Kubernetes Security Fundamentals (22%)

Pod Security Admission

• Replaces pod security standards
• Meant to be safe and easy to use.
• Enabled by default. Runs as an admission controller.
• Applied to namespaces. To apply to a namespace, simply add a label:

  kubectl label ns <namespace> pod-security.kubernetes.io/<mode>=<security standard>
  

  • Modes:

    • What action to take if a pod violates the policy
    • The modes are: enforce, audit, warn

  • Standards:

    • These are built-in policies
    • They are: Privileged, baseline, and restricted

Authentication

• Kubernetes does not manage user accounts itself. It depends on an external service to do that.
• All authentication is managed by the kube-api server
• Kube-api server authenticates users via certificates, tokens, or an external service such as LDAP or Kerberos

Authorization

• Once someone or something is authenticated, what are they able to do? This is authorization.
• There are 6 different authorization modes in Kubernetes:
  • Node
  • ABAC
  • RBAC
  • Webhook
  • AlwaysAllow (the default)
  • AlwaysDeny
• Authorization mode can be configured on the kube-api server using the --authorization-mode flag

RBAC

• Role, ClusterRole, RoleBinding ClusterRoleBinding

Secrets

• Secrets are used to store sensitive information
• They are similar in concept to ConfigMaps
• Secrets are not encrypted, they are base64 encoded
• Secrets are only loaded on nodes where they are needed.

Namespaces

• Namespaces can be used to isolate or organize resources in a Kubernetes cluster
• RBAC can be applied to namespaces for authorization

Resource Quotas and Limits

Resource Requests and Limits

Resource Quotas

• Set a hard limit for resource requests and quotas defined on a pod

Limit Ranges

Security Context

• a Security Context gives you the ability to do several things:
  • run the container as a different UID/GID
  • make the root file system read-only
  • etc
• Some settings can be applied on the pod, and some can be applied on the container