WEBVTT 00:01.090 --> 00:02.900 Hello and welcome to this lecture. 00:03.160 --> 00:09.810 In this lecture we look at the security primitives in Kubernetes. Kubernetes being the goto 00:09.810 --> 00:12.960 platform for hosting production grid applications. 00:12.960 --> 00:16.860 security is of prime concern. In this lecture 00:16.860 --> 00:23.400 we look at the various security primitives in Kubernetes at a high level before diving deeper into those 00:23.490 --> 00:25.420 in the upcoming lectures. 00:25.500 --> 00:28.970 Let's begin with the host that formed the cluster itself. 00:29.130 --> 00:35.550 Of course all access to these hosts must be secured, root access disabled, password based authentication 00:35.550 --> 00:40.200 disabled, and only SSH key based authentication to be made available. 00:40.380 --> 00:46.260 And of course any other measures you need to take to secure your physical or virtual infrastructure 00:46.290 --> 00:52.250 that hosts kubernetes. Of course if that is compromised, everything is compromised. 00:53.560 --> 00:58.570 Our focus in this lecture is more on Kubernetes related security. 00:58.570 --> 01:04.690 What are the risks and what measures do you need to take to secure the cluster. As we have seen already, 01:04.690 --> 01:10.230 the kube-api server is at the center of all operations within kubernetes. We interact with it through 01:10.230 --> 01:16.090 the kubectl utility or by accessing the API directly and through that you can perform almost any 01:16.090 --> 01:17.890 operation on the cluster. 01:17.890 --> 01:23.520 So that’s the first line of defense. Controlling access to the API server itself. 01:24.770 --> 01:31.040 We need to make two types of decisions who can access the cluster and what can they do. 01:32.160 --> 01:37.440 Who can access the API server is defined by the Authentication mechanisms. 01:37.500 --> 01:43.240 There are different ways that you can authenticate to the API server. Starting with user IDs and passwords 01:43.240 --> 01:50.160 stored in a static file, to tokens, certificates or even integration with external authentication providers 01:50.160 --> 01:51.090 like LDAP. 01:51.630 --> 01:55.950 Finally for machines we create service accounts. 01:55.950 --> 02:02.840 We will look at these in more detail in the upcoming lectures. Once they gain access to the cluster, 02:02.890 --> 02:06.880 What can they do is defined by authorization mechanisms. 02:06.880 --> 02:12.700 Authorization is implemented using Role Based Access Control, where users are associated to groups with 02:12.700 --> 02:14.110 specific permissions. 02:14.110 --> 02:20.020 In addition there are other authorization modules like Attribute based access control, Node Authorizers, 02:20.020 --> 02:21.200 webhooks etc. 02:21.280 --> 02:24.630 Again we look at these in more detail in the upcoming lectures. 02:25.000 --> 02:30.750 All communication with the cluster, between the various components such as the ETCD cluster, kube controller 02:30.760 --> 02:37.420 manager, scheduler, api server, as well as those running on the worker nodes such as the kubelet and 02:37.420 --> 02:41.950 and kubeproxy is secured using TLS Encryption. 02:41.990 --> 02:47.300 We have a section entirely for this where we discuss and practice how to setup the certificates between 02:47.300 --> 02:49.600 the various components. 02:49.690 --> 02:52.990 What about communication between applications within the cluster. 02:53.260 --> 02:58.530 By default all PODs can access all other PODs within the cluster. 02:58.620 --> 03:02.950 You can restrict access between them using Network Policies. 03:02.950 --> 03:05.080 We will look at how exactly that is done. 03:05.230 --> 03:07.870 Later in the network policy section. 03:07.870 --> 03:12.740 So that was a high level overview of the various security primitives in kubernetes. 03:12.880 --> 03:17.080 We will now look at these in much more detail going forward.