Built-in Kubernetes Security Features
Kubernetes offers native security features to protect against some of the threats described above, or at least to mitigate the potential impact of a breach. The main security features offered by Kubernetes include:
- Role-based access control (RBAC): Kubernetes allows admins to define what it calls Roles and ClusterRoles, which specify which users can access which resources within a namespace or an entire cluster. RBAC provides one way of regulating access to resources.
- Pod security policies and network policies: Admins can configure pod security policies and network policies, which place restrictions on how containers and pods can behave. For example, pod security policies can be used to prevent containers from running as the root user, and network policies can restrict communication between pods.
- Network encryption: Kubernetes uses TLS to encrypt network traffic, providing a safeguard against eavesdropping.
While these built-in Kubernetes security features provide layers of defense against certain types of attacks, they do not cover all threats. Kubernetes offers no native protections against the following types of attacks:
- Malicious code or misconfigurations inside containers or container images: To scan for these, you would have to use a third-party container scanning tool.
- Security vulnerabilities on host operating systems: Again, you would have to scan for these using other tools. And although some Kubernetes distributions (like OpenShift) integrate SELinux or similar kernel-hardening frameworks to provide more security at the host level, this is not a feature of Kubernetes itself.
- Container runtime vulnerabilities: Here again, Kubernetes has no way of knowing or alerting you if a vulnerability exists within your runtime, or if an attacker is trying to exploit a vulnerability in the runtime.
- Abuse of the Kubernetes API: Beyond following any RBAC and security policy settings that you define, Kubernetes does nothing to detect or respond to API abuse.
- Management tool vulnerabilities or misconfigurations: Kubernetes cannot guarantee that management tools (like Kubectl) are free of security problems.