11 Kubernetes Admission Controller Best Practices for Security
March 22, 2019 | by
Kubernetes provides several built-in security capabilities, including network security, resource isolation, access control, and logging and auditing. One of the more recent security capabilities is a group of plugins known asadmission controllers.
Admission controllers enable governance and enforcement of how clusters are used. Kubernetes ships with over 30 admission controllers, which are listedherealong with their descriptions. This article assumes you have a basic understanding of admission controllers, but if you are unfamiliar with them, check out Kubernetesreference guide on admission controllersto learn more.
We’ve compiled 11 tips and recommendations to help you operationalize admission controllers for better security:
As a first step, enable admission controllers in order to use some of the more advanced security features of Kubernetes, such as pod security policies which enforce configuration baseline for an entire namespace.
To turn on an admission controller, use the following command line, replacing what appears after “=” with the name of the admission controller you want to turn on
In order to validate Kubernetes resources during create, update, and delete operations, enableValidatingAdmissionWebhook
Consider disabling theMutatingAdmissionWebhookadmission controller or applying stricter RBAC restrictions as to who can createMutatingWebhookConfiguration
You can usePodSecurityPolicyadmission controller to prevent containers from running as root or ensure the container’s root filesystem is always mounted as read-only. Keep in mind that unless a policy has already been defined in aPodSecurityPolicy, pods will not be created because the admission controller’s default operation is to reject pod creation in cases where no matching policy is found.
Create custom, webhook-based admission controllers to:
Prevent pulling images from unknown registries while allowing only approved registry usage.
Set policies that prevent insecure deployments. For example, containers usingprivilegedflag increase your security risk because they can bypass a lot of security controls. You can avoid this risk by using a webhook-based admission controller that either rejects this type of deployment or overrides theprivilegedflag.
Enforce label validation on objects to ensure proper labels are used, such as every object being assigned to a team or project.
Automatically add annotations to objects, such as attributing the correct cost center for a “dev” deployment resource.
Use admission controllers to audit the configuration of the objects in clusters to prevent insecure and misconfigured objects from getting into your cluster.
Admission controllers can be used to identify and correct images deployed without semantic tags by:
Automatically adding or validating resource limits
Ensuring reasonable labels are attached to pods
Making sure image references in product deployments are not usinglatesttags, or tags with a-devsuffix
UseAlwaysPullImagesadmission controller to ensure pull policy is set to Always, such as when you want to make sure a user’s private images are only pulled by those who have the credentials to pull them. Without this admission controller, any pod from any user can use an image by merely knowing its name.
Admission controllers are one of the critical pillars of security for Kubernetes, and as a result, a Kubernetes API server that’s not utilizing the correct set of admission controllers will be incomplete and unable to support all of the expected features of Kubernetes.