Home » Labs » Kubernetes Security – Intermediate Skills

Note: Labs will not work if you’re using Incognito Mode or blocking 3rd-party cookies

Home » Labs » Kubernetes Security – Intermediate Skills

Note: Labs will not work if you’re using Incognito Mode or blocking 3rd-party cookies

Current Status

Not Enrolled

Price

Free

Get Started

Login to Enroll

Lab 8

Kubernetes Security – Intermediate Skills

Pro | ~ 1 hour

This intermediate lab is for those who want to understand how to secure cloud native applications on a Kubernetes cluster.

Lab components

Understanding authentication
Understanding Role-based Access Control (RBAC)
Understanding Runtime Security
Understanding Pod Security Standards
Understanding Encryption and Secret Management
Using Roles and RoleBindings – Hands on starts here
Configuring the Container’s Security Context
Encrypting Secrets

Prerequisites

Read Blog

Kubernetes Security – Intermediate Skills

Thomas Keenan • Instructor • Mentor • Contributor

in K10, Data Protection, Kubernetes, Community

Watch Video

Lab 8 Video Overview

Review Slides

Lab 8 Slides

Hands-On Lab #8:

Introduction to Kubernetes Security

Ratings and Reviews

5.0

Avg. Rating

1 Ratings

5

1

4

0

3

0

2

0

1

0

What's your experience? We'd love to know!

Thomas the Great K8s

Posted 15 hours ago

PHENOMENAL LAB.. GREAT SECURITY SKILLS.

5 STARS!

Show more reviews

What's your experience? We'd love to know!

Lab Content

Lab 8: Kubernetes Security – Intermediate Skills

Education

Engagement

More

Follow Us

By subscribing, you agree to receive communications about Kasten by Veeam products, services and events. Your personal data will be managed by Kasten by Veeam in accordance with the Privacy Policy. You can unsubscribe at any time.

Education

Engagement

More

Follow Us

By subscribing, you agree to receive communications about Kasten by Veeam products, services and events. Your personal data will be managed by Kasten by Veeam in accordance with the Privacy Policy. You can unsubscribe at any time.

© 2022 Kasten.io | Privacy Policy & Cookies | EULA

This lab is for those who want to deepen their knowledge of security for cloud native applications on a Kubernetes cluster. It’s a great supplement to Lab 7 – Introduction to Kubernetes Security. Complete Lab 8 to learn all about additional security topics in Kubernetes, including authentication, runtime security, encryption and more!

What is the structure of the lab?

The lab consists of two sections. The first covers intermediate-level Kubernetes Security theory, and the second provides hands-on keyboard command line experience. Each section is approximately 30 minutes long; however, your time may vary, depending on how quickly you pass either section. There are a total of 9 challenges to complete during this lab.

Important: On multiple-choice questions, note that more than one answer may be correct. The lab is timed, so it’s best to complete it in one sitting.

Section 1: Intermediate Security Theory

This section will cover intermediate topics and terminology for Kubernetes security. Each topic will review material on-screen, then pose a challenge question. You must answer the question correctly to proceed to the next section.

The theory section includes the following topics:

Authentication
Role-based access control (RBAC) plugins
Run-time security with security context
Pod security standards
Encryption and secret management

Topic 1: Authentication

Kubernetes uses client certificates, bearer tokens or an authenticating proxy to authenticate API requests through authentication plugins.

The API server can be configured with one or more authentication plugins. The server reviews the list of authentication plugins to examine the request and determine who's sending it.

First, the request is authenticated via an authentication plugin, Then, it’s authorized by an authorization plugin and intercepted by an admission controller. Finally, the request is persisted in the etcd, which is the stateful component that stores the cluster's state and configuration.

Admission controllers are Kubernetes-native features that help you define and manage what is allowed to run on the cluster. For example, you may want to enforce security policies, manage deployment resources or even block vulnerable images from being deployed.

Several authentication plugins are available. They obtain the identity of the client using the following methods:

X509 Client Certs
Bearer token passed in an HTTP header
OpenID Connect Tokens
Others

Topic 2: Role-Based Access Control Plug-ins

Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization.

The Kubernetes API server can be configured to use an authorization plugin to check whether an action is allowed to be performed by the user requesting the action.
Because the API server exposes a REST interface, users perform actions by sending HTTP requests to the server.
Users authenticate themselves by including credentials in the request (an authentication token, username and password, or a client certificate).

The RBAC authorization rules are configured through four resources, which can be grouped into two groups:

Roles and ClusterRoles, which specify what actions can be performed on which resources.
RoleBindings and ClusterRoleBindings, which bind the roles above to specific users, groups or ServiceAccounts.

Roles define what can be done, while bindings define who can do it.

The distinction between a Role and a ClusterRole, or between a RoleBinding and a ClusterRoleBinding, is that the Role and RoleBinding are namespaced resources, whereas the ClusterRole and ClusterRoleBinding are cluster-level resources (not namespaced).

Topic 3: Runtime Security with Security Context

Kubernetes runtime security is the protection of containers (or pods) against active threats once the containers are running.

Runtime security helps protect workloads against a variety of threats that could emerge after containers have been deployed, such as:

The activation of malware that is hidden inside a container image
Privilege escalation attacks in which a container exploits security bugs in the container runtime, Kubernetes or the host OS
The deployment of unauthorized containers by an attacker who exploits a gap in an access control policy or a bug in Kubernetes
Unauthorized access to secrets or other sensitive information that a running container should not be able to read

Tools for Kubernetes runtime security fall into two main categories:

Enforcement tools: These enable you to define policies that restrict the access rights and permissions of resources within a runtime environment.
Auditing tools: These enable you to detect and react to threats based on data collected from your cluster.

Topic 4: Pod Security Standards

The Pod Security Standards define three different policies to broadly cover the security spectrum. These policies are cumulative and range from highly permissive to highly restrictive.

Profile	Description
Privileged	Unrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations.
Baseline	Minimally restrictive policy, which prevents known privilege escalations. The baseline allows the default (minimally specified) pod configuration.
Restricted	Heavily restricted policy, following current pod hardening best practices.

Kubernetes offers two ways to enforce these standards: Pod Security Admission and Pod Security Policies.

The Pod Security Admission controller is a built-in beta feature as of v1.23 and a successor to PodSecurityPolicies.

Pod Security restrictions are applied at the namespace level when pods are created.

Pod Security Admission places requirements on the Pod Security Context and other related fields according to the three levels defined by the Pod Security Standards: privileged, baseline and restricted.

A Pod Security Policy is a cluster-level resource that controls security-sensitive aspects of the pod specification.

The PodSecurityPolicy objects define a set of conditions that a pod must run with an order to be accepted into the system, as well as defaults for the related fields.

PodSecurityPolicy is deprecated as of Kubernetes v1.21 and will be removed in v1.25. Therefore, it is recommended to use Pod Security Admission instead.

Topic 5: Encryption and Secret Management

Protection of secret data largely comes down to what depths we're willing to go to make it secure. There are three layers of encryption:

Disk Encryption: Protects information at rest by converting it into unreadable code that cannot be deciphered easily by unauthorized people. This can be enabled in the filesystem and/or storage systems used by Kubernetes.
Transport Encryption: Protects information that is actively in flight by ensuring that communication between components is encrypted. This can be achieved by having all the internal components of Kubernetes and etcd interact over TLS. By default, all traffic between the pods is not encrypted and will require an encrypted networking layer provided by Service Meshes over Mutual TLS (mTLS), such as Istio and Linkerd or Cilium.
Application Encryption: Protects information within our system components or workloads running in Kubernetes, for example, encrypting secret objects data.

Section 2: Hands-on Commands — Intermediate Security Skills

In this section, you will use hands-on commands to support using Roles and RoleBindings, as well as configuring a container’s security context and encrypting secrets. Each section of the hands-on exercise will provide the most important commands you need to build a solid Kubernetes security profile for applications using common commands.

Is there pre-work for the lab?

Yes. Be sure to complete reading and studying this blog post, the video showing the work to be performed during the lab, and the accompanying slides. If you haven’t already, it’s helpful to complete lab 7 –Introduction to Kubernetes Security.

How do I access Lab 8?

Go to Learning.Kasten.io to start the lab. All the best. Enjoy!

Additional Learning

To extend your learning experience, Kasten offers a variety of resources such as whitepapers, case studies, datasheets and eBooks on Kubernetes backup. Follow this link to explore these learning materials!