Summary

In this chapter, we began by exploring the importance of protecting nodes, the differences between containers and VMs from a security standpoint, and how easy it is to exploit a cluster when nodes aren't protected. We also looked at secure container design, and finally, we implemented and debugged a PSP implementation.

Locking down the nodes of your cluster provides one less vector for attackers. Encapsulating the policy makes it easier to explain to your developers how to design their containers and makes it easier to build secure solutions.

So far, all of our security has been built on Kubernetes' standard technologies and is nearly universal across Kubernetes distributions. In the next chapter, we'll work on applying policies that are beyond the scope of Kubernetes using dynamic admission controllers and the OPA.