Chapter 7 — Container & Kubernetes Security

7.1 Kubernetes Security Architecture

Cluster Hardening

Master Node Security

MasterNodeSecurity:
  AccessControl:
    - RBAC_enabled
    - ABAC_disabled
    - Anonymous_access_disabled
    - API_server_authentication

  NetworkSecurity:
    - Network_policies_enabled
    - Pod_security_policies
    - Service_mesh_integration
    - Ingress_controller_security

  etcdSecurity:
    - Encrypted_communication
    - Encrypted_data_at_rest
    - Regular_backups
    - Access_logging

Worker Node Security

WorkerNodeSecurity:
  HostSecurity:
    - Read-only_filesystems
    - SELinux/AppArmor
    - Kernel_hardening
    - Resource_limits

  ContainerRuntime:
    - Secure_runtime_configuration
    - Image_scan_integration
    - Runtime_security_monitoring
    - Sandboxing

Network Security

Pod Security Standards

PodSecurityStandards:
  Privileged:
    Level: "Restricted"
    Controls:
      - privileged_containers: "Forbidden"
      - host_network: "Forbidden"
      - host_pid: "Forbidden"
      - host_ipc: "Forbidden"

  Capabilities:
    Level: "Baseline"
    Allowed:
      - "NET_BIND_SERVICE"
      - "CHOWN"
    Denied:
      - "ALL"

  Volumes:
    TypeRestrictions:
      - hostPath: "Forbidden"
      - configMap: "Allowed"
      - secret: "Allowed"
      - persistentVolumeClaim: "Allowed"

7.2 Container Security

Image Security Pipeline

Multi-Stage Build Process

FROM golang:1.19-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o main .

# Security-hardened runtime stage
FROM scratch
WORKDIR /
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /app/main .
USER 65534:65534  # non-root user
EXPOSE 8080
ENTRYPOINT ["/main"]

Image Scanning Integration

CI/CD_Security_Pipeline:
  Stages:
    - name: "build"
      security_scan: false

    - name: "vulnerability_scan"
      tools:
        - Trivy
        - Clair
        - Grype
      fail_threshold: "high"

    - name: "compliance_check"
      policies:
        - no_root_user
        - minimal_base_image
        - no_secrets_in_image

    - name: "image_signing"
      tool: "cosign"
      key_management: "KMS"

    - name: "deploy"
      conditions:
        - scan_passed
        - signed
        - approved

Runtime Security

Container Runtime Monitoring

RuntimeSecurity:
  BehavioralMonitoring:
    - Process_execution_monitoring
    - File_access_monitoring
    - Network_connection_tracking
    - System_call_filtering

  ThreatDetection:
    - Anomaly_detection
    - Known_malware_signatures
    - Container_escape_attempts
    - Privilege_escalation_detection

  Response:
    - Automatic_isolation
    - Alert_generation
    - Forensic_data_collection
    - Policy_enforcement