Kubernetes Security Best Practices by Ian Lewis, Google
Containers give developers the ability to isolate applications from one another, but that’s not enough. Resource isolation is much different that security isolation. How do we make applications deployed in containers more secure? What tools can be we apply to our containers running in Kubernetes to make them more secure? How can we apply policy to our network and services to make sure applications only have access to what they need and nothing more?
In this talk, attendees will learn about the risks and attack surfaces of a Kubernetes cluster. s-We'll look at tools like PodSecurityPolicy, SELinux, AppArmor, seccomp, and sandboxed containers in action to improve the security of containers. We’ll then go up the stack and learn how to apply network policy to containers to further improve security.
Agenda:
- Security 101
- Defense in depth (redundant
- Limit the attack surface
- Least privilege
- Runtime security
- Attacking Kubernetes cluster itself, Kubernetes API server
- Host security
- RBAC
- API Firewall
- Network security
- NetworkPolicy
- Secured access to etcd
- Run as non-root
- Read-only root filesystem
- no new privileges (allowPrivilegeEscalation:false)
- Sandboxed Pod
- seccomp/AppArmor/SELinux
- restrict kubelet permissions
- Policy enforcement
- istio
- Use kube-bench