Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

🏠 Back to Blog

Kubernetes Cluster Component Security (22%)

  • Use TLS to ensure all traffic between cluster control-plane components is encrypted

Kube-API Server

  • Kube-API server is at the center of all operations in a Kubernetes cluster
  • In regards to security, we need to make 2 decisions, who can access the cluster, and what can they do?
    • Certificates
    • LDAP
    • Service Accounts
  • Once they gain access to the cluster, what they can do is defined by authorization mechanisms:
    • RBAC
    • ABAC

Controller Manager and Scheduler

  • Controller manager ensures nodes are healthy, manages pods and controllers, etc.
  • The scheduler determines where (on which nodes) the pods can run on in a cluster
  • To protect either of these components, you need to isolate them.

Kubelet

  • Kubelet runs on the worker nodes and manages the node
  • Kubelet registers the node with the control-plane
  • Kubelet listens on 2 ports:
    • 10250: Serves API that allows full access
    • 10255: Serves API that allows unauthenticated, read-only access
  • By default, kubelet allows anonymous access to it’s API.
    • curl -sk https://nodename:10250/pods/
    • curl -sk https://nodename:10250/logs/syslog/
    • curl -sk https://nodename:10255/metrics/
    • This can be disabled by setting anonymous-auth=false in the kubelet config
    • Kubelet supports 2 types of authentication, bearer token and certificate-based

Security the Container Runtime

  • The container runtime is responsible for running the containers
  • CRI (Container Runtime Interface) allows Kubernetes to use any container runtime that is compliant with CRI
  • The most common container runtime is Docker, but others include containerd, cri-o, etc.
  • You should configure pods and containers to run with least privileges by configuring the security context
  • You should also scan the images for vulnerabilities before deploying them

Securing KubeProxy

  • KubeProxy is responsible for managing the network in a Kubernetes cluster
  • Ensure that proper permissions are set on the kube-proxy config file 
    > px aux |grep -i kube-proxy |grep -i config - This will show the kube-proxy process and the config file it is using
> ls -l /var/lib/kube-proxy/kube-config.conf - This will show the permissions on the kube-proxy config file

Pod Security

Pod Security Admission

  • Pod Security Policies (PSP) are deprecated in Kubernetes 1.21
  • Pod Security Admission (PSA) is the new way to enforce security policies on pods
  • PSA is a webhook that intercepts pod creation requests and validates them against a set of policies

Securing etcd

  • etcd is a distributed key-value store that stores the state of the cluster
  • etcd is a critical component of the cluster and should be secured
  • etcd should be configured to use TLS for encryption. To encrypt the database, you can create a EncryptionConfiguration object and pass it to the etcd pod