Cailyn Edwards, Senior Security Engineer at Shopify, discusses the complexities of Kubernetes Network Security in a multi-tenant environment, including tools and tactics for securing Kubernetes environments. She also shares insights from her journey at Shopify and tips for advancing the security maturity of Kubernetes networks.
Understanding the communication needs within a Kubernetes network and locking down access to necessary connections is crucial for threat modeling in multi-tenant environments.
Implementing network policies, using CNCF projects like Istio and Cilium, and following the Kubernetes Security Checklist are key tools and best practices for securing Kubernetes networks.
Deep dives
Importance of Network Security in Kubernetes
Kaelin from Shopify discusses the importance of threat modeling in Kubernetes network security, particularly in a multi-tenant context. She emphasizes the need to understand the communication needs within the network and the importance of locking down access to only necessary connections. She highlights the use of network policies and CNCF projects like Istio and Cilium as tools to secure Kubernetes networks. Kaelin also highlights the Kubernetes Security Checklist as a resource for implementing best practices and mentions the ongoing work of CNCF's SIG Security in creating a Kubernetes hardening guide.
Key Concepts in Kubernetes Networking
Kaelin explains that Kubernetes networking is not fundamentally different from traditional networking but requires a focus on internal connections between resources. She emphasizes the need to define bespoke security infrastructure and outlines the Kubernetes network design, which starts off open to allow necessary communication and requires users to specify how they want to lock it down. Kaelin also highlights the importance of understanding basic Kubernetes resources, such as pods, nodes, and clusters, and their connections to effectively secure the network.
The Challenges of Multi-Tenancy in Kubernetes
In discussing multi-tenancy in Kubernetes, Kaelin describes it as multiple services sharing a network. She uses the analogy of roommates in an apartment building to explain the need to protect resources from other entities. Kaelin emphasizes the use of network policies to limit cross-namespace communication and the importance of least privilege access control. She also mentions the need for isolating workloads and restoring functionality quickly in case of compromises, highlighting the benefits of Kubernetes and Cloud Native technologies for rebuilding and specifying infrastructure.
Tools and Best Practices for Kubernetes Network Security
Kaelin mentions various tools and best practices for securing Kubernetes networks. She highlights network policies and CNI plugins like Silium and Calico as options for enforcing security controls. Kaelin also mentions the importance of observability and recommends using tools like Kaverno for network analysis. She mentions the Kubernetes Security Checklist as a starting point for implementing security best practices and references the ongoing work of CNCF in providing a mature and secure Kubernetes network environment.
Kubernetes security explained : We spoke to Cailyn Edwards, CNCF Ambassador and Senior Security Engineer at Shopify. Interview was recorded at Kubecon NA 2023. We asked her about the complexities of Kubernetes Network Security in a multi-tenant environment. During the interview, she shared the nuances of Kubernetes network security in multi-tenant setups, tools and tactics for securing Kubernetes environments, insights from her journey at Shopify and tips for advancing the security maturity of Kubernetes networks.
Thank you to our episode sponsor Vanta - You can check them out at vanta.com/cloud
(00:00) Introduction
(02:25) A bit about Cailyn
(03:08) How is Kubernetes Networking different?
(04:20) Foundational pieces of Kubernetes Networking
(06:21) Whats missing in Kubernetes Networking?
(07:47) What is Multi Tenancy?
(10:20) What are some of the common threat models?
(13:16) How are people responding to threats?
(14:41) Where to start learning about this?
(16:26) Best practices for Kubernetes Networking
(18:16) What becomes more important with maturity?
(21:14) Resources to learn more about Kubernetes Security
(22:30) The Fun Section