From 6b1fa888879520b5c1eee737b15201548395876b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= <jerome.petazzoni@gmail.com>
Date: Thu, 11 Sep 2025 16:48:13 +0200
Subject: [PATCH] =?UTF-8?q?=E2=9E=95=EF=B8=8F=20Compile=20some=20cloud=20n?=
 =?UTF-8?q?ative=20security=20recs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 slides/shared/cloud-native-security.md | 103 +++++++++++++++++++++++++
 1 file changed, 103 insertions(+)
 create mode 100644 slides/shared/cloud-native-security.md

diff --git a/slides/shared/cloud-native-security.md b/slides/shared/cloud-native-security.md
new file mode 100644
index 00000000..018c534f
--- /dev/null
+++ b/slides/shared/cloud-native-security.md
@@ -0,0 +1,103 @@
+# Cloud Native Security
+
+*Non-exhaustive list of best practices for Cloud Native Security.*
+
+---
+
+## "Less is more"
+
+- Less code (build vs buy; Pareto 80/20)
+
+- Less permissions (fine-grained vs blanket)
+
+- Less dependencies (also a trade-off)
+
+*Note: this is not at all specific to Cloud Native.*
+
+*But security must be addressed at all layers of the stack!*
+
+---
+
+## Managed platforms
+
+- Operating Kubernetes is complex
+
+- Use a managed platform
+
+  (cloud provider or service provider)
+
+- Restrict control plane access
+
+- TLS cert management (check "PKI the wrong way")
+
+- Enable Pod Security Settings
+
+- Restrict access to cloud instance metadata
+
+---
+
+## K8S upgrades
+
+- ALWAYS ALWAYS ALWAYS upgrade
+
+  (do you prefer your maintenance to be planned or unplanned?)
+
+- Upgrades can be smooth if:
+
+  - we're using a good, managed platform
+
+  - we stay away from beta APIs
+
+---
+
+## Isolate compute
+
+- Resource requests and limits for ALL workloads
+
+- Taints, tolerations, affinities where necessary
+
+- Secure container runtime if necessary
+
+---
+
+## Isolate network
+
+- Network policies
+
+- Advanced policies (check Cilium)
+
+---
+
+## Secret management
+
+- Secrets vs ConfigMaps
+
+- Store secrets in...:
+
+  - KMS
+  - External Secrets
+  - Sealed Secrets
+  - Vault
+  - Kamus
+  - SOPS
+  - ...
+
+- Encrypt secrets at rest if necessary
+
+---
+
+## AuthN & AuthZ
+
+- Authenticate users centrally
+
+  (e.g. OIDC, certificates)
+
+- Have a clear path for access revocation
+
+- Fine-grained RBAC
+
+---
+
+## Software supply chain
+
+*I'm not an expert in that field but this should be on your radar!*