Subscribe to the feed

Kubernetes provides several built-in security capabilities, including network security, resource isolation, access control, and logging and auditing. One of the more recent security capabilities is a group of plugins known as admission controllers.

Admission controllers enable governance and enforcement of how clusters are used. Kubernetes ships with over 30 admission controllers, which are listed here along with their descriptions. This article assumes you have a basic understanding of admission controllers, but if you are unfamiliar with them, check out Kubernetes reference guide on admission controllers to learn more.

We’ve compiled 11 tips and recommendations to help you operationalize admission controllers for better security:

  1. As a first step, enable admission controllers in order to use some of the more advanced security features of Kubernetes, such as pod security policies which enforce configuration baseline for an entire namespace.

  2. To turn on an admission controller, use the following command line, replacing what appears after “=” with the name of the admission controller you want to turn on

--enable-admission-plugins=NameOfController,NameOfController2

  1. To turn off an admission controller, use the following command line, replacing what appears after “=” with the actual name of the admission controller you want to turn off

--disable-admission-plugins=NameOfController,NameOfController2

  1. Ensure that the following admission controllers are enabled by default:

NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,Priority,ResourceQuota,PodSecurityPolicy

  1. In order to validate Kubernetes resources during create, update, and delete operations, enable ValidatingAdmissionWebhook

  2. Consider disabling the MutatingAdmissionWebhook admission controller or applying stricter RBAC restrictions as to who can create MutatingWebhookConfiguration

  3. You can use PodSecurityPolicy admission controller to prevent containers from running as root or ensure the container’s root filesystem is always mounted as read-only. Keep in mind that unless a policy has already been defined in a PodSecurityPolicy, pods will not be created because the admission controller’s default operation is to reject pod creation in cases where no matching policy is found.

  4. Create custom, webhook-based admission controllers to:

  • Prevent pulling images from unknown registries while allowing only approved registry usage.
  • Set policies that prevent insecure deployments. For example, containers using privileged flag increase your security risk because they can bypass a lot of security controls. You can avoid this risk by using a webhook-based admission controller that either rejects this type of deployment or overrides the privileged flag.
  • Enforce label validation on objects to ensure proper labels are used, such as every object being assigned to a team or project.
  • Automatically add annotations to objects, such as attributing the correct cost center for a “dev” deployment resource.
  1. Use admission controllers to audit the configuration of the objects in clusters to prevent insecure and misconfigured objects from getting into your cluster.

  2. Admission controllers can be used to identify and correct images deployed without semantic tags by:

  • Automatically adding or validating resource limits
  • Ensuring reasonable labels are attached to pods
  • Making sure image references in product deployments are not using latest tags, or tags with a -dev suffix
  1. Use AlwaysPullImages admission controller to ensure pull policy is set to Always, such as when you want to make sure a user’s private images are only pulled by those who have the credentials to pull them. Without this admission controller, any pod from any user can use an image by merely knowing its name.

Admission controllers are one of the critical pillars of security for Kubernetes, and as a result, a Kubernetes API server that’s not utilizing the correct set of admission controllers will be incomplete and unable to support all of the expected features of Kubernetes.


Sobre el autor

Navegar por canal

automation icon

Automatización

Las últimas novedades en la automatización de la TI para los equipos, la tecnología y los entornos

AI icon

Inteligencia artificial

Descubra las actualizaciones en las plataformas que permiten a los clientes ejecutar cargas de trabajo de inteligecia artificial en cualquier lugar

open hybrid cloud icon

Nube híbrida abierta

Vea como construimos un futuro flexible con la nube híbrida

security icon

Seguridad

Vea las últimas novedades sobre cómo reducimos los riesgos en entornos y tecnologías

edge icon

Edge computing

Conozca las actualizaciones en las plataformas que simplifican las operaciones en el edge

Infrastructure icon

Infraestructura

Vea las últimas novedades sobre la plataforma Linux empresarial líder en el mundo

application development icon

Aplicaciones

Conozca nuestras soluciones para abordar los desafíos más complejos de las aplicaciones

Original series icon

Programas originales

Vea historias divertidas de creadores y líderes en tecnología empresarial