Securing Managed Kubernetes Clusters: Best Practices

Introduction 

Managed Kubernetes Service environments, such as Amazon Elastic Kubernetes Service (EKS), Azure Managed Kubernetes (AKS) and Google Kubernetes Engine (GKE), have become the go-to choice for more and more organisations looking to leverage the power of Kubernetes without the hassle of managing the underlying infrastructure.

In this exciting blog post, we’ll discover the various threats that threaten Managed Kubernetes Service Clusters, and how cloud providers and you can safeguard your managed Kubernetes environment.

Shared Responsibility 

A common misconception is that the security of managed Kubernetes services offered by cloud providers is the responsibility of the provider. In reality, while the provider is responsible for securing the underlying infrastructure, it is still up to cloud administrators and engineers to strengthen the permissions within the cloud environment and access to avoid accidental or intentional harm to the system that can include deleting resources, modifying configurations, or deploying malicious code.

Currently, some cloud providers offer the option of managed worker nodes, which can further simplify the security and management of a Kubernetes cluster. Engineers, by default, will undertake the task of setting up and maintaining the worker nodes and their safety. 

Kubernetes Security Threats

There are several security threats to a Kubernetes cluster, including:

1. Compromised Cluster and Nodes: Attackers with access to the cluster or nodes can obtain sensitive data, cause disruption, or take over the Kubernetes cluster. 
2. Container Security: Containers operating within a cluster can be compromised, giving an attacker access to the host system. 
3. Resource Exhaustion: Attackers can launch a denial of service attack by using up all available resources in the cluster.
4. Insecure Network Communications: Unsecured network communications between components can result in the exposure of sensitive data, or allow attackers to intercept communications.
5. Configuration Mismanagement: Misconfigurations can result in the susceptibility of sensitive data or applications, allowing attackers to gain access to Kubernetes.
6. Insecure Image Repositories: Using untrusted or unverified container images from public repositories can introduce security vulnerabilities into the cluster.
7. Inadequate Role-Based Access Control (RBAC): RBAC is a vital security feature in Kubernetes, but if not correctly configured, it can result in the exposure of sensitive data or services, or allow attackers to gain access to the cluster.
8. Inadequate Network Segmentation: Inadequate network segmentation can permit the exposure of sensitive data or services, or allow attackers to gain access to the cluster.

Managed Kubernetes Security Threats

When it comes to managed Kubernetes clusters, there exist differences in architecture that can impact security, yet they are still susceptible to the security risks mentioned above. Cloud Engineers must still undertake setting up RBAC and guaranteeing secure network interactions. Moreover, managed Kubernetes services might not always be running the most recent versions of Kubernetes, leaving them open to potential security flaws until the cloud provider releases the following version.

Let us take a deep dive into the specific security threats to managed Kubernetes clusters: 

1. Limited control: While managed Kubernetes solutions offer many benefits, they also limit the control that users have over their clusters. The cloud provider handles many aspects of the cluster’s management, including configuration, updates, and patching. This can make it difficult to implement custom security measures or respond to security threats quickly.
2. Third-party access: Managed Kubernetes solutions require users to grant cloud providers access to their clusters, which can increase the risk of data breaches and other security incidents. Users must ensure that their cloud providers have adequate security measures in place to protect their clusters.
3. Data privacy: Managed Kubernetes solutions store data on cloud provider servers, which raises concerns about data privacy and security. Users must ensure that their data is encrypted and secure while it is being stored and transmitted.
4. Compliance: Managed Kubernetes solutions must comply with various security and compliance standards, such as HIPAA and PCI DSS. Users must ensure that their managed Kubernetes solutions comply with the appropriate security and compliance standards to avoid security incidents and data breaches.
5. Patch management: Managed Kubernetes solutions are responsible for patching and updating the underlying infrastructure of the cluster. Users must ensure that the patches are applied promptly and that they do not introduce new vulnerabilities or security risks.

Built-in Cloud and Managed Kubernetes Services Security

As was previously mentioned, cloud service providers support a shared responsibility model, providing several built-in security features that help customers protect their clusters. Let’s examine what each cloud provider offers in more detail to protect your Cluster.

Common security features:

Let us begin with what features are offered by all Cloud Providers: 

• Identity and Access Management (IAM): This feature helps control access to the cluster and its resources, ensuring that only authorised users have access to it.
• Encryption for data at rest and in transit: This feature protects the data against unauthorised access and exfiltration by encrypting it when it is stored and when transmitted.
• Automatic node upgrades and patching: This feature ensures that the cluster is always up-to-date with the latest security fixes by automatically upgrading the nodes and applying patches.

Now let us delve deeper into the unique features offered by the top three cloud providers of managed Kubernetes services. 

AWS and EKS-Specific security features:

• Security groups and network ACLs: This feature provides control over access to the EKS cluster, helping to prevent unauthorised access to the cluster and its resources.
• GuardDuty: By continuously monitoring and detecting potentially unauthorised EKS activity resulting from misconfiguration of the control plane nodes or application.

GCP and GKE-Specific security features:

• Google Cloud Armor: This feature allows the creation of firewall rules to control access to the GKE cluster.
• Kubernetes Binary Authorization: This feature helps to ensure that only trusted images are deployed on the GKE cluster by verifying the authenticity of the images before deployment.

Azure Managed Kubernetes (AKS) Specific security features:

• Use Azure Active Directory (AD) for identity management.
• Use Azure Network Security Groups to control network traffic to the cluster.
• Use Azure Key Vault for secrets management and encryption key management.

Client Security Responsibilities

Overall, customers are responsible for ensuring that their Kubernetes cluster and its workloads are secure and protected from various security threats. While managed Kubernetes providers handle many of the underlying infrastructure components, customers must still manage and secure the cluster’s applications and data.

Let us identify how and what actions admins must undertake in part of securing a managed Kubernetes service offered by a cloud provider. 

1. IAM (Identity and Access Management): Customers are responsible for managing user access to the Kubernetes cluster, including authentication and authorisation policies. This includes creating and managing users, groups, and roles, as well as defining their permissions within the cluster.
2. Pod Security: Customers are responsible for securing the containers running inside the cluster. This includes configuring policies to restrict privilege escalation and prevent containers from running as root, as well as limiting container capabilities and controlling access to host resources.
3. Runtime Security: Customers are responsible for monitoring the cluster and its workloads for any suspicious activity or vulnerabilities. This includes monitoring for unusual network activity, detecting and responding to unauthorised access attempts, and scanning containers for known vulnerabilities.
4. Network Security: Customers are responsible for configuring and managing network security policies to protect the cluster and its workloads from unauthorised access and data exfiltration. This includes implementing network segmentation, encrypting traffic between nodes and workloads, and controlling traffic flow in and out of the cluster.

To prevent security breaches in managed Kubernetes clusters, admins must proactively monitor for threats and vulnerabilities. Taking necessary steps to minimise risks until a patch or upgrade is available from the cloud provider can help protect the integrity of Kubernetes and the Cloud environment and ensure ongoing protection.

Conclusion

Finally, we learned about the risks Kubernetes cluster faces at the most basic level of control, along with the tools and services available to help you secure them. We learned about the security measures that each of them, individually and collectively, offer to improve security, remembering that cloud service providers use a shared responsibility model rather than a hands-off approach.

Part 2 of this blog series will look deeper into the steps undertaken to secure the worker nodes of a Managed Kubernetes cluster.