Starting Kubernetes Security with Illustration

This is a translation presentation from イラストではじめるKubernetesセキュリティ

Transcript

1. Starting Kubernetes Security with Illustration Aoi Takahashi
2. 自己紹介 Name：Aoi Takahashi SRE CNCF Ambassador Kubestronaut Author：つくって壊して直して学ぶ Kubernetes入門 etc writing illustration and comics
3. I’d like to share with you the insights I gained while taking the CKS exam • Even if you’re familiar with Kubernetes security, there are surprisingly few opportunities to learn about it in a systematic way • I hope this will give you the confidence to think, “Oh, so knowing this much is enough,” and serve as an opportunity to fill in any gaps in your knowledge • I'm not a security professional🙏
4. Maybe you may know
5. Secret • Resources for storing confidential information • Since the data is simply encoded in Base64, anyone with read access can view its contents. • You can configure whether to encrypt secrets in the etcd settings.←CKS Exam scope
6. Secret
7. Recap: Authentication and Authorization
8. ServiceAccount、RBACの関係
9. ServiceAccount • A type of non-human account • Namespaced • Used for authentication and authorization
10. Role,RoleBinding • Role：A resource that writes what is able to do • RoleBinding：A resource to bind ServiceAccount and Roles
11. Maybe you may know the name
12. Admission Controller • • An admission controller is a piece of code that intercepts requests to the Kubernetes API There are two types ◦ Validation : Deny the manifest ◦ Mutation: Fix the manifest apiVersion: apps/v1 kind: Deployment … spec: hostPID: true containers: - name: kubecon-shopping securityContext: privileged: true … Validation Not created … spec: hostPID: false … securityContext: privileged: false … Mutation corrected and created
13. Pod Security Standards(PSS) Pod Security Admission(PSA) Admission Controller（Validation）to apply PSS is PSA。
14. Gateway API GA in 2023 • The successor to Ingress •
15. Network Policy • Controlling Communication Between Pods apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: role: db policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: role: frontend ports: - protocol: TCP port: 6379 egress: - to: - ipBlock: cidr: 10.0.0.0/24 ports: - protocol: TCP port: 5978
16. • low-level container runtime • secure than runc apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: gvisor handler: runsc
17. • A security scanning tool provided by Aqua example of image scanning trivy image python:3.4-alpine
18. I did’nt know how to use…
19. • A tool for checking Kubernetes clusters based on Aqua's CIS Kubernetes Benchmark • The contents of kube-bench have been incorporated into trivy. • Both trivy and kube-bench will be on the exam.
20. Falkey • runtime security tool • Apply custom rules to Linux kernel events and other events, add context, and generate real-time alerts ↓example of custom rule - rule: Create Symlink Over Sensitive Files desc: > Detect symlinks created over a curated list of sensitive files or subdirectories under /etc/ or root directories. Can be customized as needed. Refer to further and equivalent guidance within the rule "Read sensitive file untrusted". condition: > create_symlink and (evt.arg.target in (sensitive_file_names) or evt.arg.target in (sensitive_directory_names)) output: Symlinks created over sensitive files | target=%evt.arg.target linkpath=%evt.arg.linkpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty priority: WARNING tags: [maturity_stable, host, container, filesystem, mitre_credential_access, T1555]
21. • Linux Security Modules • By writing profiles, you can set various constraints #include <tunables/global> For example, this blocks all file writes. profile k8s-apparmor-example-deny-write flags=(attach_disconnected) { #include <abstractions/base> file, # Deny all file writes. deny /** w, }