Kubernetes Security – Best Practice Guide • Hacker News Board

Kubernetes Security – Best Practice Guide

#1

Post by aboutsimon » Thu, Apr 05, 2018, 1:35 PM UTC

Kubernetes Security – Best Practice Guide
github.com

Re: Kubernetes Security – Best Practice Guide

#2

Post by iooi » Thu, Apr 05, 2018, 3:14 PM UTC

It would help a lot to have a Why for each section. For example, why use a private topology? Why block access to the AWS Metadata API?

I'm not saying it's wrong to do those things, but it would help to prioritize changes if you can understand the severity of the security vulnerabilities you're exposed to.

Re: Kubernetes Security – Best Practice Guide

#3

Post by praving5 » Thu, Apr 05, 2018, 3:14 PM UTC

Have you seen CIS Kubernetes Benchmark? It has 100+ security check points.

Re: Kubernetes Security – Best Practice Guide

#4

Post by lima » Thu, Apr 05, 2018, 3:44 PM UTC

Best practice: don't roll your own Kubernetes cluster and use a distribution like OpenShift[1].

They take care of providing, among others, a secure default configuration.

[1]: https://github.com/openshift/origin

Re: Kubernetes Security – Best Practice Guide

#5

Post by mcdan » Thu, Apr 05, 2018, 3:46 PM UTC

Another tool that can help here: https://github.com/aquasecurity/kube-bench

Re: Kubernetes Security – Best Practice Guide

#6

Post by corpMaverick » Thu, Apr 05, 2018, 3:56 PM UTC

Not included, but I would like to see how to inject secrets when running an image.

Re: Kubernetes Security – Best Practice Guide

#7

Post by swozey » Thu, Apr 05, 2018, 3:59 PM UTC

You recommend RBAC but then state that the k8s-dash starts with full permissions. That's not true at all when using RBAC. You need to define which namespaces, resources, etc get accessed. Right now with k8s if you deploy RBAC + k8s-dash (which is basically deprecated anyway) and don't set up its RBAC svc account you won't be able to view things in k8s without putting in your personal admin token because it would use the default service account which has no/very limited permissions.

Definitely suggest adding more RBAC examples to this. And things like ETCD w/SSL, etc.

Re: Kubernetes Security – Best Practice Guide

#8

Post by jaytaylor » Thu, Apr 05, 2018, 4:05 PM UTC

mcdan wrote: post #5

Another tool that can help here: https://github.com/aquasecurity/kube-bench

This looks potentially very useful, thanks for sharing!

There appear to be several of these worth investigating. Ordered by highest to lowest apparent activity level and update frequency:

https://github.com/aquasecurity/kube-bench (Go)

https://github.com/neuvector/kubernetes-cis-benchmark (Bash)

https://github.com/dev-sec/cis-kubernetes-benchmark (Ruby)

Re: Kubernetes Security – Best Practice Guide

#9

Post by kylegalbraith » Thu, Apr 05, 2018, 4:24 PM UTC

mcdan wrote: post #5

Another tool that can help here: https://github.com/aquasecurity/kube-bench

This is quite useful, thank you for pointing me in this direction!

Re: Kubernetes Security – Best Practice Guide

#10

Post by Diederich » Thu, Apr 05, 2018, 4:31 PM UTC

corpMaverick wrote: post #6

Not included, but I would like to see how to inject secrets when running an image.

At image startup you mean? Or while the image is actively running.