Cluster Components Security

​

Secure controller manager and scheduler

• Isolate the controller manager and scheduler on a dedicated node
• Apply RBAC to limit what each component can do
• Secure all inter-component communication with TLS
• Enable audit logging and monitor with Prometheus and Grafana
• Use secure default configurations and protect configuration files
• Run the latest Kubernetes version
• Regularly scan for vulnerabilities

​

Secure kubelet

• Set the authorization mode to Webhook
• Disable anonymous access and enable supported authentication mechanisms

ps -aux | grep kubelet
cat <configuration-file-path>

​

Set authorization mode to Webhook

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authorization:
  mode: Webhook

​

Disable anonymous access and enable authentication

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
  anonymous:
    enabled: false
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt

• Certificate-based
• API bearer token-based

systemctl restart kubelet.service

# Now requests require a valid client certificate
curl -k https://localhost:10250/pods \
  --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt \
  --key /etc/kubernetes/pki/apiserver-kubelet-client.key

​

Secure container runtime

• Regularly update the container runtime to the latest version.
• Run containers with least privilege and avoid running as root:
  spec:
    securityContext:
      runAsUser: 2000
      runAsGroup: 3000
  
• Set a read-only root filesystem to prevent writes:
  spec:
    securityContext:
      readOnlyRootFilesystem: true
  
• Limit resource consumption (CPU, Memory) to prevent denial-of-service:
  spec:
    resources:
      limits:
        cpu: 1
        memory: 1Gi
  
• Apply security profiles like AppArmor or SELinux:
  • SELinux
  • AppArmor

  SELinux enforces mandatory access control policies at the kernel level:

  sample.yaml

  apiVersion: v1
  kind: Pod
  metadata:
    name: sample-pod
  spec:
    containers:
    - name: sample-container
      image: nginx
      securityContext:
        seLinuxOptions:
          user: "system_u"
          role: "system_r"
          type: "svirt_lxc_net_t"
          level: "s0:c123,c456"
  

  AppArmor restricts program capabilities using profiles defined on the node:

  apiVersion: v1
  kind: Pod
  metadata:
    name: sample-pod
    annotations:
      container.apparmor.security.beta.kubernetes.io/sample-container: localhost/sample-profile
  spec:
    containers:
    - name: sample-container
      image: nginx
  
• Transition to supported runtimes like containerd or CRI-O. Docker is deprecated in Kubernetes.
• Enable monitoring and logging (Prometheus, Grafana) and audit logging to detect suspicious activity.

​

Secure kube-proxy

• Set configuration file permissions to 644 or stricter, owned by root:root
• Secure communication with TLS between kube-proxy and kube-apiserver
• Set kube-proxy with least privilege
• Apply network policies to restrict access to the kube-proxy service
• Enable audit logging and monitoring
• Regularly scan and update for vulnerabilities

# If kube-proxy is deployed as a pod
kubectl describe pod/kube-proxy-xxxx -n kube-system

# If deployed as a systemd service
ps -aux | grep kube-proxy

ls -l /var/lib/kube-proxy/config.conf
chmod 644 /var/lib/kube-proxy/config.conf
chown root:root /var/lib/kube-proxy/config.conf

apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    server: https://kind-cluster-control-plane:6443
  name: default
contexts:
- context:
    cluster: default
    namespace: default
    user: default
  name: default
current-context: default
users:
- name: default
  user:
    tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: Metadata
    resources:
      - group: ""
        resources: ["pods", "services", "endpoints"]
      - group: "extensions"
        resources: ["ingresses"]
      - group: "networking.k8s.io"
        resources: ["networkpolicies"]
  - level: RequestResponse
    users: ["system:kube-proxy"]
    verbs: ["create", "update", "patch", "delete"]
    resources:
      - group: ""
        resources: ["pods", "services", "endpoints"]
      - group: "extensions"
        resources: ["ingresses"]
      - group: "networking.k8s.io"
        resources: ["networkpolicies"]

​

Secure ETCD

• Encrypt data at rest (etcd and persistent volumes)
• Perform regular backups
• Secure all communication with TLS

​

Secure container networking

• Implement network policies to restrict ingress and egress traffic between pods.
• Use a service mesh like Istio for mutual TLS, encrypted and authenticated pod communication, traffic management, and observability.
• Encrypt network traffic between pods using IPSec or WireGuard.
• Isolate sensitive workloads using namespaces and apply namespace-level network policies to reduce the impact of a compromised workload.

​

Secure storage

• Misconfigured storage access — allows attackers to access sensitive data
• Lack of encryption — can lead to data leakage
• Insufficient backup — can result in data loss from failures or attacks

• Encrypt data at rest using your cloud provider’s encryption options (e.g., AWS EBS, Azure Disk Storage).
• Use RBAC to limit storage access to authorized users only.
• Use StorageClass to enforce encryption, performance limits, and backup policies:
  sample-storage-class.yaml

  apiVersion: storage.k8s.io/v1
  kind: StorageClass
  metadata:
    name: example-st
  provisioner: ebs.csi.aws.com
  parameters:
    csi.storage.k8s.io/fstype: xfs
    type: io1
    iopsPerGB: "50"
    encrypted: "true"
  
  IOPS (Input/Output Operations Per Second) defines the read/write throughput of the volume. Higher IOPS means better performance.
• Regularly back up data and prepare a disaster recovery plan. Tools: Velero, Heptio Ark, Kasten.
• Monitor and audit storage metrics to detect suspicious activity and enable audit logging.