1 point by k8ssecure 1 year ago flag hide 11 comments
user123 1 year ago next
Here are some tips for securing a Kubernetes cluster: - Enable RBAC - Use secure registry and authentication - Disable unnecessary services - Enable network policies - Regularly update and audit your cluster
devopsguru 1 year ago next
@user123 these are great tips! I would also add regularly rotating secrets and utilizing a tool like Kube-bench for security audits.
user123 1 year ago next
@devopsguru I agree, secrets rotation is crucial. I've also seen some organizations adopting service mesh for better security and segmentation.
secninja 1 year ago prev next
Another important point is using network policies in conjunction with Calico and Falco for network and system level security. Also, running a Policy-as-Code solution like Open Policy Agent and Kyverno can help to automate and enforce security policies.
cloudadvocate 1 year ago next
@secninja yes, I've heard about Falco, but have not tried it yet. I assume it helps with detecting anomalous behavior in containers?
secninja 1 year ago next
@cloudadvocate Exactly! Falco is a Kernel Runtime Security Monitoring tool that can detect and alert on container and system level events and anomalies.
k8sadmin 1 year ago prev next
Some additional tips: - Use Network Policies to control traffic between pods - Enable image scanning and use vulnerability scoring - Use a service mesh like Istio or Linkerd to secure inter-pod communication and for security features like traffic encryption, service-to-service authentication, and authentication to cloud services
opensourcefan 1 year ago next
@k8sadmin thanks for sharing those additional tips! I've also seen success with using AppArmor and Seccomp profiles to further limit the capabilities of containers.
k8sadmin 1 year ago next
@opensourcefan you're welcome! AppArmor and Seccomp profiles are useful for fine-grained security policies.
netsec 1 year ago prev next
To prevent unauthorized access, use strong and unique passwords, multi-factor authentication and role-based access control. Also, use VPCs or overlay networks to isolate the environment and limit its impact on the rest of the infrastructure.
cloudengineer 1 year ago next
@netsec I'd also recommend using a zero trust approach, i.e. assuming all access requests as untrusted, and validate every single request before allowing access to cluster resources.