Downloaded 59 times
Uploaded byinovex GmbH
Kubernetes Security
This document discusses how to secure a Kubernetes platform. It covers setting up authentication and authorization using RBAC and certificates. It also discusses implementing network policies and pod security policies to restrict traffic and resources. Additional topics include integrating Vault for secrets management and using admission controllers and auditing to intercept and modify API requests for security purposes.
More Related Content
Similar to Kubernetes Security
Kubernetes Security
- 1. Kubernetes Security How tosecure your Kubernetes platform Johannes M. Scheuermann Karlsruhe, 09.12.2017
- 2. Johannes M. Scheuermann ITEngineering & Operations @ inovex 〉 Software-Defined Datacentres 〉 Infrastructure as Code 〉 Cloud technologies 〉 High Availability & Scalability 〉 Want‘s a Z-Frame 〉 @johscheuer 2
- 3.
- 4. • Security Cake •Authentication and Authorisation • Network Policies • Pod Security Policies • Admission Controller • Vault Integration Security Kubernetes
- 5. Security Cake HW HWHW HW OS OS OS OS Platform Container Container Container Container Base Base Base Base App App App App
- 6. Secure the Pipeline BuildTest Ship Run
- 7. • Secure allcomponents with certificates • Only talk over TLS • Disable the insecure port (even on localhost) • Disable anonymous authentication • Or at least restrict it to uncritical resources • Since 1.7 Kubernetes supports an Audit Log Focus on the Platform
- 8. How to build”the” platform
- 9. • RBAC (RoleBased Access Control) • ABAC (Attribute Based Access Control) • WebHook • Certificates • Token (JWT à https://jwt.io) Authentication and Authorisation
- 10.
- 11.
- 12. • Since 1.6 •Ingress policies • Egress policies (1.8) • Network segmentation (distributed firewall) • CNI plugin must support it Network Policies
- 13. • DENY alltraffic to an application • LIMIT traffic to an application • DENY all non-whitelisted traffic in a namespace • DENY all traffic from other namespaces • ALLOW traffic from other namespaces • ALLOW traffic from external clients Network Policies (example)
- 14.
- 15. • Needs tobe explicitly activated • Let you define what’s allowed • There must be a default policy • Activating “runAsNonRoot” will break many things • Only activate if needed (multi-tenant) • Can be combined with RBAC Pod Security Policies
- 16. • Volumes • RunAsUser •AllowedCapabilities • Privileged • HostNetwork / HostPorts • readOnlyRootFilesystem Pod Security Policies (example)
- 17.
- 18. • Intercepts requestto the Kubernetes API • (Can) Perform modifications • Many default controllers exists • You can also write your own Admission Controller(s)
- 19. • DenyEscalatingExec • ImagePolicyWebhook •NodeRestriction • PodSecurityPolicy • SecurityContextDeny • ServiceAccount Admission Controller (example)
- 20.
- 21. Vault Integration (CA) Vault Node Master 1.)Auth (AppRoleID) 2.) Issue certificate Policies etcd
- 22. • Since 0.9Kubernetes auth backend • Solves only the challenge of authentication • Secret must be fetched • Sidecare/init container • Integrates with ServiceAccounts Vault Integration (secret store)
- 23. • Open artifactmetadata API • Pluggable (multiple providers) • ACL for the metadata • Query-ability • Integrates with Kubernetes Grafeas
- 24. • Service Mesh •Policy Enforcement (L4/L7) • Integrated CA • Transparent TLS • Routing • Language/Platform agnostic Istio
- 25.
- 26. • Many possibilitiesto make your cluster more secure • Each with it’s benefits and drawbacks • Generally à Security means (hard) work • Depends on your Use Case what to use • Play around with and get a feeling (in a playground) Conclusions
- 27.
- 28.
- 29. • https://kubernetes.io/docs/admin/admission- controllers • https://kubernetes.io/docs/concepts/policy/pod- security-policy •https://kubernetes.io/docs/concepts/services- networking/network-policies Further reading
- 30. • https://grafeas.io • https://istio.io •https://ahmet.im/blog/kubernetes-network-policy • https://github.com/kubernetes/examples/tree/master/ staging/podsecuritypolicy/rbac Further reading
- 31. Johannes M. Scheuermann inovexGmbH Johannes.scheuermann@inovex.de CC BY-NC-ND inovex.de +JohannesScheuermann github.com/johscheu er @johscheuer youtube.com/inovexGmb H