On a quest: Learn GKE security and monitoring best practices
Rich Rose
Lab Architect, Google Cloud
Whether you’re running Kubernetes yourself, using our Google Kubernetes Engine (GKE) managed service, or using Anthos, you need visibility into your environment, and you need to know how to secure it. To help you on your way, there are two new educational resources to teach you application observability and security best practices for using Kubernetes at scale.
Fashioned as a series of self-paced labs, this learning content will guide you through the most common activities associated with monitoring and securing Kubernetes through a series of complementary hands-on exercises that we call quests.
Quest for migration and observability best practices
For migration and observability best practices, enroll in the Cloud Kubernetes Best Practice quest, which includes the following labs:
GKE Migrating to Containers demonstrates containers’ central premise of isolation, restricting resources and portability.
Monitoring with Stackdriver on Kubernetes Engine explores how to obtain useful deployment information from code by using Stackdriver’s extensive real-time tooling.
Tracing with Stackdriver on Kubernetes Engine explores how to follow application trace events to find potential algorithm improvements.
Logging with Stackdriver on Kubernetes Engine presents common techniques for resource identification and export sink, including an overview of the powerful resource filter.
Connect to Cloud SQL from an Application in Kubernetes Engine helps to bridge the divide between containers and non-containers, leveraging design patterns such as the sidecar or ambassador to connect to external resources via the Kubernetes API.
On a quest for secure Kubernetes applications
Similarly, the Google Kubernetes Engine Security Best Practice quest provides actionable guidance on how to approach Kubernetes security, and includes the following labs:
How to Use a Network Policy on GKE discusses the “principle of least privilege” as applied to Kubernetes network policy, illustrating how to achieve granular control over intra-cluster communication.
Using Role-based Access Control in Kubernetes Engine shows you how to use RBAC to restrict things such as cluster state changes.
Google Kubernetes Engine Security: Binary Authorization highlights a new GKE feature that helps to determine and enforce the provenance of container security.
Securing Applications on Kubernetes Engine - Three Examples demonstrates how to use AppArmor to secure an Nginx web server; how to apply policies to unspecified resources using a Kubernetes Daemonset; and how to update pod metadata associated with a deployment with the Kubernetes API’s ServiceAccount, Role, and RoleMapping features.
Kubernetes Engine Communication Through VPC Peering walks through the process to expose services between distinct clusters using VPC Peering.
Hardening Default GKE Cluster Configurations explores mitigation security issues that can arise from running a cluster based on default settings.
When working with infrastructure and application environments, sophisticated observability tools like Stackdriver provide a unified method of monitoring, tracing and logging. Likewise, securing an environment represents an ongoing challenge, but Google Cloud Platform offers a number of tools that help to reduce the complexity, and ensure that deployments follow generally accepted best practices.
Ready to begin? Get started with Kubernetes best practice and the GKE Security Best Practice quests. On completion of the quest, you’ll be presented with a Qwiklabs digital badge that you can share on social media.
