Kubernetes (or K8s) is an open-source system for managing and organising containers. In recent years, Kubernetes has become a standout containerisation tool used by organisations across all sectors. Despite being relatively new on the scene, the system has seen rapid adoption and growth, driven partly by the Cloud Native Computing Foundation’s governance takeover from Google in 2016.
Interest in Kubernetes does not appear to be waning. It’s thought that more than 5.6 million developers are currently using Kubernetes to manage and orchestrate containerised applications, benefitting from its reliability and scalability. In 2022, Kubernetes experienced an annual growth rate of 127 per cent, with the number of Kubernetes clusters hosted in the cloud growing five times as quickly as clusters hosted on-premises.
Clearly, Kubernetes is all the rage in the DevOps world. However, securing containerised workloads can be challenging, and in recent years, users have expressed security concerns. This article will explore the current state of Kubernetes security in 2023, such as key security risks, to help you ensure that your Kubernetes deployments are as secure as possible.
The State of Kubernetes Security: Concerning Trends
A report by Red Hat has uncovered some concerning security trends relating to Kubernetes. The State of Kubernetes Security in 2023 report, which surveyed 600 professionals in the DevOps, engineering and security fields, found that almost 40 per cent of respondents believe the current level of security investment in containerised applications is inadequate, a seven per cent increase from 2022.
Additionally, 67 per cent of respondents have had to slow down cloud-native adoption due to security concerns, with more than half of survey respondents having experienced a software supply chain issue related to containerised and cloud-native development in the past year.
These findings by Red Hat highlight the importance of investing in robust, reliable security solutions for cloud-native applications. A DevSecOps approach is required to ensure security is always a priority. This approach integrates security testing at every stage of the software development process. It encourages collaboration between operations teams, developers and security specialists to ensure all systems operate efficiently but securely.
6 Kubernetes Security Best Practices
Here are some best practices to follow to ensure Kubernetes deployments are secure:
Enable Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) regulates access to network resources based on the roles of users within your company. In Kubernetes, RBAC defines who has API access and their specific permissions. It’s recommended to use namespace-specific permissions instead of cluster-wide permissions, as this limits the potential damage if the worst happens and the users’ credentials are compromised.
Keep Kubernetes up-to-date
It might seem obvious, but a simple yet highly effective way to ensure Kubernetes security is to check for updates regularly. Each new version has security patches and updates, allowing Kubernetes users to address vulnerabilities quickly and reduce the chance of breaches. However, updating Kubernetes can be a complex process when done manually, but thankfully many Kubernetes services offer automatic upgrades that remove the complexity for newer users.
It’s important that the management of updates should follow a specific strategy when choosing version updates. For production clusters—those running services intended for the business’s users—it is crucial to always run a stable version of Kubernetes. The version you choose to run should have a proven track record of stability, with few reports of bugs or other issues. For this reason, we recommend updating to the second latest version instead of the first, as the very first update may contain bugs that have not been patched yet.
You should also tread carefully when it comes to alpha and beta features. Alpha and beta Kubernetes features that are in active development may have bugs that could result in security vulnerabilities. Ensure to carefully assess the value of alpha and beta features before using them, and disable features you do not use to close any potential attack points.
Turn on audit logging
Maintaining secure clusters is much easier when audit logging is turned on. When enabled, it monitors unusual API calls, such as authentication failures that may indicate an attempted security breach. To further enhance security, audit logs should be transferred to a secure repository. This way, the logs are accessible and can be analysed even in cases where the cluster becomes unreachable. By analysing these logs and storing them securely, administrators can identify potential security vulnerabilities and take appropriate action.
Use process whitelisting
Process whitelisting is an effective way to proactively identify unexpected or malicious running processes in your Kubernetes environment. This involves creating a whitelist of processes that should run in a container under normal conditions. Once you’ve compiled a whitelist of approved processes, any process attempts not on the whitelist could indicate a potential security threat that must be immediately investigated. Whitelisting can be used to limit unwanted traffic between containers and pods within a Kubernetes cluster. You can specify the range of IPs allowed to interact and reject all other traffic. This helps prevent resources from having more access than required, keeping clusters secure.
Introducing Network Policies to resources
In their default configuration, Kubernetes deployments do not apply network policies to pods, which are the smallest deployable units of a Kubernetes application. This lack of policies means that each pod can potentially communicate with any other pod. In the event of a security breach, this could worsen the damage as the breach could spread from pod to pod. To mitigate this security risk, we recommend using network policies. Network policies prevent lateral movement between containers because they define precisely which pods are allowed to interact. By defining communication rules, network policies boost the overall security of your Kubernetes applications.
Review third-party integrations
Third-party integrations, such as monitoring and logging and storage plugins, can extend Kubernetes functionality and streamline aspects of the container orchestration process. However, be careful to review the permissions that third-party integrations have. For example, many security integrations request access to view all cluster secrets, effectively making that component a cluster admin. If you have any doubts about an integration, restrict it to functioning in a single namespace.
In Summary
The rapid adoption of Kubernetes underscores the importance of implementing best practices to ensure security. Please note that the best practices listed are not exhaustive—you can take plenty of other steps to secure Kubernetes environments. However, the best practices outlined in this article—enabling RBAC, updating Kubernetes, turning on audit logging, using process whitelisting, Network Policies on pods, and carefully reviewing third-party integrations—provide a solid foundation for securing containers.
Are you considering Kubernetes, but you’re unsure how to begin? Or maybe you’re already using Kubernetes but have concerns about securing your containers? Regardless of your situation, Evolvere is here to help. Contact us today to start your Kubernetes journey.