How to Secure Your Kubernetes Workloads

Today, DevOps and cloud-native methodologies have become standard practices for organizations. As a result, software developers are increasingly looking to take advantage of these newer computing paradigms to speed up their time to market while maintaining high availability and reducing costs. Kubernetes is one such platform organizations want to embrace to speed up their software delivery. 

As powerful as Kubernetes is, adopting Kubernetes without proper security measures can increase your cyberattack risk. The distributed nature of the container service exposes your environment to increased attack vectors. However, with the proper security protocols and best practices, you can protect your Kubernetes cluster and applications from these potential threats and ensure that all your data remains secure and confidential.

The Importance of Kubernetes Security

A survey result by ionir shows that around 60% of respondents are running stateful applications on Kubernetes, and 50% responded saying they plan to do so in the next 12 months. In addition, Red Hat's The State of Kubernetes Security in 2022 survey report stated that 78% of the respondents opted for DevsecOps as their primary focus when it comes to Kubernetes deployments.

Before diving into the specifics of Kubernetes security, let’s first look at the concepts behind these security protocols. The reason why Kubernetes is so secure is that it’s based on Linux containers that are fully isolated from the host operating system. This means that if an attacker were to breach the Kubernetes cluster, they would only have access to the containers and not the rest of the host operating system. Because of this isolation, a hacker would need to subvert every container running within the cluster individually in order to access or modify sensitive data. This makes it significantly more difficult — if not impossible — for an attacker to access data within the Kubernetes cluster without authorization.

While Kubernetes provides many benefits to modern organizations, it’s important to remember that it’s also a software product, meaning it’s susceptible to cybersecurity threats. Furthermore, since Kubernetes is open-source, it could be vulnerable to more security risks than commercial software. Therefore, before introducing Kubernetes within your environment, you must ensure that you have a security strategy to protect your data from cyber threats. Otherwise, an attacker could gain unauthorized access to your sensitive data and disrupt your business processes — leading to significant financial and reputational damage.

Kubernetes Security Best Practices

Here are some best practices to ensure your Kubernetes cluster is secure. 

Use Trusted Container Images

First, make sure that you are using trusted images instead of building your images from scratch.Instead, use trusted open-source images. This reduces the risk of introducing a malicious code injection within your containers. Additionally, you should follow the principle of least privilege when configuring your containers. This means that you shouldn’t give your containers more access than they actually need. Doing so increases the risk of a breach since malicious actors can’t gain full access to the OS if they don’t have the privileges.

Know the Cluster Administration and User Roles

You need to know how to mitigate cluster administration. This is a crucial first step in securing your cluster. Many organizations choose to create service accounts for the parts of Kubernetes that need cluster-wide privileges. Essentially, you create a special user account for each component inside Kubernetes that needs cluster-wide privileges. 

Kubernetes has two types of users: 

• Cluster users are used for the day-to-day administration of the cluster. They can create pods and services but do not have access to modify the Kubernetes API. 
• Authenticated users authenticate with the Kubernetes API and have full access to the Kubernetes API.

Monitor Your Kubernetes Workloads

You must continuously monitor your Kubernetes workloads and environments for malicious activity. This includes monitoring for the following security threats: 

• Access to unauthorized users: You should be able to monitor the IP addresses of users accessing your Kubernetes cluster. Ideally, this should extend to the containers themselves. This allows you to see whether the person accessing your containers is an authorized user. 
• API abuse: If you are using Kubernetes’ API, you should monitor API calls to ensure that malicious actors aren’t abusing your API to compromise your Kubernetes cluster. This can include monitoring for API calls from unauthorized IP addresses, API calls that fail, or API calls that take longer than expected. 
• Data breaches: You should also monitor for data breaches within your Kubernetes cluster. This can include monitoring for unusual file activity, unexpected and random access to sensitive data, or unusual network traffic.

Integrating Kubernetes Security Tools in the CI/CD Pipeline

Kubernetes security tools/platforms (such as Kubescape, Datree, Trivy, etc.) can help you find security concerns and vulnerabilities in your yaml files and clusters. There needs to be a way for developers to integrate these tools into the CI/CD pipeline. 

Using GitOps 

GitOps makes it easy to address any security concerns. With Git as the primary tool, everything can be tracked back, making observability easy. Using a CI/CD toolchain in association with the GitOps approach is essential to ensure the Kubernetes deployments are safe and a standard methodology is maintained throughout the organisation. Let’s dive into the tutorial on how to make it happen.

How to Configure Kubernetes Security in Your Pipeline Using Harness

In this tutorial, we will consider three Kubernetes security tools, namely Kubescape, Datree, and Trivy. We will configure these tools in our deployment pipeline using Harness.

First, get your free account from Harness and set up a simple CD pipeline using the Harness CD module.

Set up the required connectors:

The next step is to create a pipeline as shown below. We will check the workloads for any misconfigurations and errors. If any errors are found in the Kubernetes workloads, we will not proceed further to deploy the application. Under the deployment stage, the three Kubernetes security scans are added as steps using the shell script utilities.

Once all three (Kubescape, Datree, Trivy) Kubernetes scanning tools are integrated, the CD pipeline looks like this:

Save the configuration and run the pipeline. You will see these Kubernetes security scanners getting executed in parallel.

Don’t worry about the deployment failing (as shown in the image above). It will fail because there are some misconfigurations in the YAML file used (Datree detects it, and hence the pipeline fails). This failure is on purpose for this tutorial to demonstrate what happens with a real failure and how to recognize it.

Pipeline Detection: Kubescape vs. Datree vs. Trivy

Let’s see what each tool does and what it detects in the pipeline.

Kubescape scans the clusters and showcases the YAML files that are not compliant with security standards.

‍Datree shows if there are any misconfigurations in our Kubernetes manifest files.

‍Trivy scans the vulnerabilities in our Kubernetes workloads. 

Using Harness, all three Kubernetes security scanners can be easily integrated into your pipeline.

Securing Kubernetes with Harness

Kubernetes is a powerful container service that can help organizations accelerate the delivery of new applications and services. However, while this technology offers many benefits, it also introduces an increased risk of attack due to its distributed architecture. To minimize this risk, you must be sure to properly configure your containers and workloads and monitor your cluster for malicious activity. 

As the popularity of Kubernetes deployments increase, organizations are hiring DevOps professionals to speed up their software delivery process using DevOps principles. But we need to remember one thing: it is not just about speed, but also security. Using Kubernetes security scanners and vulnerability detectors will help you stay one step ahead of cybercriminals and ensure that your Kubernetes-related workloads remain secure.

Interested to see how Harness secures your Kubernetes deployments? Try Harness CD for free today!