What is Kubernetes security?

• How to maintain security within Kubernetes containers

• Nothing, use this as a resource

Kubernetes has a number of security measures it easily supports and integrates.

Code security

Kubernetes supports declarative configuration with Git as the source of truth. This allows for the same code base being used for builds to be used for deployment across your organization. It also makes it easier to apply security best practices in one place and ensure it applies to whichever use the code is being applied to.

Image security

Images are scanned early and often throughout the development lifecycle, double checking for any errors before they become bigger issues down the line.

Identity and access management 

By default, Kubernetes comes with RBAC, which allows for users to be granted certain access privileges as needed with appropriate authentications. This bolsters overall security best practices and reduces any unnecessary exposure of your code.

Data security

Another feature that comes packaged with Kubernetes is etcd data storage, which can be encrypted to protect system data.

Configuration management

Kubernetes comes with tools such as KubeLinter, which can be used to analyze YAML and Helm charts. By checking these files, your organization can make sure the configuration being deployed is uniform and secure.

Secrets management and API security 

Using secrets management within Kubernetes provides a nice separation of sensitive data using secrets instead of hosting them in application manifests. Kubernetes also allows for DLS encryption to be applied to your relevant APIs.

Network security

Network policies also come with Kubernetes so that traffic between pods is efficiently controlled. There are also options for ingress and egress rules as needed.

Runtime observability, monitoring, and detection

Some of the many tools Kubernetes can integrate with include Grafana and Prometheus, which can provide security monitoring and runtime anomaly detection. 
 

With the many security capabilities of Kubernetes, how do they get applied throughout the container lifecycle?

From the earliest stage of the container lifecycle, the build stage, Kubernetes’s approach to security is a shared one. This includes measures such as automating container pipelines, using Kubernetes deployment analysis, private registries to manage images, and automating application deployment.

Once in the deploy stage, Kubernetes is safeguarded by reducing any potential attack surface. This can be accomplished by using an operating system optimized for containers, automating configuration management and policy enforcement across clusters, implementing least-privilege access with more refined role-based access controls, and running compliance checks against internet best practices.

Finally, in the run stage, users can further protect their containers using isolation and resource management. This is accomplished through application monitoring and logging with service mesh visualization, as well as threat detectors to kill pods quickly based on anomalous behavior.

These measures go well with Red Hat® OpenShift® clusters and Red Hat Advanced Cluster Security for Kubernetes, which can support these best practices. We can find out how in the next resource.