Kubernetes——也被称为K8s——是一个开源软件, 用于管理容器化工作负载和服务的容器编排平台. Kubernetes is in charge of container deployment 和 also manages the software-defined networking layer that allows 容器 to talk to one another. 该平台是可移植的，便于声明式配置和自动化.
Kubernetes官方网站表示, Kubernetes这个名字来源于希腊语, 意思是舵手或飞行员. 谷歌在2014年开源了Kubernetes项目. Kubernetes combines over 15 years of Google's experience running production workloads at scale with best-of-breed ideas 和 practices from the community.”
Kubernetes plays a critical role in managing the scale 和 complexity of containerized applications by grouping 和 managing the various 容器 that run your applications. 容器不断地被旋转和替换, 因此Kubernetes将立即交换容器以确保没有停机时间.
但是，容器到底是什么? 根据Gartner，容器简化了应用程序打包并支持快速应用程序部署. 这使得跨开发、测试和登台的平台保持一致性. It also helps to accelerate builds 和 software releases, leading to more repeatable processes.
Kubernetes is important because it abstracts container management 和 orchestration 和 automates a task that would otherwise be impossible for humans to manage at scale. 在很多方面, it's a foundational component of achieving what DevOps teams are trying to accomplish when setting up a continuous integration/continuous deployment (CI / CD)管道.
Security risks come into play when that human element is taken away – analysts are now trusting a system to manage the environment, 基于一组声明性策略和命令. 以确保这是安全地完成, guardrails should be implemented 和 operations continuously monitored within Kubernetes-based applications. 这确保了 合规 漂移或异常/可疑行为被捕捉和处理.
因为它的好处, Kubernetes已经迅速成为许多企业DevOps团队事实上的编排工具. 结果是, 像AWS这样的云服务提供商, Azure和GCP已经发布了Kubernetes的托管版本(的, 部, GKE, respectively) which almost entirely remove the need to manage 和 monitor the kubernetes nodes 和 clusters
将安全性集成到DevOps流程中的实践称为 DevSecOps. Building security checks 和 guardrails into the development process can be extremely beneficial, both with respect to enabling development teams to iterate quickly without sacrificing security 和 合规 as well as by allowing teams to catch issues before they ever reach production environments.
Kubernetes的操作可以是复杂的过程来保证安全. 成功地完成, it can securely accelerate your development process in a manner that doesn’t increase your risk posture. Let’s take a look at some more prominent issues that can surface when shifting security left into Kubernetes operations.
This process watches an application at runtime (when it is in production) to block potentially malicious activity. 挑战来自于显示相关的见解，如警报和威胁发现. These findings are often missing much of the context needed to perform quickly 和 conduct proper investigations with confidence. 自动化持续监控的过程可以提高DevSecOps团队的效率, 但这也迫使政府放弃部分控制权, 这可能会导致安全问题.
小的错误配置可能导致大的漏洞. Making changes to Kubernetes resources in one instance can lead to those changes being overwritten later if they are not tracked. That can lead to unforeseen vulnerabilities even if security checks are working as they should. Version controlling enables a quick restoration to a prior configuration state if a vulnerability or security issue is detected.
确保Kubernetes 容器 最大的挑战是什么. 当然, there are many solutions on the market to mitigate any vulnerabilities or attacks that may show up in this process. 一次部署多个容器尤其难以确保安全. 这将是扩展部署的情况，这也会增加复杂性. Leveraging a single-policy framework to enforce across all Kubernetes workloads can ensure risks are flagged 和 cloud deployment is protected from malicious attacks.
利用注册表中的容器映像可以加快这个过程, 但这些图片可能包含恶意代码. 事实上, building tools like vulnerability scanning into the process is a must when working with Kubernetes 容器 that exist on publicly available registries.
Privately storing container images 和 leveraging vulnerability scanning can ensure that a development pipeline is seeing as little exposure as possible to publicly available resources 和 container images. 速度也可能是一个不利因素, especially if a team skips the step of correlating image vulnerability with already-deployed container images. 这种比较对于理解您的网络所面临的风险至关重要.
那么，什么是最关键的部分 确保Kubernetes操作的安全?
What we’ve covered so far should communicate one very important piece of information: Kubernetes is very beneficial, 但应该谨慎而有条不紊地加以利用. 说到这一点, integrating best practices into a Kubernetes workstream is critical when learning the process 和 ramping up.
rbac allows you to configure user access 和 effectively manage data 和 user bases as they grow in size 和 complexity. 分配的产品, 角色, 和资源，以便用户只能访问其角色所需的信息. 这鼓励了 最小特权原则, which helps prevent users from accessing sensitive data or information irrelevant to their 角色.
api控制应用程序之间发出的请求类型, 这些请求是如何提出的, 以及这些请求的格式. 因为单个应用程序通常可以包含许多api的使用, 它们给开发和部署过程增加了漏洞. 因此，最好将api的访问权限限制在绝对需要的人员.
安全Shell (SSH) 有助于使用加密安全性保护开发协议. 它本质上是一个外壳，用强化的安全检查覆盖信息系统. 如果SSH不安全且防御不当, 它可能会使云应用程序和Kubernetes工作负载暴露于漏洞和攻击之下, 特别是对于上市公司和向互联网开放的系统.
这可能是不言而喻的, but the best way to ensure workloads 和 deployments are protected 和 properly containerized is to keep Kubernetes up to date. 事实上, Kubernetes features rolling updates processes so users can update deployments with zero downtime by incrementally updating instances with new versions.
Continuous 和 proactive scanning 和 monitoring can protect against unexpected vulnerabilities 和 malicious threats. 在最近的云工作负载保护平台市场指南中, Gartner表示，工作负载正变得更加细化, 寿命更短. 有时每周甚至每天部署多个迭代.
A proactive approach is the best way to secure these rapidly changing 和 short-lived workloads. Pre-deployment vulnerability management 和 continuous code scanning helps to protect cloud-based workloads from the very beginning through to deployment 和 runtime.