1-cluster-setup.md

Kubernetes cluster setup

Network Policies

Use network security policies to restrict cluster level access

✨ Network Policies, Declare Network Policy

⚡️ Notes:

• NetworkPolicies allow you to prevent or restrict network communication to and from Pods
• They are "an application-centric construct which allow you to specify how a pod is allowed to communicate with various network entities over the network"
• They "do not conflict; they are additive"
• Ther are stateful, so the replies to outbound requests still reach the application

💡 Tips:

• Explain given YAML with online tools, like Isovalent: Network Policy Editor or Tufin: Kubernetes Network Policies Viewer

⚗️ Practice

📝 Read more:

• Anthos security blueprint: Restricting traffic
• Ahmet Alp Balkan: Kubernetes Network Policy Recipes
• Calico: Get started with Kubernetes network policy
• Security People: An Introduction to Kubernetes Network Policies

CIS Benchmark

Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)

⚡️ Notes:

• The Center for Internet Security (CIS) Kubernetes Benchmark is the product of a community consensus process and consists of secure configuration guidelines developed for Kubernetes

🚀 kube-bench

💡 Tips:

• Use kube-bench logs to view the CIS benchmark output
• The CIS benchmark output includes remediations steps one can follow to fix the issues that have been reported
• kubeadm clusters use a kubelet configuration file located at /var/lib/kubelet/config.yaml (can be seen from /etc/systemd/system/kubelet.service.d/10-kubeadm.conf)
• In a kubeadm cluster, control plane components run as static pods whose definitions are in /etc/kubernetes/manifest folder

⚗️ Practice

📝 Read more:

• Aqua: Kubernetes CIS Benchmark Best Practices
• DevSec Hardening Framework: CIS Kubernetes Benchmark - InSpec Profile
• GKE: CIS Benchmarks
• Microsoft Compliance: CIS Benchmarks

Ingress

Properly set up Ingress objects with security control

✨ Ingress > TLS, Generate Certificates Manually > openssl

💡 Tips:

• TLS termination can be implemented using an Ingress
• TLS certificates are stored as Secret which are referenced in the Ingress using the spec.tls[].secretName

⚗️ Practice

📝 Read more:

• Ingress Controllers
• Set up Ingress on Minikube with the NGINX Ingress Controller
• Ingress-Nginx Controller: Installation Guide, TLS/HTTPS

Node protection

Protect node metadata and endpoints

✨ Restricting cloud metadata API access, Kubelet authentication/authorization, Set Kubelet Parameters Via A Configuration File

⚗️ Practice

📝 Read more:

• Kubelet API, by Deep Network
• Setting up secure endpoints in Kubernetes
• GKE Protecting cluster metadata
• Retrieving EC2 instance metadata
• EC2 Instance user data

GUI restriction

Minimize use of, and access to, GUI elements

✨ Deploy and Access the Kubernetes Dashboard

📝 Read more:

• Dashboard Access control
• Dashboard Creating sample user
• On Securing the Kubernetes Dashboard

Platform binaries

Verify platform binaries before deploying

✨ Install and Set Up kubectl on Linux

💡 Tips:

• Perform MD5 checks on binaries against official releases.

⚗️ Practice

📝 Read more:

• Learn How to Generate and Verify Files with MD5 Checksum in Linux
• Ubuntu how-to sha256sum.

---

🧵 Next: Cluster hardening