Skip to content

Security: devpro/kubernetes-essentials

Security

docs/security.md

Security in Kubernetes

kubernetes.io/docs/concepts/security

Authentication

Two types of accounts:

  • Users through the kube-apiserver
    • Authentication mechanism
      • static password files: kube-apiserver --basic-auth-file start argument (csv file)
      • static token files: kube-apiserver --token-auth-file start argument (csv file)
      • certificates
      • identity services
  • Service Accounts

See:

Certificates

# view a certificate
openssl x509 -in <certificate path> -text

# for example to view the Common Name (CN) configured on the Kube API Server Certificate
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

Certificates folders: /etc/kubernetes/pki (control plane), /var/lib/kubelet/pki (workder node)

Roles

# check if a user can do actions
k get pods --as dev-user

Operators

Tools

Concepts

Terminology

Abbreviation Meaning Links
CIS Center for Internet Security CIS Kubernetes Benchmarks
CVE Common Vulnerabilities and Exposures cve.org
DLP Data Loss Prevention What is DLP? (example: Social Security Number (SSN))
DPI Deep Packet Inspection What is DPI?
eBPF ebpf.io, eBPF: Put the Kubernetes Data Plane in the Kernel
FIPS Federal Information Process Standard -
FISMA Federal Information Security Management Act -
IAM Idendity and Access Management -
IDS Intrusion Systems -
IPS Intrusion Prevention Systems -
OWASP Open Web Application Security Project owasp.org
OSI Open Systems Interconnection OSI Model Explained
SIEM Security Information and Event Managers -
WAF Web Application Firewall What is a WAF?

Securization logic

  • Principles

    • Least privilege
    • Zero-Trust

  • 3 steps of authentication security

    • Authentication
    • Authorization
    • Admission

  • Network traffic

    • North-South
    • East-West

Checklists

There aren’t any published security advisories