Book Image

Learn Kubernetes Security

By : Kaizhe Huang, Pranjal Jumde
5 (1)
Book Image

Learn Kubernetes Security

5 (1)
By: Kaizhe Huang, Pranjal Jumde

Overview of this book

Kubernetes is an open source orchestration platform for managing containerized applications. Despite widespread adoption of the technology, DevOps engineers might be unaware of the pitfalls of containerized environments. With this comprehensive book, you'll learn how to use the different security integrations available on the Kubernetes platform to safeguard your deployments in a variety of scenarios. Learn Kubernetes Security starts by taking you through the Kubernetes architecture and the networking model. You'll then learn about the Kubernetes threat model and get to grips with securing clusters. Throughout the book, you'll cover various security aspects such as authentication, authorization, image scanning, and resource monitoring. As you advance, you'll learn about securing cluster components (the kube-apiserver, CoreDNS, and kubelet) and pods (hardening image, security context, and PodSecurityPolicy). With the help of hands-on examples, you'll also learn how to use open source tools such as Anchore, Prometheus, OPA, and Falco to protect your deployments. By the end of this Kubernetes book, you'll have gained a solid understanding of container security and be able to protect your clusters from cyberattacks and mitigate cybersecurity threats.
Table of Contents (19 chapters)
Section 1: Introduction to Kubernetes
Section 2: Securing Kubernetes Deployments and Clusters
Section 3: Learning from Mistakes and Pitfalls

Scanning images with Anchore Engine

Anchore Engine is an open source image scanning tool. It not only analyzes Docker images but also allows users to define an acceptance image scanning policy. In this section, we will first give a high-level introduction to Anchore Engine, then we will show how to deploy Anchore Engine and the basic image scanning use case of Anchore Engine by using Anchore's own CLI tool, anchore-cli.

Introduction to Anchore Engine

When an image is submitted to Anchore Engine for analysis, Anchore Engine will first retrieve the image metadata from image registry, then download the image and queue the image for analysis. The following are the items that Anchore Engine will analyze:

  • Image metadata
  • Image layers
  • Operating system packages such as deb, rpm, apkg, and so on
  • File data
  • Application dependency packages:

    - Ruby gems

    - Node.js NPMs

    - Java archives

    - Python packages

  • File content

To deploy Anchore Engine in a Kubernetes...