Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Secure your Kubernetes Containers - All Day DevOps

Secure your Kubernetes Containers - All Day DevOps

Hossam Barakat

November 06, 2019

More Decks by Hossam Barakat

Other Decks in Programming


  1. @hossambarakat_ Kubernetes Architecture Master API Server Worker Kubelet Container Runtime

    UI (Dashboard) CLI (Kubectl) Other Client(s) Pod Pod Cluster Scheduler TLS TLS
  2. @hossambarakat_ Role Based Access Control (RBAC) 10 Role Binding Role

    Resource User Group Service Account Verb Verb Subject
  3. @hossambarakat_ Role 12 Role Based Access Control (RBAC) Role Binding

    kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: my-role namespace: default rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list"] kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: my-role-binding namespace: default subjects: - kind: ServiceAccount name: webapp-service-account namespace: default roleRef: kind: Role name: my-role apiGroup: rbac.authorization.k8s.io
  4. @hossambarakat_ Pod 13 Role Based Access Control (RBAC) kind: Pod

    apiVersion: v1 metadata: name: webapp spec: serviceAccountName: webapp-service-account containers: - name: webapp image: hossambarakat/k8s-security-webapp ports: - containerPort: 3000
  5. @hossambarakat_ CIS Kubernetes Benchmark » Document that provide guidance for

    establishing a secure configuration posture for Kubernetes » Specific recommendations with a description, rationale, method of audit and remediation » Can be automated with kube-bench 14
  6. @hossambarakat_ Images Security » Never run as root • Set

    USER in Dockerfile » Minimal base image • Alpine 2 MB • Ubuntu 60 MB » Trusted base image » Private image registry » Do NOT use latest tag » Vulnerability scans 16
  7. @hossambarakat_ Image Scanning Tools » aquasecurity/trivy » coreos/clair » optiopay/klar

    » aquasecurity/microscanner » Aqua Security » Twistlock 17
  8. @hossambarakat_ Vulnerability Scanning CI Pipeline Integration 20 Code CI Vulnerability

    Scanning Image Registry Schedule Container Publish Scanning Results Is Scanned Image? Admission Webhook
  9. @hossambarakat_ Privilege Escalation 22 Pod Worker Container Modify container file

    system Modify host file system Crypto Miner Hacker icon by karina from the Noun Project
  10. @hossambarakat_ » RunAsUser » RunAsGroup » AllowPrivilegdeEscalation » ReadOnlyRootFilesystem 27

    Security Context apiVersion: v1 kind: Pod metadata: name: my-app spec: securityContext: runAsUser: 1000 RunAsGroup: 2000 containers: - name: my-app image: my-app securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true
  11. @hossambarakat_ Pod Security Policy » A Pod Security Policy is

    a cluster-level resource that controls the actions that a pod can perform and what it has the ability to access. » The PodSecurityPolicy objects define a set of conditions that a pod must run with in order to be accepted into the system. 29
  12. @hossambarakat_ Pod Security Policy » privileged » volumes » fsGroup

    » runAsUser, runAsGroup » readOnlyRootFilesystem » allowedHostPaths » hostNetwork » Linux capabilities 30
  13. @hossambarakat_ App 1 33 Network Communication Frontend DB Pod apiVersion:

    networking.k8s.io/v1 kind: NetworkPolicy metadata: name: my-frontend-policy spec: podSelector: matchLabels: app: db ingress: - from: - podSelector: matchLabels: app: frontend
  14. @hossambarakat_ Summary 39 Kubernetes Cluster Bootstrap TLS Authentication Enable RBAC

    CIS Benchmark Container Images No root user Small images Do NOT use latest Private Image Registry Containers Pod Security Context Pod Security Policy Network Policy Service Mesh Vulnerability Scans