Kubernetes is an open-source container or microservice platform that manages computing, networking, and storage infrastructure workloads. Kubernetes provides a framework to run distributed systems resiliently.
Kubernetes environment security is a major concern for most organizations. Kubernetes configurations are more complex because of cloud-based multi-environment and hybrid deployments. This increases the chances of human error in system administration and can leave organizations vulnerable to cybersecurity incidents.
In Feb 2018, Telsa had a cyberattack on its infrastructure due to misconfigured a Kubernetes deployment. The attackers were able to exploit this vulnerability and gain access to Tesla’s larger AWS environment. In June 2018, Weight Watchers had the same exposure in their Kubernetes instance. This allowed the attackers to gain access to sensitive details such as AWS access keys, Kubernetes pod specifications, as well as several Amazon S3 buckets that were holding the company’s data.
Due to incidents like these, organizations are pressured to take strict steps to ensure the security of their Kubernetes clusters. Organizations should follow the best practices provided below and look to automate security.
Tools such as Alcide provide continuous automation for Kubernetes’s security-related processes. Alcide Advisor automatically scans for a wide range of compliance, security, and governance risks and vulnerabilities. Then it provides insights and recommendations to ensure clusters, nodes, and pods operate within the provided security guidelines and best practices.
To ensure the security of a Kubernetes implementation, a set of guidelines that organizations can follow is provided below.
All-access to the Kubernetes control plane should be controlled by a restricted network access control list
Nodes should be configured to only accept connections
Provide the cluster with cloud provider access that follows the principle of least privilege
Access to etcd limited to the control plane only.
Encrypt all drives at rest
Use Transport Layer Security (TLS) for all API traffic
API Authentication and Authorization
Control the capabilities of a workload or user at runtime
Limit resource usage on a cluster
Control what privileges containers run with
Prevent containers from loading unwanted kernel modules
Restrict network access
Restricting cloud metadata API access
Restrict access to etcd
Enable audit logging
Restrict access to alpha or beta features
Rotate infrastructure credentials frequently
Review third-party integrations before enabling them
Receiving alerts for security updates and reporting vulnerabilities
Introduce Container Vulnerability Scanning and OS Dependency Security
Introduce Image Signing and Enforcement
Sign container images to maintain a system of trust
Disallow privileged users
Access over TLS only
Limiting port ranges of communication
3rd Party Dependency Security
Static Code Analysis
Dynamic probing attacks