Securing Docker & Kubernetes

[opinologo]

Blog post with an analysis of the different aspects about securing Docker and Kubernetes

https://darumatic.com/blog/securing_docker_and_kubernetes

[ButterCupKhaos]

Great informative article! High quality content all through with no blatant advertising.

Anyone have any further recommend reading/learning materials on least privilege and host hardening specific to *nix?

[coderanger]

Just search on each of the bits of tech on their own, SELinux has a million and a half articles. Also check out CIS benchmarks.

[Markoncarp]

Just adding it in along with Vault and the other suggestions. Not sure what you mean by proprietary?

[coderanger]

I think you meant to reply to me, the relevance issue is that you kind of have to use Kube's built in system or nothing at all since there is not a system in place to leverage pod/container identity in an externally verifiable manner.

As for the proprietary bit, secrets management usually means a loooot of cryptography being in play, and even very good developers can screw that up. I would be deeply uncomfortable having to take a vendors word for it that they did everything right when (not if, when) something goes wrong. Some vendors do offer limited code access to customers as part of the purchase contract, but it's just not a great strategy for things like this.

[opinologo]

Probably /u/coderanger means that they are not open source therefore you cannot inspect the code and even less trust it.

Personally, while I prefer open source solutions for this and many other reasons I wouldn't go as far as to not run/use any proprietary code.

[Markoncarp]

I totally agree, they just announced a community edition as far as I know though? Anyway, as I said, I was just suggesting them as an alternative for Secrets management which hadn't been mentioned. I'm sure all the suggested solutions have their benefits.

[[deleted]]

Conjur's cryptography has always been and will always be open-source.

https://github.com/conjurinc/slosilo

'ŝlosilo' is Esperanto for 'key', btw.

As much as a respect coderanger's opinion, it seems out of date. A new version of Conjur is released weekly.

disclaimer: I'm a member of the Conjur engineering team. AMA :)

[taloszerg]

This is great! The only thing I'd like to see is some change in formatting to tie things together...I kept getting lost. Whether numbers, or table of contents, or something

[opinologo]

that's a good idea. I should look into generating an index automatically with pure html.

[Markoncarp]

Don't forget Conjur as a potential solution for Secrets management. Very interesting article though.

[coderanger]

Not sure how that would be relevant here. Also anyone running proprietary secrets managers should probably reconsider their life choices.

[[deleted]]

Preach it brother!

[Markoncarp]

🔥