Containers deployments in Kubernetes clusters create both familiar and new security challenges. Given the ephemeral nature of containers, the speed and agility goals of microservices architecture, a preliminary detection of potential risks, and early discovery of viable threats yield the best security outcomes. Successfully addressing the Kubernetes security challenges requires integrating security into each phase of the container lifecycle: build, deploy, and run. This webinar will throw light on how to: * Stay on top of ongoing Kubernetes hygiene by hardening your nodes, employing best practices * Implement role-based access control of users * Manage Kubernetes Secrets * Thwart an attack, with a live demo

1. Hardening
Kubernetes
Cluster
Presented By: Mukesh Yadav
Software Consultant / DevOps
Knoldus Inc.
LEARN NOW

2. About Knoldus
Knoldus is a technology consulting firm with focus on modernizing the digital systems
at the pace your business demands.
DevOps
Functional. Reactive. Cloud Native

3. 01 Securing the Cluster
02 Authentication
03 Authorization
04 Securing Images
05 Running Containers
Securely
Secrets Management
Our Agenda
0506

4. Where does the k8s fits in SDLC phase?

5. Introduction K8s
Kubernetes is an open-source container-orchestration system for automating
application deployment, scaling, and management. It was originally designed by
Google, and is now maintained by the Cloud Native Computing Foundation.

6. Architecture K8s

7. Securing the cluster
API Server
● REST API for controlling Kubernetes.
● Powerful
● --insecure-port=0
$ curl <IP address>:8080
{
"paths": [
"/api",
"/api/v1",
"/apis",
...
Running etcd Safely
● --cert-file and --key-file to enable HTTPS
● --etcd-certfile and --etcd-keyfile on
api-server
● --auto-tls=false no to self sign cert.
● --trusted-ca-file certificate authority with
signed the client certificates

8. Securing the cluster
Kubernetes Dashboard
● Don’t expose your Dashboard to
the public internet
● Make sure the Dashboard service
account has limited access
-------> Use RBAC
Kubelet
● interacting with the container runtime to
launch pods, and report node and pod
status and metrics.
● --anonymous-auth=false
● --kubelet-client-certificate and
--kubelet-client-key flags
● --read-only-port=0

9. Authentication
Identity

10. Authentication
Authentication Concepts
●

11. Authentication
Authentication Strategies
● Static password or token file
● X.509 certificates
● OpenID Connect (OIDC) (JSON Web
Token)
● Bootstrap tokens
(--enable-bootstrap-token-auth)
Good Practices
● Use third-party providers
● Don’t use static files
● Life cycle

12. Authorization
Authorization Concepts Authorization Modes
● Node authorization
● Webhook
● Role-based access control (RBAC)

13. Authorization
Access Control with RBAC ● Entity ---->Action
get , list (read-only)
create , update , patch ,
delete , deletecollection
(read-write)
● Resources → pod ,services
● Role
Cluster-wide
Namespace-wide

14. Securing the Image
Scanning/patching Container
Images
● update or apt-get update , as this is
an antipattern for containers
● Anchore
● Use ci/cd
Image Storage
● Docker’s own implementation,
GitLab’s Container Registry
● AlwaysPullImages
● Image Trust and Supply Chain(grafeas)
● Minimizing Images to Reduce the
Attack Surface

15. Running container Securely
Security Boundaries

16. Running container Securely
Best practices
● Use least privilege to carry out the task
at hand.
● Do only the minimal host mounts
necessary.
● Limit communication between
applications.
Say No to Root
● container needs to modify the host
system
● Installing software into a container at
runtime: traditional package management
systems might require root to function or
store files in a certain location

17. Secrets Management
Kubernetes Secret Storage
● Storing Secrets in etcd(At rest-
AES-CBC → strong , fastest)
● Storing Secrets in Third-Party
Stores (HashiCorp Vault-In transit)
Good practices
● Don’t Build Secrets into Images(rebuilt
and redeployed)
● Passing Secrets as Environment
Variables(inspect)
● Passing Secrets in Files
● Secret Rotation and Revocation

18. Secrets Management
Least Privilege
● read only the secrets that it needs
● different set of secrets for different
environments

19. Reference
● https://kubernetes.io/
● Book -Operating Kubernetes Clusters and
Applications Safely

20. Thank You!
/Mukesh_Yadav236
/mukesh-yadav236
/MukeshAtFB