Security hardening enhancements for Kubernetes

The default security settings of a Kubernetes deployment is not hardened and fine tuned for security. Let's walk through what enhancements and config changes can be done to make it robust and ready for production.

1. Kubernetes Security Hardening

2. 01 C loud native security intro 02 Shared responsibility model The next 30 mins... 04  K ubernetes security improvements 03 Journey from VMs to Microservices

3. Engineering Leader with 2 decades of primary exp in systems, cloud, security, networking Special interest in serverless, containers and cloud-native offerings. Firm believer of a multi-hybrid cloud future Career Community Organizer of GDG Cloud; Former co-organizer of AWS UG Bangalore Google Developer Expert (GDE) in cloud Multiple hackathon wins in cloud/security topics Recognized by Google as a community influencer runcyoommen https://runcy.me

4. What being “Cloud Native” means ? A cloud computing approach to build & run scalable apps in modern environments such as public, private and hybrid clouds . Technologies such as containers, microservices and serverless are elements of this architecture. Reference: https://en.wikipedia.org/wiki/Cloud_native_computing

5. So, how exactly should cloud native security differ from traditional network security ?

6. Cloud Features v/s Security Balances Agility Self service Scale Automation Gatekeeper Standards Control Centralized Pay as you go Timely alerts

7. Shared Responsibility Model

8. MONOLITH M-I-C-R-O-S-E-R-V-I-C-E-S Let’s begin the journey… f rom to

9. VM Container

10. Portability – A bstract apps from host ; easy to run on any platform Scalability – Containerized apps can handle increasing workload Security – App isolation ensures separate containers run independently Continuity – Failure of one will not influence the state of others Easy Management – Performs orchestration, workload management, automated installation

11. How did we get here?

12. LET'S FIX THE BREAKING K8s

13. Ensure each container has a configured... Hardening #1 Memory request & limit​ CPU request & limit Liveness probe Readiness probe​

14. Overview of hardening Mem requests allocate guaranteed memory to pods in the cluster Mem limits restrict max memory resources to pods in the cluster Memory requests & limits CPU requests enable guaranteed computing to pods in the cluster CPU limits restrict max computing resources to pods in the cluster CPU requests & limits Liveness probe determines when a pod should be replaced (resiliency) Readiness probe determines when a pod is ready to accept traffic Liveness & Readiness probe

15. Remediation Set memory requests & limits Set CPU requests & limits

16. Remediation Configure liveness probe with HTTP req, TCP protocol or exec command Configure readiness probe with HTTP req, TCP protocol or exec command

17. Hardening #2 Prevent deploying naked pods

18. Overview of hardening It's preferable to manage services and applications using higher-level resources like Deployments, StatefulSets and DaemonSets instead of raw Pod resources These are necessary to configure & maintain a stable cluster

19. Remediation Deploy pods using higher-level resources

20. Use images only with... Hardening #3 Pinned (tag) version​ Digest (checksum)

21. Overview of hardening When an image tag is not descriptive, every time that image is pulled, version will be different and might break your code Non-descriptive image tag does not allow to easily roll back to different image version​

22. Remediation Each container image should have a pinned version tag or image ID

23. Prevent containers from... Hardening #4 Accessing underlying host Allowing command execution Escalating privileges Running with root privileges

24. Overview of hardening Pods can use host bind mounts ( dirs and vols mounted on container host) Using hostPath may enable to break from container and gain host access Prevent access to underlying host As an example ' kubectl exec' allows to execute a command in container Prevent command execution Containers allow privilege escalation by default Attackers may utilise this to manipulate app or process Prevent privilege escalation Having non-root execution provides better assurance that apps will function correctly without root privileges Recommended to run with least privileges possible Prevent running with root

25. Remediation Refrain from using hostPath mount Refrain from setting exec, create in your Role

26. Remediation Set the allowPrivilegeEscalation to false Set runAsNonRoot to true

27. Configure HPA with... Hardening #5 Minimum replicas Maximum replicas

28. Overview of hardening When auto-scaling resource utilization is triggered with Horizontal Pod Autoscaler , acceptable values must be set to prevent unintended scale HPA doesn't have min replicas HPA doesn't have max replicas

29. Remediation Configure HPA with minReplicas and maxReplicas value

30. CronJob has... Hardening #6 Deadline configured Concurrent execution forbidden

31. Overview of hardening By default, cron job allows concurrently running jobs, but would be more deterministic if prevented Allowing concurrency requires locking to avoid race conditions When CronJob controller miss more than 100, job is no longer scheduled Counts how many missed schedules since lastScheduleTime

32. Remediation Set deadline to reduce number of missed schedules and increase CronJob reliability Set concurrencyPolicy to either Forbid or Replace

33. runcyoommen https://runcy.me