DevOps Pro Moscow 2018

Natalya Sugako

Kublr, Russia

About Natalya Sugako

Sugako Natalya is an information security specialist at kublr. She is engaged in research of methods of realization of the safe containerized environments, the security assessment of own containerized applications and the k8s / docker configuration parameters used in kublr. Sugako Natalya is an Expert in information security with 15 years of experience. Before kublr was engaged in the development of security systems for state organizations, evaluation of security and designing “from scratch” of local networks for state-owned enterprises in Russia.

Talk

Security in k8s: from containers to network policies and RBACs

A number of practical tips and solutions for using the mechanisms implemented in docker / k8s and which are used in kublr to insulate containers from each other and to isolate containers and OS. Security in a containerizedЯ environment depends on several factors: OS vulnerabilities, used modules (daemon docker, component k8s, vulnerabilities of containerized applications) and applied security policies.

k8s and docker include mechanisms for segmenting and filtering network traffic. Also, k8s includes mechanisms for restricting access to file systems, to objects of type “Configmap”, namespaces and objects in namespaces, as well as “secret” objects. Using PodSecurityPolicy in k8s, you can limit the launch of containers in privileged mode, limit the use of “linux capabilities” and list the available sysctl for the container.

One of the most meaningful and actual issues that arise when moving to a containerized environment is the question of a trusted container. Kublr uses a number of open-source solutions of the safety assessment of distributed containers, which are considered here. Repositories support a number of methods to verify downloadable images to protect against MiTM attacks and the substitution of containers during the transfer.

The focus of the report is on the use of built-in k8s and docker mechanisms, as well as on the use of freely distributed systems and applications for implementing a secure containerized environment and methods for evaluating the security of distributed containerized applications.