|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/learn-aks-network-security/
课程评论：没有评论
Coursera 课程总结：高级 Kubernetes/AKS 网络与基础设施 本课程专为已掌握 Kubernetes 基础知识，并希望将集群提升至生产级别安全性的学习者设计。它深入探讨了 Kubernetes 集群的安全性，涵盖了以下关键领域： * **网络安全：** * 利用私有终结点实现 API Server 的私有集群访问。 * 通过防火墙过滤所有出站流量，确保安全的出站连接。 * 使用 TLS 和 HTTPS 保护入口流量，例如通过入口控制器。 * 使用 TLS 或 mTLS 实现 Pod 间通信的安全。 * 运用 Calico 等网络策略工具控制 Pod 间的流量。 * **身份验证与访问控制：** * 通过限制对 IMDS 端点 (169.254.169.254) 的访问来保护托管标识。 * **基础设施与管理：** * 实现登陆区域，并与 Hub-Spoke 模型集成。 * 定制日志和指标收集。 * 优化集群基础设施成本。 课程重点介绍了 Microsoft 关于保护 AKS 集群的建议，并提供了深入的演示： 1. **入口资源和控制器：** 推荐使用入口资源和控制器来分发 HTTP/HTTPS 流量，它们提供比 Azure 负载均衡器更多的功能，并且可以作为原生 Kubernetes 资源进行管理。 2. **Web 应用程序防火墙 (WAF)：** 建议使用 Azure Application Gateway 等 WAF 来扫描传入流量中的潜在攻击。这些高级网络资源还可以处理非 HTTP/HTTPS 连接或基本的 TLS 终止。 3. **网络策略：** 强调使用网络策略来控制 Pod 间的流量，允许或拒绝特定的通信，从而提高安全性。 4. **节点安全：** inadvisable 建议不要直接暴露 AKS 节点的远程连接，而是通过管理虚拟网络中的堡垒主机（jump box）进行安全的远程管理。 **请注意：** 本课程以 Azure Kubernetes Service (AKS) 为例进行演示，但其大部分内容适用于任何环境下的 Kubernetes 集群。
You started your journey learning Kubernetes ?You have been learning the fundamentals of a Kubernetes cluster ?And now you want to make sure your cluster is production ready in terms of security ?If you are looking for how to secure your Kubernetes cluster then this course is for you.Let us face it, security is not an easy task. And Kubernetes is not an exception.Securing a Kubernetes cluster requires thinking about all these aspects:Network security: through private cluster access to API Server with Private Endpoint.Secure egress traffic: all egress traffic should be filtered using Firewall.Secure ingress traffic: using TLS and HTTPS on the ingress controller.Secure inter-pod communication: secure traffic between pods using TLS or mTLS.Controlling traffic between pods: using Network Policy tools like Calico.Securing access to Managed Identities: by restricting access to IMDS endpoint (169.254.169.254).Implementing a Landing Zone: with integration into the Hub an Spoke modelCustomize logging and metrics collectionReduce the cost of the cluster infrastructureMicrosoft provides the following recommendations to secure an AKS cluster and this course will try to go deeper with demonstration.Recommendation 1: To distribute HTTP or HTTPS traffic to your applications, use ingress resources and controllers. Compared to an Azure load balancer, ingress controllers provide extra features and can be managed as native Kubernetes resources.Recommendation 2: To scan incoming traffic for potential attacks, use a web application firewall (WAF) such as Barracuda WAF for Azure or Azure Application Gateway. These more advanced network resources can also route traffic beyond just HTTP and HTTPS connections or basic TLS termination.Recommendation 3: Use network policies to allow or deny traffic to pods. By default, all traffic is allowed between pods within a cluster. For improved security, define rules that limit pod communication.Recommendation 4: Don't expose remote connectivity to your AKS nodes. Create a bastion host, or jump box, in a management virtual network. Use the bastion host to securely route traffic into your AKS cluster to remote management tasks.Disclaimer: This course uses Azure Kubernetes Service (AKS) for demonstrations. But most of the content is applicable to any Kubernetes cluster on any environment.
