Kubernetes 1.28 introduces several security enhancements to improve the user experience and address the evolving needs of its users. The enhancements include the use of CEL-based admission policies and webhook match conditions, reduction of secret-based service account tokens, ensuring secure image pulling, container image signature handling based on sigstore, KMS v2 improvements, and an Auth API to get self-user attributes. These enhancements provide better security, performance, and management of Kubernetes clusters, ensuring that only verified and secure images are used and that sensitive data remains encrypted. As Kubernetes becomes more essential, these enhancements play a critical role in ensuring the security and reliability of container orchestration platforms.

Source: CNCF Blog.

The New Stack has posted a guide on how to harden n Ubuntu server. Ubuntu is a popular choice for container deployments, but many admins and DevOps teams overlook the importance of securing the operating system itself. The article provides a guide to hardening Ubuntu to ensure a secure foundation for deployments. The steps include:

1. Schedule regular upgrades to ensure the server is patched against the latest threats.

2. Change sudo and SSH settings.

3. Install and configure fail2ban to automatically ban IP addresses that attempt to compromise the server via SSH.

4. Secure shared memory by mounting /run/shm with certain privileges.

5. Enable and configure the Uncomplicated Firewall (UFW) and allow SSH connections.

By following these steps, admins and DevOps teams can significantly enhance the security of their Ubuntu Server deployments. Head over to The New Stack and read the guide!

Source: The New Stack.

This guide will help you set up a Kubernetes cluster, including a service mesh using k3s (at the time of writing at version 0.10.2) and Rio. We’ll deploy the cluster on DigitalOcean. Ubuntu 18.04 LTS will be the OS during this tutorial. If you sign up to DigitalOcean using this link, you’ll receive $50 to spend on their services over 30 days. If you wish to run your cluster on your own hardware, you could do so on Raspberry Pis (ARM64) or Intel NUCs (x86_64) for example.

In this tutorial, we’ll deploy Bitwarden on Docker Swarm. It’s based on an earlier tutorial on this site, where we deployed Docker Swarm on DigitalOcean. Bitwarden is a password manager with support for self-hosting. We’ll use bitwarden_rs, an unofficial Bitwarden API server implementation, as it’s a bit faster than the default implementation. Bitwarden_rs is written in Rust and is compatible with the official Bitwarden clients. Bitwarden has the following features, among others:

This short tutorial demonstrates how simple it is to deploy applications, in this case GitLab CE, with a Docker Swarm cluster. It builds on the last one, which deployed a Docker Swarm cluster on DigitalOcean. GitLab CE can also be installed and run on a bare-metal server as well. It assumes you have a Docker Swarm cluster running and that you have root access to your nodes. Prepare Manager Node First, GitLab CE requires a decent amount of resources.

This tutorial will guide you through the process of setting up a Docker Swarm cluster on DigitalOcean. It’ll also show you how to deploy Traefik as a reverse proxy for your services and Swarmpit as a web interface for your cluster. We’ll use Fedora 30 as the OS for this tutorial. If you sign up to DigitalOcean using this link, you’ll receive $50 to spend on their services over 30 days.