1 00:00:01,090 --> 00:00:02,900 Hello and welcome to this lecture. 2 00:00:03,160 --> 00:00:09,810 In this lecture we look at the security primitives in Kubernetes. Kubernetes being the goto 3 00:00:09,810 --> 00:00:12,960 platform for hosting production grid applications. 4 00:00:12,960 --> 00:00:16,860 security is of prime concern. In this lecture 5 00:00:16,860 --> 00:00:23,400 we look at the various security primitives in Kubernetes at a high level before diving deeper into those 6 00:00:23,490 --> 00:00:25,420 in the upcoming lectures. 7 00:00:25,500 --> 00:00:28,970 Let's begin with the host that formed the cluster itself. 8 00:00:29,130 --> 00:00:35,550 Of course all access to these hosts must be secured, root access disabled, password based authentication 9 00:00:35,550 --> 00:00:40,200 disabled, and only SSH key based authentication to be made available. 10 00:00:40,380 --> 00:00:46,260 And of course any other measures you need to take to secure your physical or virtual infrastructure 11 00:00:46,290 --> 00:00:52,250 that hosts kubernetes. Of course if that is compromised, everything is compromised. 12 00:00:53,560 --> 00:00:58,570 Our focus in this lecture is more on Kubernetes related security. 13 00:00:58,570 --> 00:01:04,690 What are the risks and what measures do you need to take to secure the cluster. As we have seen already, 14 00:01:04,690 --> 00:01:10,230 the kube-api server is at the center of all operations within kubernetes. We interact with it through 15 00:01:10,230 --> 00:01:16,090 the kubectl utility or by accessing the API directly and through that you can perform almost any 16 00:01:16,090 --> 00:01:17,890 operation on the cluster. 17 00:01:17,890 --> 00:01:23,520 So that’s the first line of defense. Controlling access to the API server itself. 18 00:01:24,770 --> 00:01:31,040 We need to make two types of decisions who can access the cluster and what can they do. 19 00:01:32,160 --> 00:01:37,440 Who can access the API server is defined by the Authentication mechanisms. 20 00:01:37,500 --> 00:01:43,240 There are different ways that you can authenticate to the API server. Starting with user IDs and passwords 21 00:01:43,240 --> 00:01:50,160 stored in a static file, to tokens, certificates or even integration with external authentication providers 22 00:01:50,160 --> 00:01:51,090 like LDAP. 23 00:01:51,630 --> 00:01:55,950 Finally for machines we create service accounts. 24 00:01:55,950 --> 00:02:02,840 We will look at these in more detail in the upcoming lectures. Once they gain access to the cluster, 25 00:02:02,890 --> 00:02:06,880 What can they do is defined by authorization mechanisms. 26 00:02:06,880 --> 00:02:12,700 Authorization is implemented using Role Based Access Control, where users are associated to groups with 27 00:02:12,700 --> 00:02:14,110 specific permissions. 28 00:02:14,110 --> 00:02:20,020 In addition there are other authorization modules like Attribute based access control, Node Authorizers, 29 00:02:20,020 --> 00:02:21,200 webhooks etc. 30 00:02:21,280 --> 00:02:24,630 Again we look at these in more detail in the upcoming lectures. 31 00:02:25,000 --> 00:02:30,750 All communication with the cluster, between the various components such as the ETCD cluster, kube controller 32 00:02:30,760 --> 00:02:37,420 manager, scheduler, api server, as well as those running on the worker nodes such as the kubelet and 33 00:02:37,420 --> 00:02:41,950 and kubeproxy is secured using TLS Encryption. 34 00:02:41,990 --> 00:02:47,300 We have a section entirely for this where we discuss and practice how to setup the certificates between 35 00:02:47,300 --> 00:02:49,600 the various components. 36 00:02:49,690 --> 00:02:52,990 What about communication between applications within the cluster. 37 00:02:53,260 --> 00:02:58,530 By default all PODs can access all other PODs within the cluster. 38 00:02:58,620 --> 00:03:02,950 You can restrict access between them using Network Policies. 39 00:03:02,950 --> 00:03:05,080 We will look at how exactly that is done. 40 00:03:05,230 --> 00:03:07,870 Later in the network policy section. 41 00:03:07,870 --> 00:03:12,740 So that was a high level overview of the various security primitives in kubernetes. 42 00:03:12,880 --> 00:03:17,080 We will now look at these in much more detail going forward.