Session at ContainerDay Security 2023 on the 8th of March in Hamburg. Hardening and securing Kubernetes requires expertise and experience. The talk takes an overview of how we contributed to Kubespray enabling cluster hardening, talking about features that have been introduced, the tools that we used to verify the cluster hardenization and our experience with the open-source community.

1. Hardening
automation with
Kubespray
1

2. $ whoami
Alessio Greggi
Kubernetes Developer @ΔRMO
Full-time tin opener for my 🐱
Avid reader
📚
Open Source contributor
$ cat {twitter,github}.com | uniq
alegrey91

3. Introduction
●
Clastix
●
Small team
●
Kubernetes Multi-tenancy
●
Kubernetes operators:
– Capsule
– Kamaji

4. Use Case
●
Little Cloud Providers
●
Protect their infrastructure
●
Hardened solution
●
CIS Benchmarks
●
24/7 technical support

5. Kubespray Overview
●
Kubernetes-sigs project
●
Deploy a Production Ready Cluster
●
Highly available
●
Supports most popular Linux distributions
●
Ansible Playbook
●
Uses kubeadm under the hood

6. Contributions (CIS compliance)
●
Support for EventRateLimit (CIS 1.2.9)
●
Keep track of service-account-lookup (CIS 1.2.26)
●
Keep track of streamingConnectionIdleTimeout
(CIS 4.2.5)
●
Keep track of makeIPTablesUtilChains (CIS 4.2.7)
●
Make kubernetes owner parametric (CIS 1.1.19)

7. Other Contributions
●
Split kube_feature_gates variable
●
Add SeccompDefault admission plugin for kubelet
●
Hardened kubelet Systemd Service
●
Hardening Setup Guide

8. EventRateLimit
●
Mitigates the problem where the apiserver gets flooded by event requests
●
Limit types:
●
Server
●
Namespace
●
User
●
SourceAndObject
●
Avoid DoS in a Multi-Tenant cluster

9. EventRateLimit
●
Friendly interface

10. streamingConnectionIdleTimeout
●
Defines the maximum time an idle session is permitted prior to disconnect
●
By default is set to 4 hours
●
Ensures that you are protected against DoS attacks
●
Idle connections can be used by unauthorized users
to perform malicious activity to the nodes, pods,
containers, etc.

11. Split kube_feature_gates variable
●
kube_feature_gates allows you to manage the feature gates in a generic
way for all the components
●
Not all the components need the same configuration
●
Create a dedicated variable for each components

12. SeccompDefault Admission Plugin
●
Seccomp filter system calls based on a set of defined rules

13. SeccompDefault Admission Plugin
●
Introduced in Kubernets v1.22
●
Sets the default profile from Unconfined
to RuntimeDefault
●
Uses securityContext to specify the profile

14. SeccompDefault Admission Plugin

15. Kubelet Systemd Service Hardening
●
Systemd v235
●
Isolate systemd services with sandboxing features
●
Analyzes the security settings of service units
(systemd-analyze security)

16. Kubelet Systemd Service Hardening

17. Kubelet Systemd Service Hardening
●
Provide a variable to enable the service hardening
●
Provide a variable to whitelist allowed IPs
to communicate with kubelet

18. Kubelet Systemd Service Hardening

19. Validation Tools
●
Kube-Bench
●
Checkov
●
KSOC
●
Kubescape

20. Validation Tools - Kubescape

21. Thanks for your attention
Keep your cluster safe!