workshop
iphone
w2.
This
will
actually
download
a
bunch
of
container
images
which
may
come
up
to
like
three
to
four
gigs.
That's
the
reason
why
it
may
take
some
time
depending
on
your
internet
connection.
C
C
A
Okay,
perfect:
now
you
need
to
browse
to
the
page
on
the
second
thing
where
it
says
installing
build
server.
You
will
also
get
an
ip
address,
saying
that
please
access
your
build
server
on
the
ip
port
number,
eight,
seven,
eight,
seven,
eight,
eight
zero,
eight
zero!
So
just
access
yeah!
You
will
you
guys
need
to
access
this
build
and
deploy
server.
A
C
A
H
A
A
Could
you
please
check
this
setting
the
first
one
has
to
be
host
only
adapter
and
the
second
one
needs
to
be
nat.
Probably
you
should
have
put
it
the
other
way,
the
first
one
that
and
the
second
one
host.
Only
it's
it's
clearly
given
in
the
documentation
like
how
you
should
be
doing
so.
Even
if
you
follow
the
steps
given
in
this
documentation,
you
guys
should
be
able
to
get
it
up
and
running.
A
H
B
A
A
A
So
before
we
get
into
the
main
stuff,
I
have
like
a
few
theory,
part
and
few
basics
to
cover.
I'm
sure,
like
most
of
most
of
you
would
be
like
pretty
much
aware
about
like
what
containers
are.
What
kubernetes
is
what
microservices
are.
However,
I
still
would
like
to
give
like
a
quick
touch-up
to
ensure
everyone
is
on
the
same
page,
so
well
to
begin
with
microservices
architecture,
splits,
your
application
into
multiple
services
that
perform
fine-grained
functions
and
are
still
part
of
your
application
as
a
whole.
A
It
is
like
become
an
obvious
choice
for
most
of
the
organizations,
so
we
have
like
this
micro
services
running,
but
where
do
you
put
these
micro
services
in
containers?
So
basically,
these
containers
are
like
packages
of
your
software
that
include
everything
that
it
needs
to
run,
including
the
code
dependencies,
libraries,
binaries
and
more.
This
gives
like
the
developers,
the
ability
to
create
predictable
environments.
A
A
Well,
the
kubernetes
is
an
open
source
container
orchestration
platform
that
automates
many
of
the
manual
processes
involved
in
deploying
managing
and
scaling
containerized
applications.
You
can
think
of
kubernetes
as
you
would
a
conductor
for
an
orchestra.
In
the
same
way,
a
conductor
would
say
how
many
trumpets
are
needed,
which
one
plays
the
first
trumpet
and
how
loud
each
should
play,
etc.
A
container
orchestrator
would
say
how
many
web
servers
front-end
containers
are
needed
or
back-end
containers
are
needed.
A
It
needs
to
work
with
an
external
container
source
and
run
time
like
it's,
because
it
needs
a
container
runtime
in
order
to
orchestrate
humanity
is
mostly
and
commonly
used
with
docker,
but
it
can
also
be
used
with
any
other
container
runtime
like
run
c
crio
or
container
d,
or
some
other
container
runtimes
that
you
can
deploy
with
kubernetes
well.
Needless
to
say,
kubernetes
is
like
very
hot
in
devops
space
and
is
now
the
third
most
wanted
platform
among
developers
well
getting
started
with
kubernetes
easy.
A
It
takes
a
matter
of
minutes
to
set
up
a
new
cluster
and
run
applications.
However,
the
real
concerns
or
a
challenge
is
what
follows:
is
the
pivotal
question
of
how
to
make
sure
your
cluster
is
secure
for
any
organization?
Security
should
be
like
the
primary
concern
and
not
an
afterthought,
because,
as
we
all
know
too
well,
especially
in
the
current
kovid
environment,
prevention
is
always
better
than
cure.
A
The
company
was
asked
to
pay
like
80
million
civil
penalty,
for
its
role
in
the
security
breach
that
exposed
the
personal
data
of
more
than
100
million
customers,
and
here
is
the
another
one
if
the
value
of
cryptocurrencies
are
skyrocketing
and
limitless
compute
resources
located
in
the
cloud
hijacking,
resources
has
become
a
lot
more
lucrative
than
just
stealing
info.
World's
famous
automaker
was
one
of
the
earlier
victims
of
crypto
jacking.
A
When
a
kubernetes
cluster
was
compromised
due
to
an
administrative
console
not
being
passed
and
protected,
and
it's
called
tesla,
and
what
was
interesting
about
this
attack
was
the
number
of
ingenuine
precautionary
measures
taken
to
avoid
detection.
The
attackers
also
made
sure
that
the
mining
script
didn't
use
enough
cpu
resources
to
cause
an
alarm
or
get
detected.
These
are
like
just
two
examples.
There
are
like
many
other
examples
like
a
microsoft,
tube
flow
or
docker
content,
docker
hub,
where
the
attackers
managed
to
implant
malicious,
docker
images.
Last
year.
A
A
A
A
The
kubernetes
like
follows:
a
client
server
architecture
model
and
the
working
kubernetes
deployment
is
called
a
cluster.
Basically,
you
can
visualize
a
cluster
as
two
parts:
the
control
plane
and
the
compute
machines
are
the
worker
nodes.
So
what
happens
in
the
kubernetes
control
plane
if
the
control
plane
is
the
brain
of
the
operations?
The
worker
nodes
are
the
muscles.
So,
let's
start
with
the
nerve
center
of
the
kubernetes
cluster,
the
control
plane.
A
So
the
control
plane
is
in
like
constant
contact
with
your
nodes.
If
you
have
configured
your
cluster
to
run
a
certain
way,
the
control
plane
make
sure
it
does
and
the
cube
api
server
if
you
need
to
interact
with
the
kubernetes
cluster
talk
to
the
api.
The
api
is
the
front
end
of
the
kubernetes
control
plane.
The
next
one
is
cube.
Scheduler
is
your
cluster
healthy?
If
new
containers
are
needed,
where
will
they
fit?
These
are
the
concerns
of
the
kubernetes
scheduler.
A
The
next
one
is
controller
manager,
controller
manager
takes
care
of
actually
running
the
cluster
and
the
kubernetes
controller
manager
contains
several
controller
functions
in
one
so
fcd.
Another
important
piece
like
configuration,
data
and
information
about
the
state
of
the
cluster
lives
in
a
city.
It's
a
key
value
store
database.
It's
fault,
tolerant
and
distributed
lcd
is
designed
to
be
like
the
ultimate
source
of
truth
about
your
cluster.
A
So
what
happens
in
the
kubernetes
node?
The
worker
nodes
are
the
muzzles.
They
are
the
ones
who
actually
run
and
control
all
the
pods
and
containers
from
your
cluster.
You
can
have
zero
or
more
work
nodes
on
your
cluster,
although
it
is
not
recommended
to
run
your
pods
on
the
same
node
as
the
control
plane.
A
So
what
is
the
pod?
A
port
is
the
smallest
and
the
simplest
unit
in
the
kubernetes
object
model.
It
represents
a
single
instance
of
an
application.
The
next
one
is
cubelet.
Each
compute
node
contains
a
cubelet.
It's
a
tiny
application
that
communicates
with
the
control
plane.
The
cubelet
makes
sure
the
containers
are
running
in
a
port
when
the
control
plane
needs
something
to
happen
in
node,
the
cubelet
executes
the
action.
A
So
if
you
look
at
the
previous
diagram,
it
says
the
communications
go
through
like
the
kubernetes
api
server.
This
is
like
what
defines
and
controls
all
of
the
kubernetes
management
and
operational
functions.
The
kubernetes
api
service
acts
as
the
front
door
to
any
cluster.
It
is
generally
exposed
on
every
deployment,
since
it's
needed
for
management
purposes,
but
exposing
your
kubernetes
api
server
to
the
public
is
the
most
common
entry
point
for
attackers.
It's
actually
really
a
juicy
target.
A
Malicious
actors
will
always
try
to
get
access
to
the
cube
api
server
in
the
control
plane
and
once
these
are
compromised,
they
can
then
proceed
to
compromising
the
whole
cluster.
At
times,
it
may
not
be
a
bad
day
for
just
your
cluster,
but
also
for
your
cloud
account
or
the
underlying
infrastructure
where
the
cluster
is
running.
A
A
Anyone
who
gains
access
to
their
cd
targets
to
retrieve
service
account
tokens
and
secrets.
It's
like
once.
If
an
attacker
has
access
to
a
privileged
secret
or
token,
then
it's
game
over
a
very
quick
win
for
the
attacker,
and
apart
from
these,
there
are
like
a
host
of
ports
to
worry
about.
It's,
not
just
the
fcd
service
and
the
kubernetes
api
that
you
need
to
be
cautious
about
leaving
exposed,
for
example,
like
the
cubelet
exposes
endpoints,
which
grant
powerful
control
over
the
node,
and
the
containers
been
compromised.
A
Anyone
by
gaining
control
of
a
cube
light.
The
attacker
has
gained
unfettered
access
to
the
kubernetes
application.
This
is
an
end
game
tool
and,
needless
to
say,
the
last
one
is
like
the
container
runtime.
A
component
enables
the
functionality
required
to
start
run
and
manage
containers
on
a
given
node,
for
example
docker.
A
I
can't
stress
enough
how
important
it
is
to
secure
your
workloads
or
containers.
A
privileged
container
when
gained
access,
gives
an
attacker
the
privilege
to
run
a
command
in
the
context
of
that
container
or
even
the
option
to
escape
and
access
the
underlying
course
resources.
This
is
an
endgame
too
an
attacker
who
gains
access
to
the
container
has
gained
access
to
your
cluster
and
eventually
the
underlying
cloud
account
and
the
last
one
is
like
the
threat
matrix.
A
The
mitre
attack
framework
covers
like
various
stages
that
are
involved
in
cyber
attacks
and
elaborate
like
known
methods
in
each
of
them.
These
mattresses
help
organizations
understand
the
attack
surface
in
their
environments
and
also
make
sure
they
have
adequate,
detections
and
mitigations
to
various
risks.
Today
we
will
be
looking.
Most
of
these
scenarios
could
be
like
initial
gaining
access
or
execution
persistence,
privilege
escalation,
defensivation,
credential
access,
discovery,
literal
movement
collection.
We
will
be
looking
at
all
these
components
in
the
attack
and
different
scenarios.
A
I'm
sure,
like
you
said
most
of
you
are
like
already
aware
with
humanities,
but
we
will
still
look
at
at
very
high
level,
a
few
kubernetes
commands
which
we'll
be
using
for
the
rest
of
the
workshop.
So
I
want
you
all
to
practice
these
commands
even
without
practicing.
You
can
still
go
ahead.
We
can
go
ahead
with
the
rest
of
the
scenarios,
but
I
will
quickly
show
you
all
these
very
high
level
commands.
A
A
F
A
K
A
And
if
we
get
into,
if
you
go
to
this
page,
just
make
a
note
of
these
ip
addresses
just
replace
this
ip
with
your
ipn.
Everything
else
is
same
okay,
it's
as
simple
the
first
one.
At
this
stage
we
are
accessing
like
your
ip
and
port
8080.
You
should
be
able
to
see
like
the
jenkins
build,
which
is
happening
so.
A
A
A
A
So
if
you
want
to
see
like
the
cluster
input,
this
is
the
command
and,
for
example,
getting
any
resources
we
use.
The
command
called
cube,
ctl
get
and
then
you
can
define
if
it
is
a
name
space
or
a
port
or
a
node
or
a
deployment.
So
it's
cube.
Cdl
get
pods
qctl
get
nodes,
or
if
you
want
to
get
all
everything
in
all
namespaces,
you
need
to
define
hyphen
a
and
qcdl
will
get
pods
hyphen
a
so.
When
you
give
this
command,
you
see
it
will
get
bot's
iphone
a
you
should
see.
A
A
A
A
If
you
want
to
see
name
spaces
in
any
of
the
particular
name
space,
we
define
it
like
this
cube
c
del
get
parts
you
provide
iphone
and
flying
and
the
name
space
where
you
want
to
see
the
pawns
and,
if
you
want
to,
for
example,
create
any
name
space,
you
can
simply
cube.
Ctl,
create
namespace
and,
for
example,
anything
called
kcd.
A
A
A
A
A
You
can
see
what
all
privileges
that
you
have
got
inside
the
cluster
and
iphone
iphone,
as
is
another
important
thing
which
we'll
be
using
in
for
some
situations
or
scenarios.
In
the
workshop
we
use
basically
iphone
fm,
as
whenever
we
want
to
impersonate
a
particular
user.
So
here
I'm
saying
cube
ctl,
or
can
I
create
pod
as
user
dave?
A
A
A
Plane
we
need
to
provide
the
namespace
cube
system,
so
this
is
how
you
see
the
logs
of
any
of
the
pods
and
if
you
want
to
see
like
the
events
that
are
happening
inside
the
kubernetes,
so
when
it
is
get
events,
these
are
like
very
important
commands,
which
we
may
be
using
in
the
workshop
going
forward
during
the
monitoring
sessions
or
to
see
what's
happening
inside
the
cluster.
What
an
attacker
is
doing
being
a
system
admin
how
to
identify
malicious
events
that
are
happening
inside
the
cluster.
A
A
A
J
D
A
A
A
These
are
some
other
important
commands
that
you
can
try
post
workshop
now,
let's
quickly,
look
at
what
a
cube
configures,
for
example,
we
just
tried
this
command
cube,
sql
config
view,
and
this
is
the
output
that
we
got
so
here.
The
resources
like
cluster
contains
like
the
endpoints
data
for
a
kubernetes
cluster.
This
includes
the
fully
qualified
url
of
the
kubernetes
api
server
and
the
user
basically
defines
the
client
credentials
for
authenticating
the
kubernetes
cluster.
A
A
F
A
B
B
B
A
A
A
A
It
is
very
critical
that
the
cube
api
server
is
not
left
publicly
exposed,
or
there
is
some
kind
of
anonymous
access
or
it
could
be
like
insecure
port
or
cubelet
read,
write
ports.
You
know
what,
although
this
is
not
enabled
by
default
now
some
engineers,
like
me,
might
end
up
giving
some
more
permissions
to
anonymous
users
for
testing
purposes
or
leave
some
ports
open
for
testing
and
then
forget
to
revert
those
changes
once
the
testing
is
done.
A
So
these
are
some
scenarios
which
we
came
across
during
the
security
assessments
or
the
penetration
testings,
where
an
anonymous
user
has
been
given
access
or
there
are
some
unsecured
posts
or
cube
that
read.
Write
ports
were
kept
open
to
the
public,
so
I
want
you
all
to
identify.
How
do
you
go
ahead
and
find
these
ports
and
after
finding
those
ports?
What
you
can
actually
grab
from
those
ports?
A
So
if
you
also
have
like
the
solutions,
I
want
you
all
to
start
with
this
command
cube,
ctl,
what's
right
in
info.
This
will
give
you
like
your
cluster,
and
I
want
you
to
all
to
run
this
command
cube.
Ctl
get
your
iphone
wide,
and
I
want
you
all
to
make
a
note
of
this
ip
address.
This
is
the
ip
address
of
your
control
plane,
so
we
will
be
using
this
ip
address
in
the
rest
of
the
steps.
A
A
So
we
have
like
around
or
six
ports
that
are
open
on
this
machine
and
just
with
a
little
bit
of
googling,
you
should
be
able
to
identify
like
what
are
the
common
kubernetes
api
server,
secure
ports
or
insecure
port
or
the
cube
that
read,
write
or
read
only
ports,
but
for
now
I'll
be
I'll,
be
giving
you
the
solution.
Usually
kubernetes.
A
Api
server
runs
on
four
six,
four,
four,
three
or
port
four,
four,
three,
eight
four,
four
three
or
any
other
defined
port,
and
we
have
like
cubelet,
read:
write
port
on
port
one
zero,
two
five
zero
and
read
only
port
one,
zero,
two
five
five
and
these
are
like
the
xcd
clients
and
that
cd
servers-
and
this
is
like
kubernetes
in
secure
port.
Now
that
we
have
identified
a
host
of
posts
running
on
the
kubernetes
control
plane
being
an
attacker.
What
we
do
is
we
try
to
grab
some
information.
A
F
A
Thank
you.
There
you
go
you're
able
to
access
that
endpoint,
and
these
are
other
endpoints
which
are
available
on
that
yep
on
that
host
called
1750.5.
There
are
some
interesting
things
like
api
api,
v1
apis.
You
can
try
and
see
what's
lives
on
these
different
endpoints,
so
I
can
start
with
a
few
basic
things.
A
Slash
version
will
give
us
different
versions
or
if
you
want
to
see
api,
so
it
will
give
you
some
other
information
about
the
server
address
and
the
client
cidr
or
if
you
want
to
see
api
under
v1,
it
will
give
host
of
things
such
as
like
secrets
or
resource
quotas
or
service
accounts.
Now,
if
you
want
to
access
any
of
these
things,
you
would
be
simply
appending
that
particular
endpoint
here
api,
slash,
v1
secrets.
A
Or
api
slash,
v1,
slash
nodes
and
guys,
like
I
said
this
is
not
enabled
by
default,
but
it
doesn't
mean
that
this
cannot
happen
and
we
usually
come
across
these
scenarios
in
security
assessments
and
most
of
the
companies-
and
this
is
like
you-
have
an
control
plane
listening
on
a
secure
port
with
anonymous
access
enabled.
That
is
the
reason
why
we
are
able
to
access
this.
A
H
A
A
So
if
you
look
at
this
particular
role,
binding,
which
will
which
we'll
be
discussing
further
about
what
is
a
role,
what
a
role
binding
is,
but
for
now
at
this
stage
there
is
a
user
called
system
anonymous.
Needless
to
say,
in
plain
english,
anonymous
and
this
particular
user
has
been
bounded
with
a
role
called
admin.
Cluster
admin
role
has
been
bounded
to
this
user
called
anonymous.
That's
the
reason
why
any
anonymous
user,
without
any
authentication,
can
access
all
the
resources
and
perform
any
operation
inside
the
cluster.
A
This
is
a
major
bug
and
it
still
happens
in
most
of
the
environments.
We'll
also
be
looking
at
how
to
avoid
these
things
in
the
next
coming
different
scenarios.
Anyhow.
Needless
to
say,
no
because
you
know
how
this
happened,
it's
simply
deleting
or
defending
not
giving
anonymous
users.
Any
kind
of
privileges
will
stop.
This
attack.
H
D
C
A
A
And
the
next
one
is
the
scenario
two
now
that
we
have
seen
a
secure
port
where
we
have
anonymous
access
enabled
now
we
also
have
like
insecure
port.
If
you
have
like
an
insecure
port
on
your
kubernetes
cluster,
open
it
by
default
gives
a
wide
access
to
everyone.
There
is
no
like
anonymous
user.
You
don't
need
to
bind
any
role
bindings
or
rules
to
anyone.
If
some
insecure
port
is
open
in
your
cluster,
anybody
can
access
it.
That's
it.
A
So
we
have
run
this
command
and
we
are
done
with
this
port
6443
and
probably
two
three
seven,
nine
two
three
eight
zero
are
like
the
lcd
clients,
and
these
are
like
read,
write
and
read
only
ports,
and
this
is
the
other
port
which
is
up
and
running.
So
I
want
you
to
all
to
hit
this
port
and
see
what
you
can
grab
I'll.
Give
you
like
quick,
five
minutes,
and
you
also
have
the
commands
here.
A
I
A
I
A
A
D
A
A
And
the
upcoming
scenarios
will
be
like
very
interesting,
we'll
be
training
like
different
tags,
we'll
be
looking
at
some
privilege,
escalations,
lateral
movements
and
bypassing
some
controls
right.
So
everyone
up
with
solution
to
can
we
go
ahead
with
to
the
scenario
number?
Three?
Do
you
all
have
any
questions?
Yes,
no
any
issues
with
scenario,
two.
A
A
Cool
now,
let's
move
on
to
scenario
number
three
again,
a
quick
one.
So
this
time
we'll
be
exploring
like
the
first
two
scenarios.
We
have
seen
cubelet
in
insecure
port
and
secure
port
with
anonymous
access,
but
now
we'll
be
looking
at
a
cubelet
read,
write
and
read-only
ports
when
they're
exposed
the
scenario.
Number
three
is
where,
like
the
cube
left
read,
write
port
is
exposed.
A
So
we
will
see
how
an
attacker
can
abuse
in
case.
If
a
cube
like
rewrite
port
is
exposed
to
the
public
or
at
times
an
attacker
might
already
gain
access
to
your
internal
infrastructure
and
then
still
he
can
start
playing
with
your
open
ports.
If
he
is
already
inside
the
network,
you
don't
need
to
explicitly
expose
them
to
the
public,
but
if
somebody
gains
access
to
your
network,
they
can
still
start
playing
with
it.
A
A
Now
there
is
something
called
an
extra
mile.
The
reason
why
we
say
this
has
read:
write
port,
it's
because
if
somebody
has
access
to
the
sport,
they
can
even
in
fact
start
interacting
with
your
cluster
and
then
I
can
actually
have
like
write
privileges,
which
means
they
can
create
or
they
can
delete
something.
For
example,
in
this
scenario,
let's
start
with
creating
some
files
in
one
of
the
containers
and
see
how
it
works.
I
H
A
And
now
let
us
look
at
something
called
a
reverse
shell,
where
usually
the
attackers
or
the
penetration
testers
which
they
actually
use.
It's
like
they
if,
if
you're
like
sitting
inside
the
network,
instead,
you
directly
coming
to
one
of
the
open
ports
where
a
firewall
might
attempt
to
discover
your
actions.
If
you
perform
a
connection
from
inside
the
network
to
the
outside,
there
are
less
chances
of
finding
out
a
firewall.
So
this
is
what
we
call
it
as
a
reverse
shell.
So
we
say
that
hey!
This
is
an
attacker.
A
K
A
Right
so
usually
when,
when
doing
penetration
testing
or
when
some
attacker
trying
to
do
something
on
your
network,
they
try
to
connect
to
the
services
or
the
host
or
to
the
open
ports
that
are
running
inside
your
network.
So
if
I
happen
to
directly
connect
to
your
open
port
or
an
open
service
in
your
environment,
there
are
chances
that
firewall
might
not
allow
that
particular
thing,
or
there
are
also
chances
that
some
endpoint
protection
might
identify
as
an
anomaly.
A
In
order
to
avoid
these
things,
instead
of
directly
connected
to
the
point
what
attackers
or
penetration
testers
will
do,
is
they
will
have
an
open
port
or
running
on
a
particular
ip
address
in
their
machine
and
from
inside
the
network?
They
initiate
a
reverse
connection,
saying
that
hey,
instead
of
me
connecting
directly
the
machine,
will
now
directly
initiate
a
connection
to
the
attacker,
because
now
the
network
or
the
connection
is
being
initiated
from
inside
the
network,
the
chances
of
being
detected
or
being
identified
is
very
low.
A
A
Pods,
so
if
you
observe
carefully
I'm
running
this
command
in
one
of
the
ports,
because
there
is
a
cubeletry
report
open,
so
this
command
is
being
run
inside
the
pod
and
from
inside
the
port.
A
connection
is
being
issued
from
inside
the
pod
to
the
external
attacker.
So
this
is
the
external
attacker
listening
on
port
7777
on
on
this
ip
address,
and
we
are
saying
hey
connect
to
that
particular
ip
on
the
port.
A
A
Host
name,
it
is
like
the
workshop
dev
control
plane,
so
we've
got
a
connection
from
the
control
plane,
so
this
is
called
reverse
shell.
You
can
ideally
like
google,
this
stuff.
What
is
like?
A
reverse
shell.
There
are
like
many
good
tutorials,
what
is
the
river
shell
and
how
these
reverse
shells
will
actually
work,
because
we
are
going
to
use
this
in
one
or
two
scenarios
going
forward
so
well.
This
concludes
like
the
scenario
number
three
and
scenario
number
four
is
like
the
cubelet
read-only
port.
A
So
it
runs
on
port
one
zero,
two
five,
five
slash
pods
and
I'm
leaving
it
to
you
to
identify
what
are
the
different
endpoints
that
are
running
it
could
be
pods
or
running
pods
or
metrics.
You
have
like
two
minutes
to
try
this
one.
Everything
else
remains
the
same.
It's
just
the
port
number.
It
will
change
this
time
and
from
scenario
number
five.
Everything
is
going
to
be
a
bit
high
level
and
it
requires
some
efforts
on
thinking.
A
A
K
C
A
A
And
like
the
scenarios,
five,
six,
seven
and
eight
they
are
like
linked
together.
We
will
see
how
an
attacker
gains
access
inside
the
network
by
exploiting
a
vulnerable
web
application
and
then
how
they
create,
contain
vulnerable
container
images,
how
they
bypass
the
internal
registries
or
how
they
try
to
get
or
create
and
push
some
vulnerable
containers
into
private
registries
and
then
gain
access.
This
kind
of
stuff,
the
scenarios-
five
six
and
seven
eight-
are
linked
together.
So
I
want
you
to
all
to
concentrate
and
pay
more
interest
here.
A
A
A
A
This
is
called
code
execution,
so
during
a
penetration
testing
or
or
an
attacker
gets
to
know
that
there
is
a
remote
code,
execution
or
command
execution
bug
in
one
of
the
applications,
and
then
from
here
we
see
how
they
try
to
gain
access
to
the
pods
and
to
the
underlying
infrastructure.
All
together.
A
A
A
A
A
A
A
7777,
I
want
you
to
all
to
be
a
bit
careful
with
this
step
and
make
sure
you
give
the
right
port
number
and
the
ip
and
then
click
on
encode.
Otherwise
there
are
chances
that
it
might
corrupt
this
container
and
we
may
have
to
build
a
few
things
again.
So
after
you
have
like
the
appropriate
ip
and
the
port
number
click
on
encode
and
you
should
see
yeah
there
we
go.
We
got
like
the
reversal
from
that
particular
host
or
like
the
host,
where
this
web
application
is
running.
A
So
now
the
attacker
has
gained
access
to
the
underlying
host
where
the
web
application
is
hosted.
Now
he
performs
little
enumeration
on
that
machine
and,
let's
see
what
an
attacker
will
do
from
here,
the
first
command
he
gives
is
like
id
and
see
what
okay
he
is
running
as
a
root
and
he
gives
tries
to
identify
the
environment
variables
and
looking
at
the
environment
variables.
He
identifies
that
this
is
a
kubernetes
pod
which
is
running
or
the
web.
A
Application
is
running
on
the
kubernetes
board
and
from
here
we
quickly
do
these
things
you
get
into
the
temp
folder
and
we
try
to
download
the
cubectl
and
you
need
to
give
these
three
commands.
Otherwise,
the
cubectl
is
already
installed
inside
that
machine.
What
you
will
be
doing
is
cubecdl
cluster
iphone
info.
There
we
go
now.
The
attacker
has
access
to
the
cube
cd
cluster
iphone
info
and,
let's
see
actually
what
this
particular
user
has
privileges
to
perform
here.
A
A
So
this
is
how
you
identify
which
privileges
a
particular
user
has
got
and
from
here
being
an
attacker,
he
doesn't
stop
there.
So
what
he
does
is
like
he
creates
a
cube
config
file
for
this.
I
want
you
to
all
to
download
this
script,
so
you
can
give
this
command
wget.
It
will
generate
a
config
file.
A
J
A
So
this
is
one
thing
which
we
have
discussed
during,
like
the
basics,
there
is
a
thing
called
impersonation,
you
can
always
give
privileges
or
you
can
define
different
roles
to
different
users,
saying
that
hey,
if
you
have
like
two
different
users,
a
dev
or
a
devops
or
an
admin,
can
always
say
dev
user.
Along
with
these
privileges,
he
can
also
impersonate
as
an
admin
or
a
devops
guy
depending
on
his
requirements.
A
So
by
mistake
somebody
has
assigned
an
impersonate
role
to
this
particular
user
and
then
the
attacker
after
enumerating
few
things
he
got
to
know,
and
he
now
he
tries
to
impersonate
as
the
group
system
masters,
which
means
as
an
admin.
So
initially
we
were
not
able
to
get
the
secrets,
but
now,
when
the
same
user,
impersonates
iphone
iphone
as
system
masters.
A
He's
able
to
get
all
the
secrets,
so
this
is
one
of
the
bugs
or
one
of
the
issues
which
we
usually
come
across,
like
the
impersonation.
They
try
to
give
like
at
least
additional
privileges
to
like
unwanted
users,
unwanted
privileges
right
now
that
the
attacker
has
enough
privileges
to
get
the
secrets
and
parts,
and
now
he
can
do
anything
inside
the
cluster.
A
Now,
let's
move
on
to
like
scenario:
six,
the
scenario
know
that
the
attacker
now
has
gained
has
identified
that
he
can
impersonate
assistant
masters,
which
means
he's
ideally
an
admin.
The
attacker
is
now
an
admin
inside
your
cluster.
What
he
doesn't
he
further
enumerates
the
cluster
and
he
identifies
that
there
is
a
build
server
inside
the
kubernetes
cluster.
Usually
the
build
servers
are
considered
as
like
the
crown
jewels
of
any
organization
because
they
will
have
very
high
privileges
to
build
or
to
deploy
or
anything
they
also
have
access
to
like
the
code
base.
A
They'll
also
have
access
to
the
infrastructure.
They'll
also
have
access
to
like
the
web
applications.
So
these
are
like
very
juicy
targets
for
anyone.
The
attackers
are
always
in
the
hunt
of
the
build
servers
if
they
happen
to
gain
access
to
the
build
servers.
The
game
is
over.
They
have
like
unfettered
access
to
the
whole
infrastructure.
A
So
what
an
attacker
does,
what
being
an
attacker?
What
we
do
is
you
try
to
list
all
the
parts
that
are
running
inside
the
cluster
and
the
attacker
sees,
and
there
are
like
some
juicy
pods
like
cube
api
server
workshop
dev
control
plane.
This
is
the
control
plane,
part
which
gives
like
very
critical
information
about
the
cluster
and
also
there
is
something
called
a
jenkins
build
server.
A
A
There
you
go
now,
we
are
inside
the
jenkins
build
server.
If
you
remember,
we
started
with
a
web
application
vulnerability
in
the
web
application,
and
then
we
gain
access
to
the
underlying
host
and
from
that
underlying
host.
The
attacker
has
identified
that
that
particular
service
account
has
impersonate
privileges
as
system
admins
and
based
on
that
privileges.
We
gain
access
to
the
build
server
which
is
running
inside
the
cluster,
so
we
are
like
changing
different
attacks.
A
Now
that
we
are
inside
the
jenkins
server,
we'll
see
what
we
can
do
again.
Needless
to
say,
let
us
search
for
some
environment
variables.
We
may
come
across
some
juicy
information,
but
there
we
go.
There
is
something
called
secret
password.
It
gives
the
host
name.
This
is
the
jenkinsport.
This
is
the
jenkins
service
and
there
are
some
other
information,
and
there
is
some
token-
and
there
is
some
critical
piece
of
information,
username
admin
password
person.
Now,
let's
see
how
we
can
actually
use
this
information.
A
A
A
Wow
it
gives
us
when
you
enumerate
the
particular
target
endpoint
or
like
the
internal
repository.
It
will
list
all
the
repositories
that
codebase
has.
This
is
one
of
the
repositories
you
can
clone
them
using
this
clone
url
and
there
is
some
another
repository
named
wasant
and
there
is
another
repository
named
infra.
There
is
another
repository
named
backend.
There
is
another
repository
named
frontend,
so
all
these
things
seems
to
be.
You
know
juicy
targets
in
our
scenario.
A
A
Inside
the
temp
folder,
so
usually,
there
will
be
like
certain
restrictions
in
most
of
the
organization.
In
fact,
in
every
organization
like
a
very
basic
restriction,
neither
developers
nor
devops
or
system
admins,
they
cannot
merge
the
code
directly
into
the
master
branch.
Usually,
the
process
is
like
they
need
to
create
a
devil
branch.
It
needs
to
go
some
testing
and
they
need
to
create
a
pull
request.
A
A
A
A
A
A
A
A
Cool
this
time
the
comment
is
successful
and
now,
let's
push
in
any
organization
initially,
when
a
developer
creates
a
push,
it
could
be
like
the
dev
or
any
other
feature
pipelines.
It
will
basically
trigger
a
build
now.
It's
the
same
thing
which
happens
here
now
at
the
very
beginning,
when
I
told
you
to
note
down
the
ip
addresses
and
the
ports
other
than
the
main
jenkins
server,
which
is
running
on
port
8080.
A
A
So
after
we
pushed
into
the
dev
branch,
it
triggered
a
build,
and
that
has
successfully
run
and
let
us
see
what
actually
has
happened
so
build
is
successful
and
we
have
downloaded
like
an
evil
image.
We
have
replaced
nipple
image,
so
it
created
enable
image
and
the
build
pipeline
has
been
configured
in
such
a
way
that
every
time
it
creates
a
docker
image,
it
will
be
pushed
to
their
internal
repository.
Now,
in
the
scenario
what
the
attacker
has
done
is
he
removed
the
existing
docker
file.
A
A
Well,
that
concludes
like
the
scenario
six
so
till
now.
What
we
have
done
is
starting
from
like
the
scenario
file.
The
attacker
has
gained
access
to
the
underlying
port
or
the
host
using
like
a
vulnerable
web
application
using
remote
code
execution,
and
then
he
tried
to
perform
lateral
movements
by
gaining
access
to
a
high
privileged
machine
to
the
jenkins
server,
using
impersonation
techniques
and
from
the
jenkins
machine.
A
He
tried
to
identify
some
jobs
and
he
downloaded
some
cloned
git
repository,
because
usually
the
jenkins
server
will
have
high
privileges
to
the
code
base
and
to
the
infrastructure.
So
using
those
privileges
he
downloaded
like
one
of
the
clone,
the
repositories
he
replaced
existing
docker
file
with
a
malicious
docker
file
and
he
triggered
the
build
and
that
build
has
pushed
a
vulnerable
or
malicious
docker
image
to
the
internal
repository.
The
next
scenario.
A
A
Initially,
I
created
a
reverse
shell.
I
was
listening
on
a
reversal
in
my
machine
and
then
you
gained
the
reversal,
and
then
you
got
into
like
the
jenkins
machine
and
all
the
stuff
just
to
make
sure
or
to
make
the
lives
easier
going
forward.
I
want
you
to
all
to
use
exit
of
this
one
and
use
the
same
vm
for
the
rest
of
the
things.
A
A
A
A
A
So
when
you
target
this
one,
we
have
a
container
or
deployment
or
a
pod
running
with
something
called
the
bath,
and
if
you
look
at
what
is
the
image
that
is
being
used
by
this
pod,
it
says
there
is
an
image
called
clouds,
a
guy
demotion.
This
is
the
image
that
is
being
used
by
this
deployment
now
being
an
attacker.
A
I
will
try
to
replace
this
image
with
the
malicious
image
which
I
have
built
so
here,
I'm
ideally
creating
a
back
door
so
going
forward
every
time
if
any
of
the
devops
or
the
internal
people
use
that
malicious
image
will
give
like
a
wide
access
to
the
attacker.
So
let
us
see
how
this
happens
so
previously
we
have
used
this
command.
A
A
A
What
is
the
image
that
attacker
has
built,
which
is
from
here?
This
is
called
asm
web
app.
So
let
us
replace
that
image
with
this
one
and
everything
that
we
are
doing
is
like
a
live.
Workshop
live
hacking.
This
is
not
something
which
have
been
built
before,
because
everything
that
is
something
which
we
are
doing
right
now
so
now.
The
attacker
also
knows
that
he
has
built
this
container
in
such
a
way
that
it
should.
Whenever
this
is
run,
it
will
come
back.
It
will
connect
to
a
remote
attacker
on
a
particular
port.
A
A
J
A
The
file,
now,
what
I
will
do
is,
I
will
simply
apply
cube.
Cdl
apply,
iphone,
f
employment.
It's
configured
now.
Let
us
see
what
are
the
changes?
That's
been
happening.
It
says
this
container
is
creating.
So
once
this
container
is
created.
Ideally,
we
should
see
the
attacker
getting
the
access
again
to
the
internal
port.
So
this
way,
even
if
the
attacker
loses
his
access
to
the
cluster
every
time,
someone
deploys
these
images
or
this
kind
of
configuration
he
will
be
able
to
gain
access
back
to
the
cluster.
A
J
A
A
H
A
A
A
We
are
inside
the
container
now,
let's
the
attacker
of
doing
a
little
bit
of
research
after
checking
all
the
folders,
all
the
files
inside
the
container
he
comes
across
var
run
and
then
so
there
is
like
some
juicy
target.
Docker
socket
has
been
mounted
into
this
machine
so
now
that
the
docker
socket
has
been
mounted
being
an
attacker.
What
I
will
do
is,
I
quickly
add
the
docker
client
onto
this
container.
A
A
The
topic
line
has
been
installed
now.
What
you
can
do
is
you
can
play
with
the
underlying
docker
node
you're,
actually
inside
a
container,
but
because
the
docker
socket
has
been
mounted,
you
install
the
docker
client
and
you
are
actually
playing
with
a
container
or
with
the
docker
images
which
are
hosted
or
which
are
running
in
the
underlying
host,
or
if
you,
you
can
run
all
the
commands,
locker
ps.
A
A
When
that
attacker
can
do
is
he
can
simply
login
into
his
docker
account
using
your
personal
email
address
or
the
password,
and
they
can
steal
the
images.
This
is
called
exfiltration,
where
the
attacker
can
tag
the
existing
images
with
the
docker
hub
account
and
they
can
push
to
their
personal
docker
hub
account.
They
can
ideally
steal
the
images
after
that
they
can
pull
these
images
into
their
personal
machines
and
they
can
inspect
for
important
secrets
or
any
other
stuff.
This
is
called
like
the
docker
acceleration.
A
A
A
I
have
like
a
small
homework
for
you
all,
so
here
I'm
just
what
I'm
doing
is
simply
running
a
pod,
and
I
want
you
to
find
out
what
ns
enter
is
and
what
ns
enter
does,
if
not
I'll,
explain
you
towards
the
end
of
the
workshop
and
I'm
also
running
this
board
with
the
privileges
called
privilege
flag.
True,
so
what
I
will
do
is.
A
Let
us
identify
nodes,
so
if
you
ask
me
about
some,
how
will
an
attacker
can
identify
the
nodes
that
are
running
inside
the
cluster?
You
can
in
any
of
the
scenarios
like
where
we
have
seen
where
there
is
anonymous
user
access
given
or
if
there
is
an
insecure
port
running
or
if
this
is.
There
is
a
web
application
vulnerability.
There
are
different
ways:
if
the
attacker
gains
access
to
inside
they
can
use
these
techniques
to
further
distract
the
cluster.
A
A
A
I
A
Ls-
and
there
is
some
juicy
information
such
as
like
admin.com,
there
you
go,
you
can
grab
the
secrets
and
all
the
stuff
from
here
or
you
can
further
get
into
the
manifest
folder
and
tree.
These
are
some
important
juicy
files.
It
will
give
us
in
complete
configuration
of
the
kubernetes
api
server,
so
there
are
like
a
number
of
things
that
an
attacker
can
do
if
they
can
gain
access
to
the
underlying
host
or
the
underlying
node.
A
Now,
let's
look
at
the
scenario
number
10
and
like
we
have
discussed
before
hcd,
plays
a
very
vital
role
inside
the
kubernetes
cluster.
If
any
by
mistake,
if
the
xcd
is
kept
exposed
or
if
somebody
can
gain
anonymous
access
to
xcd,
let
us
see
what
they
can
actually
do.
We
can
start
by
all
right.
There
is
an
fcd
client,
now
use
this
command
to
enumerate
and
get
some
information
from
the
lcd
client
yep.
A
A
A
There
we
go
like
this,
we
can
grab
like
the
cluster
information
or
the
certificate,
or
even
the
tokens
is
what
happens.
This
is
what
which
we
have
discussed
before.
If
an
attacker
happens
to
gain
access
to
the
etsy
client,
you
can
further
gain
access
to
the
secrets
or
the
service
account
tokens
and
the
game
over.
So
I
will
leave
it
to
you
guys
to
perform
certain
things
before.
This
is
how
you
can
access,
or
you
can
do
further
privileges
or
do
enumeration.
You
can
assign
the
token
you
can
grab
the
token
from.
A
Here
and
you
can
assign
to
an
environment
variable
called
token,
and
you
also
have
like
the
ip
address
of
the
control
plane,
and
then
you
can
see
what
you
can
do
with
the
privileges
that
you
have
got.
Likewise,
if
you
have
time
you
can
go
through
all
the
secrets
and
see
what
you
can
do
and
you
can
identify
which
secret
or
the
token
has
got
higher
privileges
if
the
attacker
happens
to
gain
access
to
any
of
the
token
which
has
higher
privileges,
it's
game
over.
A
previously
we
have
seen
how
to
gain
access
to
one
of
the
worker
nodes,
but
if
you
want
to
gain
access
to
any
of
the
worker
nodes
randomly
if
we
have
like
multiple
worker
nodes
and
if
you
don't
know
the
names
of
the
worker
nodes,
let
us
assume
we
have
like
10
worker
nodes
running
inside
the
cluster,
and
if
you
can't,
if
you
don't
know
what
are
the
names,
you
can
simply
do.
One
thing
you
can
create
a
daemon
set,
which
means
which
will
create
a
privileged
board
on
each
and
every
node.
A
That
is
what
a
daemon
set
is.
It
will
deploy
pods
on
the
number
of
nodes
that
exist
inside
the
cluster,
so
you
can
simply
download
this
one,
this
file
and
just
apply
it
and
see
it
will
create
these
things
right,
no
problem,
let's
try
it.
I
will
quickly
download
this
one
yep.
It
has
created
shalon
node.
A
A
There
you
go
you're
inside
the
pod.
If
you
search
for
the,
u
name
or
host
name,
it
says
you
are
under
the
workshop
dev
control
plane,
because
this
particular
part
is
hosted
on
this
node.
Likewise,
if
you
want
to
gain
access
to
like
one
of
the
worker
nodes
number
one
or
two,
you
just
need
to
execute
into
these
things,
and
you
should
gain
get
access
to
directly
to
the
underlying
parts
or
to
the
underlying
nodes.
A
A
A
The
next
one
is
another
interesting
scenario:
it's
called
performing
crypto
mining
attacks
inside
the
cluster,
we'll
be
looking
at
this
one,
along
with
the
monitoring.
After
a
few
things,
and
now
we
will
jump
on
to
like
scenario,
number
13.,
just
again,
a
very
important
thing.
So
far
we
have
seen
like
the
attacking
kubernetes
api
server
on
secure
port
in
secure
port,
keep
that
ready
right,
read
only
or
gaining
access
to
the
web
server
using
some
vulnerable
web
application.
A
But
during
these
scenarios
there
is
a
possibility
that
performing
any
of
these
things
might
get
triggered
by
any
of
the
endpoint
protection
tools
or
any
of
the
runtime
protection
tools,
but
now
quickly
after
the
attack
has
gained
access
to
the
kubernetes
cluster,
what
he
will
do
is
he
will
just
clone
or
he
will
create
a
carbon
copy
of
the
kubernetes
api
server.
That
way
the
attackers
can
avoid
the
detection.
Have
you
ever
seen
like?
There
are
two
kubernetes
control
planes
or
kvds
control,
plane,
pods
running
inside
the
cluster.
A
A
So
this
is
this
is
like
a
very
critical
piece
of
information
for
the
control
plane
and
because
this
cluster
has
been
designed
intentionally
vulnerable
for
the
demo
purposes.
If
you
look
at
some
important
pieces
like
there
is
an
insecure
port
which
is
open,
which
you
are
able
to
access,
and
there
is
an
insecure
bind
address.
It
says
hello,
privileged
and
authorization
mode.
These
are
like
some
important
pieces
that
you
need
to
keep
in
mind
and
the
secure
port
running
6443.
A
A
Everything
pretty
much
looks
the
same,
but
what
I'm
doing
is.
I
am
just
creating
another
api
server,
the
carbon
copy
of
the
api
server,
with
an
insecure
port
running
on
port
443,
because
usually
port
443
will
be
open
to
the
world
to
the
public
and
usually
the
firewalls
doesn't
monitor
any
traffic
on
the
port
443.
A
A
A
You
can
grab
all
the
information
so
well.
That
concludes
like
the
attacking
scenarios
for
today
and
now
we
have
like
the
defense
mechanisms,
we'll
be
going
through
how
the
role
back
access
works,
network
policies,
the
resource
constraints,
the
security
constraints
and
the
admission
controllers
work,
and
then
we
will
look
into
like
the
monitoring
stack.
How
can
we
monitor
different
metrics
inside
the
kubernetes
or
how
to
identify
the
anomalies
and
then
we'll
also
be
looking
into
brief
security
and
runtime
security?
A
A
A
Topics
right
exactly
so,
I
will
teach
you
like
all
the
difference
mechanisms
and
initially,
if
you
have
seen
in
the
jenkins
console,
we
have
an
option,
called
proceed
and
report
and
towards
the
end
of
the
workshop.
When
you
click
on
proceed,
it
will
create,
it
will
deploy
another
cluster
and
then
you
can
patch
and
you
can
practice
these
things.
That
way,
you
will
have
like
two
clusters:
one
vulnerable
cluster,
one
secured
cluster.
You
can
practice
all
the
techniques
there.
It
is
like
an
inception.
A
A
Yes,
so
on
this
page
at
the
top
right
hand
corner,
you
should
see
like
a
pdf
image
print
image.
If
you
click
on
print,
you
should
be
able
to
download
the
whole
documentation.
Whole
digital
guide
in
pdf
format,
all
right.
So
in
this
different
section
we
will
be
covering
a
few
things,
such
as
like
role-based
access
control,
the
network
policies,
resource
constraints,
security,
contacts
and
admission
controllers.
A
A
So
in
kubernetes
everything
is
a
resource,
it
could
be
pods
nodes,
services,
service
accounts
and
all
the
rest,
but
these
resources
don't
have
ownership
or
permission
attributes.
Instead,
there
are
like
additional
level
of
abstraction
which
are
called
roles
and
role
bindings,
so
the
roles
define
rules
that
specify
a
set
of
resources
and
a
set
of
verbs,
which
are
actions
that
can
be
taken
on
those
objects,
but
they
say
nothing
about
who
can
perform
those
actions,
and
this
is
where
the
role
binding
comes
into
play.
A
role,
binding
links,
a
role
to
an
identity.
A
This
might
be
a
user,
a
group
or
a
service
account.
This
will
complete
the
whole
part,
so
the
roles
and
the
role
bindings
apply
to
a
namespace,
and
there
are
also
like
cluster
wide
equivalence,
called
cluster
roles
and
cluster
role
bindings,
and
there
is
like
second
law
of
our
back.
The
second
law
of
thermodynamics
states
that
entropy
increases
over
the
time
and
the
entropy
of
our
back
tends
to
increase
over
the
time
as
well.
Basically,
I
call
this
phenomenon
as
the
second
law
of
our
back.
A
We
need
to
fight
the
tendency
to
grant
too
many
permissions
to
too
many
players.
Just
like
you
successfully
overcame
your
urge
to
scroll
down
to
the
end
of
this
book.
So,
even
though
you
have
to
jump
through
like
a
number
of
hoops
to
configure
specific
permissions
to
different
members
of
your
organization
kubernetes,
it
is
well
worth
the
effort.
A
Like
I
mean,
even
if
it
is
like
painful
to
set
up
permissions
correctly,
it
will
be
easier
than
asking
for
forgiveness
if
your
cluster
gets
compromised
due
to
like
over
generous
roll
back
and
the
most
important
advice
that
I
can
give
to.
Anyone
is
like
regarding
our
back.
It's
just
use
it
and
based
on
my
experience
or
based
on
like
the
security
architect's
experience
with
customers
have
revealed
like
there
are
like
five
most
common
mistakes.
To
look
for
in
your
our
back
configuration
settings.
A
A
A
So,
like
we
discussed
for
our
back,
we
will
have
like
two
pieces
like
the
role
and
the
role
binding.
The
role
defines
what
a
user
can
do,
what
actions
on
what
resources
and
the
role
mining
defines
to
which
user
those
attributes
apply.
So
for
that,
let
us
start
by
creating
a
namespace
to
practice
these
things,
so
we
have
created
a
namespace
and
let
us
create
two
different
users:
a
dev
user
and
an
admin
user,
and
this
is
the
command
cube.
Ctl
create
service
account
dev
user.
A
And
previously
I
have
shown
you
if
you
want
to
impersonate
a
particular
user.
We
use
the
command
for
life
in
f
and
yas,
and
the
system
service
account
the
name
space
where
the
user
belongs
to
and
the
service
account
name,
and
this
is
what
we
use
for
the
dev
user.
If
you
want
to
impersonated
a
user,
so
I
will
quickly
create
an
alias
for
you
guys
to
make
sure
it
is
easy
to
issue
the
commands
instead
of
saying,
cube,
ctrl
iphone,
then
our
back
example
a
long
command.
A
A
So
as
an
admin,
we
will
try
to
get
some
ports
there.
You
go
because
the
admin
user
have
privileges
and
he's
able
to
access
all
the
thoughts.
Now
as
a
normal
user
cube,
ctl
life
and
user,
try
to
grab
is
the
same
command.
It
says
no.
This
user
cannot
list
the
resources
paused
in
the
api
group
at
the
cluster
score
because
he
doesn't
have
enough
privileges.
A
A
Now
there
is
a
role
called
rolecat
secrets.
If
you
look
at
just
cat,
oh
yeah,
this
is
the
role.
So,
if
you
look
at
this
one,
we
basically
define
the
api
version
and
the
metadata
where
we
provide
the
name
in
the
namespace,
and
these
are
the
rules.
So
in
this
one
we
are
saying
we
are
creating
a
role
called
rule,
get
secrets,
and
this
is
the
name
space
where
this
applies
to
and
we
are
seeing.
A
This
applies
to
the
resource
secrets,
the
verbs
list
and
get
so
ideally
what
this
means
is
anyone
to
whom
this
role
is
bound.
They
will
have
list
and
get
privileges
for
the
secrets
in
the
namespace
are
by
typing
examples.
So
for
this
we
need
to
create
a
role
binding
so
before
that,
let's
apply
this.
A
I
A
A
When
we
have
tried
before
the
user
doesn't
have
privileges
to
do
anything,
but
if
we
can,
we
see
if
this
user
has
privileges
to
access
the
secrets,
the
cluster-wide?
No,
he
still
doesn't
have
access
to
access
the
secrets
across
the
cluster
because
we
have
created
or
given
privileges
only
for
the
namespace,
our
back
example.
So
this
is
how
the
roles
and
the
role
binding
works.
A
If
you
want
to
define
any
privileges
of
the
cluster
at
the
name,
space
level,
that's
when
we
use
a
role
and
then
in
order
to
bind
the
troll
to
someone,
we
use
rule
mining.
But
if
you
want
to
give
a
wide
access
the
cluster
level,
then
we
use
something
called
a
cluster
role
in
the
cluster
rule
binding.
A
So
here
the
only
difference
is
we
don't
define
a
namespace,
which
means
this
will
apply
at
the
cluster
level,
and
here
we
are
saying
that
pods
get
most
english
list,
so
anyone
to
whom
this
cluster
role
is
bound.
They
will
be
able
to
get
watch
and
list
parts
at
the
cluster
level.
So
for
that
we
need
to
create
a
cluster
rule
binding,
so,
okay,
and
so
this
now
this
is
the
cluster
rule
binding
where
the
user
service
account
dev
user.
A
Now
this
user
cube,
gta
life
and
user
should
be
able
to
access
parts
across
the
cluster.
There
you
go,
so
this
is
how
we
define
the
roles
and
the
role
bindings
and
rules
and
role
bindings.
The
cluster
roles
and
cluster
rule
bindings
play
a
very
vital
role
in
the
part
of
kubernetes
security,
because
that's
where
you
actually
define
the
identity
and
access
management
inside
the
cluster.
A
So,
in
the
very
first
scenario
where
there
is
an
anonymous
user
which
we
have
created
and
where
we
gave
classified
access,
it's
because
of
this
cluster
role
in
the
cluster
role
binding.
So
there
is
a
section
called
extra
miles
and
I
also
have
a
file
called
I've
created
anonymous.yaml
here.
What
I'm
creating
is
like
the
cluster
admin
role,
I'm
binding
to
system
anonymous
user.
So
I
want
you
to
all
to
try
both
these
exercises
and
see
what
you
can
do
and
also
like
the
impersonate.
A
So
I'm
creating
a
cluster
rule
in
a
role
mining,
a
cluster
rule
I'm
giving
like
the
verb
impersonate
to
the
users
in
the
groups,
and
I
am
attaching
this
impersonate
to
the
dev
user.
So
after
you
apply
these
things,
you
will
be
able
to
impersonate
the
dev
user
as
a
cluster
admin.
So
this
is
something
which
we
have
seen
in
the
previous
scenarios
iphone
iphone
ads.
So
I
want
you
to
try
these
things
and
the
solution
for
these.
Both
of
these
is
in
the
same
booklet.
I
want
you
to
search
this
one.
A
Well
kubernetes
by
default,
shows
all
thoughts
to
communicate
among
themselves
for
simplicity
like,
however,
you
can
use
network
security
policies
and
ingresses
to
enforce,
like
a
tiered
architecture
within
the
kubernetes.
In
simple
terms
like
network
security
policies
and
kubernetes
are
analogous
to
firewalls
to
let
or
block
the
traffic.
A
Now,
let's
quickly
review
like
the
manifest
file
and
try
to
understand
how
these
network
policies
are
actually
built-
and
these
are
like
some
important
features
like
policies
are
like
namespace
scoped
policies
are
applied
to
parts
using
the
labels
and
policy
rules
can
specify
the
traffic
that
is
allowed
to
and
from
pods
namespaces,
and
they
all
can
also
define
the
protocols.
Is
it
like
a
tcp
or
an
udp
and,
needless
to
say,
ingress
and
request,
plain
english
and
default
delay
and
alloys.
Again,
like
the
plain
english
I'm
sure,
most
of
you
are
aware
of
this
one.
A
A
So
now,
let's
go
back
to
the
previous
location.
Now
there
is
a
folder
called
network
policies,
there's
a
bunch
of
things
now
let
us
investigate
one
after
the
other.
So
let
us
start
I've
created
something
called
network
demo
app.
What
I'm
doing
for
this
demo
is
like,
basically,
I'm
creating
a
deployment.
A
A
A
A
J
J
A
A
A
A
A
Perfect,
so
at
this
stage,
like
the
nginx
has
access
to
the
public
to
the
public
world,
also
to
like
the
api
port.
Likewise,
the
api
power
has
also
access
to
public
world
and
also
api.
Now,
using
like
network
policies,
let's
see
how
we
can
actually
play
with
the
network
traffic
and
how
we
can
actually
restrict
the
traffic
between
different
pods
or
to
the
outer
world
and
external
world.
A
D
A
A
A
A
J
A
No,
I
can't
access
it
now.
Let
me
try
to
access
on
port
443
there
we
go
open,
that's
how
you
actually
can
play
with
ingress
and
address
rules,
and
you
can
restrict
the
traffic
in
most
of
the
attack
scenarios,
which
we
have
seen
like
attacking
gaining
access
to
the
web
application
and
then
from
web
application
gaining
access
to
the
jenkins
server.
All
these
things
could
have
been
restricted
by
restricting
the
traffic
between
the
ports
or
the
labels
using
this
network
policies.
A
So
after
the
workshop,
I
would
like
you
all
to
try
the
rest
of
the
things
and
towards
the
end.
You
can
click
on
proceed
and
it
takes
you
to
the
production
and
the
cluster,
and
then
you
can
try
all
these
scenarios
all
the
deployments
there.
Now,
let's
look
at
another
important
thing,
which
is
called
like
resource
constraints.
A
Well,
basically,
this
resource
constraints
is
where
we
actually
define
like
the
maximum
memory
constraints
or
maximum
cpu
constraints
for
powers
or
inside
a
namespace.
This
actually
defines
what
you
can
provide
to
a
container
or
a
port
like
the
maximum
amount
of
cpu
or
maximum
amount
of
memory
utilization
for
any
port
for
any
container.
A
A
I
have
like
created
different
files
for
your
practice,
so
let
us
start
with
this
one.
Let
us
see
what
this
file
says
set
limit
range.
There
is
an
angle
file
which
is
set
limit
range.
So,
according
to
this
file,
when,
whenever
we
create,
whenever
we
apply
this
file,
it
creates
a
limit
range
where
it
is
defining
the
maximum
and
the
minimum
cpu
limits
that
are
required
for
a
container.
A
A
So
this
is
how
we
can
actually
limit
the
usage
of
the
resources
inside
the
cluster
that
way
the
attackers
they
won't
be
able
to
perform
crypto
mining
or
they
cannot
be
able
to
max
the
resources
and
cause
any
denial
of
service
attacks
inside
the
cluster.
Now,
let's
quickly
locate
one
more
thing
cube
cdl
can
we
create
a
pod
with
the
resources
less
than
what
we
have
defined?
We
have
defined
200
minimum,
but
we
are
trying
to
launch
a
container
which
says
like
200
100.
Now
let
us
apply.
A
A
A
A
So
this
is
the
one
which
has
actually
happened
with
the
tesla
hack.
We
will
be
seeing
it
in
the
next
scenario,
so
the
hack
happens.
So
this
is
something
which
we
have
discussed
all
the
way
for
memories,
but
now
I
have
also
have
an
extra
mile
for
you.
I've
created
some
files
with
the
cpu
limits.
I
want
you
to
try
these
files
and
practice
them.
A
A
Well,
there
are
like
many
different
settings
which
actually
impact
like
security
throughout
the
kubernetes
api,
requiring
significant
knowledge
to
implement
correctly,
like
one
of
the
most
powerful
tools
kubernetes
provides
in
this
area
are,
like
the
security
context,
edits
that
every
port
and
container
manifest
can
actually
leverage,
and
basically
these
security
context
allows
for
the
definition
of
the
privilege
and
access
controls
on
a
pair
pod
basis
and
a
per
container
basis.
These
settings
basically
allow
you
to
handle
security
settings
of
your
process
like
the
kernel
capabilities,
which
can
be
restricted
only
to
the
container.
A
What
user
and
group
can
your
processes
run
inside
the
container?
What
linux
capabilities
you
want
your
process
have
and
how
you
can
restrict
as
privileged
escalations
into
the
cluster.
All
these
things
will
happen
using
like
the
security
context.
There
is
like
a
huge
documentation
for
a
community
security
context.
I
want
you
to
all.
A
A
So
here
in
this
scenario,
this
is
how
we
actually
define
like
the
security
context,
so
anything
under
directly
here
will
be
applied
to
the
pod.
Whatever
you
define,
it
could
be
run
as
a
non-root
run
as
a
user
run
as
a
group
or
a
privileged
escalation
flag
through
our
privileges,
flag,
falls
or
true.
Everything
can
be
applied
here,
but
anything
that
is
applied
inside
the
container
section
will
be
applied
to
the
containers,
and
one
thing
I
want
you
to
remember
is
anything
that
you
applied
inside.
A
The
container
will
bypass
whatever
you
have
mentioned
at
security
context
at
the
port
level,
so
whatever
you
applied
here
will
be
applying
to
the
container
instead
of
whatever
you
have
defined
at
the
power
level.
There
are
like
multiple
flags
that
I
want
you
to
try,
but
this
is
like
a
very
critical
piece
of
information
that
I
want
you
to
remember.
That's
why
we
are
looking
at
that
scenario.
Are
there
like
different
things
that
you
can
see
like
assigning,
cpu
resources
or
countering
them
as
a
username
or
report?
A
Now
I'm
creating
a
pod
with
these
settings,
the
pod
has
been
created.
Ideally,
I
gave
like
the
runners,
use
a
hundred
and
run
as
group
100
and
run
as
known
to
true,
but
at
the
container
level
I
have
provided
run
as
user
200
and
see
which
one
actually
is
considered
by
the
container
cto
exec
inside
the
pod.
A
Here
we
go,
though
I
have
provided
has
run
as
user
100
is
running
with
the
privileges
uid
200,
because
they
are
provided
at
that
one
at
the
container
level.
This
is
a
very
critical
piece
of
information.
I
want
you
to
remember,
because
this
is
where
most
of
the
devops
of
the
system
admins
built
with
the
mistakes,
and
if
you
want
to
try
like
different
flags,
it's
these
are
like
the
different
flags
that
are
available
for
this,
and
this
workshop
is
not
sufficient
to
go
through
each
and
every
flag.
A
And
if
you're
new
like
this,
basically,
these
admission
controller
is
a
mechanism
by
which
requests
coming
to
the
kubernetes
api,
so
it
can
be
intercepted
prior
to
getting
stored
in
the
lcd.
They
are
like
part
of
the
cube
api
server
binary
and,
using
this
admission
controller,
we
can
control
the
request
coming
to
the
kubernetes
cluster.
Basically,
these
admission
controllers
limit
requests
to
create
delete,
modify
or
connect
to.
They
do
not
support
the
read
request.
A
So
and
basically,
if
you
look
at
the
picture,
it
defines
what
it
actually
does
and
then
like
two
types
of
controllers,
validating
and
mutating
the
difference
between
these
two
is
that
mutating
web
can
modify
objects
sent
to
the
api
server
to
enforce
custom
defaults.
While
a
validating
admission
can
reject
requests
to
implement
custom
policies,
so
validating
web
can
only
be
used
to
admit
or
deny.
So.
In
this
example,
now
different
scenarios
we'll
be
looking
at
the
validating
web
hooks,
and
for
that
we
use
like
the
oppa.
A
This
open
policy
agent
basically
offers
an
open
source
service
that
can
evaluate
inputs
against
user
defined
policies
and
marks
the
input
as
either
passing
or
failing.
I
mean
like
any
application
or
service
that
can
be
configured
to
make
an
api
request
for
determining
authorization
or
other
policy
decisions,
can
integrate
with
oppa.
A
Basically,
oppa
evaluates
only
whether
a
request
confirms
to
the
required
policies.
It
is
like
mostly
like
validating
the
book
either
deny
or
hello,
and
basically
this
oppa
is
written
using
a
rego
users
can
write
policies
using
this.
A
language
regulation
has
like
very
simple
syntax
and
small
set
of
functions
and
operations
optimized
for
query
evaluation,
so,
for
example,
opa
generates
policy
decisions
by
evaluating
the
query,
input
and
against
policies,
and
data,
opa
and
rego
are
like
domain
agnostics.
A
So
you
can
describe
almost
any
kind
of
variant
in
your
policies,
for
example,
which
users
can
access
which
resources
which
subnets
address
traffic
is
allowed
to
wear
and
which
clusters
a
workload
must
be
deployed
to
which
os
capabilities
a
container
can
execute
with.
So
this
is
this
acts
like
an
additional
layer
of
security
inside
the
kubernetes
cluster,
though
we
have
like
our
back
or
we
have
like
seen,
security
contacts
or
anything
but
mostly
opa.
This
is
where
you
can
define
certain
policies
as
per
the
organization.
A
A
So
now,
let's
look
at
some
quick
examples
for
this
to
work.
You
need
to
issue
this
command.
Launch
opa
stack
workshop,
iphone
dev.
This
will
set
up
all
the
requirements
that
are
required
for
testing
open,
launch
opa
stack
workshop,
iphone
dev.
It
says
openstack
launched
successfully
in
case.
If
anyone
has
issues
with
it,
just
give
the
command
called
tia,
and
this
one
and
then
launch
it
again.
It
will
work
so
it
will
basically
deploy
a
few
containers.
A
A
A
A
constraint
template
consists
of
both
a
logic
that
enforces
the
constraint
and
the
schema
for
the
constant,
which
includes
the
schema
of
the
crd
and
the
parameters
that
can
be
passed
into
a
construct.
I'll,
explain
you
in
detail
I'll
show
you
the
file.
The
constraint
is
an
object
that
says
on
which
resources
are
the
policies
applicable
and
also
like
what
parameters
are
to
be
queried
and
checked
to
see
if
they're
available
in
the
resource.
A
So
let
us
check
yep,
our
gatekeeper
setup
is
up
and
running
now
let
us
get
into
this
folder
oppa
and
I
have
created
so
many
scenarios
for
you
to
practice.
So
let
us
start
with
the
scenario
called
privileged
containers.
Let
us
get
into
privileged
containers
and
c
and
start
with
template.
This
is
the
one
which
I'm
discussing
about
the
constant
template.
So
here
in
this
constant
template,
we
define
the
logic
that
needs
to
be
enforced
here.
I'm
saying
that
I'm
writing
a
small
violation
message.
A
If
the
security
context
has
anything
or
a
flag
called
privileged,
just
say,
privileged
container
is
not
allowed
security
context.
Science
is
enabled
so
after
we
apply
this
one.
Let
us
see
if
anyone
inside
the
infrastructure
can
deploy
any
privileged
containers
in
the
infrastructure
or
not
so
cubectl
apply
iphone
f.
A
Now
let
us
look
at
the
constraint.
We
have
applied
constant
template
now.
Let
us
see
what
constraint
is.
It
says
all
right.
We
have
created
a
constant
template,
and
now
we
are
creating
a
template
which
actually
says
to
which
it
should
be
applied
like
on
which
resources
are
the
policies
applicable.
So
we
are
applying
this
policy
of
the
template
to
the
resources
parts
and
we
are
also
excluding
kubernetes
cube
system.
Now.
What
this
means
is.
A
A
A
A
F
A
Sure
yeah,
the
constant
template,
basically
consists
the
logic
that
enforces
the
constraint.
So
here
I
have
shown
you
the
file.
This
is
the
constant
template
here,
we're
defining
the
logic.
So
the
logic
is:
if
the
security
context
has
the
privilege
flag
make
sure
the
privileged
container
is
not
allowed.
A
A
So
this
constraint,
we
are
creating,
like
security
context
privileged,
and
we
are
applying
it
to
the
pods,
because
security
context,
privilege
can
also
be
applicable
to
the
pod
security
policies.
Even
when
you
define
the
port
security
policies,
you
can
define
the
flags
the
security
context
flag,
but
in
this
scenario
we
want
this
thing
to
be
applied
only
to
the
pods.
A
A
A
This
is
one
of
the
examples
where
we
have
tried
like
shell
on
pod,
where
we
deployed
a
daemon
site
and
then
we
were
able
to
ssh
or
exec
into
that
particular
pod
and
we
gained
access
to
the
underlying
post.
That's
because
we
were
able
to
mount
the
host
path
volume
onto
the
host,
so
we
can
restrict
such
attacks
using
this
one.
So
we
will
see
what
the
template
is.
A
A
A
A
There
you
go,
it
gives
us
an
error
message
like
host
path.
These
things
is
not
a
load.
A
load
path
is
for
read
only
true,
so
I
want
you
to
find
out
a
solution
for
this,
because
we
couldn't
launch
this
one
just
identify
solution.
What
is
the
right
one
to
actually
mount
this
try
to
play,
replace
this
one,
slash
temp
with
slash
f40
and
try
to
deploy
and
play
with
it.
So
these
are
like
two
examples
for
oppa.
A
Cluster
and
I'm
sure
you
must
be
like
well-versed
with
the
poor
security
policies
or
security
pulses,
apply
at
or
act
as
an
additional
layer
of
security
with
pretty
much
which
works
like
an
oppa.
I'm
not
going
to
discuss
much
about
the
psps,
because
they're
going
to
be
deprecated
anytime
soon,
but
it's
still
like
a
valid
thing
that
you
need
to
be
looking
into
this
stuff
and
now,
let's
get
into
like
the
monitoring.
A
Well,
you
might
be
wondering
like
why
are
we
doing
this?
After
all,
the
humanities
cluster
has
like
multiple
components
and
layers
and
across
each
of
them
we
will
find
like
different
failure,
points
that
we
need
to
monitor
and
there
are
like
some
typical
use
cases
for
kubernetes
monitoring.
It
could
be
like
the
cluster
resource
usage,
for
example,
is
the
cluster
infrastructure
underutilized
or
rv
like
over
capacity,
or
we
can
like
identify,
node
availability
and
the
health
of
the
underlying
nodes,
or
in?
A
Are
there
any
like
missing
and
failed
pods
or
the
pod
resource
usage
against
the
requests
and
limits?
All
these
things
can
be
identified.
The
monitoring
monitoring
plays
a
very
vital
road.
Needless
to
say,
it
would
be
like
the
kubernetes
infrastructure
or
the
docker
infrastructure
or
any
normal
networking
infrastructure.
A
A
And
basically
like
the
data
in
elasticsearch
is
on
a
disk
as
an
unstructured
json
objects,
but
the
case
for
each
object
and
the
contents
of
the
keychair
index
and
in
comparison
a
loki
is
another
source
is
like
a
single
binary
mode
that
can
store
data
on
the
disk
and
fluency.
I
want
you
to
all
to
read
this
I'll
leave
it
to
you
guys,
but
for
today's
demo,
we'll
be
looking
at
like
the
loki
prometheus
grafana
stack.
A
Let
us
start
with
the
installation.
Installation
is
pretty
straightforward.
I
have
set
up
everything
for
you
inside
the
cluster.
Let's
go
to
this
one
cd
slash
root
and
you
need
to
run
this
command,
launch
monitoring,
stack,
ultra
wife,
and
then
it
will
create
the
whole
setup
for
you.
Wow
has
been
encountered
so
probably
I'll.
Give
this
a.
A
A
So
if
anybody
has
any
issues,
while
doing
it
just
issue
the
command
here,
the
same
instead
of
launch
and
then
relaunch
it
again,
it
will
give
you
on
which,
how
to
access
the
dashboard.
This
is
the
ip
address
on
the
port,
where
you
should
be
accessing
the
dashboard,
and
these
are
the
credentials
log
in
with
the
username
admin
and
the
password.
This
one
usually
takes
a
minute
to
do
because
it
will
spin
up
your
whole
prometheus
loki.
A
A
A
A
So
when
a
request
comes
into
like
the
kubernetes
api
server,
it
can
create
one
of
the
several
different
audit
events,
such
as
like
creating
a
new
folder
or
service
account
the
service
filters.
These
events
through
an
audit
policy
and
what
is
an
audit
policy.
It
is
basically
a
set
of
rules
that
defines
which
audit
event
should
be
recorded
and
where
they
should
be
sent.
A
A
A
A
A
A
A
A
Now
what
we
are
going
to
do
is
we
play
with
some
important
metrics
just
go
to
this
option.
Click
on
explore
and
then
make
sure
you
choose
like
prometheus
or
loki
for
prometheus.
You
will
be
able
to
see
different
resources
and
for
loki
you
will
be
using
the
loki
as
the
resource.
You
will
be
able
to
see
all
the
kubernetes
events.
Let
us
start
with
this.
A
A
Or
maybe,
let's
start
with
loki
so
click
on
log
browser
and
then
click
on
pod
and
make
sure
you
always
choose
the
kubernetes
api
server
dev
control
plane,
because
this
is
from
where
the
control
plane,
we
get
all
the
kubernetes
events
and
make
sure
you
change
the
time
to
last
five
minutes
so
that
the
search
will
be
pretty
quick.
So
this
is
how
the
kubernetes
events
look
like
the
container
or
the
name
space
where
the
container
is
running
board
and
all
these
things.
A
A
A
I
A
A
This
piece
of
information
is
very
critical
for
anyone
for
any
network
monitoring
or
security
monitoring
or
the
sort
teams,
because
if
someone
announced,
if
some
anonymous
user
is
trying
to
access
the
resources
inside
the
cluster
and
if
they
come
across
any
successful
request,
that
is,
that
could
be
considered
as
a
compromise.
Now,
how
do
we
actually
identify
these
things
here?
A
There
you
go.
It
will
list
all
the
successful
requests
which
have
been
performed
by
the
anonymous
user,
which
we
have
done
since
right
from
the
beginning
of
the
workshop.
But
here
because
I
have
chosen
last
five
minutes,
it
will
show
us
whatever
I
have
done
a
few
minutes
back
and
now.
I
want
to
see
all
the
resources,
all
the
requests
where
they
try
to
access
the
secrets
and
which
have
been
successful.
A
A
D
A
Now,
let's
also
quickly
look
at
how
we
can
do
some
activities
at
the
resource
level.
For
example,
if
you
go
to
prometheus
and
you
have
like
different
metrics,
which
comes
by
default,
it
will
be
all
the
metrics
related
to
kubernetes
api
server,
see
all
the
admission
control,
the
duration
or
the
different
number
of
audits,
total
or
audit
a
level
total.
A
There,
like
n
number
of
things
that
you
can
try
from
here
so
and
next
you
can
go
to
like
the
container
get
some
information
about.
Like
the
network
transmission,
that's
been
happening
on
the
containers
or
the
cpu
period
or
the
cpu
load,
or
the
memory
limit
that's
been
being
consumed
by
different
containers.
A
A
A
A
A
A
J
A
Right
and
previously
we
were
discussing
about
a
scenario
where
we'll
be
looking
after
the
crypto
mining
attack,
so
we
will
look
after
this
crypto
mining
in
this
scenario,
what
happens
actually
in
crypto
mining
and
basically
how
we
can
actually
identify
the
mining
in
the
monitoring
stuff.
So
for
this
I
want
you
to
all
to
download
this
yaml.
A
Just
paste
this
command,
it
should
download
crypto.cml.
Let's
see
the
contents,
what
we
have
inside
the
crypto.camel,
it's
basically
like
an
attacker
doing
some
crypto
mining.
These
are
the
commands
which
he
has
issued
and
this
will
be
doing
the
mining
for
him.
He
has
also
defined
like
the
memory
limits
and
the
cpu
to
ensure
they
are
like
another
limit
so
that
it
won't
get
detected
now
apply
this
one.
A
D
A
So
let
us
open
this
one
everything
looks
valen
good.
Everything
is
like
green.
Your
cpu
utilization
is
under
the
limit,
your
partitions,
or
it
could
be
like
your
download
and
upload
everything
seems
to
be
under
control,
but
let
us
see
what
happens
in
the
next
few
minutes
now
that
we
have
deployed
the
crypto
miner
and
again
make
sure
you
don't
run
it
for
more
than
a
minute
if
you
have
deployed
it
to
on
your
cluster.
A
A
Well,
it
says
like
cpu
stone
to
orange
and
memory
utilization
has
been
done
to
orange
and
the
disk
write
operations
have
been
turned
to
orange
and
they
have
been
increased
a
lot.
The
download
and
upload
just
keep
observing
like
the
memory
utilization
of
the
utilization
is
being
increased,
but
while
this
happens,
I
would
like
to
delete
this
image.
Otherwise
it
will
consume.
A
More
and
before
that,
I
would
like
to
show
you
the
stuff:
let
us
get
to
the
explorer
and
if
you
want
to
see
like
what's
actually
that
crypto
is
doing,
go
to
like
the
matrix
and
choose
loki,
the
log
browser
choose
pod
and
then
go
to
the
choose.
The
pod
miner,
the
show
logs
it
will
show
you
like,
what's
been
actually
being
done
by
this
particular
pod.
A
A
And
like
previously
one
someone
has
asked
me,
this
question,
like
have
a
son,
but
if
somebody
gives
or
launches
the
container
within
the
limits
of
the
defined
cpn
memory
elements,
so
this
is
what
the
attackers
are
basically
doing.
This
is
what
actually
happened
with
the
tesla
attack.
They
made
sure
like
they
launched
crypto
miners
with
very
minimal
cpu
and
memory
utilization.
So
that
way,
even
like
the
monitoring
tools
could
not
detect
it.
For
many.
A
A
So
now
that
we
have
stopped,
everything
is
coming
under
control,
the
cp
utilization
got
down
to
36
35
and
the
member
utilization
is
coming
down.
So
basically,
this
is
one
of
the
use
cases
where
monitoring
plays
a
very
vital
role,
the
utilization
and
using
this
things
you
can
identify
these
kind
of
memory
attacks
and
also
because
I
have
created
some
alerts,
I
keep
receiving
some
alerts
in
my
slack
channel
like
if
you
look
at
these
are
the
alerts
see
utilization
high
cpu
utilization
is
high.
A
A
A
So
you'll
have
like
multiple
and
number
of
logs
and
the
different
fields
for
you
to
explore.
So
if
you
go
back
to
the
workshop
this
one,
let's
try
last
few
more
rules
this
time,
let's
try
to
identify
any
anomalies
inside
the
cuban
events.
Now
that
we
have
seen
like
issues
with
the
resource,
utilization
and
other
things
now,
let
us
see
what
if
some
cube
anomalous
happens
inside
the
kubernetes
cluster,
like
someone
anonymous
user
trying
to
access
something
or
creating
secrets
or
exit
something,
these
kind
of
things.
J
A
A
A
A
A
It
says,
like
there
are
total
nine
spaces
which
are
inside
the
cluster,
so
even
here
you
can
define
some
alerts,
for
example
by
default.
If
you
know
hey,
these
are
the
name
spaces
which
we
agreed
to
be
deployed
by
the
deployment
team
and
by
default.
If
you
know
there
are
nine
and
if
by
any
chance,
if
somebody
happens
to
create
another
name
space,
you
can
immediately
receive
an
alert.
Likewise,
if
you
have
limited
number
of
deployments
or
anything,
you
can
immediately
get
an
alert.
Now,
let's
look
at
some
interesting
examples.
A
So
let
us
write
a
query,
so
this
is
something
the
stuff
which
we
have
seen
before
like
if
you
want
to
identify
like
the
anonymous
users
accessing
secrets
or
the
number
of
anonymous
user
accessing
powers
and
nodes
and
then
like
a
number
of
use
cases,
there
is
like
no
limit,
for
you
can
go
to
any
extent,
but
these
are
like
few
examples,
so
this
is
pretty
much
about
the
monitoring
stack.
I
want
you
all
to
try
all
these
commands
and
different
alerting
techniques
and
mechanisms
and
setting
up
the
stack
is
very
straightforward.
A
You
just
need
to
launch
one
single
command
now,
let's
move
on
to
like
the
build
phase
security
when
it
comes
to
like
the
community
security,
there
are
like
three
phases
like
build
phase
security
and
the
deployment
phase,
security
and
the
runtime
phase
security.
So
so
far
what
we
have
seen
are
like
the
deployment
phases
like
ensuring
we
have
good
containers
up
and
running.
We
have
good
role,
role
based
access
controls,
we
have
appropriate
network
policies
or
we
have
like
secured
security
contacts
applied.
A
Having
known
vulnerabilities
is
very
bad
to
leaving
the
organization,
doors
and
windows
wide
open,
because
the
exploits
are
readily
available,
and
this
is
the
reason
why
we
use
vulnerability.
Scanning
and
vulnerability
scanning
is
like
an
organized
approach
to
the
testing,
identification,
analysis
and
reporting
of
the
potential
security
issues
on
a
network,
and
this
vulnerability
scanning
is
very
safe.
It's
like
non-destructive
non
destructive
form
of
testing
that
provides
like
immediate
feedback
on
like
the
security
of
the
container
images.
A
So
this
is
something
which
we
actually
perform:
the
vulnerability
scanning
on
the
images
that
we
build
or
that
we
use.
So
this
can
also
actually
happen
at
two
phases.
One
is
during
before
actually
deploying
the
image
you
can
run
the
image
you
can
scan
an
image
and
if
there
are
like
any
vulnerabilities,
you
can
patch
it,
or
there
is
also
possibility
that
after
you
deploy
the
image,
somebody
might
discover
a
new
vulnerability
and
that
vulnerability
might
exist
inside
your
image.
That's
why
you
need
to
also
perform
a
runtime
security
scan.
A
I
D
A
It's
pulling
like
the
drive
scanner
before
it's
installed.
Now
what
we
are
going
to
look
at
is
we
are
scanning.
We
are
going
to
scan
a
couple
of
images
inside
the
host.
So
if
you
issue
the
command,
docker
images,
these
are
the
containers
which
we
have
inside
the
cluster.
Now,
let's
try
to
scan
this.
One
just
need
to
grab
the
image
id
it's
as
simple
as
pass
the
scanner
name
and
the
image.
That's
it
the
next
one
minute
you
should
have
all
the
vulnerabilities
that
exist
inside
your
container
image.
A
A
A
The
scan
has
been
completed
and,
if
you
look
at,
we
have
like
these
mini
vulnerabilities
like
close
to
104
vulnerabilities
inside
this
container
image,
and
we
have
like
close
to
160
packages
inside
this
thing.
So
this
is
how
we
actually
use
to
identify
the
vulnerabilities.
Now,
let's
try
one
more
thing.
D
A
A
J
A
This
is
like
a
very
much
cringe,
even
like
multi-billionaire
companies,
like
multimedia
companies,
will
also
face
these
issues
and
there
is
like
no
appropriate
solution.
The
only
solution
that
we
follow
is
like
they
build
in-house
inbuilt
images
or
they
use
sometimes
wherever
possible.
They
build
images,
something
called
from
the
scratch
or
they
use.
Some
multi-stage
builds
they're
like
different
ways
to
actually
reduce
the
bugs,
but
there
is
no
way
one
can
say.
Okay,
this
is
like
vulnerability,
free
image.
A
A
A
So
they
are
again
sassed
and
dashed
they
fall
under
like
the
application
security.
The
sas
is
called
like
static
scanner,
which
will
scan
for
the
vulnerabilities
in
the
code
format.
Whether
are
you
following,
like
appropriate
input,
validation
sanitization
for
these
kind
of
things
in
the
code
and
the
dashed
works
like
the
dynamic
thing,
as
if
an
attacker
is
attacking
your
machine
once
the
whole
deployment
is
done,
the
sas
is
different.
That's
just
different,
and
this
kind
of
docker
container
image
is
different
and
the
vulnerability
of
the
network
is
different.
Security
is
different.
K
Yeah,
you
know,
is
there
any
good
paper
or
something
see?
There
is
a
sequence:
let's
see,
developer
checks
in
code
and
then
we
got
to
do
is
probably
assass
scan
first
right
and
then
once
that
is
done,
you
have
to
build
the
image
right
and
then
probably
scan
for
your
image
vulnerabilities
right
like
what
is
what
yeah.
I
A
A
Yeah,
so
we
have
covered
till
the
container
scanning,
and
these
are
like
some
other
open
source
tools
which
you
can
use.
One
is
like
the
trivia,
the
other
one
is
clear:
pretty
much
do
the
same
job,
it's
just
the
ui
might
change
a
bit,
but
pretty
much.
They
use
like
the
open
world
of
big
database
and
check
them
against
the
packages.
Pretty
much
do
the
same
stuff.
Now,
let's
look
at
the
runtime
security.
A
Basically
like
runtime
security
means
wetting
all
activities
within
the
container
application
environment,
from
analysis
of
container
and
host
activity
to
monitoring
the
protocols
and
payloads
of
network
connections.
You
know
what,
basically,
what
kind
of
problems
does
this
solve?
The
container
runtime
security
in
the
build
phase
security?
A
We
have
seen
like
how
to
secure
the
docker
images
identifying
any
vulnerabilities
even
before
they
gets
into
the
cluster,
and
then
we
have
seen
deployment
phase
security
where
we
secure
like
the
role
based
access,
control,
security
context
and
everything-
and
this
is
like
the
runtime
security
when
actually
the
cluster
is
deployed
and
when
all
the
operations
are
being
done.
So
what
kind
of
problems
does
it
solve?
A
Are
my
hosts
and
containers
doing
something
they
shouldn't
be
doing
like
building
runtime
models
and
monitoring
for
deviations
and
identifying
any
spawn
processes
like
did
my
postgres
sql
container,
spawned
in
unexpected
process
or
file
system,
reads
and
writes
that
someone
install
a
new
package
or
change
configuration
in
a
running
container
or
network
activity?
Did
my
container
open
a
new
listening
port
or
unexpected
outgoing
connections,
or
also
like?
Did
the
kubernetes
user
spawn
a
shell
into
a
privileged
container,
these
kind
of
things?
A
A
J
A
Now,
what
all
hacks
that
we
have
been
doing
right
from
the
step
one
it
could
be
like
creating
reverse
shells
or
running
netcat
or
executing
into
different
containers,
or
doing
some
accessing
crickets
unwanted
stuff.
All
these
things
can
be
identified
by
a
runtime,
a
security
checks
instantly
and
immediately.
Let
us
see
that
in
action,
how
it
actually
works
so.
J
A
A
D
A
A
A
We
will
come
back
in
this
one
in
a
while,
let's
move
on
to
like
the
next
scenarios,
like
the
tools
of
the
trade,
so
these
are
like
some
important
tools
which
are
any
devops
or
anyone
who
actually
uses
with
kubernetes
needs
them
in
their
arsenal.
So
let
us
start
with
canines
canines
is
like
basically
provides
a
terminal
ui
to
interact
with
your
humanities
clusters.
The
aim
of
this
project
is
to
make
it
easier
to
navigate,
observe
and
manage
all
your
applications
and
setting
it
up
is
like
very
easy.
Just
run.
These
few
commands.
A
Yeah,
it's
all
done
now.
Launching
this
tool
is
like
very
simple,
just
run
k9s
there
you
go,
it
gives
you
like.
A
very
this
looks
like
a
web
application,
but
it's
like
a
ui
cli
and
it's
very
user
friendly.
It
will
give
you
all
the
information
about
the
powers
deployments
that
are
running
and
if
you
want
to
see
different
nodes,
just
type
nodes.
But
if
you
want
to
see
parts
you
can
type
pods
if
you
want
to
type
daemon
search
search
for
daemon
set.
A
D
A
D
A
So
if
you
look
at
this
section,
it
will
give
you
all
the
shortcuts,
like,
for
example,
c
copy
mark
all
these
things,
and
here,
if
you
want
to
do
some
port
forwarding
or
if
you
want
to
get
a
shell,
you
can
get
a
shell
or
you
can
edit
describe
delete,
attach,
kill.
You
can
perform
all
the
commands
from
here.
This
is
like
a
very
handy
tool.
A
A
A
H
A
I
J
A
A
A
A
Yeah,
this
is
a
little
heavy
image.
Oh,
it
says
started
container
tool.
Then
it
should
be
all
good
yep,
it's
all
up
and
running
now,
if
you
guys
access
the
browser
yeah.
So
this
is
how
the
ui
looks
like
in
case.
If
you
happen
to
give
slack
channel,
you
can
see
the
alerts
in
the
slack
it
says
already,
there
is
a
privileged
container
has
been
launched,
some
sensitive
mount
container
or
the
pseudo
set
uid.
Now
what
we
are
going
to
do
is
we
are
going
to
run
some
test.
A
A
A
A
So
this
is
pretty
much
what
a
runtime
security
does,
even
if
you
have,
if
somebody
like
launches
a
privileged
container
or
if
somebody
launches
a
container
with
sensitive
host
path
mode
or
if
somebody
launches
like
a
suspicious
networking
tool
like
netcat
or
something
else
or
if
somebody
performs
like
privileged
escalation
or
somebody
tries
to
run
some
exploits
inside
your
infrastructure
or
somebody
even
tries
to
gain
access
to
the
shell
or
executing
into
the
container.
All
these
things
will
be
alerted
immediately
to
the
security
team.
This
is
called
like
runtime
security.
A
Anything
that
is
happening
during
the
runtime
will
immediately
be
alerted
to
the
team.
So
this
I
want
you
all
to
try
different
things
like
everything
that
we
have
done
in
the
attack
scenario.
Just
try
them
again
and
see
if
you
can
actually
see
the
alerts
and
if
you
actually
see
the
alerts,
how
you
can
use
like
the
defenses
that
we
have
seen
and
how
to
like
defend
them,
you
can
try
it
in
the
another
cluster.
A
A
Think
it's
done
now
just
run
popeye.
It
will
basically
scan
your
cluster
for
all
the
things
and
it
will
give
you
like
what
is
good.
What
is
bad,
it
will
scan
for
your
roles,
role,
mining
secrets,
cluster
roles,
cluster
role,
mining,
all
these
kind
of
things,
it's
very
simple
and
very
lightweight,
and
you
can
also
try
two
other
tools.
Like
cube
audit
and
cube
bench.
A
A
It's
called
cube,
striker
dot
io,
so
there
is
like
a
documentation
page
for
it,
and
basically,
I
started
building
this
tool
somewhere
like
towards
end
and
bid
of
2020
and
cube.
Striker
performs
numerous
in-depth
checks
on
range
of
services
and
open
person,
communities
platforms.
It
will
like
scan
self
management.
Cloud
provider
managed
humanities
infrastructure,
it
performs
various
tricks
on
open
codes
or
it
performs
like
automated
enumeration
in
case
of
the
insecure
port
and
other
ports
are
open,
performs
both
authenticated
and
authenticated
scans.
A
A
Striker
for
various
platforms,
you
can
scan
eks
self,
manage
aws,
gke
or
whatnot,
so
this
is
how
the
ui
looks
like
and
can
also
be
integrated
with
the
ci
cd.
So
every
time
you
create
some
deployments
in
your
dev
or
even
before
the
deployment
happens
into
the
production
environment.
You
can
use
this
tool
in
your
csc
pipelines
and
identify
any
issues
even
before
they
made
it
to
the
production.
A
A
A
So
make
sure
you
start
this
page
so
that
you
will
get
constant
updates,
like
whatever
I'm
updating,
whatever
things,
I'm
giving.
The
reason
why
I
didn't
show
this
one
in
the
demo
is
because
I
don't
want
to
publicize
in
my
workshops,
but
it
is
like
very
straightforward
to
use
that
very,
very
user
friendly
and
very
highly
capable
of
scanning.
Like
the
kubernetes
clusters.
You
have
two
versions
like
command
line.
Interface
looks
like
this
and
the
web
application
interface.
We
can
use
either
of
them
and
if
anybody
wants
to
contribute,
I'm
like
more
than
happy.
A
That
is
pretty
much
cube
striker,
so
we
have
covered
the
kubernetes
basics.
We
have
covered
different
attacks.
We
have
covered
different
defense
mechanisms,
we
have
looked
into
the
monitoring
stack
using
prometheus
grafana
and
we
have
seen
like
container
scanning
and
we
have
performed
runtime
basic
runtime
security
using
falco.
A
It
is
like
continuously
generating
some
alerts.
You
can
actually
go
here
to
the
events
and
see
why
it's
actually
an
alert
and
we
have
covered
different
tools.
We
have
seen
canines,
we
have
seen
popeye,
we
have
seen
cube
striker
and
we
have
seen
like
different
real
world
attacks
and
hacks.
So
what
you
can
do
is
you
can
pretty
much
click
on
proceed
now
it
will
deploy
another
container.
The
only
thing
that
you
need
to
do
is
in
your
machines.
You
need
to
create
an
alias
something
like
now
cube
cdl
equal
to.
A
So
basically
you
have
like
no
two
clusters.
One
is
the
cluster,
the
other
one
is
broad
cluster.
So
whatever
defense
mechanisms
we
have
seen
and
whatever
attacks
we
have
done,
you
can
actually
keep
trying
that
stuff.
I
can
give
you
the
solution
straight
away,
but
if
you
like
look
at
the
solutions
you
won't
be
able
to
learn
and
until
unless
you
do
something
hands-on,
you
won't
learn
much.
But
if
you
want
solutions
you
can
always
reach
out
to
me.
A
I
will
give
the
next
one
to
rule
is,
but
I
want
to
make
sure
you
try
something
before
you
reach
out
to
me
to
the
solutions.
So
you
have
like
two
setups
up
and
running.
It's
like
an
inception
started
with
a
docker
container
and
inside
a
docker
container.
We
have
like
humanities
cluster
inside
the
kubernetes
cluster.
You
have
a
jenkins
image
and
then
two
kubernetes
clusters
took
a
lot
of
time
and
effort
to
build
this
infrastructure
and
pretty
much.
You
can
download
the
documentation
from
here
by
clicking
this
image
and
yeah.
A
That's
pretty
much
concludes
the
workshop
today
we
are
on
time
and
I'm
like
happy
to
take
any
questions.
If
you
have
in
case,
if
you
have
learned
something
just
let
me
know
hey
some.
This
is
good
or
if
you
need
any
improvements
for
the
next
workshops,
I'm
like
more
than
happy
to
take
your
suggestions
and
make
them,
but,
like
I
said
I
had
to
cut
down
most
of
the
content
to
ensure
we
covered
most
of
the
stuff
in
the
four
hours.
A
A
Yep,
and
also
if
you
like,
the
workshop,
just
write
a
quick
feedback
wherever
you
can
and
if
you
have
any
suggestions,
you
can
always
give
me
pass
on
those
suggestions,
cool
guys.
That
pretty
much
concludes
the
today's
workshop.
Thank
you
very
much
for
joining
the
session
and
thank
you
for
being
very
patient
and
yeah.
I'm
happy
to
take
any
questions.
If
you
have.
H
G
H
G
D
G
Company
called
cloudsec
yep,
and
so
I
am,
I
have
some
certifications
like
oscp
and
all
that
okay
yeah,
but
I
am
interested
in
cloud
actually
I'm
trying
to
dive
deep
into
the
cloud
concepts
now.
So
my
question
is:
I'm
more.
I,
like
my
work
responsibilities.
This
is
a
carrier-based
question.
I
hope
it's
okay,
so
I'm
more
into
I
mean
my
work
is
more
into
applicant
security
right.
That
makes
sense.
So
excuse
me.
A
I
A
A
G
A
Exactly
so
talk
to
your
boss
and
ask
him
to
put
you
in
some
projects
where
you
can
actually
penetration
or
do
some
penetration
testing
on
kubernetes
and
cloud
environments
and
see,
I
always
give
one
advice
for
any
of
the
security
of
professionals
or
the
beginners
before
you
want
to
break
or
penetrate
anything.
You
should
actually
learn
how
to
build
it.
A
For
example,
if
you
said
you
are
like
an
application
security
specialist
in
order
to
attack
and
break
the
application,
you
should
also
know
how
the
application
works
and
how
the
people
have
built
it,
and
that's
when
you
can
actually
explain
to
the
developers
what
the
mistake
they
have
done
and
how
they
have
actually
how
to
actually
correct
it.
Likewise,
if
you
want
to
learn
cloud
and
container
security,
you'll
have
to
start
building
it,
create
your
own
cloud
account
they're,
like
so
many
open
source.
A
I
mean,
I
don't
say,
open
source
they're
like
many
giving
like
free
credits
where
you
can
use
with
azure
or
gk
or
cloud
start
actually
deploying
your
things
start
configuring
different
things,
learn
how
to
how
the
security
grows.
What
cloud
works?
What
are
the
things
that
actually
work
and
then
start
breaking
them,
and
then
you
and
trust
me,
you
don't
need
experience,
you
just
put
them
in
your
resume
and
tell
them
hey.
A
If
you're
exclusively
working
in
a
penetration
testing
consultancy,
then
it
might
be
a
little
challenging
for
you
to
work
with
some
other
teams,
but
there
are
always
like
startups
and
meetups
conferences
like
this,
and
these
days,
like
a
cloud
group
and
all
these
things
are
providing
multiple
resources
where
you
can
actually
do
hands-on
stuff
and
learn.
That's
the
only
way
you
have
to
do
it
in
order
to
learn,
and
then
trust
me
like
learn
the
basics
and
start
applying
for
jobs.
You
should
be
able
to
get
it.
F
G
H
G
A
Exactly
and
then
you
should
actually
configure
the
stuff.
You
should
know
how
the
different
components
in
cloud
works.
That's
when
actually
can
secure
it
and
that's
when
you
will
be
able
to
break
it,
but
yeah
anyways
happy
to
help
you
on
this
stuff.
I
can
provide
you
more
resources,
connect
with
me
on
linkedin
and
leave
a
message.
H
K
A
Absolutely
I
was
about
to
tell
you
on
this
thing,
because
I
I
may
not
be
able
to
cover
everything
in
the
demos
in
the
few
hours
we
have,
you
can
integrate
it
with
slack.
You
can
integrate
it
with
email,
you
can,
you
can
integrate
it
with
different
tickets.
In
fact,
you
can
even
integrate
it
with
the
prometheus
grafana
stack
that
we
have
seen.
If
you
follow
the
documentation,
you
should
be
able
to
integrate
like
this
falco
with
the
prometheus
and
then
again
you
can
write
alerts.
A
I
K
Wonderful,
actually,
I
see
I
say:
I've
been
more
into
technology,
manage
management
and
stuff
doing
a
devops
engineers
work
with
me
right.
You
see
unless
you
are
hands-on
a
little
bit
right.
You
can't
appreciate,
I
know
some
challenges
I
had
faced
but
see
I
with
the
face.
I
was
not
able
to
fully
do
it
and
then
I
thought.
Okay,
let
me
listen
and
understand
the
things
and
then
follow
up
with
your
material,
so
that
I
would
definitely
do
and
then
with
any
questions,
definitely
I'll
be
interested.
K
It's
a
good
thing,
great!
Basically
right,
I
will
be
in
touch
on
a
few
things.
Let's
see
basically
within
companies
right,
there
is
a
team
which
does
the
kubernetes
setup
and
cluster
and
protection
sector
and
blah
blah
actual
devops.
We
don't
do
all
these
security
related
mechanisms,
but
we
only
the
things.
What
we
do
is
more
on
a
deployment
perspective,
right,
yeah
and
see
as
because
what
I
see
the
gap
is
right.
Unless
you
know
this
right,
you
can't
they
are
they're
kind
of
doing
the
right
things.
We
don't
know
right
exactly.
A
And
this
is
like
a
major
gap
in
not
just
your
organization
in
like
most
of
the
organizations,
and
this
is
like
a
gap
between
like
the
security
professionals
and
devops
devops,
doesn't
know
what
security
is
and
security
people
doesn't
know
how
the
devops
works.
This
is
like
a
huge
gap,
and
this
is
where
people
need
to
work
on
actually
bridging
the
gap
between
the
devops
and
the
security
teams.
A
A
I
can
totally
understand
because
I
work
with
a
startup.
I
closely
sit
next
to
the
devops
guys.
If
they
are
not
aware,
I
can
write
my
devops
scripts
myself.
I
can
do
yeah,
I
have
knowledge
of
devops
and
communities,
but
when
I
talk
to
my
other
friends
who
actually
work
in
bigger
organizations,
banks
and
all
right,
yeah
yeah
like
I
can
totally.
K
See
I
want
to
see
basically
the
things
what
you
have
given.
I
want
to
see
if
I
can
break
something
and
then
show
to
the
proof
to
them
right.
These
are
things
your
cluster
is
broken
right.
Do
we?
How
do
you
go
about
it?
So
that's
how
the
conversation
is
you
challenge
somebody
on
something
and
then
that
would
probably
trigger
to
make
sure
the
right
things
are
replaced
right.
I'm
just
this
is
one
thought
process.
A
And
one
thing,
probably
in
your
organization,
you
may
not
come
across
everything
that
we
have
seen
today,
but
security
is
all
about.
There's
one
thing:
if
out
of
100
bugs,
if
you
patch
99
out
of
100,
they
don't
say
like
you
are
100
secured,
like
99
person,
secured
you're
still
100
vulnerable,
because
the
attacker
needs
one
bloody
loophole
to
get
into
your
infrastructure.
So
out
of
all
the
scenarios
that
we
have
seen,
I'm
pretty
sure
your
organization
will
miss
at
least
one
or
the
two
things.
B
F
A
F
A
And
also
the
cluster
setup
which
I
have
given,
it
is
like
one
of
the
state
of
the
art
setup
which
you
can
utilize.
You
have
like
two
act,
two
clusters
actually
running
all
the
cuban
d
is
running
only
with
just
docker
containers.
It's
actually
a
very
good
setup
with
the
jenkins
running
inside
it
like
pushing
the
docker
images
to
your
internal
repositories.
It's
very
complicated
setup.