$30 off During Our Annual Pro Sale. View Details »

Secure your Kubernetes Containers - All Day DevOps

Secure your Kubernetes Containers - All Day DevOps

Hossam Barakat

November 06, 2019
Tweet

More Decks by Hossam Barakat

Other Decks in Programming

Transcript

  1. Secure your Kubernetes Containers Hossam Barakat Lead Consultant at Telstra

    Purple @hossambarakat_
  2. @hossambarakat_ 3

  3. @hossambarakat_ Attack Vectors 4 OS Application

  4. @hossambarakat_ Attack Vectors 5 OS Kubernetes Container Image Container Application

  5. @hossambarakat_ 6

  6. @hossambarakat_ Kubernetes Cluster 7

  7. @hossambarakat_ Kubernetes Architecture Master Worker Worker Client Worker Cluster

  8. @hossambarakat_ Kubernetes Architecture Master API Server Worker Kubelet Container Runtime

    UI (Dashboard) CLI (Kubectl) Other Client(s) Pod Pod Cluster Scheduler TLS TLS
  9. @hossambarakat_ Role Based Access Control (RBAC) 10 Role Binding Role

    Resource User Group Service Account Verb Verb Subject
  10. @hossambarakat_ Service Account 11 apiVersion: v1 kind: ServiceAccount metadata: name:

    webapp-service-account namespace: default
  11. @hossambarakat_ Role 12 Role Based Access Control (RBAC) Role Binding

    kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: my-role namespace: default rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list"] kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: my-role-binding namespace: default subjects: - kind: ServiceAccount name: webapp-service-account namespace: default roleRef: kind: Role name: my-role apiGroup: rbac.authorization.k8s.io
  12. @hossambarakat_ Pod 13 Role Based Access Control (RBAC) kind: Pod

    apiVersion: v1 metadata: name: webapp spec: serviceAccountName: webapp-service-account containers: - name: webapp image: hossambarakat/k8s-security-webapp ports: - containerPort: 3000
  13. @hossambarakat_ CIS Kubernetes Benchmark » Document that provide guidance for

    establishing a secure configuration posture for Kubernetes » Specific recommendations with a description, rationale, method of audit and remediation » Can be automated with kube-bench 14
  14. @hossambarakat_ Container Images 15

  15. @hossambarakat_ Images Security » Never run as root • Set

    USER in Dockerfile » Minimal base image • Alpine 2 MB • Ubuntu 60 MB » Trusted base image » Private image registry » Do NOT use latest tag » Vulnerability scans 16
  16. @hossambarakat_ Image Scanning Tools » aquasecurity/trivy » coreos/clair » optiopay/klar

    » aquasecurity/microscanner » Aqua Security » Twistlock 17
  17. @hossambarakat_ Trivy 18

  18. @hossambarakat_ Vulnerability Scanning CI Pipeline Integration 19 Code CI Vulnerability

    Scanning Image Registry Schedule Container
  19. @hossambarakat_ Vulnerability Scanning CI Pipeline Integration 20 Code CI Vulnerability

    Scanning Image Registry Schedule Container Publish Scanning Results Is Scanned Image? Admission Webhook
  20. @hossambarakat_ Containers 21

  21. @hossambarakat_ Privilege Escalation 22 Pod Worker Container Modify container file

    system Modify host file system Crypto Miner Hacker icon by karina from the Noun Project
  22. @hossambarakat_ Demo 23 Privilege Escalation

  23. @hossambarakat_ » RunAsUser » RunAsGroup 24 Security Context securityContext: runAsUser:

    1000 runAsGroup: 3000
  24. @hossambarakat_ » AllowPrivilegdeEscalation 25 Security Context securityContext: allowPrivilegeEscalation: false

  25. @hossambarakat_ » ReadOnlyRootFilesystem 26 Security Context securityContext: readOnlyRootFilesystem: true

  26. @hossambarakat_ » RunAsUser » RunAsGroup » AllowPrivilegdeEscalation » ReadOnlyRootFilesystem 27

    Security Context apiVersion: v1 kind: Pod metadata: name: my-app spec: securityContext: runAsUser: 1000 RunAsGroup: 2000 containers: - name: my-app image: my-app securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true
  27. @hossambarakat_ Enter Pod Security Policy 28

  28. @hossambarakat_ Pod Security Policy » A Pod Security Policy is

    a cluster-level resource that controls the actions that a pod can perform and what it has the ability to access. » The PodSecurityPolicy objects define a set of conditions that a pod must run with in order to be accepted into the system. 29
  29. @hossambarakat_ Pod Security Policy » privileged » volumes » fsGroup

    » runAsUser, runAsGroup » readOnlyRootFilesystem » allowedHostPaths » hostNetwork » Linux capabilities 30
  30. @hossambarakat_ kube-psp-advisor 31

  31. @hossambarakat_ » All pods can communicate with each other 32

    Network Communication Pod Pod Pod
  32. @hossambarakat_ App 1 33 Network Communication Frontend DB Pod apiVersion:

    networking.k8s.io/v1 kind: NetworkPolicy metadata: name: my-frontend-policy spec: podSelector: matchLabels: app: db ingress: - from: - podSelector: matchLabels: app: frontend
  33. @hossambarakat_ Network Plugin » Calico » Cilium » Kube-Router »

    Weave Net » … 34
  34. @hossambarakat_ 35

  35. @hossambarakat_ Service Mesh » Security specific policy enforcement » End-to-end

    encryption » Rolling certificates 38
  36. @hossambarakat_ Summary 39 Kubernetes Cluster Bootstrap TLS Authentication Enable RBAC

    CIS Benchmark Container Images No root user Small images Do NOT use latest Private Image Registry Containers Pod Security Context Pod Security Policy Network Policy Service Mesh Vulnerability Scans
  37. @hossambarakat_ Resources » https://kubernetes-security.info » http://github.com/hossambarakat/secure-k8s-containers 40

  38. @hossambarakat_ Questions? #2019addo-devsecops 41

  39. @hossambarakat_ 42

  40. Thank You Hossam Barakat @hossambarakat_