Kubesploit

Master Kubernetes with Learnk8s' Advanced Kubernetes workshops!

What should you expect?

- Learn how to architect and design clusters from the ground up (in the cloud or on-prem).
- Explore the Kubernetes internal component and how the system is designed with resiliency in mind.
- Deep-dive into the networking components and observe the packets flowing into the cluster.
- Hands-on labs to test the theory with real-world scenarios!
- And more.

The next course starts on the 18th of April: https://learnk8s.io/online-advanced-april-2024

We also run in-person courses and corporate training: https://learnk8s.io/corporate-training

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Plaid
💰 $215.3K to $322.9K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/82ecabe4-3ee3-408e-9e59-de3130fd3475?s=55

DevSecOps Engineer with Applied Intuition
💰 $65K to $400K a year
🏠 From the office in Mountain View, CA, USA
→ https://kube.careers/t/c6291093-2e86-4446-aab7-7f34af1a3112?s=55

DevSecOps Engineer with PagerDuty
💰 $176K to $277K a year
🏠 From the office in Atlanta, GA, USA
→ https://kube.careers/t/f7204480-93a6-477a-996f-eee9e4c5f9bd?s=55

DevSecOps Engineer with Hyperscience
💰 $190K to $260K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/ab01bf82-75af-4610-ba58-d58cd09f529a?s=55

Security Architect with Collectors
💰 $160K to $250K a year
🏠 From the office in Santa Ana, CA, USA
→ https://kube.careers/t/b13459c6-6642-4c50-bdc0-c95a11cdd990?s=55

👉 Browse all 449 Kubernetes jobs on Kube Careers https://kube.careers

The kube-rbac-proxy is an HTTP proxy for a single upstream, that can perform RBAC authorization against the Kubernetes API using SubjectAccessReview.

More: https://github.com/brancz/kube-rbac-proxy

This week on the Learn Kubernetes Weekly:

🏅 Golden testing Helm
📈 Harnessing the power of metrics
1️⃣ Kubernetes Gateway API v1.0
📽️ How to use TokenRequest API and TokenVolume Projection
🪨 ReadOnlyRootFilesystem

Read it now: https://learnk8s.io/issues/72

In this article, learn how ReadOnlyRootFilesystem enhances container security by enforcing immutability, thwarting attacks, and ensuring consistent deployments.

More: https://alexandre-vazquez.com/readonlyrootfilesystem

Bank-Vaults is an umbrella project which provides various tools for Cloud Native secret management, including:

- Bank-Vaults CLI to configure Hashicorp Vault.
- Vault operator.
- Vault secrets webhook to inject secrets.
- Vault SDK

More: https://github.com/bank-vaults/bank-vaults

This article teaches you to manage Service Accounts securely by creating expirable tokens using projected volumes or the TokenRequest API.

It advises against non-expirable tokens, demonstrates auto-renewal, and how to prevent automatic token mounting.

More: https://adil.medium.com/how-to-use-tokenrequest-api-and-tokenvolume-projection-in-kubernetes-f007135b9994

The ultimate goal of every GitOps setup is complete automation.

To operate a system hands-off, its monitoring and alerting must be reliable and comprehensive.

This tutorial will teach you how to monitor a FluxCD-operated GitOps setup on Kubernetes.

More: https://dev.to/mms-tech/monitoring-and-hardening-the-gitops-delivery-pipeline-with-flux-1gk

Chaos Mesh brings various types of fault simulation to Kubernetes and can orchestrate fault scenarios.

It helps you simulate various abnormalities that might occur in reality during the development, testing, and production.

More: https://github.com/chaos-mesh/chaos-mesh

Falco is a cloud-native security tool designed for Linux systems.

It employs custom rules on kernel events, which are enriched with container and Kubernetes metadata, to provide real-time alerts.

More: https://falco.org

Master Kubernetes with Learnk8s' Advanced Kubernetes workshops!

What should you expect?

- Learn how to architect and design clusters from the ground up (in the cloud or on-prem).
- Explore the Kubernetes internal component and how the system is designed with resiliency in mind.
- Deep-dive into the networking components and observe the packets flowing into the cluster.
- Hands-on labs to test the theory with real-world scenarios!
- And more.

The next course starts on the 18th of April: https://learnk8s.io/online-advanced-april-2024

We also run in-person courses and corporate training: https://learnk8s.io/corporate-training

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Plaid
💰 $215.3K to $322.9K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/82ecabe4-3ee3-408e-9e59-de3130fd3475?s=55

DevSecOps Engineer with Hinge Health
💰 $189K to $283K a year
🏠🏃🏻‍♂️🌎 San Francisco, CA, USA
→ https://kube.careers/t/7848823a-5edb-406f-86f8-a505220dc8e4?s=55

DevSecOps Engineer with PagerDuty
💰 $176K to $277K a year
🏠 From the office in Atlanta, GA, USA
→ https://kube.careers/t/f7204480-93a6-477a-996f-eee9e4c5f9bd?s=55

DevSecOps Engineer with Hyperscience
💰 $190K to $260K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/ab01bf82-75af-4610-ba58-d58cd09f529a?s=55

Security Architect with Apollo
💰 $190K to $250K a year
🏠🏃🏻‍♂️🌎 Alhambra, CA, USA
→ https://kube.careers/t/8a1ea5dc-5d25-4ab0-95c8-d893bdb6249b?s=55

👉 Browse all 448 Kubernetes jobs on Kube Careers https://kube.careers

In this article, you'll examine the Node authorization mode and the NodeRestriction admission controller.

These components play a crucial role in granting Kubelets the rights and privileges to access the essential resources required for their operation.

More: https://medium.com/@seifeddinerajhi/kubernetes-node-security-the-role-of-kubelet-authorization-366220051cb

This week on the Learn Kubernetes Weekly:

💨 Airflow on Kubernetes for 2 years
📝 Learning apple/pkl
👋 Migrating from Pod Security Policies
👷🏻‍♂️ Build a Lightweight Internal Developer Platform with Argo CD and Kubernetes Labels

Read it now: https://learnk8s.io/issues/71

In this tutorial, you will learn how to set up OAuth2 Proxy to pass authentication headers to Kubernetes Dashboard, which doesn't provide its authentication but instead relies on Kubernetes' own RBAC auth.

More: https://geek-cookbook.funkypenguin.co.nz/recipes/kubernetes/oauth2-proxy

Ensuring the repeatability of your infrastructure is a crucial aspect of managing Kubernetes clusters.

This allows you to swiftly tear down and set up a new one, a practice that is quite handy.

However, there are exceptional circumstances when your cluster becomes more than a disposable tool.

Dan shared, "A Kubernetes cluster will be treated as disposable until you deploy ingress, and then it becomes a pet."

In this episode, you will delve into the concept of 'disposable' and 'pet' Kubernetes clusters and learn:

- How you can use GitOps to create a repeatable infrastructure that syncs.
- How resources such as the Ingress and external-dns require careful maintenance and monitoring to make your cluster special.
- How Crossplane and vCluster help you define repeatable environments that are disposable.
- All the flavours for Argo: Workflows, Autopilot, CD, etc., and "Project" a newer abstraction to manage apps across environments.

Watch (or listen to) it here: https://kube.fm/ingress-gitops-dan

Validating Admission Policies makes it easy to write, enforce and use policies in Kubernetes without needing a third-party tool.

Learn how to use them in this article.

More: https://eminalemdar.medium.com/policy-management-in-kubernetes-is-changing-9d4808f548a0

Learn to auto-update Kubernetes secrets via External Secrets Operator and secret managers like GCP secret manager.

The guide covers secret rotation, syncing, Helm installation, and TLS management.

More: https://medium.com/linux-shots/sync-kubernetes-secrets-with-cloud-native-secret-managers-e24095472a24

In this article, you'll find instructions for setting up and installing Pod Security Admission (PSA), step-by-step migration guides to transition from Pod Security Policies (PSP) to PSA, and precise commands for transferring existing PSP rules to PSA.

More: https://hackernoon.com/migrating-from-pod-security-policies-a-comprehensive-guide-part-1-transitioning-to-psa

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with Plaid
💰 $215.3K to $322.9K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/82ecabe4-3ee3-408e-9e59-de3130fd3475?s=55

DevSecOps Engineer with Hinge Health
💰 $189K to $283K a year
🏠🏃🏻‍♂️🌎 San Francisco, CA, USA
→ https://kube.careers/t/7848823a-5edb-406f-86f8-a505220dc8e4?s=55

DevSecOps Engineer with PagerDuty
💰 $176K to $277K a year
🏠 From the office in Atlanta, GA, USA
→ https://kube.careers/t/f7204480-93a6-477a-996f-eee9e4c5f9bd?s=55

DevSecOps Engineer with Hyperscience
💰 $190K to $260K a year
👨‍💻 Remote from the United States
→ https://kube.careers/t/ab01bf82-75af-4610-ba58-d58cd09f529a?s=55

Security Architect with Apollo
💰 $190K to $250K a year
🏠🏃🏻‍♂️🌎 Alhambra, CA, USA
→ https://kube.careers/t/8a1ea5dc-5d25-4ab0-95c8-d893bdb6249b?s=55

👉 Browse all 456 Kubernetes jobs on Kube Careers https://kube.careers