|Kubernetes Security Audit Open Sourced|
|Written by Kay Ewbank|
|Tuesday, 20 August 2019|
A security audit of Kubernetes has been made available in an open source format. The project reviewed the security of Kubernetes, and produced a threat model alongside the security review.
This is the latest and largest security audit undertaken on behalf of the Cloud Native Computing Foundation (CNCF). Last year it audited CoreDNS, Envoy and Prometheus, made the audits public, and has since seen core maintainers for the three projects address the vulnerabilities identified.
The audit was undertaken by CNCF's Third Party Security Audit Working Group, Trail of Bits and Atredis Partners, and looked at a number of Kubernetes components across six control families:
CNCF says that as Kubernetes itself is a large system, with functionality spanning from API gateways to container orchestration to networking and beyond, this audit concentrated on eight components within the larger Kubernetes ecosystem for evaluation in the threat model:
Some of the main findings in the report (which can be downloaded from GitHub) are that security policies may not be applied, leading to a false sense of security by users. Insecure TLS is in use by default, and credentials are exposed in environment variables and command-line arguments.
Other problems include the leaking in logs of the names of secrets; no revocation of certificates, and the fact that seccomp is not enabled by default. Of the security vulnerabilities discovered, half of the most severe have already been updated in the most recent release of Kubernetes.
For the moment (and until the problems identified in the audit are corrected), the recommendation is that cluster administrators use attribute based access controls rather than relying on role based access controls. Where role based access controls (RBAC) are necessary, administrators should ensure they follow RBAC best practices.
Kubernetes developers are advised to avoid hardcoding paths to dependencies, and to carry out file permissions checking. Processes on Linux should be monitored, and processes should moved to a cgroup.
The report makes interesting reading for anyone thinking about securing systems, as does the accompanying 50 page threat model document.
or email your comment to: firstname.lastname@example.org
|Last Updated ( Tuesday, 20 August 2019 )|