Save on skills. Reach your goals from $11.99

Advanced Kubernetes/AKS Network & Infrastructure

Last updated on July 6, 2024 5:33 pm
Category:

Description

What you’ll learn

  • Learn AKS and Kubernetes network best practices
  • Learn how to securely expose services in Kubernetes
  • Learn how to secure pod to pod communication
  • Learn to setup TLS certificates for pods and ingress

You started your journey learning Kubernetes ?

You have been learning the fundamentals of a Kubernetes cluster ?

And now you want to make sure your cluster is production ready in terms of security ?

 

If you are looking for how to secure your Kubernetes cluster then this course is for you.

 

Let us face it, security is not an easy task. And Kubernetes is not an exception.

Securing a Kubernetes cluster requires thinking about all these aspects:

  1. Network security: through private cluster access to API Server with Private Endpoint.
  2. Secure egress traffic: all egress traffic should be filtered using Firewall.
  3. Secure ingress traffic: using TLS and HTTPS on the ingress controller.
  4. Secure inter-pod communication: secure traffic between pods using TLS or mTLS.
  5. Controlling traffic between pods: using Network Policy tools like Calico.
  6. Securing access to Managed Identities: by restricting access to IMDS endpoint (169.254.169.254).
  7. Implementing a Landing Zone: with integration into the Hub an Spoke model
  8. Customize logging and metrics collection
  9. Reduce the cost of the cluster infrastructure

 

Microsoft provides the following recommendations to secure an AKS cluster and this course will try to go deeper with demonstration.

Recommendation 1: To distribute HTTP or HTTPS traffic to your applications, use ingress resources and controllers. Compared to an Azure load balancer, ingress controllers provide extra features and can be managed as native Kubernetes resources.

Recommendation 2: To scan incoming traffic for potential attacks, use a web application firewall (WAF) such as Barracuda WAF for Azure or Azure Application Gateway. These more advanced network resources can also route traffic beyond just HTTP and HTTPS connections or basic TLS termination.

Recommendation 3: Use network policies to allow or deny traffic to pods. By default, all traffic is allowed between pods within a cluster. For improved security, define rules that limit pod communication.

Recommendation 4: Don’t expose remote connectivity to your AKS nodes. Create a bastion host, or jump box, in a management virtual network. Use the bastion host to securely route traffic into your AKS cluster to remote management tasks.

 

Disclaimer: This course uses Azure Kubernetes Service (AKS) for demonstrations. But most of the content is applicable to any Kubernetes cluster on any environment.

Who this course is for:

  • This course is for platform teams that needs to manage Kubernetes cluster and securely deploy apps.

Course content

  • Course introduction2 lectures • 2min
  • Course introduction
  • Kubernetes and AKS architecture1 lecture • 21min
  • Kubernetes and AKS architecture
  • Introduction to Kubernetes fundamentals9 lectures • 40min
  • Introduction to Kubernetes fundamentals
  • Comparing AKS public and private clusters7 lectures • 25min
  • Comparing AKS public and private clusters
  • Networking plugins for AKS: Kubenet & Azure CNI8 lectures • 33min
  • Networking plugins for AKS: Kubenet & Azure CNI
  • AKS Private DNS resolution at scale5 lectures • 38min
  • AKS Private DNS resolution at scale
  • Kubernetes External-DNS3 lectures • 34min
  • Kubernetes External-DNS
  • Kubernetes CoreDNS3 lectures • 18min
  • Kubernetes CoreDNS
  • Gateway API with Application Gateway for Containers7 lectures • 49min
  • Gateway API with Application Gateway for Containers
  • AKS Application Routing (Managed Ingress)9 lectures • 47min
  • AKS Application Routing (Managed Ingress)

Reviews

There are no reviews yet.

Be the first to review “Advanced Kubernetes/AKS Network & Infrastructure”

Your email address will not be published. Required fields are marked *