Keeping Your Kubernetes Cluster Secure

Editor's Notes

1. We will look at 10 tools across 3 rough layers of the Kubernetes ecosystem. All are open-source and/or freely available Also, some publicly available guidance Security is a type of quality You cannot be insecure and have high quality You cannot have low quality but high security
2. Kubernetes clusters consist of servers acting as master nodes and worker nodes. The operating system and processes on these servers have to be secured just like any others. These are the tasks traditionally done by Ops and Security YAGNI K8s hosts need the same security as other hosts Keep the systems up-to-date Easiest to do. Just regularly run apt-get update or dnf update or yum update CISA recommends the following remediation timelines: Critical vulnerabilities should be remediated within 15 calendar days of initial detection. High vulnerabilities should be remediated within 30 calendar days of initial detection.
3. Least privilege Ronald Reagan 1986 – The nine most terrifying words in the English language are "I'm from the Government and I'm here to help." Google both terms, See the Kubernetes.io article from Oct 2021. See the stigviewer.com link Also, not specific to k8s, but Federal, state, local, tribal and territorial governments, as well as public and private sector critical infrastructure organizations. Can request Cyber Hygiene Services at no cost from CISA. CIS is not a government agency, but it is non-profit. CIS Benchmarks are free checklists, very similar to STIGs, easier to read.
4. "checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark." If you are running in a managed Kubernetes cluster, such as Amazon EKS or Azure AKS, kube-bench does not have access to the master nodes but can still evaluate the worker nodes.   Runs as a kubectl job
5. Runs as a kubectl job cd ~/git/ggkube/Book/code kubectl apply -f kube-bench-job-eks.yaml kubectl get pods kubectl logs kube-bench-kc82n
6. These tasks are typically going to fall to the development teams while they are producing their software for deployment All of this is a moot point if the application is security swiss cheese.
7. Least privilege Checkov by Bridgecrew Frequent updates, sometimes daily I use this extensively on Terraform code
8. Python pip install or use Docker container pushd ./microservices-demo/deploy/Kubernetes checkov -d manifests --quiet --compact
9. Can’t just scan once, vulnerabilities can be found even in existing, previously “safe”, containers/code
10. Installs as package, from script, container, etc. trivy config manifests/01-carts-dep.yaml
11. trivy image weaveworksdemos/carts:0.4.8 --no-progress
12. Other options are Clair by Red Hat Can’t just scan once, vulnerabilities can be found even in existing, previously “safe”, containers/code
13. grype weaveworksdemos/carts:0.4.8
14. Can feed that back to Grype
15. Can feed that back to Grype syft weaveworksdemos/carts:0.4.8 --output json --file carts-0.4.8.json grype sbom:carts-0.4.8.json syft weaveworksdemos/carts:0.4.8 --output cyclonedx-json --file carts-0.4.8-dx.json
16. This is the Ops piece of DevSecOps. After you deploy, the job isn’t finished. Keep monitoring. It is embarrassing how often companies that spend millions to staff a 24x7 SOC have apps go down when they run out of disk space
17. Oh-pah
18. https://open-policy-agent.github.io/gatekeeper-library/website/imagedigests kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/library/general/imagedigests/template.yaml kubectl describe ConstraintTemplate -A kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/library/general/imagedigests/samples/container-image-must-have-digest/constraint.yaml cat allowed.yaml kubectl apply -f allowed.yaml
19. cat disallowed.yaml kubectl apply -f disallowed.yaml
20. 014d4142-ca50-4f71-a9f5-a7f727c8df1f kubectl apply -f manifests kubectl label ns sock-shop goldilocks.fairwinds.com/enabled=true kubectl -n goldilocks port-forward svc/goldilocks-dashboard 8444:80& kubectl -n sock-shop port-forward svc/front-end 8555:80&
21. Least privilege Container network interfaceLinkerd, Istio, Calico, Cilium mTLS
22. Least privilege Container network interfaceLinkerd, Istio, Calico, Cilium mTLS
23. Install to host so it is isolated from Kubernetes Can also install into cluster using Helm if you don’t control the host, e.g., EKS
24. kubectl get pods -n falco -o wide kubectl logs -n falco falco-zplnz -f
25. There are commercial versions that incorporate many of these tools and capabilities, often together in a single package.