Kubernetes Security Concepts

Internal

• Kubernetes Concepts

Transport Security

• https://kubernetes.io/docs/reference/access-authn-authz/#transport-security

Service Account

A service account provides an identity for processes that run in a pod. Pods that want to interact with the API Server will authenticate with a particular service account. By default, in absence of specific configuration, the pods will authenticate as the default service account in the namespace they are running in. Service accounts are rendered in logs using the following pattern: "system:serviceaccount:namespace:account-name (e.g. "system:serviceaccount:blue:default).

TODO:

• https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
• https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/

Default Service Account

Each namespace comes with a default service account:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: default
secrets:
- name: default-token-dddkl

Service Account Operations

• Details about the Namespace's Default Service Account
• Assigning a Cluster Role to a Service Account

Role Based Access Control (RBAC)

In Kubernetes, granting a role to an application-specific service account is a best practice to ensure that the application is operated in a specified scope.

TODO:

• https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions
• https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/

RBAC Operations

• Assigning a Cluster Role to a Service Account