To protect the critical Kubernetes configuration files and reduce the risk of unauthorized access or modification, enforce the following security measures:
Restrict Directory Access:
Limit read and write permissions for directories containing critical configuration files to only cluster administrators. Use the following commands to restrict access:
chmod -R 700 /etc/kubernetes/
chmod -R 700 /var/lib/kubelet/
chmod -R 700 /etc/sysconfig/kubelet
chmod 700 $HOME/.kube/config.yaml
These restrictions ensure that only authorized personnel can view or modify critical files, reducing the risk of unauthorized tampering.
Limit Access to systemctl:
The systemctl command can expose sensitive paths to configuration files using systemctl cat kubelet. Restrict access to this command by limiting its use to cluster administrators:
chmod 700 /bin/systemctl
Use Role-Based Access Control (RBAC):
Implement RBAC to manage access to configuration resources based on user roles. For example, non-admin users should only have minimal access to view basic information without modifying sensitive configurations. Use the following role and role binding examples to limit access:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: kube-system
name: configmap-reader
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch"]
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
namespace: kube-system
name: configmap-reader-binding
subjects:
- kind: User
name: <admin-username>
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: configmap-reader
apiGroup: rbac.authorization.k8s.io
Additionally, define view-only roles for non-admin users:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: view-only
rules:
- apiGroups: [""]
resources: ["pods", "services"]
verbs: ["get", "list", "watch"]
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: view-only-binding
subjects:
- kind: User
name: <non-admin-username>
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: view-only
apiGroup: rbac.authorization.k8s.io
Regular Audits and Monitoring:
Conduct regular audits and monitor access to directories containing Kubernetes configuration files. Set up alerts for any unauthorized access attempts or changes to these files, ensuring that any suspicious activity is detected and addressed promptly.
By implementing these security measures and restricting access to critical directories and configuration files, you can significantly reduce the risk of unauthorized access and protect the stability and security of the Kubernetes cluster.
