What is Kubernetes security?
Securing the orchestration platform for those containers is just as important as securing the containers themselves. Kubernetes (K8s or Kube), is an open source orchestration platform that can automate deployment, management, and scaling of containerized applications.
Using Kubernetes as your orchestration platform allows for a few built-in security options including:
- Security checks performed during runtime and fixed at build stage
- Segmentation of pods or groups of pods by network policies
- Role-based access control (RBAC)
- Kubernetes secrets for sensitive data
We will learn more about how to implement best security practices as it pertains to Kubernetes.
What will you learn?
- How to maintain security within Kubernetes containers
What you need before starting:
- Nothing, use this as a resource
The pillars of Kubernetes security
Kubernetes has a number of security measures it easily supports and integrates.
Code security
Kubernetes supports declarative configuration with Git as the source of truth. This allows for the same code base being used for builds to be used for deployment across your organization. It also makes it easier to apply security best practices in one place and ensure it applies to whichever use the code is being applied to.
Image security
Images are scanned early and often throughout the development lifecycle, double checking for any errors before they become bigger issues down the line.
Identity and access management
By default, Kubernetes comes with RBAC, which allows for users to be granted certain access privileges as needed with appropriate authentications. This bolsters overall security best practices and reduces any unnecessary exposure of your code.
Data security
Another feature that comes packaged with Kubernetes is etcd data storage, which can be encrypted to protect system data.
Configuration management
Kubernetes comes with tools such as KubeLinter, which can be used to analyze YAML and Helm charts. By checking these files, your organization can make sure the configuration being deployed is uniform and secure.
Secrets management and API security
Using secrets management within Kubernetes provides a nice separation of sensitive data using secrets instead of hosting them in application manifests. Kubernetes also allows for DLS encryption to be applied to your relevant APIs.
Network security
Network policies also come with Kubernetes so that traffic between pods is efficiently controlled. There are also options for ingress and egress rules as needed.
Runtime observability, monitoring, and detection
Some of the many tools Kubernetes can integrate with include Grafana and Prometheus, which can provide security monitoring and runtime anomaly detection.
K8s security in motion
With the many security capabilities of Kubernetes, how do they get applied throughout the container lifecycle?
From the earliest stage of the container lifecycle, the build stage, Kubernetes’s approach to security is a shared one. This includes measures such as automating container pipelines, using Kubernetes deployment analysis, private registries to manage images, and automating application deployment.
Once in the deploy stage, Kubernetes is safeguarded by reducing any potential attack surface. This can be accomplished by using an operating system optimized for containers, automating configuration management and policy enforcement across clusters, implementing least-privilege access with more refined role-based access controls, and running compliance checks against internet best practices.
Finally, in the run stage, users can further protect their containers using isolation and resource management. This is accomplished through application monitoring and logging with service mesh visualization, as well as threat detectors to kill pods quickly based on anomalous behavior.
These measures go well with Red Hat® OpenShift® clusters and Red Hat Advanced Cluster Security for Kubernetes, which can support these best practices. We can find out how in the next resource.
