Securing Applications and Clusters

00000000000000In this chapter, we will discuss the fundamental steps of reducing the attack surface and securing Kubernetes clusters before we go live from test to production. We will talk about security auditing, building DevSecOps into CI/CD pipelines, detecting metrics for performance analysis, and how to securely manage secrets and credentials.

In this chapter, we will cover the following recipes:

• Using RBAC to harden cluster security
• Configuring Pod Security Policies
• Using Kubernetes CIS Benchmark for security auditing
• Building DevSecOps into the pipeline using Aqua Security
• Monitoring suspicious application activities using Falco
• Securing credentials using HashiCorp Vault

Technical requirements

The recipes in this chapter require that you have a functional Kubernetes cluster deployed by following one of the recommended methods described in Chapter 1, Building Production-Ready Kubernetes Clusters.

The Kubernetes command-line tool, kubectl ,will be used for the rest of the recipes in this chapter since it's the main command-line interface for running commands against Kubernetes clusters. We will also use helm where Helm charts are available to deploy solutions.

Using RBAC to harden cluster security

In a complex system such as Kubernetes, authorization mechanisms are used to set who is allowed to make what changes to the cluster resources and manipulate them. Role-based access control (RBAC) is a mechanism that's highly integrated into Kubernetes that grants users and applications granular access to Kubernetes APIs.

As good practice, you should use the Node and RBAC authorizers together with the NodeRestriction admission plugin.

In this section, we will cover getting RBAC enabled and creating Roles and RoleBindings to grant applications and users access to the cluster resources.

Getting ready

Make sure you have an RBAC-enabled Kubernetes cluster ready (since Kubernetes 1.6, RBAC is enabled by default) and that kubectl and helm have been configured so that you can manage the cluster resources. Creating private keys will also require that you have the openssl tool before you attempt to create keys for users.

Clone the k8sdevopscookbook/src...

Configuring Pod Security Policies

Pod Security Policies (PSP) are used on Kubernetes clusters to enable granular authorization of pod creation and to control security aspects of pods. PodSecurityPolicy objects define the conditions for a pod to be accepted into the cluster and run as expected.

In this section, we will cover the recreation and configuration of PSPs on Kubernetes.

Getting ready

Make sure you have an RBAC-enabled Kubernetes cluster ready (since Kubernetes 1.6, RBAC is enabled by default) and kubectl and helm configured to manage the cluster resources.

Clone the k8sdevopscookbook/src repository to your workstation to use the manifest files in the chapter9 directory, as follows:

$ git clone https://github.com/k8sdevopscookbook/src.git
$ cd src/chapter9/psp

Verify if PodSecurityPolicy needs to be enabled on your cluster by running the kubectl get psp command. If you get a message stating the server doesn't have a resource type "podSecurityPolicies"., then PSP...

Using Kubernetes CIS Benchmark for security auditing

Kubernetes CIS Benchmarks are the security configuration best practices that are accepted by industry experts. The CIS Benchmark guide can be download as a PDF file from the Center for Internet Security (CIS) website at https://www.cisecurity.org/. kube-bench is an application that automates documented checks.

In this section, we will cover the installation and use of the open source kube-bench tool to run Kubernetes CIS Benchmarks for security auditing of Kubernetes clusters.

Getting ready

For this recipe, we need to have a Kubernetes cluster ready and the Kubernetes command-line tool kubectl installed.

Clone the k8sdevopscookbook/src repository to your workstation to use the manifest files in the chapter9 directory, as follows:

$ git clone https://github.com/k8sdevopscookbook/src.git
$ cd src/chapter9/cis

Some of the tests target Kubernetes nodes and can only be executed on fully self-managed clusters where you have control over the...

Building DevSecOps into the pipeline using Aqua Security

The Shift Left approach to DevOps Security is becoming increasingly popular, which means that security must be built into the process and pipeline. One of the biggest problems with shortened pipelines is that they often leave little room for proper security checks. Due to this, another approach called deploy changes as quickly as possible was introduced, which is key to the success of DevOps.

In this section, we will cover automating vulnerability checks in container images using Aqua Security to reduce the application attack surface.

Getting ready

Make sure you have an existing CI/CD pipeline configured using your preferred CI/CD tool. If not, follow the instructions in Chapter 3, Building CI/CD Pipelines, to configure GitLab or CircleCI.

Clone the k8sdevopscookbook/src repository to your workstation to use the manifest files in the chapter9 directory, as follows:

$ git clone https://github.com/k8sdevopscookbook/src.git
$ cd src...

Monitoring suspicious application activities using Falco

Falco is a cloud-native runtime security toolset. Falco gains deep insight into system behavior through its runtime rule engine. It is used to detect intrusions and abnormalities in applications, containers, hosts, and the Kubernetes orchestrator.

In this section, we will cover the installation and basic usage of Falco on Kubernetes.

Getting ready

Clone the k8sdevopscookbook/src repository to your workstation to use the manifest files in the chapter9 directory, as follows:

$ git clone https://github.com/k8sdevopscookbook/src.git
$ cd src/chapter9

Make sure you have a Kubernetes cluster ready and kubectl and helm configured to manage the cluster resources.

How to do it…

This section will show you how to configure and run Falco. This section is further divided into the following subsections to make this process easier:

• Installing Falco on Kubernetes
• Detecting anomalies using Falco
• Defining custom rules

Installing Falco on...

Securing credentials using HashiCorp Vault

HashiCorp Vault is a popular tool for securely storing and accessing secrets such as credentials, API keys, and certificates. Vault provides secure secret storage, on-demand dynamic secrets, data encryption, and support for secret revocation.

In this section, we will cover the installation and basic use case of accessing and storing secrets for Kubernetes.

Getting ready

Clone the k8sdevopscookbook/src repository to your workstation to use the manifest files in the chapter9 directory, as follows:

$ git clone https://github.com/k8sdevopscookbook/src.git
$ cd src/chapter9

Make sure you have a Kubernetes cluster ready and kubectl and helm configured to manage the cluster resources.

How to do it…

This section is further divided into the following subsections to make this process easier:

• Installing Vault on Kubernetes
• Accessing the Vault UI
• Storing credentials on Vault

Installing Vault on Kubernetes

This recipe will show you how to get a Vault...