订阅内容

Kubernetes provides several built-in security capabilities, including network security, resource isolation, access control, and logging and auditing. One of the more recent security capabilities is a group of plugins known as admission controllers.

Admission controllers enable governance and enforcement of how clusters are used. Kubernetes ships with over 30 admission controllers, which are listed here along with their descriptions. This article assumes you have a basic understanding of admission controllers, but if you are unfamiliar with them, check out Kubernetes reference guide on admission controllers to learn more.

We’ve compiled 11 tips and recommendations to help you operationalize admission controllers for better security:

  1. As a first step, enable admission controllers in order to use some of the more advanced security features of Kubernetes, such as pod security policies which enforce configuration baseline for an entire namespace.

  2. To turn on an admission controller, use the following command line, replacing what appears after “=” with the name of the admission controller you want to turn on

--enable-admission-plugins=NameOfController,NameOfController2

  1. To turn off an admission controller, use the following command line, replacing what appears after “=” with the actual name of the admission controller you want to turn off

--disable-admission-plugins=NameOfController,NameOfController2

  1. Ensure that the following admission controllers are enabled by default:

NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,Priority,ResourceQuota,PodSecurityPolicy

  1. In order to validate Kubernetes resources during create, update, and delete operations, enable ValidatingAdmissionWebhook

  2. Consider disabling the MutatingAdmissionWebhook admission controller or applying stricter RBAC restrictions as to who can create MutatingWebhookConfiguration

  3. You can use PodSecurityPolicy admission controller to prevent containers from running as root or ensure the container’s root filesystem is always mounted as read-only. Keep in mind that unless a policy has already been defined in a PodSecurityPolicy, pods will not be created because the admission controller’s default operation is to reject pod creation in cases where no matching policy is found.

  4. Create custom, webhook-based admission controllers to:

  • Prevent pulling images from unknown registries while allowing only approved registry usage.
  • Set policies that prevent insecure deployments. For example, containers using privileged flag increase your security risk because they can bypass a lot of security controls. You can avoid this risk by using a webhook-based admission controller that either rejects this type of deployment or overrides the privileged flag.
  • Enforce label validation on objects to ensure proper labels are used, such as every object being assigned to a team or project.
  • Automatically add annotations to objects, such as attributing the correct cost center for a “dev” deployment resource.
  1. Use admission controllers to audit the configuration of the objects in clusters to prevent insecure and misconfigured objects from getting into your cluster.

  2. Admission controllers can be used to identify and correct images deployed without semantic tags by:

  • Automatically adding or validating resource limits
  • Ensuring reasonable labels are attached to pods
  • Making sure image references in product deployments are not using latest tags, or tags with a -dev suffix
  1. Use AlwaysPullImages admission controller to ensure pull policy is set to Always, such as when you want to make sure a user’s private images are only pulled by those who have the credentials to pull them. Without this admission controller, any pod from any user can use an image by merely knowing its name.

Admission controllers are one of the critical pillars of security for Kubernetes, and as a result, a Kubernetes API server that’s not utilizing the correct set of admission controllers will be incomplete and unable to support all of the expected features of Kubernetes.


关于作者

按频道浏览

automation icon

自动化

有关技术、团队和环境 IT 自动化的最新信息

AI icon

人工智能

平台更新使客户可以在任何地方运行人工智能工作负载

open hybrid cloud icon

开放混合云

了解我们如何利用混合云构建更灵活的未来

security icon

安全防护

有关我们如何跨环境和技术减少风险的最新信息

edge icon

边缘计算

简化边缘运维的平台更新

Infrastructure icon

基础架构

全球领先企业 Linux 平台的最新动态

application development icon

应用领域

我们针对最严峻的应用挑战的解决方案

Original series icon

原创节目

关于企业技术领域的创客和领导者们有趣的故事