Skip to content

Commit da14ff8

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #43176 from sftim/20230923_revise_security_concept_section
Move and revise overview for Security section
2 parents 1c4d93b + 9323995 commit da14ff8

File tree

8 files changed

+362
-164
lines changed

8 files changed

+362
-164
lines changed

‎content/en/docs/concepts/security/_index.md

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,127 @@ title: "Security"
33
weight: 85
44
description: >
55
Concepts for keeping your cloud-native workload secure.
6+
simple_list: true
67
---
8+
9+
This section of the Kubernetes documentation aims to help you learn to run
10+
workloads more securely, and about the essential aspects of keeping a
11+
Kubernetes cluster secure.
12+
13+
Kubernetes is based on a cloud-native architecture, and draws on advice from the
14+
{{< glossary_tooltip text="CNCF" term_id="cncf" >}} about good practice for
15+
cloud native information security.
16+
17+
Read [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)
18+
for the broader context about how to secure your cluster and the applications that
19+
you're running on it.
20+
21+
## Kubernetes security mechanisms {#security-mechanisms}
22+
23+
Kubernetes includes several APIs and security controls, as well as ways to
24+
define [policies](#policies) that can form part of how you manage information security.
25+
26+
### Control plane protection
27+
28+
A key security mechanism for any Kubernetes cluster is to
29+
[control access to the Kubernetes API](/docs/concepts/security/controlling-access).
30+
31+
Kubernetes expects you to configure and use TLS to provide
32+
[data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/)
33+
within the control plane, and between the control plane and its clients.
34+
You can also enable [encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
35+
for the data stored within Kubernetes control plane; this is separate from using
36+
encryption at rest for your own workloads' data, which might also be a good idea.
37+
38+
### Secrets
39+
40+
The [Secret](/docs/concepts/configuration/secret/) API provides basic protection for
41+
configuration values that require confidentiality.
42+
43+
### Workload protection
44+
45+
Enforce [Pod security standards](/docs/concepts/security/pod-security-standards/) to
46+
ensure that Pods and their containers are isolated appropriately. You can also use
47+
[RuntimeClasses](/docs/concepts/containers/runtime-class) to define custom isolation
48+
if you need it.
49+
50+
[Network policies](/docs/concepts/services-networking/network-policies/) let you control
51+
network traffic between Pods, or between Pods and the network outside your cluster.
52+
53+
You can deploy security controls from the wider ecosystem to implement preventative
54+
or detective controls around Pods, their containers, and the images that run in them.
55+
56+
### Auditing
57+
58+
Kubernetes [audit logging](/docs/tasks/debug/debug-cluster/audit/) provides a
59+
security-relevant, chronological set of records documenting the sequence of actions
60+
in a cluster. The cluster audits the activities generated by users, by applications
61+
that use the Kubernetes API, and by the control plane itself.
62+
63+
## Cloud provider security
64+
65+
{{% thirdparty-content vendor="true" %}}
66+
67+
If you are running a Kubernetes cluster on your own hardware or a different cloud provider,
68+
consult your documentation for security best practices.
69+
Here are links to some of the popular cloud providers' security documentation:
70+
71+
{{< table caption="Cloud provider security" >}}
72+
73+
IaaS Provider | Link |
74+
-------------------- | ------------ |
75+
Alibaba Cloud | https://www.alibabacloud.com/trust-center |
76+
Amazon Web Services | https://aws.amazon.com/security |
77+
Google Cloud Platform | https://cloud.google.com/security |
78+
Huawei Cloud | https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety |
79+
IBM Cloud | https://www.ibm.com/cloud/security |
80+
Microsoft Azure | https://docs.microsoft.com/en-us/azure/security/azure-security |
81+
Oracle Cloud Infrastructure | https://www.oracle.com/security |
82+
VMware vSphere | https://www.vmware.com/security/hardening-guides |
83+
84+
{{< /table >}}
85+
86+
## Policies
87+
88+
You can define security policies using Kubernetes-native mechanisms,
89+
such as [NetworkPolicy](/docs/concepts/services-networking/network-policies/)
90+
(declarative control over network packet filtering) or
91+
[ValidatingAdmisisonPolicy](/docs/reference/access-authn-authz/validating-admission-policy/) (declarative restrictions on what changes
92+
someone can make using the Kubernetes API).
93+
94+
However, you can also rely on policy implementations from the wider
95+
ecosystem around Kubernetes. Kubernetes provides extension mechanisms
96+
to let those ecosystem projects implement their own policy controls
97+
on source code review, container image approval, API access controls,
98+
networking, and more.
99+
100+
For more information about policy mechanisms and Kubernetes,
101+
read [Policies](/docs/concepts/policy/).
102+
103+
## {{% heading "whatsnext" %}}
104+
105+
Learn about related Kubernetes security topics:
106+
107+
* [Securing your cluster](/docs/tasks/administer-cluster/securing-a-cluster/)
108+
* [Known vulnerabilities](/docs/reference/issues-security/official-cve-feed/)
109+
in Kubernetes (and links to further information)
110+
* [Data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/) for the control plane
111+
* [Data encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
112+
* [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
113+
* [Network policies](/docs/concepts/services-networking/network-policies/) for Pods
114+
* [Secrets in Kubernetes](/docs/concepts/configuration/secret/)
115+
* [Pod security standards](/docs/concepts/security/pod-security-standards/)
116+
* [RuntimeClasses](/docs/concepts/containers/runtime-class)
117+
118+
Learn the context:
119+
120+
<!-- if changing this, also edit the front matter of content/en/docs/concepts/security/cloud-native-security.md to match; check the no_list setting -->
121+
* [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)
122+
123+
Get certified:
124+
125+
* [Certified Kubernetes Security Specialist](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)
126+
certification and official training course.
127+
128+
Read more in this section:
129+

‎content/en/docs/concepts/security/cloud-native-security.md

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
---
2+
title: "Cloud Native Security and Kubernetes"
3+
linkTitle: "Cloud Native Security"
4+
weight: 10
5+
6+
# The section index lists this explicitly
7+
hide_summary: true
8+
9+
description: >
10+
Concepts for keeping your cloud-native workload secure.
11+
---
12+
13+
Kubernetes is based on a cloud-native architecture, and draws on advice from the
14+
{{< glossary_tooltip text="CNCF" term_id="cncf" >}} about good practice for
15+
cloud native information security.
16+
17+
Read on through this page for an overview of how Kubernetes is designed to
18+
help you deploy a secure cloud native platform.
19+
20+
## Cloud native information security
21+
22+
{{< comment >}}
23+
There are localized versions available of this whitepaper; if you can link to one of those
24+
when localizing, that's even better.
25+
{{< /comment >}}
26+
27+
The CNCF [white paper](https://github.com/cncf/tag-security/tree/main/security-whitepaper)
28+
on cloud native security defines security controls and practices that are
29+
appropriate to different _lifecycle phases_.
30+
31+
## _Develop_ lifecycle phase {#lifecycle-phase-develop}
32+
33+
- Ensure the integrity of development environments.
34+
- Design applications following good practice for information security,
35+
appropriate for your context.
36+
- Consider end user security as part of solution design.
37+
38+
To achieve this, you can:
39+
40+
1. Adopt an architecture, such as [zero trust](https://glossary.cncf.io/zero-trust-architecture/),
41+
that minimizes attack surfaces, even for internal threats.
42+
1. Define a code review process that considers security concerns.
43+
1. Build a _threat model_ of your system or application that identifies
44+
trust boundaries. Use that to model to identify risks and to help find
45+
ways to treat those risks.
46+
1. Incorporate advanced security automation, such as _fuzzing_ and
47+
[security chaos engineering](https://glossary.cncf.io/security-chaos-engineering/),
48+
where it's justified.
49+
50+
## _Distribute_ lifecycle phase {#lifecycle-phase-distribute}
51+
52+
- Ensure the security of the supply chain for container images you execute.
53+
- Ensure the security of the supply chain for the cluster and other components
54+
that execute your application. An example of another component might be an
55+
external database that your cloud-native application uses for persistence.
56+
57+
To achieve this, you can:
58+
59+
1. Scan container images and other artifacts for known vulnerabilities.
60+
1. Ensure that software distribution uses encryption in transit, with
61+
a chain of trust for the software source.
62+
1. Adopt and follow processes to update dependencies when updates are
63+
available, especially in response to security announcements.
64+
1. Use validation mechanisms such as digital certificates for supply
65+
chain assurance.
66+
1. Subscribe to feeds and other mechanisms to alert you to security
67+
risks.
68+
1. Restrict access to artifacts. Place container images in a
69+
[private registry](/docs/concepts/containers/images/#using-a-private-registry)
70+
that only allows authorized clients to pull images.
71+
72+
## _Deploy_ lifecycle phase {#lifecycle-phase-deploy}
73+
74+
Ensure appropriate restrictions on what can be deployed, who can deploy it,
75+
and where it can be deployed to.
76+
You can enforce measures from the _distribute_ phase, such as verifying the
77+
cryptographic identity of container image artifacts.
78+
79+
When you deploy Kubernetes, you also set the foundation for your
80+
applications' runtime environment: a Kubernetes cluster (or
81+
multiple clusters).
82+
That IT infrastructure must provide the security guarantees that higher
83+
layers expect.
84+
85+
## _Runtime_ lifecycle phase {#lifecycle-phase-runtime}
86+
87+
The Runtime phase comprises three critical areas: [compute](#protection-runtime-compute),
88+
[access](#protection-runtime-access), and [storage](#protection-runtime-storage).
89+
90+
91+
### Runtime protection: access {#protection-runtime-access}
92+
93+
The Kubernetes API is what makes your cluster work. Protecting this API is key
94+
to providing effective cluster security.
95+
96+
Other pages in the Kubernetes documentation have more detail about how to set up
97+
specific aspects of access control. The [security checklist](/docs/concepts/security/security-checklist/)
98+
has a set of suggested basic checks for your cluster.
99+
100+
Beyond that, securing your cluster means implementing effective
101+
[authentication](/docs/concepts/security/controlling-access/#authentication) and
102+
[authorization](/docs/concepts/security/controlling-access/#authorization) for API access. Use [ServiceAccounts](/docs/concepts/security/service-accounts/) to
103+
provide and manage security identities for workloads and cluster
104+
components.
105+
106+
Kubernetes uses TLS to protect API traffic; make sure to deploy the cluster using
107+
TLS (including for traffic between nodes and the control plane), and protect the
108+
encryption keys. If you use Kubernetes' own API for
109+
[CertificateSigningRequests](/docs/reference/access-authn-authz/certificate-signing-requests/#certificate-signing-requests),
110+
pay special attention to restricting misuse there.
111+
112+
### Runtime protection: compute {#protection-runtime-compute}
113+
114+
{{< glossary_tooltip text="Containers" term_id="container" >}} provide two
115+
things: isolation between different applications, and a mechanism to combine
116+
those isolated applications to run on the same host computer. Those two
117+
aspects, isolation and aggregation, mean that runtime security involves
118+
trade-offs and finding an appropriate balance.
119+
120+
Kubernetes relies on a {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}
121+
to actually set up and run containers. The Kubernetes project does
122+
not recommend a specific container runtime and you should make sure that
123+
the runtime(s) that you choose meet your information security needs.
124+
125+
To protect your compute at runtime, you can:
126+
127+
1. Enforce [Pod security standards](/docs/concepts/security/pod-security-standards/)
128+
for applications, to help ensure they run with only the necessary privileges.
129+
1. Run a specialized operating system on your nodes that is designed specifically
130+
for running containerized workloads. This is typically based on a read-only
131+
operating system (_immutable image_) that provides only the services
132+
essential for running containers.
133+
134+
Container-specific operating systems help to isolate system components and
135+
present a reduced attack surface in case of a container escape.
136+
1. Define [ResourceQuotas](/docs/concepts/policy/resource-quotas/) to
137+
fairly allocate shared resources, and use
138+
mechanisms such as [LimitRanges](/docs/concepts/policy/limit-range/)
139+
to ensure that Pods specify their resource requirements.
140+
1. Partition workloads across different nodes.
141+
Use [node isolation](/docs/concepts/scheduling-eviction/assign-pod-node/#node-isolation-restriction)
142+
mechanisms, either from Kubernetes itself or from the ecosystem, to ensure that
143+
Pods with different trust contexts are run on separate sets of nodes.
144+
1. Use a {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}
145+
that provides security restrictions.
146+
1. On Linux nodes, use a Linux security module such as [AppArmor](/docs/tutorials/security/apparmor/) (beta)
147+
or [seccomp](/docs/tutorials/security/seccomp/).
148+
149+
### Runtime protection: storage {#protection-runtime-storage}
150+
151+
To protect storage for your cluster and the applications that run there, you can:
152+
153+
1. Integrate your cluster with an external storage plugin that provides encryption at
154+
rest for volumes.
155+
1. Enable [encryption at rest](/docs/tasks/administer-cluster/encrypt-data/) for
156+
API objects.
157+
1. Protect data durability using backups. Verify that you can restore these, whenever you need to.
158+
1. Authenticate connections between cluster nodes and any network storage they rely
159+
upon.
160+
1. Implement data encryption within your own application.
161+
162+
For encryption keys, generating these within specialized hardware provides
163+
the best protection against disclosure risks. A _hardware security module_
164+
can let you perform cryptographic operations without allowing the security
165+
key to be copied elsewhere.
166+
167+
### Networking and security
168+
169+
You should also consider network security measures, such as
170+
[NetworkPolicy](/docs/concepts/services-networking/network-policies/) or a
171+
[service mesh](https://glossary.cncf.io/service-mesh/).
172+
Some network plugins for Kubernetes provide encryption for your
173+
cluster network, using technologies such as a virtual
174+
private network (VPN) overlay.
175+
By design, Kubernetes lets you use your own networking plugin for your
176+
cluster (if you use managed Kubernetes, the person or organization
177+
managing your cluster may have chosen a network plugin for you).
178+
179+
The network plugin you choose and the way you integrate it can have a
180+
strong impact on the security of information in transit.
181+
182+
### Observability and runtime security
183+
184+
Kubernetes lets you extend your cluster with extra tooling. You can set up third
185+
party solutions to help you monitor or troubleshoot your applications and the
186+
clusters they are running. You also get some basic observability features built
187+
in to Kubernetes itself. Your code running in containers can generate logs,
188+
publish metrics or provide other observability data; at deploy time, you need to
189+
make sure your cluster provides an appropriate level of protection there.
190+
191+
If you set up a metrics dashboard or something similar, review the chain of components
192+
that populate data into that dashboard, as well as the dashboard itself. Make sure
193+
that the whole chain is designed with enough resilience and enough integrity protection
194+
that you can rely on it even during an incident where your cluster might be degraded.
195+
196+
Where appropriate, deploy security measures below the level of Kubernetes
197+
itself, such as cryptographically measured boot, or authenticated distribution
198+
of time (which helps ensure the fidelity of logs and audit records).
199+
200+
For a high assurance environment, deploy cryptographic protections to ensure that
201+
logs are both tamper-proof and confidential.
202+
203+
## {{% heading "whatsnext" %}}
204+
205+
### Cloud native security {#further-reading-cloud-native}
206+
207+
* CNCF [white paper](https://github.com/cncf/tag-security/tree/main/security-whitepaper)
208+
on cloud native security.
209+
* CNCF [white paper](https://github.com/cncf/tag-security/blob/f80844baaea22a358f5b20dca52cd6f72a32b066/supply-chain-security/supply-chain-security-paper/CNCF_SSCP_v1.pdf)
210+
on good practices for securing a software supply chain.
211+
* [Fixing the Kubernetes clusterf\*\*k: Understanding security from the kernel up](https://archive.fosdem.org/2020/schedule/event/kubernetes/) (FOSDEM 2020)
212+
* [Kubernetes Security Best Practices](https://www.youtube.com/watch?v=wqsUfvRyYpw) (Kubernetes Forum Seoul 2019)
213+
* [Towards Measured Boot Out of the Box](https://www.youtube.com/watch?v=EzSkU3Oecuw) (Linux Security Summit 2016)
214+
215+
### Kubernetes and information security {#further-reading-k8s}
216+
217+
* [Kubernetes security](/docs/concepts/security/)
218+
* [Securing your cluster](/docs/tasks/administer-cluster/securing-a-cluster/)
219+
* [Data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/) for the control plane
220+
* [Data encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
221+
* [Secrets in Kubernetes](/docs/concepts/configuration/secret/)
222+
* [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
223+
* [Network policies](/docs/concepts/services-networking/network-policies/) for Pods
224+
* [Pod security standards](/docs/concepts/security/pod-security-standards/)
225+
* [RuntimeClasses](/docs/concepts/containers/runtime-class)
226+

0 commit comments

Comments
 (0)