Harden access to the cluster

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

RBAC, serviceaccounts, API-toegang en upgrades

Apply least-privilege RBAC

Give the smallest verbs on the smallest resources in the smallest scope. Look for dangerous rights.

$kubectl get clusterrolebindings -o wide | grep -E 'cluster-admin'
$kubectl auth can-i --list --as system:serviceaccount:shop:default -n shop
$kubectl get roles,clusterroles -A -o yaml | grep -n '"\*"' | head

Dangerous right	Why
`` on ``	Everything
`create pods` / `pods/exec`	Run any image or shell in any pod of the namespace
`get secrets` (`list`, `watch`)	Read every secret, including tokens
`escalate`, `bind`, `impersonate`	Give yourself more rights
`create` on `nodes/proxy`	Talk to kubelets directly

2.2

Limit service account tokens

Most pods never call the API. Do not give them a token; give the ones that do their own service account.

$kubectl patch serviceaccount default -n shop -p '{"automountServiceAccountToken": false}'
$kubectl create serviceaccount reporter -n shop
$kubectl create token reporter -n shop --duration=10m

pod (no token)

spec:
  serviceAccountName: reporter
  automountServiceAccountToken: false

Onthoud

Since 1.24, tokens are short-lived and projected; no long-lived Secret tokens are made automatically. Do not create them by hand unless needed.

2.3

Restrict access to the API server

Reduce who can reach and use the API.

Do not expose port 6443 to the internet; allow only admin networks (firewall, cloud NSG).
Turn off anonymous access where possible: --anonymous-auth=false (check health probes still work).
Use --authorization-mode=Node,RBAC; never AlwaysAllow.
Admission plugins on: NodeRestriction (kubelets can only change their own node and pods).
Prefer short-lived credentials (OIDC) over static client certificates for people.

#grep -E 'anonymous-auth|authorization-mode|enable-admission-plugins' /etc/kubernetes/manifests/kube-apiserver.yaml
$curl -k https://CONTROL_PLANE:6443/api/v1/namespaces

2.4

Upgrade Kubernetes regularly

Each minor version gets patches for about a year. Old clusters collect known vulnerabilities.

$kubectl version
#kubeadm upgrade plan

Upgrade steps: CKA cluster maintenance.

2.5

Review who did what

Find old bindings, unused service accounts and users with too many rights — regularly.

$kubectl get rolebindings,clusterrolebindings -A -o custom-columns='KIND:kind,NS:metadata.namespace,NAME:metadata.name,ROLE:roleRef.name,SUBJECTS:subjects[*].name'
$kubectl get serviceaccounts -A

Op het werk

Tools like rbac-tool or kubectl-who-can answer "who can read secrets in namespace X?" quickly.

Alle commando's in dit hoofdstuk