Securing Kubernetes Containers

Securing a Kubernetes container involves multiple layers of security best practices to protect the containerized applications from potential threats. Below are some essential techniques, explained with examples:

1. Use of Non-Root User

By default, containers often run as the root user, which can be a security risk. Running containers as non-root users reduces the impact of a security breach.
Example: Modify your Dockerfile to specify a non-root user.


        FROM nginx:alpine
        # Create a non-root user
        RUN adduser -D myuser
        USER myuser
        CMD ["nginx", "-g", "daemon off;"]

In your Kubernetes manifest:


        apiVersion: v1
        kind: Pod
        metadata:
          name: secure-pod
        spec:
          containers:
          - name: nginx
            image: nginx:alpine
            securityContext:
              runAsUser: 1000  # Specify a non-root user ID

2. Use Security Context

Kubernetes allows defining security context settings for both pods and containers. This can limit container capabilities and reduce the attack surface.
Example: Limiting privileges with securityContext:


        apiVersion: v1
        kind: Pod
        metadata:
          name: secure-pod
        spec:
          containers:
          - name: nginx
            image: nginx:alpine
            securityContext:
              runAsUser: 1000           # Run as a non-root user
              readOnlyRootFilesystem: true  # Set filesystem to read-only
              capabilities:
                drop: ["ALL"]            # Drop all extra Linux capabilities

3. Network Policies

Network policies in Kubernetes can control the communication between pods and restrict unnecessary access to services.
Example: Allow traffic only from specific pods or namespaces.


        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: allow-specific
          namespace: default
        spec:
          podSelector:
            matchLabels:
              role: secure-app
          ingress:
          - from:
            - podSelector:
                matchLabels:
                  app: frontend

4. Use Image Scanning

Always scan container images for vulnerabilities before deploying. Tools like Trivy, Clair, or cloud-native security tools (like AWS ECR scanning) can help detect issues in the image.
Example: Use Trivy to scan an image before deployment.


        trivy image nginx:alpine

5. Limit Resource Usage

To avoid Denial of Service (DoS) attacks, always define resource limits for CPU and memory.
Example: Set resource requests and limits in the pod spec.


        apiVersion: v1
        kind: Pod
        metadata:
          name: secure-pod
        spec:
          containers:
          - name: nginx
            image: nginx:alpine
            resources:
              requests:
                memory: "64Mi"
                cpu: "250m"
              limits:
                memory: "128Mi"
                cpu: "500m"

6. Enable Pod Security Policies (PSP)

PSPs define security rules for pods, such as whether privileged containers are allowed, file system access, etc. Though deprecated in newer Kubernetes versions, you can use PodSecurity Standards or PSP alternatives.
Example: A policy to prevent privileged containers.


        apiVersion: policy/v1beta1
        kind: PodSecurityPolicy
        metadata:
          name: restricted
        spec:
          privileged: false  # Don't allow privileged containers
          runAsUser:
            rule: 'MustRunAsNonRoot'  # Ensure non-root user
          readOnlyRootFilesystem: true

7. Use Role-Based Access Control (RBAC)

RBAC allows you to control which users or services have access to specific resources. Always follow the principle of least privilege.
Example: Create an RBAC role that only allows specific read-only access.


        apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          namespace: default
          name: pod-reader
        rules:
        - apiGroups: [""]
          resources: ["pods"]
          verbs: ["get", "list"]

8. Secrets Management

Avoid hardcoding sensitive information (like API keys) in containers. Use Kubernetes Secrets to securely manage sensitive data.
Example: Store a secret and use it in a pod.

kubectl create secret generic my-secret --from-literal=password=securepassword

Use it in the deployment:


        apiVersion: v1
        kind: Pod
        metadata:
          name: secret-pod
        spec:
          containers:
          - name: my-app
            image: my-app-image
            env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: my-secret
                  key: password

9. Audit Logs

Always enable and review audit logs to track any suspicious activity or access to your containers.

10. Image Policies

Restrict which images can be used by enforcing image policies. For example, you can use Admission Controllers to block unsigned images or images from unauthorized registries.

Conclusion

Securing a Kubernetes container requires multiple layers of defense. By applying practices like running non-root containers, setting up security contexts, enforcing network policies, scanning images, and limiting resource usage, you can greatly reduce the attack surface and protect your Kubernetes workloads from potential threats.

How to secure the kubernetes containers?