Bonus security tips
These are some general security best practices and tips that did not fit under any of the previous sections. However, I find them to be useful:
- Always keep Kubernetes updated to the latest version.
- Update worker AMIs to the latest version. You have to be cautious because this change could introduce some downtime, especially if you are not using a managed node group.
- Do not run Docker in Docker or mount the socket in a container.
- Restrict the use of
hostPath
or, ifhostPath
is necessary, restrict which prefixes can be used and configure the volume as read-only. - Set requests and limits for each container to avoid resource contention and Denial of Service (DoS) attacks.
- Whenever possible, use an optimized operating system for running containers.
- Use immutable infrastructure, and automate the rotation of the cluster worker nodes.
- You should not enable the Kubernetes dashboard.
- Enable AWS VPC Flow Logs to capture metadata about...