What is Kubernetes Security?

• Code from untrusted registries.Untrusted code can include malware or backdoors that could unintentionally grant access to bad actors.
• Bloated base images. Less is more for containerized applications, so developers should eliminate unnecessary packages, libraries, and shells that could be compromised. 
  

• Granting unnecessary privileges. Wherever possible, keep privileges to a minimum and mount only the secrets that a task requires to shrink the attack surface.
• Failure to isolate applications in the cluster. Namespaces should be used to keep resources and teams separate from each other. 
• Lateral motion within the cluster. Use policies that segment the network to prevent lateral movement of an attack within the cluster.
• Unauthorized access. Ensure role-based access controls (RBAC) are properly configured to limit access.
  

• Infrastructure attacks. During runtime, Kubernetes infrastructure elements including the API server, etcd, and controllers all present their own attack surfaces.
• Complexity. The ongoing health of a Kubernetes cluster has many moving parts. Compromised containers must be quickly isolated, stopped, and replaced with healthy ones while the source of the attack is located and remediated. 
  

Best practice recommendations include:Begin with minimal, distro-less images and add only what is absolutely necessary. Smaller is safer.

• Use a minimal host OS, end read-only mounts, and use SELinux options for even more control
• Scan images for vulnerabilities top to bottom, including OS images and outside images of any kind. There is no such thing as an outside trusted source.
• Use namespaces and RBAC to segment the cluster and users in a logical manner. If it’s not needed it shouldn’t be visible.
• Kubernetes networking defaults allow any-to-any communications, so network segmentation should be implemented before production. Carefully define ingress and egress policies to ensure connections are routed properly.
• Keep privileges to a minimum, and never run application processes as root. Using a read-only root filesystem prevents any attack that depends on installing software or modifying the file system.
• Integrate security such as image scanning into the CI/CD pipeline. Even better, run CIS Benchmark security tests.
• Secure the cluster itself. Configure RBAC to limit access to the API server and ensure all etcd communications are secured with TLS encryption. Likewise, lockdown kubelet permissions by configuring RBAC for kubelets.
• Take advantage of built-in controls in Kubernetes, such as configuring security context to limit pod access.
• Proactive security should include monitoring of process activity, communications between services, and communications external to the cluster.