{"id":19668216,"url":"https://github.com/nsmith5/road-to-secure-kubernetes","last_synced_at":"2025-04-29T00:30:30.154Z","repository":{"id":103593894,"uuid":"414799229","full_name":"nsmith5/road-to-secure-kubernetes","owner":"nsmith5","description":"Hardening a sketchy containerized application one step at a time","archived":false,"fork":false,"pushed_at":"2022-01-25T18:32:21.000Z","size":126,"stargazers_count":54,"open_issues_count":0,"forks_count":7,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-05T11:41:23.881Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nsmith5.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-08T00:43:45.000Z","updated_at":"2024-08-20T19:39:18.000Z","dependencies_parsed_at":null,"dependency_job_id":"8d91f2a7-9846-4af7-a9dc-d7b9dc3b0815","html_url":"https://github.com/nsmith5/road-to-secure-kubernetes","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Froad-to-secure-kubernetes","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Froad-to-secure-kubernetes/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Froad-to-secure-kubernetes/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nsmith5%2Froad-to-secure-kubernetes/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nsmith5","download_url":"https://codeload.github.com/nsmith5/road-to-secure-kubernetes/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251410152,"owners_count":21584973,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T16:34:49.632Z","updated_at":"2025-04-29T00:30:30.142Z","avatar_url":"https://github.com/nsmith5.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# Road to Secure Kubernetes\n_Hardening a containerized application one step at a time_\n\nThis repository hosts a tutorial on security hardening a containerized workload\nin Kubernetes. Its a self-guided, hands on guide from the \"default\" settings we\nsee in Kubernetes to a relatively well configured workload. The mitigations\ndescribed are by no means exhaustive but show a lot of low hanging fruit anyone\ncan take advantage of to harden a workload.\n\n## Video Walk-through\n\nI recorded a walk-through of this entire tutorial for folks that want a \nvideo guide: https://www.youtube.com/watch?v=fe_6UZG8Hlo\n\n## Prerequistes\n\nTo run through the tutorial you'll need\n\n- [Docker](https://docker.io)\n- [`kind`](https://kind.sigs.k8s.io/) to run a Kubernetes cluster on your laptop with Docker\n- `kubectl` the Kubernetes CLI to interact with the cluster\n- `helm` to install [Cilium](https://cilium.io/) in our cluster\n\nBefore you begin, install the `kind` cluster as follows:\n\n```bash\n$ cd cluster\n\n# Install kind cluster\n$ kind create cluster --config config.yaml\n\n# Install Cilium into kind cluster\n$ helm repo add cilium https://helm.cilium.io/\n$ helm install cilium cilium/cilium --version 1.9.10 \\\n   --namespace kube-system \\\n   --set nodeinit.enabled=true \\\n   --set kubeProxyReplacement=partial \\\n   --set hostServices.enabled=false \\\n   --set externalIPs.enabled=true \\\n   --set nodePort.enabled=true \\\n   --set hostPort.enabled=true \\\n   --set bpf.masquerade=false \\\n   --set image.pullPolicy=IfNotPresent \\\n   --set ipam.mode=kubernetes\n\n# Wait to be installed\n$ kubectl wait --for=condition=available deployment.apps/cilium-operator -n kube-system\n\n# Install Nginx Ingress controller\n$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml\n$ kubectl wait --for=condition=available deployment.apps/ingress-nginx-controller -n ingress-nginx\n\n```\n\nOnce you can run `curl http://localhost` and get back a 404 like this one from Nginx, you're ready\nto start\n\n```html\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003e404 Not Found\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ccenter\u003e\u003ch1\u003e404 Not Found\u003c/h1\u003e\u003c/center\u003e\n\u003chr\u003e\u003ccenter\u003enginx\u003c/center\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n## How-to\n\nThe tutorial shows the step by step progression of an application configuration. Each configuration or step\nhas a corresponding git tag from `1` to `10`. Start at `1` and move from tag to tag. For every change there\nis a detailed explaination of whats been changed and what the change mitigates.\n\n- [Step 1](https://github.com/nsmith5/road-to-secure-kubernetes/tree/1) is our\n  starting point. If I was to hazard a guess, about 95% of Kubernetes\napplication are deployed in this state. Its a functioning application with some\nvulnerabilities as you'll see.\n- [Step 2](https://github.com/nsmith5/road-to-secure-kubernetes/tree/2) uses a non-root user in the container\n- [Step 3](https://github.com/nsmith5/road-to-secure-kubernetes/tree/3) leverages read-only filesystems\n- [Step 4](https://github.com/nsmith5/road-to-secure-kubernetes/tree/4) adds network policies\n- [Step 5](https://github.com/nsmith5/road-to-secure-kubernetes/tree/5) uses a `scratch` container\n- [Step 6](https://github.com/nsmith5/road-to-secure-kubernetes/tree/6) adds resource requests and limits\n- [Step 7](https://github.com/nsmith5/road-to-secure-kubernetes/tree/7) drops linux capabilities\n- [Step 8](https://github.com/nsmith5/road-to-secure-kubernetes/tree/8) disables privilege escalation\n- [Step 9](https://github.com/nsmith5/road-to-secure-kubernetes/tree/9) adds seccomp profile\n- [Step 10](https://github.com/nsmith5/road-to-secure-kubernetes/tree/10) removes service account credentials\n\nNavigate to each tag to learn more!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnsmith5%2Froad-to-secure-kubernetes","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnsmith5%2Froad-to-secure-kubernetes","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnsmith5%2Froad-to-secure-kubernetes/lists"}