Kubernetes Security
•
4 likes•1,033 views
This document discusses how to secure a Kubernetes platform. It covers setting up authentication and authorization using RBAC and certificates. It also discusses implementing network policies and pod security policies to restrict traffic and resources. Additional topics include integrating Vault for secrets management and using admission controllers and auditing to intercept and modify API requests for security purposes.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Kubernetes Security
Similar to Kubernetes Security (20)
More from inovex GmbH
More from inovex GmbH (20)
Recently uploaded
Recently uploaded (20)
Kubernetes Security
- 1. Kubernetes Security How to secure your Kubernetes platform Johannes M. Scheuermann Karlsruhe, 09.12.2017
- 2. Johannes M. Scheuermann IT Engineering & Operations @ inovex 〉 Software-Defined Datacentres 〉 Infrastructure as Code 〉 Cloud technologies 〉 High Availability & Scalability 〉 Want‘s a Z-Frame 〉 @johscheuer 2
- 3. Security
- 4. • Security Cake • Authentication and Authorisation • Network Policies • Pod Security Policies • Admission Controller • Vault Integration Security Kubernetes
- 5. Security Cake HW HW HW HW OS OS OS OS Platform Container Container Container Container Base Base Base Base App App App App
- 6. Secure the Pipeline Build Test Ship Run
- 7. • Secure all components with certificates • Only talk over TLS • Disable the insecure port (even on localhost) • Disable anonymous authentication • Or at least restrict it to uncritical resources • Since 1.7 Kubernetes supports an Audit Log Focus on the Platform
- 8. How to build ”the” platform
- 9. • RBAC (Role Based Access Control) • ABAC (Attribute Based Access Control) • WebHook • Certificates • Token (JWT à https://jwt.io) Authentication and Authorisation
- 11. Network Policies
- 12. • Since 1.6 • Ingress policies • Egress policies (1.8) • Network segmentation (distributed firewall) • CNI plugin must support it Network Policies
- 13. • DENY all traffic to an application • LIMIT traffic to an application • DENY all non-whitelisted traffic in a namespace • DENY all traffic from other namespaces • ALLOW traffic from other namespaces • ALLOW traffic from external clients Network Policies (example)
- 15. • Needs to be explicitly activated • Let you define what’s allowed • There must be a default policy • Activating “runAsNonRoot” will break many things • Only activate if needed (multi-tenant) • Can be combined with RBAC Pod Security Policies
- 16. • Volumes • RunAsUser • AllowedCapabilities • Privileged • HostNetwork / HostPorts • readOnlyRootFilesystem Pod Security Policies (example)
- 18. • Intercepts request to the Kubernetes API • (Can) Perform modifications • Many default controllers exists • You can also write your own Admission Controller(s)
- 19. • DenyEscalatingExec • ImagePolicyWebhook • NodeRestriction • PodSecurityPolicy • SecurityContextDeny • ServiceAccount Admission Controller (example)
- 20. Vault
- 21. Vault Integration (CA) Vault Node Master 1.) Auth (AppRoleID) 2.) Issue certificate Policies etcd
- 22. • Since 0.9 Kubernetes auth backend • Solves only the challenge of authentication • Secret must be fetched • Sidecare/init container • Integrates with ServiceAccounts Vault Integration (secret store)
- 23. • Open artifact metadata API • Pluggable (multiple providers) • ACL for the metadata • Query-ability • Integrates with Kubernetes Grafeas
- 24. • Service Mesh • Policy Enforcement (L4/L7) • Integrated CA • Transparent TLS • Routing • Language/Platform agnostic Istio
- 25. Conclusions
- 26. • Many possibilities to make your cluster more secure • Each with it’s benefits and drawbacks • Generally à Security means (hard) work • Depends on your Use Case what to use • Play around with and get a feeling (in a playground) Conclusions
- 28. Q&A
- 29. • https://kubernetes.io/docs/admin/admission- controllers • https://kubernetes.io/docs/concepts/policy/pod- security-policy • https://kubernetes.io/docs/concepts/services- networking/network-policies Further reading
- 30. • https://grafeas.io • https://istio.io • https://ahmet.im/blog/kubernetes-network-policy • https://github.com/kubernetes/examples/tree/master/ staging/podsecuritypolicy/rbac Further reading
- 31. Johannes M. Scheuermann inovex GmbH Johannes.scheuermann@inovex.de CC BY-NC-ND inovex.de +JohannesScheuermann github.com/johscheu er @johscheuer youtube.com/inovexGmb H