{"id":34924,"date":"2022-11-02T19:54:28","date_gmt":"2022-11-02T14:24:28","guid":{"rendered":"http:\/\/ismiletechnologies.com\/?p=34924"},"modified":"2022-11-02T21:53:51","modified_gmt":"2022-11-02T16:23:51","slug":"top-tips-for-securing-enterprise-kubernetes-clusters","status":"publish","type":"post","link":"https:\/\/ismiletechnologies.com\/en_us\/devops\/top-tips-for-securing-enterprise-kubernetes-clusters\/","title":{"rendered":"Top tips for securing Enterprise Kubernetes Clusters"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"34924\" class=\"elementor elementor-34924\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-9e41739 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"9e41739\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-701e732\" data-id=\"701e732\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2964078 elementor-widget elementor-widget-text-editor\" data-id=\"2964078\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Kubernetes has become an essential part of software infrastructure today. Are you using Kubernetes clusters for your workloads? If you are an enterprise or a medium size company, there are chances that you are already running Kubernetes clusters for doing your organizational chores. Today, many DevOps engineers maintain either an on-prem Kubernetes cluster or they maintain a PaaS like Amazon EKS, <span style=\"color: #14a49c;\"><a style=\"color: #14a49c;\" href=\"http:\/\/ismiletechnologies.com\/microsoft-azure-cloud\/\">Microsoft AKS<\/a><\/span>, or GKE. But irrespective of how you run your Kubernetes clusters, you will have to ensure that they are safe &amp; secure. There are multiple levels of security in Kubernetes API.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-584df66 elementor-widget elementor-widget-text-editor\" data-id=\"584df66\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<ul><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span style=\"color: #000000;\">Transport security:<\/span> This layer is used to do all kinds of API communications, and this is done using valid certificates.\u00a0<\/li><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span style=\"color: #000000;\">Authentication:<\/span> Kubernetes support different kinds of authentication mechanism to authenticate all API requests.\u00a0\u00a0<\/li><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span style=\"color: #000000;\">Authorization:<\/span> One or more supported authorization models are used to authorize authenticated requests.\u00a0\u00a0<\/li><li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span style=\"color: #000000;\">Admission control:<\/span> Admission control modules validate all authorized requests except read\/get requests.\u00a0\u00a0<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2fc6f0e elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"2fc6f0e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d0616d4 elementor-widget elementor-widget-text-editor\" data-id=\"d0616d4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>There are many out-of-the-box security options in Kubernetes, but to protect your infrastructure, you will have to consider many more security best practices. Let&#8217;s see what the tips are for protecting Kubernetes clusters:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7c81f4a elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"7c81f4a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5ed144b elementor-widget elementor-widget-heading\" data-id=\"5ed144b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Employ Kubernetes Role-Based Access Control (RBAC)\u00a0<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1486786 elementor-widget elementor-widget-text-editor\" data-id=\"1486786\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Kubernetes support multiple authorization models for its API server. RBAC (Role-Based Access Control), ABAC (Attributed-Based Access Control), Node authorization, and Webhook mode. Amongst all these authorization models, RBAC is the more secure and is widely used. It&#8217;s also ideal for enterprises and medium size organizations. It&#8217;s easy to define role-based access control with RBAC, which resembles your organization&#8217;s business rules. RBAC is also an excellent option for OIDC authentication.\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9b80c99 elementor-widget elementor-widget-template\" data-id=\"9b80c99\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"template.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-template\">\n\t\t\t\t\t<div data-elementor-type=\"section\" data-elementor-id=\"33182\" class=\"elementor elementor-33182\" data-elementor-post-type=\"elementor_library\">\n\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-88fb3b3 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"88fb3b3\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-eaf9399\" data-id=\"eaf9399\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-59a2347 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"59a2347\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-33 elementor-inner-column elementor-element elementor-element-38acb31\" data-id=\"38acb31\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c9dc7b5 elementor-widget elementor-widget-heading\" data-id=\"c9dc7b5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Ready to automate dev &amp; ops to shorten the SDLC? <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5120274 elementor-widget elementor-widget-text-editor\" data-id=\"5120274\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Talk to our experts today &amp; see how they can help to fulfill your business objectives.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-33 elementor-inner-column elementor-element elementor-element-239b517\" data-id=\"239b517\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f13eeb0 elementor-align-center elementor-widget elementor-widget-lottie\" data-id=\"f13eeb0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;source&quot;:&quot;external_url&quot;,&quot;source_external_url&quot;:{&quot;url&quot;:&quot;https:\\\/\\\/assets4.lottiefiles.com\\\/packages\\\/lf20_kkesf8mx.json&quot;,&quot;is_external&quot;:&quot;&quot;,&quot;nofollow&quot;:&quot;&quot;,&quot;custom_attributes&quot;:&quot;&quot;},&quot;loop&quot;:&quot;yes&quot;,&quot;play_speed&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:0.9,&quot;sizes&quot;:[]},&quot;lazyload&quot;:&quot;yes&quot;,&quot;link_to&quot;:&quot;none&quot;,&quot;trigger&quot;:&quot;arriving_to_viewport&quot;,&quot;viewport&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:{&quot;start&quot;:0,&quot;end&quot;:100}},&quot;start_point&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:0,&quot;sizes&quot;:[]},&quot;end_point&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:100,&quot;sizes&quot;:[]},&quot;renderer&quot;:&quot;svg&quot;}\" data-widget_type=\"lottie.default\">\n\t\t\t\t\t<div class=\"e-lottie__container\"><div class=\"e-lottie__animation\"><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-33 elementor-inner-column elementor-element elementor-element-b5ccacc\" data-id=\"b5ccacc\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2f134cd elementor-align-right elementor-mobile-align-left elementor-tablet-align-right elementor-widget elementor-widget-button\" data-id=\"2f134cd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-xs\" href=\"#elementor-action%3Aaction%3Dpopup%3Aopen%26settings%3DeyJpZCI6IjI5OTEiLCJ0b2dnbGUiOnRydWV9\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Start Today !<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba4129e elementor-widget elementor-widget-heading\" data-id=\"ba4129e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Use OpenID Connect to secure your API server\u00a0<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e8293a8 elementor-widget elementor-widget-text-editor\" data-id=\"e8293a8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>There are so many authentication mechanisms that Kubernetes support. Some of them are OpenID Connect (OIDC), Client certificates, Basic authentication, , and Proxy. OIDC is quite secure and scalable solution.\u00a0 \u00a0<\/p><p>If you have clusters that are accessed by large teams, then this authentication mechanism is ideal for such clusters. It is so because it provides a single sign-on solution for all users. Also, it makes it easy to onboard and offboard users. Because you don&#8217;t have to store sensitive information on a user&#8217;s computer, such as client secrets and passwords, it&#8217;s also considered far more secure than other mechanisms. It also has key features like MFA and Yubikey, which you can use if your OIDC provider supports it.\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c337e76 elementor-widget elementor-widget-heading\" data-id=\"c337e76\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Use the Secrets feature to take care of all Sensitive Data\u00a0<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-68d4466 elementor-widget elementor-widget-text-editor\" data-id=\"68d4466\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>This one is pretty straightforward. Kubernetes has a provision for storing sensitive data in the form of Secret resources. Sensitive data like passwords, keys, and others can be stored this way. Secrets can store string data, tokens, files, docker config, certificates, etc. You can mount Secrets as data volumes or expose them as container environment variables. You can use plain or encoded text to store Secrets, but it&#8217;s advisable to use it to store secrets. Secrets are very flexible and are native to Kubernetes, so there is every reason for you to use them. Also, ensure that you have implemented proper RBAC for secrets so that it&#8217;s not accessible to everyone.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b88d43b elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"b88d43b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a3271df elementor-widget elementor-widget-text-editor\" data-id=\"a3271df\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>ISmile Technologies is a renowned provider of DevOps enablement solutions. We see DevOps as a no-touch CI\/CD driven software delivery approach that believes that a single integrated delivery function from requirements to testing &amp; production will provide better business value to the customers. <span style=\"color: #14a49c;\"><a style=\"color: #14a49c;\" href=\"http:\/\/ismiletechnologies.com\/contact-us\/\">Schedule your free assessment<\/a><\/span> today.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Kubernetes has become an essential part of software infrastructure today. Are you using Kubernetes clusters for your workloads? If you are an enterprise or a medium size company, there are chances that you are already running Kubernetes clusters for doing your organizational chores. Today, many DevOps engineers maintain either an on-prem Kubernetes cluster or they [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":34932,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[103],"tags":[],"class_list":["post-34924","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/34924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/comments?post=34924"}],"version-history":[{"count":10,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/34924\/revisions"}],"predecessor-version":[{"id":34999,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/34924\/revisions\/34999"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/media\/34932"}],"wp:attachment":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/media?parent=34924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/categories?post=34924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/tags?post=34924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}