Kubernetes Security For Beginner – CKS

Kubernetes is the most used platform among admins. Given the platform’s popularity and high adoption rates, it’s important for developers to ensure that Kubernetes security is always prioritized.

If you are new to Docker & Kubernetes world, then check out our previous blog on Kubernetes for Beginners and Kubernetes Architecture to get an idea about the components and concepts of Kubernetes.

In this article, you will learn about Kubernetes security,

• What is Kubernetes security
• Kubernetes Security Features
• RBAC
• Pod security policies
• Network policies
• Secrets management
• Security Context
• kubeconfig
• Images
• Security Certification

What is Kubernetes Security? ^

Kubernetes security is all about establishing and implementing security measures to protect container-based applications from potential threats and attacks. Generally, most organizations have experienced a serious security issue in the last few months in their container environment. These attacks include the exploitation of vulnerabilities in container base images. Their widespread popularity and the many organizations without proper security measures in place have made containerization and Kubernetes the perfect target for attackers.

Kubernetes security is based on the 4C’s of cloud-native security: Cloud, Cluster, Container, and Code

Cloud Security

In this framework, the cloud layer refers to the infrastructure that runs servers. There are many different services involved in setting up a server on your preferred Cloud Service Provider (CSP).

Cluster Security

When talking about cluster security, we’ll focus mostly on Kubernetes since it is the most used container orchestration tool today, however, the security principles discussed can also be applied to other solutions as well.

Container Security

Container Runtime Engines (CREs) are needed for running the containers in the cluster. Although Docker is one of the most popular CREs, Kubernetes also supports others such as containers or CRI-O.

Code Security

This can also be called application security, and it is the layer that organizations have the most control over. The code of your applications is the heart of your systems, along with their respective databases.

Kubernetes Security Features ^

When it comes to security, Kubernetes offers several built-in security features to help secure the components and some which it doesn’t secure on its own by using other tools.

RBAC

Role-based access control (RBAC) is a technique of regulating access to a user or network resources based on the roles of individual users within an enterprise. In RBAC it provides private user to perform a selected task, like read, create, or modify a file.

Role Binding

Role Binding in RBAC is used for granting permission to a Subject in a Kubernetes cluster. Subjects are nothing but a  group of users, services, or team making an attempt at Kubernetes API. It defines what operations a user, service, or a group can perform.

Cluster Role Binding

Cluster Role Binding in RBAC is used to grant permission to a subject on a cluster-level in all the namespaces. It will offer you permissions for cluster resources and it can even offer you with permissions for resources within any namespace within a cluster.
Note: Learn more about RBAC

Pod security policies

Think of Kubernetes pod security policies as sort of the opposite of RBAC policies. While RBAC lets you control which actions certain users can perform on pods (or other resources), pod security policies are used to restrict the actions that pods are allowed to perform. You can create pod security policies that do things like preventing containers from running as root or disallow a pod to share the process ID namespace with its host.

Network policies

Kubernetes allows you to define a Network policy to control what traffic is allowed to flow between different pods and endpoints in your cluster. Network policies aren’t designed primarily as a security tool, they are mainly a way to manage network traffic and avoid unnecessary network load. However, because they allow you to block traffic ingress or egress certain pods or endpoints, they can essentially function as a sort of firewall if you want them to. Network policies are a handy way to help lock down the networks inside your cluster to reduce security risks associated with the network.

Ingress – Each Network Policy may include a list of allowed ingress rules. This includes inbound traffic whitelist rules.

Egress – Each Network Policy may include a list of allowed egress rules. This includes outbound traffic whitelist rules.
Note: Learn more about Network policies

Secrets management

If you are running an application on Kubernetes that needs to access secrets (like passwords or an SSH key), you can keep those secrets secure by using Kubernetes built-in secrets management framework. To do this, you use the kubectl command to translate your secret information into a special object that you can later make accessible to your pods.

Security Context

A security context defines the operating system security settings. It defines privilege and access control settings for a Pod or Container. It is available on two levels; per pod and container. Some configurations are possible on both levels. Security settings for Pods are typically applied by using security contexts. Security Contexts allow for the definition of privilege and access controls on a per-Pod basis.

kubeconfig

Kubecofig enables clients like kubectl and many programming languages to securely access your Kubernetes Cluster. A kubeconfig file is a file used to configure access to Kubernetes when used in conjunction with the kubectl command-line tool (or other clients).  The kubectl command-line tool uses kubeconfig files to find the information it needs to choose a cluster and communicate with the API server of a cluster.

Image Security

The image is pulled from docker default registry called docker hub. All images are pushed in the registry, these are publicly accessible. When we have applications built in house that should not be accessible to the public, hosting private registry is a solution. Service providers like Azure Kubernetes Service gives a private registry by default. These are accessible by using a set of credentials to access. Login to the private registry using docker login command. In Kubernetes, image is pulled by docker runtime on the worker node. For passing credentials, we create a secret object. Secret is a type of docker registry, we name it regcred. These are built in secret type used for storing docker credentials these are used to pull private images.
Note: Learn more about image

kubernetes Security Certification ^

Certified Kubernetes Security Specialist (CKS): This program will consist of a performance-based certification exam and assures that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment, and runtime.
NOTE: Know more about Certified Kubernetes Security Specialist (CKS) Certification

Step-by-Step Activity Guides (Hands-on Labs)

In order to clear the Kubernetes Certifications, you need practical knowledge and the best way to learn is to perform. Hands-on labs for Certified Kubernetes Security Specialist [CKS]: Step-by-Step Activity Guide

Related / References:

• Visit our YouTube channel on “Docker & Kubernetes”
• Certified Kubernetes Security Specialist (CKS): Everything You Must Know
• (CKS) Certification: Step By Step Activity Guides/Hands-On Lab Exercise & Learning Path
• Certified Kubernetes Administrator (CKA) Certification Exam
• (CKA) Certification: Step By Step Activity Guides/Hands-On Lab Exercise & Learning Path

Next Task For You

Begin your journey towards becoming a Certified Kubernetes Security Specialist (CKS) and earning a lot more in 2020 by joining our Free Class Waitlist.

The post Kubernetes Security For Beginner – CKS appeared first on Cloud Training Program.