TechDays Finland 2020: Best practices of securing web applications running on Azure Kubernetes Service
1 like560 views
The document outlines best practices for securing web applications on Azure Kubernetes Service (AKS), detailing various security controls and configurations necessary for effective protection. Key topics include access control using Azure Active Directory, pod and network security policies, and the importance of deploying trusted container images. The document emphasizes that while AKS offers more security controls compared to PaaS, it also demands greater responsibility from users to maintain security integrity.
TechDays Finland 2020: Best practices of securing web applications running on Azure Kubernetes Service
- 1. Best practices of securing web applications running on Azure Kubernetes Service KARL OTS
- 2. Karl Ots Chief Consulting Officer karl.ots@zure.com • Cloud & cybersecurity expert from Finland • Community leader, speaker, author & patented inventor • Working on Azure since 2011 • Helped to secure 100+ Azure applications, from startups to Fortune 500 enterprises • zure.ly/karl
- 3. @fincooper What to expect in this session • You will learn how to build, operate and architect secure web applications on top of Azure Kubernetes Service. • You will learn which security controls are available, how effective they are and what will be the cost of implementing them. • Resources to help you better secure your AKS environment, regardless of your current level!
- 4. @fincooper Before we go any further…
- 5. @fincooper Azure Kubernetes Service A fully managed Kubernetes cluster Managed Azure infrastructure services Docker Kubernetes Managed Kubernetes control pane Application architect Infrastructure architect Applications Operations
- 6. @fincooper
- 7. @fincooper Securing web apps on AKS CLUSTER SECURITY NETWORK SECURITY POD SECURITY DEPLOYMENT AND AUTOMATION
- 8. @fincooper Access control to Azure management pane • To provision Azure infrastructure, the AKS resource will need the following AAD entities: • A service principal for the Kubernetes cluster to create new resources and modify existing ones • RBAC role assignment for the Service Principal • A service principal for accessing the container registry • In addition, you will need to configure: • An app registration for acting as the AAD Server • An app registration for acting as the AAD Client
- 9. @fincooper Access control when connecting to cluster • AKS can be configured to use Azure AD for user authentication.
- 10. @fincooper Access control when connecting to cluster
- 11. @fincooper Access control when connecting to cluster • AKS can be configured to use Azure AD for user authentication. • But what about az aks get-credentials --admin?
- 12. @fincooper Access control when connecting to cluster
- 13. @fincooper
- 14. @fincooper Access control one inside the cluster • Once our users are authenticated through Azure AD, we can implement proper access control. • Kubernetes RBAC and Pod Security policies allow us to restrict which pods our dev/ops can operate.
- 15. @fincooper Often overlooked in AKS ops • Azure automatically applies security patches to the Linux nodes in your cluster on a nightly schedule. • You are responsible for ensuring that those Linux nodes are rebooted as required.
- 16. @fincooper You are responsible for ensuring AKS nodes are rebooted as required AKS is not PaaS
- 17. @fincooper Often overlooked in AKS ops • Azure automatically applies security patches to the Linux nodes in your cluster on a nightly schedule. • You are responsible for ensuring that those Linux nodes are rebooted as required. • Because AKS is free, no cost is available to reimburse, so AKS has no formal SLA. • AKS “seeks to maintain” availability of at least 99.5 percent for the Kubernetes API server.
- 18. @fincooper Control access to Kubernetes Master • Disable Dashboard! • (preview) Limit access to API server • https://github.com/Azure/azure-cli-extensions/tree/master/src/aks-preview#enable- apiserver-authorized-ip-ranges • https://docs.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges
- 19. @fincooper Securing web apps on AKS CLUSTER SECURITY NETWORK SECURITY POD SECURITY DEPLOYMENT AND AUTOMATION
- 20. @fincooper
- 21. @fincooper User Admin access Azure SQL Database Application access End user access k8s
- 22. @fincooper User AppAKSSubnet Application VNET Access only over SSL Admin access Azure SQL Database Access restricted Access only from AppAKSSubnet Access restricted k8s
- 23. @fincooper User WAFSubnet 10.0.2.0/24 AppAKSSubnet 10.0.1.0/24 Application VNET 10.0.0.0/16 Web Application Firewall Frontend IP Configuration Public IP Web Application Firewall Enabled, Prevention mode Access only over SSL IP restriction Web Application Firewall Frontend IP only Admin access Azure SQL Database Access restricted Access only from AppAKSSubnet Access restricted Access only over SSL k8s HTTP Listener HTTPS Port 443 Private SSL certificate Backend Pool Kubernetes Internal Load Balancer IP address HTTP Settings HTTPS redirect SSL: Public Certificate Health Probe Kubernetes Internal Load Balancer IP address
- 24. @fincooper Application Gateway Ingress Controller
- 25. @fincooper Securing web apps on AKS CLUSTER SECURITY NETWORK SECURITY POD SECURITY DEPLOYMENT AND AUTOMATION
- 26. @fincooper Network policies • Control the flow of traffic between pods in the AKS cluster • ingress from / egress to • namespaceSelector / podSelector • Network policies are translated into sets of allowed and disallowed IP pairs • Kubernetes implements these pairs as IPTable rules
- 30. @fincooper Securing web apps on AKS CLUSTER SECURITY NETWORK SECURITY POD SECURITY DEPLOYMENT AND AUTOMATION
- 31. @fincooper Deployment Release Management •Deploy the application using Helm charts Build Management •Build Dockerfile •Push to Azure Container Registry Code •Developer makes changes to code •Developer checks in code to source control Infrastructure deployment •Deploy the cluster using ARM templates
- 32. @fincooper What about Web Application Firewall certificates? Release Management •Deploy the application using Helm charts Build Management •Build Dockerfile •Push to Azure Container Registry Code •Developer makes changes to code •Developer checks in code to source control Infrastructure deployment •Deploy the cluster using ARM templates
- 33. @fincooper Deployment security Make sure container images deployed to Kubernetes are from a trustworthy source • If a Kubernetes Service runs an untrusted container image (or an untrusted nested image), it can violate integrity of the infrastructure. Do not use the default cluster namespace to deploy applications • Resources/Applications in same namespace will have same access control (RBAC) policies. • Users are granted permission on default namespace if no other namespace is provided in rolebindings.
- 34. @fincooper
- 35. @fincooper
- 36. @fincooper Laundry list of AKS security Control access to Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action Cluster operators should authenticate with AAD to appropriate cluster RBAC role Control ingress traffic to the cluster Store secret in Azure Key Vault and access them at runtime Ops is key – spend enough design time on how you deploy new services and maintain the cluster Not the first web app in the cluster? Control cross-pod networking and access with Pod Identity
- 37. @fincooper Take-aways • Compared to PaaS, AKS allows for more security controls to be put in place • This comes with more responsibilities! • Every application is different • You might not need all (or any) of the security controls listed in this session • AKS is continuously evolving • Check the backlog and challenge your (perceived) security requirements • Use AzSK and Azure Policy to automatically scan the security posture of your cluster and Azure environment
- 38. @fincooper Resources • My slides: zure.ly/karl/slides • AKS Roadmap at https://github.com/Azure/AKS/projects/1 • The controls discussed today: • docs.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges • github.com/Azure/kubernetes-keyvault-flexvol • github.com/Azure/aad-pod-identity • azure.github.io/application-gateway-kubernetes-ingress/ • docs.microsoft.com/en-us/azure/aks/concepts-security • docs.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-security • docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security