k8s-keystone-auth service is used for Kubernetes webhook authentication and authorization for OpenStack Keystone. The k8s-keystone-auth service can be running either as a static pod(controlled by kubelet) or a normal kubernetes service.继续阅读 »
When looking at container orchestration platforms, open-source communities have produced a number of viable options including Kubernetes, Marathon-Mesos, or Docker Swarm. Kubernetes stands out as a popular choice amongst many users looking to run cloud-native on-line workloads. It has built-in support for a number of u继续阅读 »
Goal of K8S Security
Ensure a clear isolation between the container and the underlying host it runs on
Limit the ability of the container to negatively impact the infrastructure or other containers
Principle of Least Privilege - ensure components are only authorized to perform the actions they need, and limit the scop继续阅读 »