▫️ 🙈 🧖 認定Kubernetesセキュリティに合格した方法 ⏫ 👨🏿‍🏫 🧑🏿‍🤝‍🧑🏿

みなさん、こんにちは。

私は正常に渡すの私の経験を共有したいと思い公認Kubernetesセキュリティ（CKS）の試験にからLinux Foundationのを。この試験では、ご想像のとおり、Kubernetesクラスターとその上で実行されているアプリケーションのセキュリティのさまざまな側面を構成する能力をテストします。私は試験が好きで、さまざまな観点からセキュリティを調べ、Falco、Trivy、kube-bench、Open Policy Agent、gVisorなどの非常に便利な外部ツールも使用しています。試験自体は、私には適度に難しいように見えました。 KKAは、Kubernetesの新規参入者を対象としています。

まず、試験とその準備全般について説明し、次に試験で取り上げるトピックに移ります。

現時点では、Kubernetesのセキュリティ試験は2つしかありません。実際、これはCKS自体と、OpenShiftセキュリティを扱うRedHat認定セキュリティスペシャリストであるContainersとOpenShiftです。これらの2つの試験は多くの点で重複していますが、Openshiftによると、試験はさらに難しいと思います（私は成功しました）。

試験の費用は個別に300ドル、公式のKubernetes Security Fundamentals（LFS260）コースの費用は299ドルで、コースと試験を一緒に499ドルで購入できます。従来のLinuxFoundation New YearSaleでコースと試験を一緒に200ドルで購入しました。

CKS CKA (Certified Kubernetes Administrator). CKS, , CKA. , CKS CKA.

. :

Linux Foundation: Kubernetes Security Fundamentals (LFS260). Linux Foundation, . , , , , - PDF ( , ?!), . , . , .
Udemy 3599 . , " ", . , , . https://killer.sh. , , .. - . , , .. , . , .

15-20 , 2 .. 6-8 . . , Kubernetes killer.sh, 1 40 .

67%, . , "".

. , .

- . CKS. :

Cluster Setup (10%)

Use Network security policies to restrict cluster level access
Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
Properly set up Ingress objects with security control
Protect node metadata and endpoints
Minimize use of, and access to, GUI elements
Verify platform binaries before deploying

Cluster Hardening (15%)

Restrict access to Kubernetes API
Use Role Based Access Controls to minimize exposure
Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
Update Kubernetes frequently

System Hardening15%

Minimize host OS footprint (reduce attack surface)
Minimize IAM roles
Minimize external access to the network
Appropriately use kernel hardening tools such as AppArmor, seccomp

Minimize Microservice Vulnerabilities (20%)

Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts
Manage Kubernetes secrets
Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
Implement pod to pod encryption by use of mTLS

Supply Chain Security20%

Minimize base image footprint
Secure your supply chain: whitelist allowed registries, sign and validate images
Use static analysis of user workloads (e.g.Kubernetes resources, Docker files)
Scan images for known vulnerabilities

Monitoring, Logging and Runtime Security20%

Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
Detect threats within physical infrastructure, apps, networks, data, users and workloads
Detect all phases of attack regardless where it occurs and how it spreads
Perform deep analytical investigation and identification of bad actors within environment
Ensure immutability of containers at runtime
Use Audit Logs to monitor access

, , , - . , , . .

. Falco Sysdig. Linux , . Falco , :

hostPID

hostNetwork
hostPath
, /etc
IP-

... .

, Falco Kubernetes, Kubernetes API, :

hostPID

hostNetwork

.
kube-system
ClusterRoleBinding

cluster-admin

... .

, Falco . , .. , . , Falco , .

Kubernetes, RBAC , Open Policy Agent (OPA). Kubernetes , Rego. Kubernetes validating admission webhook OPA Gatekeeper. Custom Resource Definition. , costcenter.

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          properties:
            labels:
              type: array
              items: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        
        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("you must provide labels: %v", [missing])
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: ns-must-have-costcenter
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
  parameters:
    labels: ["costcenter"]

costcenter :

Error from server (you must provide labels: "costcenter"): error when creating "ns.yaml": admission webhook "validating-webhook.openpolicyagent.org" denied the request: you must provide labels: "costcenter"

OPA Gatekeeper , , .. Kubernetes, , . , Gatekeeper mutating webhook, .. , .

, Rego playground, . , Kubernetes, .

, , Trivy Aquasecurity. , , , Clair, .

Network Policy. , from to . .
RBAC. Role

ClusterRole

, RoleBinding

ClusterRoleBinding

. , ClusterRole

ClusterRoleBinding

, , RoleBinding

, ClusterRole

( , admin

, edit

view

, ).

Role

RoleBinding

, , . , .

, , , ("Authorization: Bearer $TOKEN" ).
Kubernetes. Falco, . , kube-apiserver, .
Kube-bench. .
kube-apiserver, kube-scheduler, kube-controller-manager kubelet. , kubeadm, . , , , kube-apiserver, , (/var/log/pods/*

), .. .
kubeadm .
YAML- Kubernetes . , , , .
TLS-enabled Ingress.
ImagePolicyWebhook.
AppArmor. AppArmor . (!)
Seccomp. , AppArmor.
RuntimeClass, gVisor. , , .
PodSecurityPolicy (PSP). , PSP , .. , , AppArmor securityContext, defaultAllowPrivilegeEscalation

defaultAddCapabilities

.

, PodSecurityPolicy use PSP . .
Kubernetes Dashboard. Kubernetes Dashboard, , .

(, Chrome, Vivaldi). :

, . https://kubernetes.io/docs.

, Certified Kubernetes Security.

認定Kubernetesセキュリティに合格した方法

More articles: