Recently, there’s been a lot of attention paid to software supply chain security. In particular, here’s a quote from the May 2021 presidential executive order on improving the nation’s cybersecurity: “The Federal government must … advance toward zero trust architecture; accelerate movement to secure cloud services, including … platform as a service (PaaS).”
There are two parts necessary to create a truly trusted software supply chain; securing the non-technical areas and securing the technical areas.
Non-technical aspects of any secure software supply chain involve having individuals or teams focused on security and audit compliance. Internal company policies that act as a regulatory system and set standards for developers are a must, as are efforts to enforce compliance with security best practices. While this can bode well for large organizations, small software engineering teams and startups do not have the bandwidth, budget or culture to make this a reality.
Envisioning Robust Security Best Practices
Tools that are open source, governed strictly and enable automation of secure build and deployment are the components that form the technical aspects of the solution. Engineering teams must find a way to envision robust security best practices and find a way to apply them without unduly affecting the developer workflow. This is a founding principle of the DevSecOps efforts within the larger community of software development professionals.
Ergo, advocating a technology stack that:
Is composed of open components
Provides automated builds
Reduces the dependency on developers
Allows security operators to extend control
and is actively supported by the community is an ideal choice upon which to build a platform for use by development teams.
The focus of this article is to describe a robust stack that will sit above compute resources and power applications. The stack will consist of fully customizable open source components that put reliability and security at the forefront.
Simplify Operations
Application source code is the single source of truth when working with this stack. The use of Git, a popular version control system that is free and open source will allow developers to work with a source code management system from which all the downstream steps will be triggered.
Kubernetes is an open source container orchestration tool developed under the auspices of the Cloud Native Computing Foundation (CNCF). It serves as an abstraction over the infrastructure and compute layers to power the system from underneath. Kubernetes has managed to gather a large community following—second only to the Linux OS itself. Using Kubernetes will bring homogeneity above the infrastructure layer and will simplify further operations.
Cloud Foundry is an open-source PaaS tool. The use of Kubernetes introduces complexity that introduces a bit of overhead for developers who work with the platform. Cloud Foundry provides a countermeasure that simplifies the developer experience and greatly eases the pain points commonly associated with Kubernetes adoption. The Cloud Foundry platform does the job of deploying all the applications to the Kubernetes infrastructure. The cfpush command triggers the export of a container image from the application source code.
When building these containers to deploy to the runtime within Kubernetes, Cloud Foundry uses Paketo buildpacks internally. Paketo buildpacks are an implementation of the cloud-native buildpacksspecification which aims to provide a unified means to generate OCI-compatible container images for all languages and frameworks that are commonly used to build applications. Paketo buildpacks are also open source and fully customizable according to the needs of software development teams.
A Trusted Architecture
Together, this platform, built on open tools, supported actively by the community and facilitating the exact needs of software developers helps promote a trusted architecture upon which to stage applications. Using these tools would enable an organization to build a software development ecosystem that satisfies all the requirements implied and enumerated in the various recommendations for improving software security.
As we close out 2021, we at devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the twenty-second in our series of the Best of 2021.
As we close out 2021, we at devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the seventh in our series of the Best of 2021.
As society continues to recover from the global COVID-19 pandemic and some semblance of normal starts to return, technology continues to move forward. The pandemic certainly changed what normal means and people, processes and technologies all have adapted and evolved to meet those challenges. The narrative that the pandemic caused of your organization’s digital transformation is true for many practitioners. With 2022 just around the corner, DevOps is on the cusp of maturation of previously bleeding-edge paradigms and a focus on engineering efficiency. Here are five DevOps evolutions you should keep an eye on going forward.
Engineering Efficiency is Front and Center
Engineering efficiency is a particularly broad umbrella term. At the foundational level, engineering efficiency focuses on making someone (for example, an engineer) more productive. There are a multitude of disciplines that intersect, from organizational design to engineering/developer experience. Engineering efficiency is increasingly critical for organizations today. The pandemic had two major impacts on the technology sector in terms of resources and staffing. The first, at the start of the pandemic, was the unprecedented and unpredictable availability of resources; physical locations were being shut down because of the medical severity of the pandemic and the “getting hit by a bus” factor was playing out in real life. Second, during the recovery period, the Great Resignation began, and with it, a fight for resources that has become increasingly intense. Both have meant that the availability of resources, especially ramped resources, is scarce.
The Spotify model of tribes/guilds of engineering resources is a promising evolution; folks can frequently move around, reducing the toil that engineering resources face and allowing for engineering resources to not only ramp up more quickly but also increasing engagement and retention. The industry continues to march toward standardization in areas that were typically bespoke, such as the release process, and I think we’ll see that continue to evolve, as well.
Git is Ubiquitous
Leveraging a source code management (SCM) solution used to be reserved for software engineers. But as the proliferation of “something-as-code” has touched multiple levels of the technology stack from networking, storage and, ultimately, a development pipeline, the march of operations-focused engineers adopting many of the traits of software engineers continues. Having iteration in your infrastructure stack with more ephemeral/disposable infrastructure is becoming the norm. Saving and packaging the multitude of configurations for the “something-as-code” source control is a natural area of evolution.
Building off of source control are the package managers—your Docker registries, Helm chart repositories, etc.—for more deployable artifacts; that said, getting those artifacts to production is a process. Because Git is becoming ubiquitous across the technology landscape, this leads to the continued adoption of GitOps. Since the seminal piece was written by Weaveworks in 2017 defining the GitOps paradigm, leveraging GitOps is seen as a viable paradigm for many organizations five years later, especially when starting with greenfield initiatives.
Kubernetes is No Longer Bleeding Edge
In 2022, Kubernetes will celebrate the eighth birthday of its first commits on GitHub. Taking a jog down technology memory lane, eight years before Kubernetes (in 2006), VMware was still a private company and it would be a few years before vSphere was even released (remember how it felt to run a workload on a virtual machine in 2014?). The Kubernetes ecosystem still moves quickly, but placing workloads on Kubernetes is not a novel concept anymore. As application infrastructure and architecture have adopted the Kubernetes way (in other words, being idempotent and ephemeral), there is maturity around running a suitable workload on Kubernetes.
Kubernetes by design is highly pluggable. If you do not like the opinion or implementation of something inside Kubernetes, you can replace that opinion. Don’t like how Kubernetes handles ingress traffic? Then choose from one of the many ingress controllers available today. That is just one example of dozens of pluggable areas. Because of this, Kubernetes is viewed as a dynamic, non-static resource. Using Kubernetes takes trial and error and getting your cluster to be robust, performant and reliable is an ongoing journey that requires ongoing iteration.
Authors Can Be the Enforcers
There is no question that in a modern software stack, we are inundated with data. The metrics soup and the continued science of and exploration of observability (metrics, traces, logs) provide us with a lot to work with. Making decisions, even automated ones, based on that data continues to be critical. With the rise of site reliability engineering (SRE) practices, reacting or anticipating spikes in usage, failures and even security-related items are par for the course for modern teams.
These decisions can be authored into policies that specific platforms understand, such as autoscaling rules for a cloud vendor or something like Open Policy Agent in the Kubernetes ecosystem. With so many items shifting left toward the development team, finding the right resource, skillset or institutional knowledge to author these rules can involve the input of several teams. Because of the rise of “something-as-code,” regardless of whether the author of these rules is a software engineer, DevOps engineer, platform engineer or anyone in between, that author has the ability to enforce.
Shifting Left … But Complexity Shifts Left, Too
The old adage is that complexity is like an abacus: You can shift complexity around, but it never really goes away. With the movement to shift responsibility left to development teams, this also means that associated complexity is shifting to the development teams. Modern platform engineering teams provide the infrastructure (compliant Kubernetes clusters) to teams and any workload that is run on those clusters is up to the development team that owns it.Typically, development teams then focus on features and functionality. Managing lots of non-functional requirements—and even core infrastructure requirements such as networking—can be a burden; think about how your organization would handle a service mesh.
If you are a DevOps or platform engineer, making your internal customers—your development teams—successful is a great goal to work toward. Crucial to this is disseminating expertise. This can be in the form of automation and education. A common practice with the DevSecOps movement is to have some sort of scanning step as part of the build or deployment process, disseminating the internals as far as how the scan is performed, what happens if something is found, etc. Gaining internal adoption is a journey and having a good developer experience built around clarity and stability are important.
Evolution in 2022
Even with all of the challenges, bumps and learnings that the last year has given us, technology continues to evolve and advance and even lower the barriers of entry to continually become more inclusive. Focusing on improving engineering efficiency and reducing toil will allow for more participation and lower the barriers to entry.
Argo is an open source suite of projects that helps DevOps teams deliver software more rapidly and safely. Argo Workflows, Argo CD, Argo Rollouts and Argo Events are open source tools for Kubernetes to run workflows, manage clusters and do GitOps right. On Dec. 8, the Argo community will come together at ArgoCon ’21 Virtual Event to share their Argo journey, some less known details about the project and offer a glimpse into what the future may hold.
The agenda for ArgoCon ’21 features technical sessions, demos, deep-dives and case studies covering a variety of topics, including:
How GitOps workflows relate to DevOps movement and how it paves the way toward a successful DevOps adoption
How to use Argo Workflows, Events, CD and Rollouts to create a flexible, customizable developer experience for CI/CD
Argo CD production best practices and how to customize your Argo CD setup
Building medical grade AI with Argo Workflows
Bridging into Python ecosystem with cloud-native distributed ML pipelines
How to enable and empower teams to manage their own Argo-based CI/CD pipelines across multiple multi-tenant clusters
How scalable is Argo
GitOps-ifying your K8s management with Argo CD and Codefresh
Speakers
ArgoCon ’21 features outstanding DevOps and GitOps leaders from the Argo community, including:
Alex Collins, Argo project lead at Intuit
Alexander Matyushentsev, Argo project lead at Intuit
Anaïs Urlichs, SRE at Civo
Aya Ivtsan, senior computer scientist at Adobe
Christian Hernandez, senior principal technical marketing manager at Red Hat
Dan Garfield, co-founder and chief open source officer at Codefresh
Edgar Magana, senior principal software engineer at Splunk
Hannah Seligson, developer advocate at Codefresh
Hong Wang, founder and CEO at Akuity
Hui Kang, platform engineer at Salesforce
Ian McGraw, lead platform engineer at Arthur.ai
Jesse Suen, Argo project lead, co-founder and CTO at Akuity
J.P. Zivalich, CTO at Pipekit
Kelsey Hightower, principal engineer of Google Cloud Platform at Google Cloud
Mike Bowen, director open source program office, cloud native engineer at BlackRock
Omri Fima, chief architect at Diagnostic Robotics
Pratik Wadher, SVP, product development at Intuit
Ravi Lachhman, field CTO at Shipa
Ryan Umstead, BlackRock
Saad Malik, CTO and co-founder at Spectro Cloud
Sergio Méndez, DevOps engineer at Yalo
Severin Ryberg, senior infrastructure architect at ACCURE Battery Intelligence
Siamak Sadeghianfar, product manager at Red Hat
Venkata Gunapati, staff software engineer at Intuit
Yuan Tang, founding engineer at Akuity
Giveaways
There will be six sponsor giveaways at ArgoCon ’21:
A mouse pad and wireless charger giveaway by Red Hat
A $100 Amazon gift card raffle by Akuity
The Kubernetes 2021: Operationalizing for Scale study by Dimensional Research (sponsored by Spectro Cloud) is freely available for download
A $200 gift card raffle by Shipa
A brand new Quest 2 and Pipekit swag package giveaway
15 Argo Codefresh branded Bluetooth speakers giveaway
For more information on how to participate on the raffles and giveaways, visit the ArgoCon ’21 website.
There will also be a virtual exhibit hall to interact with partner sponsors and download information. All attendees will receive a link to access the virtual environment on-demand once the live event is over. To see the full agenda and to register, please visit the ArgoCon ’21 website.
GitOps has become more than a buzzword in the DevOps community. It consists of a set of best practices designed to better deploy, manage and monitor Kubernetes clusters and applications. By adopting GitOps everything becomes code, therefore empowering DevOps teams to control every aspect of the development process from beginning to end.
Viktor Farcic, developer advocate at Upbound, member of the Google Developer Experts and a published author, has been doing GitOps even before the term was coined by Alexis Richardson in 2017. Viktor believes that even though many developers have been doing GitOps for a while, defining what it really is and giving GitOps a name is what has helped with its rapid adoption.
Viktor is one of our outstanding speakers presenting at GitOps Evolution Virtual Summit. During his session, Viktor will talk about GitOps and explore Crossplane combined with Flux as a potential solution for all infrastructure needs and to see whether it fits into the broader Kubernetes ecosystem.
Crossplane is an open-source project that enables engineers to use Kubernetes to provision and manage infrastructure, services and applications. Combined with Flux, it allows us to apply GitOps principles to constantly monitor infrastructure and fix any drifts there are between the current and desired states.
Our very own Jackie Whetzel sat down with Viktor Farcic for a quick interview on GitOps and his upcoming session. Check out a clip of the interview below.
To learn more about how to apply GitOps on infrastructure join Viktor’s session at GitOps Evolution Virtual Summit on Sept. 23. To check out the full agenda or to register for free, visit the GitOps Evolution Virtual Summit website.
If you think all the way back to primary and secondary school, you may remember hearing something like, “open your ears while your teacher is talking to you.” It’s true that someone tuned in to listening learns more than someone who doesn’t, but opening your ears is a lot more important than that. Open ears have the ability to open minds. And with the tech industry constantly changing it’s more important than ever to keep your ears—and your mind—open to change.
With Cloud-Native Days with Kubernetes approaching, attendees have the perfect chance to open their ears and listen to the best of the best in the tech industry. Cloud-Native Days with Kubernetes is a two day virtual summit boasting over 50 speakers and sessions led by industry thought leaders and doers in the cloud-native space. Attendees will walk away with a better understanding of cloud native, its impact on the IT landscape and a lot more after listening to the key practices and methodologies of these tech titans.
While there are a myriad of talented speakers at Cloud-Native Days with Kubernetes, there are two very special keynote speakers you’ll want to pay extra attention and listen extra closely to. Hosting keynote sessions Aug. 4 and 5, Tara Hernandez and Caroline Wong are prepared to talk about technology shifting and the future of cloud-native security. With loads of experience and sage advice, Tara and Caroline are without a doubt the top two tech experts you won’t want to miss.
If you’re unfamiliar with Tara Hernandez, she’s a senior engineering manager at Google Cloud Platform, Associate Board member of Women Who Code and the host of the 12 episode podcast series, ‘Women Who Code’. A specialist in software engineering infrastructure and early backer of the Continuous Integration revolution, Tara has done everything from developing developer tools such as Tinderbox and Bugzilla, working at Pixar Animation studios to reinvent development infrastructure to handle the challenges of writing software in a film production environment, and helping create cloud developer platforms at Google. Beyond being a wizard in her field, Tara is equally impressive in her drive to share useful things about engineering management.
No-one’s journey goes without its challenges. But for Tara, “One issue [she] has faced in her rise to success is a case of imposter syndrome. While she has always had the skills to overcome any challenges that came her way, it took a lot of work for her to develop mental self defenses, and tame the anxiety that came when she was presented with a project […] Getting involved with [Women Who Code] has made her aware of the need for advocacy at a grassroots level, and she’s become more confident brainstorming with peers and management teams about increasing diversity in her own work place. At the same time it’s helped her find the confidence to attend more conferences, and even start giving talks.” A supporter, advocate, mentor, and “shining example of someone who has overcome doubt to achieve success,” Tara is the ultimate speaker to inspire change and innovation, especially in creators.
Check out Tara’s podcast ‘Women Who Code’ and listen to her talk about the current state of DevOps hereto learn more before her talk, ‘Those Little Tectonic Shifts,’ Wednesday Aug. 4 at 12:45 p.m. EDT.
Cloud-Native Days with Kubernetes is also incredibly proud to host Caroline Wong, Chief Strategy Officer of COBALT. Caroline is also an author, teaches cybersecurity courses on LinkedIn Learning, and similar to her fellow keynote speaker, hosts the ‘Humans of InfoSec’ podcast. With a background in communications and cybersecurity, Caroline holds deep-rooted expertise every attendee will want access to.
As Caroline says, “Cloud native is here; it is scaling, and it is not going anywhere. The more we can see the reality and necessity of what security must become, the better we will all be in the long run.” In her talk, ‘The Future of Cloud Native Security,’ Thursday Aug. 5 at 11 a.m. EDT, Caroline will share her observations on how companies must change the way they build security into their cloud-native projects, forecast what’s next for cloud-native security, and how organizations must double down on people and process innovation to overcome the misconceptions, education gaps and common mistakes we see when it comes to the cloud.
Be sure to check out Caroline’s podcast ‘Humans of InfoSec’ here before joining her keynote session next week.
It’s always important to listen. But when listening means driving ideas forward, opening your ears can be the most beneficial tool to be better than we were yesterday.
So open your ears, get ready to listen and join us Aug. 4 and 5 at 9 a.m. ET for a much needed active listening experience! Register today.
After over a year of dreaded isolation, many of us are ready to return to the networking and social atmosphere of pre-COVID life. While physical proximity continues to be a struggle, virtual proximity through events like virtual summits and teleconference meetings, is getting increasingly more helpful amidst the transition.
Cloud-Native Days with Kubernetes is a continuation of the virtual social interaction we’ve seen throughout the last year but offers attendees more than just a chance to talk with session leaders and speakers.
Sessions will be geared toward practitioners, managers and C-level executives, and led by industry thought leaders and doers in the cloud-native space, allowing attendees an opportunity to meet and network with experts in the cloud-native field.
At the end of this two day virtual summit, attendees will walk away with a better understanding of cloud native and its impact on the IT landscape.
Cloud-Native Days is hardly short of talent with over 50 speakers holding featured, insight and spotlight sessions.
Attendees will have networking access to a variety of speakers through keynote sessions at Cloud-Native Days, but catching keynote speakers Tracy Miranda and Rosalind Radcliffe’s sessions will certainly be a highlight of the virtual summit.
Not only will attendees be able to network with speakers, by means of networking, attendees will have the opportunity to forge collaboration. Keynote speaker Tracy Miranda has some valuable words to share regarding projects born from collaboration. She says, “We had this idea that Continuous Delivery is bigger than just one project, and we should be working together to make things inter-operable and better for everybody. Then as we went around talking to people for that idea— when it resonated with other people— they really became fans, and they would be like, “How can we help? What can we do? This is how we build up on it.” So find that core set of folks who will be enthusiastic, and will get you through the honeymoon period.”
Learn from the best of the best in the cloud-native space. With cloud-native technologies becoming an integral part of IT environments, it’s incredibly valuable to learn from industry specialists changing the IT world as we know it.
Listen to the best of the best at Cloud-Native Days. It’s always important to listen. But when listening means driving ideas forward, opening your ears can be the most beneficial tool to be better than we were yesterday.
Get real-world insight into topics like: trends and best practices in the cloud-native space, addressing Kubernetes complexities, tackling cloud-native security from the onset, etc.
Have fun while learning new things! Who says networking and learning can’t be fun? With so many exciting people, sessions and topics, attendees have a lot to look forward to at Cloud-Native Days with Kubernetes.
Networking isn’t just about linking on LinkedIn anymore. Collaboration doesn’t come from a request, it comes from interaction, engagement and communication. Find all three and start collaborating at Cloud-Native Days with Kubernetes, Aug. 4 and 5 at 9 a.m. (ET).
Now mark your calendars and meet the best of the best in tech! Register today.
Keeping up with information can be challenging. With all these changes, you’re probably left wondering, “who can guide me through all this information?” Fortunately, Cloud-Native Days with Kubernetes is focused on giving attendees the tools they need to become proficient in cloud-native technologies. At the virtual summit, attendees can tune into our expert-led featured sessions and learn how to leverage cloud native technologies to move faster and more securely.
Cloud-native technologies are quickly becoming an integral part of IT environments as organizations continuously accelerate their development efforts to meet business demands. Because of this, it’s incredibly valuable to learn from industry specialists changing the IT world as we know it. And who better to learn from than the industry thought leaders and doers in the cloud-native space? Through sessions touching on topics like security and observability, our featured tech titans will give you a better understanding of cloud native and its impact on the IT landscape.
Today, the CI/CD pipeline is mainly built on open source tools – Kubernetes, Jenkins, GitLab, etc. Security has traditionally been closed, but it’s now clear the pace of innovation cannot be constrained by proprietary development models. Keynote speaker Loris Degioanni, CTO and founder of Sysdig, will discuss key practices needed for a secure cloud and container environment, including: what is required to increase security, visibility and simplicity in the cloud, lessons learned from major attacks like Kaseya and SolarWinds, ways to leverage Secure DevOps to not only ‘shift left,’ but also ‘roll right’ for detection and response, and how open source is the key ingredient to see all your signals in a constantly changing landscape.
In his article, “Open Source is Taking Over Security,” published last year on The New Stack, Loris Degioanni elaborates on this idea that open source is essential to maintaining high security, stating, “I argue that, despite having lower penetration of open source, security is the industry that benefits the most from an open source approach. I also argue that open source will gradually take over and become the standard way to do security.” To understand this further, Loris breaks it up into a few key questions: Why is open source the best way to do security? and, Will open source become the standard way to do security?
Let’s start with the most important question: Why is open source the best way to do security? Loris is adamant that open source is the key ingredient to security because of one thing – speed of innovation. Loris points out that the rise of widely adopted and open computing platforms like Kubernetes have had a big impact on how distributed, coordinated ecosystems can beat out a ‘behind closed doors’ single vendor 100% of the time. Loris writes, “On one hand, Kubernetes and cloud native have such a fast innovation pace that it’s hard for a vendor to keep up by itself. On the other hand, thanks to Kubernetes, for the first time we have a completely open platform to run our applications, where security can be natively integrated rather than being bolted on top.”
Open source also increases the speed of innovation because it empowers end users to work with vendors. Any user, regardless of size and level of sophistication, Loris says, can provide feedback in a tight loop and they can also contribute. So why is this relevant to security? As Loris explains, “The intrinsically fragmented nature of vulnerabilities and threats makes this bazaar-oriented approach to contributing very effective.”
This brings us to Loris’s second question: will open source become the standard way to do security? Not only does Loris say yes, open source will become the standard way to do security, but in fact there is no escaping this. Using a metaphor of bad guys vs. good guys to describe cybersecurity battles, Loris says, “the army of the bad guys is big, smart, and aggressive. And the deck is stacked in their favor.”
So how do the good guys win in this scenario? Loris says the best chance at this is, “working together, as a team, leveraging each other’s strength, making sure that no energy is wasted.” Rather than having competing standards upheld by a variety of vendors, Loris is adamant that “a much better approach consists of leveraging a common set of standards that are deeply integrated in the platform, owned by the community, driven by consensus, on top of which all of the players can confidently innovate.”
Much like Loris’s approach to open source, innovation and security are also valuable key practices at Cloud-Native Days with Kubernetes. Life moves fast. Innovation cannot afford to be slowed down, especially now. So begin your cloud-native information journey by tuning into our expert-led sessions, gathering your questions and learning from our talented speakers August 4 and 5 at 9 a.m. ET.
84% of companies are using containers in production.
Of those, 78% are using Kubernetes to manage their containers.
69% of companies have found security holes due to misconfiguration of their Kubernetes environment.
Your Kubernetes architecture is like a large house with container “tenants” living inside it. You’ll need to build it with care to make sure it’s a safe and happy place to live.
Here are six essential factors to get right when planning (or auditing) your Kubernetes architecture.
Setting the Foundation: Underlying Platform and Control Plane Configuration
The foundation of a house is a critical first step. A weak foundation leads to cracks over time.
Similarly, where you install Kubernetes is your first choice. There are several options available, each with pros and cons.
Kubernetes is a cloud-native tool. Therefore, it makes sense to install it on the cloud. There are two cloud deployment options: Infrastructure as a Service (IAAS) or Platform as a Service (PAAS).
An IAAS installation involves creating a series of virtual machines in the cloud (for instance, using Amazon EC2) and installing Kubernetes on those machines. You’ll be responsible for updates and configuration of the Kubernetes installation.
On the other hand, all major cloud providers offer managed Kubernetes services. This deployment model allows you to use Kubernetes without having to handle the infrastructure.
Even though Kubernetes was made for the cloud, you don’t have to install it in the cloud. An on-prem installation is an option, with many companies choosing to use their virtualization infrastructure to host Kubernetes.
You’ll find a quick summary of the pros and cons of each choice below.
Your decision depends on three factors:
The skillset of your team
Your need for control and flexibility
Your company’s goals
Control Plane Configuration
The Kubernetes Control Plane consists of the services run on the Master node. The cluster store, scheduler, controller manager, and API server combine to create the control plane.
Plan your control plane security well. If an attacker gains access to your control plane, they’ll be able to control your entire Kubernetes cluster. Use SSH or a VPN / VPC to connect to and use the control plane.
If you’re using a managed service from a cloud provider, protect your API keys and credentials. Don’t ever store them in a source control system. Losing your API keys would lead to a complete takeover of your cloud infrastructure, not only your Kubernetes installation.
Finding Good Tenants: Container Security and Composition Analysis
The wrong tenants can destroy your house. Similarly, dangerous containers can bring down your Kubernetes environment.
Make sure any containers you bring in from the outside are vetted and configured correctly. Only use trusted registries, such as Docker Hub or Quay.io.
Finally, scan your containers before using them. You can use open-source container scanners to find vulnerabilities and malware. You can integrate most scanners into your CI/CD pipeline.
Plan Your Rooms Wisely: Kubernetes Cluster Partitioning
The rooms in your house each have a different name and purpose. You don’t keep a stove inside your bedroom or a bed in the kitchen. You give tenants private rooms while allowing them to share common areas, such as the kitchen.
In Kubernetes, namespaces allow you to separate various applications within the same cluster logically. If the cluster is your house, each namespace is a separate room within it.
Give namespaces to each application within your cluster. This practice produces three benefits:
Logically separates applications and environments (Development, Staging, Production)
Allows for robust Role-Based Access Control (RBAC)
Allows for network partitioning for added security within the cluster
Kubernetes RBAC Primer
You can check out the Kubernetes docs for comprehensive explanations of RBAC within Kubernetes. But here’s a quick primer for those who don’t have the time to read it now.
Kubernetes has Roles and ClusterRoles. They contain rules that represent a set of permissions. There are no “deny” rules, so you have to know what access is necessary.
Each Role is scoped to a specific namespace. ClusterRoles, on the other hand, have no namespace. In Kubernetes, an object can only be namespaced or not; it can’t be both. Therefore it’s necessary to have two resources, one for each scenario.
Use Roles to create permissions tied to a specific application. Use ClusterRoles for access to cluster-scoped resources or resources used by multiple namespaces.
RoleBinding and ClusterRoleBinding is the act of assigning permissions to a specific user. A RoleBinding grants permissions within a single namespace while a ClusterRoleBinding grants access cluster-wide.
For example, assigning the “pod-reader” Role to the user “jane” in the “default” namespace allows “jane” to read pods in the “default” namespace.
Roles define a set of permissions. Then users, groups, or service accounts (collectively called “subjects”) are assigned roles to grant access to specific resources within the cluster.
Define network partitioning and access control appropriate for the business’s needs before deploying any application into your cluster.
Watch Your Wiring: Inter-Pod Communications
Shoddy wiring is more than an inconvenience. It can lead to damaging fires or even destroy the entire house.
Similarly, poor inter-pod communications can bring your Kubernetes cluster grinding to a halt.
A Kubernetes environment is a small network ecosystem. The same network topologies, protocols, and policies govern pod-to-pod communication as those you’d find in any corporate network.
A full discussion of Kubernetes networking is beyond the scope of this article. You can read up on it using the Kubernetes networking documentation. But here are some quick pointers.
You can use Service Topology to define how traffic flows to and from a particular service. For example, a service can specify that traffic should be routed to endpoints on the same node as the client.
Service Topology is useful in the public cloud. You can use it to keep a service’s traffic in a particular availability zone or region to reduce latency.
Another useful networking tool is NetworkPolicies. These application-level constructs specify how a pod is allowed to communicate with other entities. This feature is especially useful when you want to control network traffic using IP addresses or ports.
Finally, you need to have a robust authentication and authorization strategy. We recommend using a service mesh to simplify load balancing, service discovery, encryption, and authentication. For example, service meshes include support for OAuth, which makes service authorization much easier to manage.
Secure the Front Door: Ingress Architecture
There’s no point in building a secure home and then leaving the front door unlocked. You don’t want to do that with your Kubernetes cluster either.
In Kubernetes, Ingress exposes HTTP and HTTPS routes from outside the cluster to your services within it. Ingress is your environment’s “front door.”
Carefully consider which server to use in your Ingress architecture. NGINX is a tried and true web server with all of the security features necessary to protect your services. NGINX now offers an Ingress Controller for cloud-native Kubernetes environments.
However, you may want to give Envoy a look. It’s an open-source edge and service proxy built by Lyft specifically for cloud-native applications. It tackles the common observability and network debugging issues common in a microservice architecture. Envoy can also serve as a service mesh.
As the “front door” to your cluster, the choice of an Ingress server also impacts security. You can use it to terminate TLS connections from clients before they access your services. Be sure to include a key management strategy, including a Key Management Service or another secure vault.
Remember to follow the same security practices for your Kubernetes cluster as you do for any other part of your network infrastructure. Watch for OWASP Top 10 and OWASP API Top 10 vulnerabilities as well as logic-based threats.
(Hint: Traceable watches for common and logic-based vulnerabilities by learning the business logic of your microservice applications. Check it out for yourself here).
Finally, make sure your ingress plays nicely with mobile and IoT devices if you serve those clients.
Install Security Cameras: Secure and Monitor Microservice Communications
Video doorbells and security cameras are becoming commonplace. Homeowners want to know what is happening in and around their house.
Securing and monitoring within your Kubernetes cluster is equally critical. Make sure that microservice communications are protected, and you know what requests are being sent between services.
Consider point-to-point encryption between all microservices. And ensure real-time API monitoring for both REST and gRPC protocols.
Zero Trust principles not are becoming more popular as new technologies are appearing that support it. Zero Trust is an operating model where no traffic is trusted by default, inside or outside your network.
Within Kubernetes, implementing this model means verifying every request, client, or object trying to connect to your services. Nothing happens within your cluster unless the user or service account has proven that they have permission to act.
Zero Trust is essential to cloud-native security. At any moment, dozens or hundreds of services are trying to perform actions and share information. Zero Trust ensures that every request is validated and there are no holes due to the assumption that internal traffic is automatically safe.
Protect Your House
The world of microservices and cloud-native architecture unlock countless opportunities for businesses today. But new technologies also come with new dangers; new opportunities for malicious actors to steal sensitive information.
We’ve discussed six essential factors for securing your Kubernetes architecture:
1. Choosing the underlying platform and control plan configuration
2. Vetting and securing the containers running in your environment
3. Implementing cluster partitioning and access control
4. Defining inter-pod communications
5. Choosing your Ingress architecture (protecting your “front door”)
6. Securing and monitoring your microservice communications
With these factors in mind, what should your next steps be?
If you have an existing Kubernetes installation, use these factors as a mini-audit. Review your current policies and see how well they match up in these six areas.
If you’re planning your first Kubernetes installation, use these factors as a guide to making sure you cover all of your bases. Meet with implementers and make sure you have a plan for all of these factors.
Then your Kubernetes environment will be a happy home for your microservices.
