Ask An OpenShift Admin episode 115: Configuration Management for Security

More than 50% of respondents to the State of Kubernetes Security Report 2023 were highly concerned about misconfigurations and vulnerabilities when it came to the security of their applications in containers and Kubernetes environments.  

But, there are ways to mitigate the risks introduced by misconfigurations. One way is to take a proactive approach with configuration management - introducing automation for security scanning, having a zero trust policy within the cluster, ensuring you are thinking about security for the platform and the application-level. 

A couple of best practices for configuration management are: 

1. Set egress policies for your pods: A lot of external attacks or breaches on the pod-level come via the internet. You can configure your pods to prevent this. A lot of pods might not need internet access at all - they just need to be able to communicate with other pods and DNS. You can set egress policies for your pods and by making egress impossible, you can mitigate it at the pod level by eliminating the possibility of the pod accessing the internet and being vulnerable to being attacked.
2. Containers have writable file systems that are ephemeral. But, you can change this to ensure you are using read-only file systems and empty-dr. Tools like podman-diffs to gain visibility into how your apps are interacting with local file systems and can help you check this. 

Watch  the second episode of the Security Series on Ask an OpenShift Admin, where Chris Porter joins Andrew and Jonny to talk about Configuration Management for security in more detail! They go over how to build a security mindset, small steps you can take today to build apps the DevSecOps way, and more best practices for configuration management. 

At Red Hat, we offer Red Hat Advanced Cluster Security for Kubernetes as a way to manage container images and their related issues. Try ACS Cloud Service today! 

Tune in next week for part three on Runtime Security of this new series!