Add Authorization in Kubernetes Hardening Guide #43623

ashish493 · 2023-10-21T03:49:46Z

This is Authorization Section of Kubernetes hardening guide which has been under discussion in SIG-Security-Docs kubernetes/sig-security#30 .

linux-foundation-easycla · 2023-10-21T03:49:50Z

The committers listed above are authorized under a signed CLA.

✅ login: ashish493 / name: Ashish Malik (45a9a00, 0db7cd7, e2cc6b9, 297a238, f33dd7f, 32452e0, 1ee39f9, efac9de, a98172c, 5bfe93b, 37807bd, 3b00279, 87b284d, 0cdb8f1, cae1363, b8fc1e8, 3be42b2, f95f709, c428bc9)

k8s-ci-robot · 2023-10-21T03:49:55Z

Welcome @ashish493!

It looks like this is your first PR to kubernetes/website 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/website has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

netlify · 2023-10-21T03:52:31Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`b8fc1e8`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/65edc6ae2c8282000822813f
😎 Deploy Preview	https://deploy-preview-43623--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

aj11anuj

Some minor suggestions from my side

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

ashish493 · 2023-10-24T07:29:44Z

@aj11anuj Thanks, I've made some changes by checking with grammarly.

k8s-triage-robot · 2024-01-22T19:32:48Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

divya-mohan0209 · 2024-01-25T05:31:39Z

/remove-lifecycle stale

divya-mohan0209

Overarching concerns here:

Is this still being worked upon @ashish493? I see a lot of deviations from the Kubernetes style guide here & would recommend that you read through the style guide and make necessary changes.
Can we please get a technical review from SIG Security? @kubernetes/sig-security-pr-reviews ?

cc: @savitharaghunathan {Sorry, in advance, if this doesn't fall within your remit}

ashish493 · 2024-01-25T05:53:08Z

@divya-mohan0209 Yeah I'm currently working on the Resource Limits topic for the Hardening Guide. Thanks for the pointing out the Kubernetes style guide . I will make the changes in this doc according to it.

divya-mohan0209 · 2024-03-08T07:16:27Z

Hello @ashish493, checking in on the updates for the PR. Is this still being worked upon?

ashish493 · 2024-03-08T07:25:51Z

Hi @divya-mohan0209
Yeah, I've made the changes locally and will update this PR within this weekend. Sorry for the delay, was occupied in the release for my company.

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

k8s-ci-robot · 2024-03-10T14:30:49Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign katcosgrove for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

content/en/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ashish493 · 2024-03-10T14:50:39Z

Thanks @reylejano for reviewing, I've updated the changes according to it.

@divya-mohan0209 I've also updated the content according to Kubernetes style guide.

sftim

Thanks @ashish493

We've got some quite good documentation already, which sets a bar for quality. I'd only be happy to merge this if you:

remove the implication that RBAC mode is always active
fix the snag around recommending admission controllers, rather than authz webhooks
(it's OK to mention admission control as further reading)

and please also consider

fix the wrapping for the Markdown source, so that lines are typically 100 characters of fewer

sftim · 2024-03-10T18:26:21Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+
+<!-- body -->
+
+### Role based access control(RBAC)


Suggested change

### Role based access control(RBAC)

## Role based access control (RBAC) {#hardening-rbac}

sftim · 2024-03-10T18:27:08Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+- It is crucial to refrain from using the AlwaysAllow value in the --authorization-mode flag. This value effectively disables all authorization modes, compromising the ability to enforce the principle of least privilege.
+- Assigning rights using the `system:masters` group should always be avoided, as it possesses hardcoded cluster-admin rights. These rights cannot be revoked due to their hardcoded nature in the source code. Users with `system:masters` rights will always have administrative privileges. The groups who genuinely require cluster-admin rights should be provided a binding to the cluster-admin clusterrole.
+
+### Resources to restrict to prevent privilege escalation


Suggested change

### Resources to restrict to prevent privilege escalation

## Resources to restrict to prevent privilege escalation {#hardening-components}

sftim · 2024-03-10T18:27:27Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+
+To prevent privilege escalation, specific measures should be taken to restrict access to critical resources within the Kubernetes environment:
+
+- *etcd*: A crucial component storing state information and cluster Secrets, requires careful access control. Roles should be defined for users with access limited to specific keys to prevent unauthorized access, safeguarding the entire cluster.


Make it clear that these aren't roles in the RBAC sense

sftim · 2024-03-10T18:27:57Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+
+- *etcd*: A crucial component storing state information and cluster Secrets, requires careful access control. Roles should be defined for users with access limited to specific keys to prevent unauthorized access, safeguarding the entire cluster.
+
+- *kubelet*: The primary node agent operating on every node, necessitates secure configuration. The kubelet service should run with --anonymous-auth=false to enhance security. The node/proxy right should be granted judiciously, ensuring only necessary users have access to the Kubelet API and preventing evasion of Kubernetes admission control.


Put command line arguments inside backticks.

sftim · 2024-03-10T18:28:24Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+
+- *kubelet*: The primary node agent operating on every node, necessitates secure configuration. The kubelet service should run with --anonymous-auth=false to enhance security. The node/proxy right should be granted judiciously, ensuring only necessary users have access to the Kubelet API and preventing evasion of Kubernetes admission control.
+
+- *Kubernetes Dashboard* : a web-based UI for cluster interaction, poses a security risk if accessed by attackers. Users with elevated access to the dashboard can exploit vulnerabilities, including opening shell connections to pods and viewing Secrets. In the cluster role, grant users read-only permission to the dashboard, minimizing write access to mitigate the risk of cryptojacking attacks.


Ideally, reword this to be good advice whether or not the cluster in question uses Kubernetes RBAC.

sftim · 2024-03-10T18:28:34Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+
+- *Kubernetes Secret* : An object containing sensitive information like passwords and tokens, demand controlled access. Unrestricted access to Secrets should be avoided to limit exposure to potential attackers. Admission controllers should be used to restrict access to only for necessary components.
+
+- *Kubernetes API* : It is an HTTP API for querying and modifying cluster objects, is critical for communication. Unrestricted access to the API poses risks, including resource modifications, data breaches, and potential cluster takeovers. Implement RBAC policies with minimal verbs, ensuring that users have only the necessary permissions to interact with the Kubernetes API securely.


Ideally, reword this to be good advice whether or not the cluster in question uses Kubernetes RBAC.

sftim · 2024-03-10T18:28:59Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+
+- *Kubernetes API* : It is an HTTP API for querying and modifying cluster objects, is critical for communication. Unrestricted access to the API poses risks, including resource modifications, data breaches, and potential cluster takeovers. Implement RBAC policies with minimal verbs, ensuring that users have only the necessary permissions to interact with the Kubernetes API securely.
+
+### Admission controllers


Suggested change

### Admission controllers

## Admission control {#hardening-admission-control}

sftim · 2024-03-10T18:29:33Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+
+### Admission controllers
+
+You can extend the built-in RBAC policies using the validation admission webhooks to strengthen the authorization design. 


This is poor advice; if you want custom authz, you should use an authorization callout: https://kubernetes.io/docs/reference/access-authn-authz/webhook/

sftim · 2024-03-10T18:29:52Z

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md

+A Kubernetes admission controller is a component of code that analyzes requests made to the Kubernetes API server and decides whether to approve them or deny them. The request gets evaluated after it has been verified and authorized by the API server before it is granted and implemented. 
+This is an optional feature that may only be required for  large-scale clusters or where complex security is required. They can be adjustable for many different user-specific scenarios and environments. There are many open source and commercial implementations from which organizations can choose and enforce their specific restrictions.
+
+### Auditing RBAC policies


Suggested change

### Auditing RBAC policies

## Policy review

divya-mohan0209 · 2024-04-01T03:55:53Z

@ashish493 : Please could you advise if you're able to address the suggestions made by @sftim in this review?

ashish493 · 2024-04-03T13:42:16Z

@divya-mohan0209 need some more time for those changes. We have sig-security-docs meeting this thursday. I will ask for some help for proceeding further. After that I will update my progress here.

dipesh-rawat · 2024-05-21T23:48:17Z

@ashish493 What's the plan for this PR moving forward? Does it require more refinement, is it ready for review (pending review comments), or are we at the stage where this can be closed?

ashish493 · 2024-05-26T17:37:28Z

@dipesh-rawat Yeah, it needs a little refinement. I couldn't give much time to it because of some personal issues. I will definitely try to do it soon. If it comes to a point where I won't be able to do it, then I will definitely pass this on to sig-security-docs for further enhancement.

divya-mohan0209 · 2024-08-12T11:29:09Z

@ashish493 Thank you for your efforts! Since there has been no progress on this PR, I'll be closing it out. In the event that you'd like to pass it on to SIG Security Docs and reopen it, please feel free to do so whenever you have the bandwidth.

/close

k8s-ci-robot · 2024-08-12T11:29:14Z

@divya-mohan0209: Closed this PR.

In response to this:

@ashish493 Thank you for your efforts! Since there has been no progress on this PR, I'll be closing it out. In the event that you'd like to pass it on to SIG Security Docs and reopen it, please feel free to do so whenever you have the bandwidth.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Add Authorization in Kubernetes Hardening Guide

32452e0

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Oct 21, 2023

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 21, 2023

k8s-ci-robot requested review from sftim and shannonxtreme October 21, 2023 03:50

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Oct 21, 2023

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Oct 21, 2023

ashish493 mentioned this pull request Oct 21, 2023

Kubernetes Hardening Guide kubernetes/sig-security#30

Open

Removed additional header Authorization from overview

0db7cd7

tengqm reviewed Oct 21, 2023

View reviewed changes

ashish493 and others added 14 commits October 21, 2023 09:57

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

efac9de

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

45a9a00

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

f33dd7f

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

1ee39f9

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

297a238

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

87b284d

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

3be42b2

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

0cdb8f1

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update the required review changes

e2cc6b9

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

a98172c

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

3b00279

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

37807bd

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

5bfe93b

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

Update content/en/docs/concepts/security/hardening-guide/authorizatio…

cae1363

…n-hardening.md Co-authored-by: Qiming Teng <[email protected]>

aj11anuj suggested changes Oct 24, 2023

View reviewed changes

updated with grammarly check

c428bc9

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 22, 2024

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 25, 2024

divya-mohan0209 reviewed Jan 25, 2024

View reviewed changes

k8s-ci-robot added the sig/security Categorizes an issue or PR as relevant to SIG Security. label Jan 25, 2024

reylejano reviewed Mar 8, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md Outdated Show resolved Hide resolved

reylejano reviewed Mar 8, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md Outdated Show resolved Hide resolved

reylejano reviewed Mar 8, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md Outdated Show resolved Hide resolved

reylejano reviewed Mar 8, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md Outdated Show resolved Hide resolved

reylejano reviewed Mar 8, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md Outdated Show resolved Hide resolved

reylejano reviewed Mar 8, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md Outdated Show resolved Hide resolved

reylejano reviewed Mar 8, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/authorization-hardening.md Outdated Show resolved Hide resolved

Update Content with respect to Kubernetes Styling Guide

f95f709

Update the content with code styling

b8fc1e8

sftim requested changes Mar 10, 2024

View reviewed changes

k8s-ci-robot closed this Aug 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Authorization in Kubernetes Hardening Guide #43623

Add Authorization in Kubernetes Hardening Guide #43623

ashish493 commented Oct 21, 2023

linux-foundation-easycla bot commented Oct 21, 2023 •

edited

Loading

k8s-ci-robot commented Oct 21, 2023

netlify bot commented Oct 21, 2023 •

edited

Loading

aj11anuj left a comment

ashish493 commented Oct 24, 2023

k8s-triage-robot commented Jan 22, 2024

divya-mohan0209 commented Jan 25, 2024

divya-mohan0209 left a comment

ashish493 commented Jan 25, 2024

divya-mohan0209 commented Mar 8, 2024

ashish493 commented Mar 8, 2024

k8s-ci-robot commented Mar 10, 2024

ashish493 commented Mar 10, 2024 •

edited

Loading

sftim left a comment

sftim Mar 10, 2024

sftim Mar 10, 2024

sftim Mar 10, 2024

sftim Mar 10, 2024

sftim Mar 10, 2024

sftim Mar 10, 2024

sftim Mar 10, 2024

sftim Mar 10, 2024

sftim Mar 10, 2024

divya-mohan0209 commented Apr 1, 2024

ashish493 commented Apr 3, 2024

dipesh-rawat commented May 21, 2024

ashish493 commented May 26, 2024

divya-mohan0209 commented Aug 12, 2024

k8s-ci-robot commented Aug 12, 2024

	### Role based access control(RBAC)
	## Role based access control (RBAC) {#hardening-rbac}

	### Resources to restrict to prevent privilege escalation
	## Resources to restrict to prevent privilege escalation {#hardening-components}


		To prevent privilege escalation, specific measures should be taken to restrict access to critical resources within the Kubernetes environment:

		- etcd: A crucial component storing state information and cluster Secrets, requires careful access control. Roles should be defined for users with access limited to specific keys to prevent unauthorized access, safeguarding the entire cluster.


		- etcd: A crucial component storing state information and cluster Secrets, requires careful access control. Roles should be defined for users with access limited to specific keys to prevent unauthorized access, safeguarding the entire cluster.

		- kubelet: The primary node agent operating on every node, necessitates secure configuration. The kubelet service should run with --anonymous-auth=false to enhance security. The node/proxy right should be granted judiciously, ensuring only necessary users have access to the Kubelet API and preventing evasion of Kubernetes admission control.


		- kubelet: The primary node agent operating on every node, necessitates secure configuration. The kubelet service should run with --anonymous-auth=false to enhance security. The node/proxy right should be granted judiciously, ensuring only necessary users have access to the Kubelet API and preventing evasion of Kubernetes admission control.

		- Kubernetes Dashboard : a web-based UI for cluster interaction, poses a security risk if accessed by attackers. Users with elevated access to the dashboard can exploit vulnerabilities, including opening shell connections to pods and viewing Secrets. In the cluster role, grant users read-only permission to the dashboard, minimizing write access to mitigate the risk of cryptojacking attacks.


		- Kubernetes Secret : An object containing sensitive information like passwords and tokens, demand controlled access. Unrestricted access to Secrets should be avoided to limit exposure to potential attackers. Admission controllers should be used to restrict access to only for necessary components.

		- Kubernetes API : It is an HTTP API for querying and modifying cluster objects, is critical for communication. Unrestricted access to the API poses risks, including resource modifications, data breaches, and potential cluster takeovers. Implement RBAC policies with minimal verbs, ensuring that users have only the necessary permissions to interact with the Kubernetes API securely.


		- Kubernetes API : It is an HTTP API for querying and modifying cluster objects, is critical for communication. Unrestricted access to the API poses risks, including resource modifications, data breaches, and potential cluster takeovers. Implement RBAC policies with minimal verbs, ensuring that users have only the necessary permissions to interact with the Kubernetes API securely.

		### Admission controllers

	### Admission controllers
	## Admission control {#hardening-admission-control}


		### Admission controllers

		You can extend the built-in RBAC policies using the validation admission webhooks to strengthen the authorization design.

Add Authorization in Kubernetes Hardening Guide #43623

Add Authorization in Kubernetes Hardening Guide #43623

Conversation

ashish493 commented Oct 21, 2023

linux-foundation-easycla bot commented Oct 21, 2023 • edited Loading

k8s-ci-robot commented Oct 21, 2023

netlify bot commented Oct 21, 2023 • edited Loading

✅ Pull request preview available for checking

aj11anuj left a comment

Choose a reason for hiding this comment

ashish493 commented Oct 24, 2023

k8s-triage-robot commented Jan 22, 2024

divya-mohan0209 commented Jan 25, 2024

divya-mohan0209 left a comment

Choose a reason for hiding this comment

ashish493 commented Jan 25, 2024

divya-mohan0209 commented Mar 8, 2024

ashish493 commented Mar 8, 2024

k8s-ci-robot commented Mar 10, 2024

ashish493 commented Mar 10, 2024 • edited Loading

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

divya-mohan0209 commented Apr 1, 2024

ashish493 commented Apr 3, 2024

dipesh-rawat commented May 21, 2024

ashish493 commented May 26, 2024

divya-mohan0209 commented Aug 12, 2024

k8s-ci-robot commented Aug 12, 2024

linux-foundation-easycla bot commented Oct 21, 2023 •

edited

Loading

netlify bot commented Oct 21, 2023 •

edited

Loading

ashish493 commented Mar 10, 2024 •

edited

Loading