Different ways to provide API-Security on kubernetes

Question

Could you list the different ways in which I can provide API-security on kubernetes?

Answer 1

• Use the correct auth mode with API server authorization-mode=Node,RBAC

• Ensure all traffic is protected by TLS

• Use API authentication (smaller cluster may use certificates but larger multi-tenants may want an AD or some OIDC authentication).

• Make kubeless protect its API via authorization-mode=Webhook

• Make sure the kube-dashboard uses a restrictive RBAC role policy

• Monitor RBAC failures

• Remove default ServiceAccount permissions

• Filter egress to Cloud API metadata APIs

• Filter out all traffic coming into kube-system namespace except DNS

• A default deny policy on all inbound on all namespaces is good practice. You explicitly allow per deployment.

• Use a podsecurity policy to have container restrictions and protect the Node

• Keep kube at the latest version.