07-25-2018, 03:05 AM
11 Ways (Not) to Get Hacked
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/11-ways-not-to-get-hacked.png" width="1475" height="852" title="" alt="" /></div><div><p>Kubernetes security has come a long way since the project’s inception, but still contains some gotchas. Starting with the control plane, building up through workload and network security, and finishing with a projection into the future of security, here is a list of handy tips to help harden your clusters and increase their resilience if compromised.</p>
<h2>Part One: The Control Plane</h2>
<p>The control plane is Kubernetes’ brain. It has an overall view of every container and pod running on the cluster, can schedule new pods (which can include containers with root access to their parent node), and can read all the secrets stored in the cluster. This valuable cargo needs protecting from accidental leakage and malicious intent: when it’s accessed, when it’s at rest, and when it’s being transported across the network.</p>
<h3>1. TLS Everywhere</h3>
<p>TLS should be enabled for every component that supports it to prevent traffic sniffing, verify the identity of the server, and (for mutual TLS) verify the identity of the client.</p>
<blockquote>
<p>Note that some components and installation methods may enable local ports over HTTP and administrators should familiarize themselves with the settings of each component to identify potentially unsecured traffic.</p>
</blockquote>
<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#use-transport-level-security-tls-for-all-api-traffic">Source</a></p>
<p>This network diagram by <a href="https://docs.google.com/presentation/d/1Gp-2blk5WExI_QR59EUZdwfO2BWLJqa626mK2ej-huo/edit#slide=id.g1e639c415b_0_56">Lucas Käldström</a> demonstrates some of the places TLS should ideally be applied: between every component on the master, and between the Kubelet and API server. <a href="https://twitter.com/kelseyhightower/">Kelsey Hightower</a>‘s canonical <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/1.9.0/docs/04-certificate-authority.md">Kubernetes The Hard Way</a> provides detailed manual instructions, as does <a href="https://coreos.com/etcd/docs/latest/op-guide/security.html">etcd’s security model</a> documentation.</p>
<p><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/11-ways-not-to-get-hacked.png" width="800" alt="kubernetes-control-plane.png" /></p>
<p>Read more at <a href="https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/">Kubernetes.io</a></p>
</div>
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/11-ways-not-to-get-hacked.png" width="1475" height="852" title="" alt="" /></div><div><p>Kubernetes security has come a long way since the project’s inception, but still contains some gotchas. Starting with the control plane, building up through workload and network security, and finishing with a projection into the future of security, here is a list of handy tips to help harden your clusters and increase their resilience if compromised.</p>
<h2>Part One: The Control Plane</h2>
<p>The control plane is Kubernetes’ brain. It has an overall view of every container and pod running on the cluster, can schedule new pods (which can include containers with root access to their parent node), and can read all the secrets stored in the cluster. This valuable cargo needs protecting from accidental leakage and malicious intent: when it’s accessed, when it’s at rest, and when it’s being transported across the network.</p>
<h3>1. TLS Everywhere</h3>
<p>TLS should be enabled for every component that supports it to prevent traffic sniffing, verify the identity of the server, and (for mutual TLS) verify the identity of the client.</p>
<blockquote>
<p>Note that some components and installation methods may enable local ports over HTTP and administrators should familiarize themselves with the settings of each component to identify potentially unsecured traffic.</p>
</blockquote>
<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#use-transport-level-security-tls-for-all-api-traffic">Source</a></p>
<p>This network diagram by <a href="https://docs.google.com/presentation/d/1Gp-2blk5WExI_QR59EUZdwfO2BWLJqa626mK2ej-huo/edit#slide=id.g1e639c415b_0_56">Lucas Käldström</a> demonstrates some of the places TLS should ideally be applied: between every component on the master, and between the Kubelet and API server. <a href="https://twitter.com/kelseyhightower/">Kelsey Hightower</a>‘s canonical <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/1.9.0/docs/04-certificate-authority.md">Kubernetes The Hard Way</a> provides detailed manual instructions, as does <a href="https://coreos.com/etcd/docs/latest/op-guide/security.html">etcd’s security model</a> documentation.</p>
<p><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/07/11-ways-not-to-get-hacked.png" width="800" alt="kubernetes-control-plane.png" /></p>
<p>Read more at <a href="https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/">Kubernetes.io</a></p>
</div>