Kubernetes Security
Sicherheitsebenen
- Cluster-Ebene
- Node-Ebene
- Pod/Container-Ebene
- Application-Ebene
RBAC (Role-Based Access Control)
Komponenten
- Role/ClusterRole: Berechtigungen
- RoleBinding/ClusterRoleBinding: Zuweisung
- ServiceAccount: Identität für Pods
- Users/Groups: Menschliche Identitäten
Best Practices
- Least Privilege Principle
- Namespace-spezifische Roles
- Regelmäßige Audits
- ServiceAccounts pro Workload
Network Policies
Funktionsweise
- Firewall-Regeln für Pods
- Ingress/Egress Kontrolle
- Label-basierte Selektion
Beispiel
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: api-policy
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- port: 8080
Pod Security Standards
Levels
- Privileged: Keine Einschränkungen
- Baseline: Minimal restriktiv
- Restricted: Best Practice
Enforcement
- Pod Security Admission (PSA)
- Namespace Labels
- warn, audit, enforce Modes
Secrets Management
Native Secrets
- Base64-kodiert (nicht verschlüsselt!)
- etcd Encryption at Rest
- RBAC-geschützt
External Secrets
- HashiCorp Vault
- AWS Secrets Manager
- External Secrets Operator
- Sealed Secrets
Image Security
Best Practices
- Trusted Base Images
- Minimale Images (Distroless)
- Regular Updates
- No root User
Image Scanning
- Trivy
- Snyk
- Prisma Cloud
- In CI/CD Pipeline
Image Signing
- Cosign
- Notary
- Admission Policies
Runtime Security
Container Runtime
- seccomp Profiles
- AppArmor/SELinux
- Capabilities dropping
- Read-only Filesystem
Runtime Monitoring
- Falco
- Sysdig
- Aqua Runtime Protection
Service Mesh Security
- mTLS automatisch
- Certificate Rotation
- Access Policies
- Istio, Linkerd
Audit Logging
- API Server Audit Logs
- Pod-Level Logging
- SIEM Integration
- Compliance Requirements
Security Checkliste
- RBAC konfiguriert
- Network Policies aktiv
- Pod Security Standards
- Secrets verschlüsselt
- Images gescannt
- Audit Logging aktiv
CFTools Software implementiert umfassende Kubernetes-Security-Konzepte.