Kickstart Your Kubernetes Security

A report by Cyble revealed that over 900,000 Kubernetes clusters were exposed online due to misconfigurations. Yes, Kubernetes is complex, leading to configuration missteps and security vulnerabilities. I will cover basic concepts and introduce open-source tools to enhance Kubernetes security.

Apply the Principle of Least Privilege

Applying the principle of least privilege is crucial in securing Kubernetes clusters to ensure that users and applications have only the access they need and nothing more. This significantly reduces the risk of a security breach. Role-based access control (RBAC) is a key mechanism in Kubernetes to execute this principle. RBAC allows administrators to define what actions a user, group or service account can perform. These actions include reading, creating or deleting resources within a cluster, among others.

With 71% of container workloads configured to run with root privileges, this granular control should extend to containers running within the Kubernetes cluster. Docker provides guidelines on how to best write Dockerfiles without a root user and alternatives to have privileged access without using root.

Use Segmentation

Segmentation in Kubernetes is efficiently handled through namespaces — which partition cluster resources for different users, applications or environments. This setup allows the implementation of tailored security policies and controls. With namespaces, administrators can utilize Kubernetes’ RBAC to set precise user and application permissions within each namespace.

Namespaces also facilitate resource management, enabling administrators to assign quotas and limits, which helps prevent any single entity from consuming excessive resources and potentially impacting cluster performance or security. However, keep in mind that namespaces don’t provide network isolation. You do this through Kubernetes network policies.

Tighten Up Your Container Images

A Kubernetes cluster’s security is as strong as the images it runs. While crafting, a basic Dockerfile is straightforward; however, ensuring it is secure requires a deeper dive, and various developers who write these might not have the proper security knowledge.

For companies with bandwidth, it is crucial to give a team the responsibility to scrutinize every container image before it hits production. A practical method to achieve a thorough inspection is generating a software bill of materials (SBOM) for each image, providing clear visibility into its contents. This approach has gained such importance that it is now part of the U.S. government’s executive order on improving the nation’s cybersecurity.

However, only some organizations have the luxury of a dedicated team for this task. In such cases, the smart move is to sidestep the issue of writing container images from scratch. Leveraging open-source Buildpacks offers a streamlined path to creating secure, OCI-compliant container images. Providers such as Google, Heroku and Paketo Buildpacks offer production-ready and secure buildpack images built with best practices and security for every stack.

Specifically, community-led Paketo Buildpacks commits to weekly rebuilds to keep packages up to date and promise updates for critical CVEs within 48 hours. If this time frame isn’t quick enough for you, these open-source images can be easily patched.

Implement Continuous Security Scanning and Compliance

Implementing continuous scanning is crucial for maintaining the integrity of your Kubernetes cluster. The scanning should be aligned with your company’s security and compliance requirements. Data compliance is often overlooked but with 71% of countries having some data protection and privacy legislation, this topic can no longer be ignored.

For example, you should integrate security scanning into your development lifecycle as part of your CI/CD pipeline. Open-source tools such as Clair and Trivy will scan container images for vulnerabilities. For Kubernetes scanning, look into open-source KubiScan and Kube-bench. These tools automate detecting issues early in the development phase, taking a shift-left approach to prevent insecure code or configurations from reaching production.

Self-managed Kubernetes

Choosing to manage their Kubernetes cluster can be the right move for various organizations because skills are scarce. A survey by Canonical found that a lack of talent is a significant barrier to Kubernetes adoption, with 48% of respondents citing difficulties in accessing the necessary skills. Additionally, the cost of hiring for Kubernetes roles — with salaries averaging between $144K and $202K in North America — represents a substantial financial commitment for companies.

Plenty of tools will allow companies to benefit from the power of Kubernetes without worrying about managing its complexity and security. Open-source Korifi brings ease and simplicity of the Cloud Foundry developer experience to Kubernetes, while MicroK8s strives for simplicity. This approach allows engineering teams to focus on development while offloading some security burdens.

Zero-Trust: Never Trust, Always Verify

Zero-trust is a cybersecurity approach that challenges the traditional model of trusting entities within an organization’s network perimeter. The model assumes that threats can come from outside and inside the organization. The concept is so efficient that the U.S. Government requires federal agencies to use zero-trust practices.

This shift aligns well with the dynamic nature of Kubernetes, where resources and identities are constantly changing. Teams managing cloud-native security must rethink identity and move away from location-centric identities such as IP addresses. For instance, companies can implement zero-trust at the network level using sidecar-based service meshes, which — among many other features — provide authentication and authorization at a granular level.

Conclusion

Implementing the steps discussed here will only partially secure your Kubernetes cluster, and there is no such thing as perfect security. But these serve as good starting points. Security is a challenging aspect of Kubernetes management, but leveraging the knowledge and tools from the community and open-source projects can significantly help, especially for small organizations that may lack resources.