Summary

In this chapter, we began by exploring the importance of protecting nodes, the differences between containers and VMs from a security standpoint, and how easy it is to exploit a cluster when nodes aren’t protected. We also looked at secure container design, implemented and debugged node security policies using Gatekeeper, and finally, used the new Pod Security Admission feature to restrict pod capabilities.

Locking down the nodes of your cluster provides one less vector for attackers. Encapsulating a policy makes it easier to explain to your developers how to design their containers and also makes it easier to build secure solutions.

So far, all of our security has been built to prevent workloads from being malicious. What happens when those measures fail? How do you know what’s going on inside of your pods? In the next chapter, we’ll find out!