DevOps Hunter Security Automation

In this post we are going to learn more  about what is service accounts in Kubernetes and how that is useful. Prerequisites Kubernetes cluster Up and running Let's take the scenario where we get need to connect with the pods, nodes, deployments and other resources in the Kubernetes cluster. you might be working with the automated build with the CICD pipelines to interconnect with each other resources. Pod  is going to work with the planned application deployments. If  you're working in DevSecOps you need to focus on the regular monthly maintenance OS  patching scheduled in this case Kubernetes node maintenance should be done from a pod.  In the above two scenarios there is a need of service account inside the pod. When Kubernetes cluster is created at the same time service account also created and its name is default . We can also create our own service accounts using the following command Every service account is associated with the secret wh...

Hello DevOps, DevSecOps Engineers, SREs, and Kubernetes Administrators! As Kubernetes environments grow, managing access becomes an important part of cluster administration. Not every engineer needs full cluster-admin access. In many situations, we need to provide users with access to specific cluster-wide resources such as Nodes, PersistentVolumes, StorageClasses, or other non-namespaced resources . This is where Kubernetes RBAC (Role-Based Access Control) becomes extremely useful. In this article, we will explore ClusterRoles and ClusterRoleBindings with practical examples. We will create permissions for users, bind those permissions to users, validate access, and clean up the configuration. The examples are based on the practical Kubernetes administration scenarios I have worked with and used while practicing Kubernetes RBAC concepts. What We Will Learn In this article, we will cover: What is a ClusterRole? What is a ClusterRoleBinding? ClusterRole vs Role ClusterRoleBinding vs R...

My Understanding about RBAC in Kubernetes RBAC stands for Role based access control in our Kubernetes system we have users that needs to access the kubernetes cluster and it's resources. Here role is that categorize their needs. Let's say our project have developers, admins, presale users. We could define role named as "readers" that allows all users, because its common need to all user to read from the system. We could define a role called "writers" and allow certainer users like "developers" who contribute many things to develop in application end, "Admin" user can have this to control it. We could also define a role called "administrators" to admins users. Administrator role users can have full rights such as delete from the system. Role can be used to define "what can be done?" Role will be given to users, application software. If we need to deal with software then we need to use service account. Service accou...

Kubernetes  Groups API What is the Kubernetes API?  Kubernetes API means it works with webservice that uses HTTP and REST protocols to enable the access for the API calls.  Let's see this how it works using 'curl' command, where we need to provide the URL then API call object path. Examples To view the Kubernetes version we can use : curl https://controlplane:6443/version -k To get the list of pods in default cluster curl https://controlplane:6443/api/v1/pods -k in this post we will get to know more about the API specifically Kubernetes API Groups. Each group is defined with a specific purpose, such as on API for health check, other for metrics collection logs etc. These metrics, health check will be used for health of the Kubernetes cluster. And the logs will be used for collecting by third party system where all logs will be collected such as ELK stack uses logstash agent.   The API are categorized into two :  1. Core group /api  2. Named g...

Hello everyone! Welcome back to the Kubernetes Security Series . In this article, we'll explore the Kubernetes CertificateSigningRequest (CSR) API , an important security feature that helps Kubernetes administrators securely manage user authentication using certificates. If you're preparing for the CKA (Certified Kubernetes Administrator) exam, working in a DevOps/DevSecOps role, or managing Kubernetes clusters in production, understanding the CSR workflow is essential. What You'll Learn By the end of this blog tutorial, you will be able to: Understand the role of Certificate Authorities (CA) in Kubernetes Generate private and public key pairs Create a Certificate Signing Request (CSR) Submit a CSR to Kubernetes Review, approve, or deny certificate requests Retrieve and decode signed certificates Understand how Kubernetes Controller Manager handles certificate operation User Certificate Approval process What is the Kubernetes Certificate API? Kubernetes uses certificates t...

Hello Guys! in this post we are going to explore about the Kubeconfig. This is a special configuration that will be part of Kubernetes Security. We can configure multiple clusters and different users can access these Kubernetes cluster. We can also configure the users can have access to multiple clusters. When we started working on Kubernetes Cluster there is a config file automatically generated for us.  To access a Kube Cluster using the certificate files generated for admin user can be given as follows: kubectl get pods \ --server controlplane:6443 --clisent-key: admin.key --client-certificate admin.crt --certificate-authority ca.crt Every time passing all these TLS details(server,client-key,client-certificate, certificate-authority) including in the kubectl command is tedious process. Instead of this we can move TLS Certificate file set into a config file that is called kubeconfig file. The usage will be as follows kubectl get pods --kubeconfig config Usually this...

Transport Layer Security  (TLS) Basics   Early days it was called Secure Socket Layer (SSL) now it is renamed as TLS. In this post we will explore more TLS  certificate files. and their usage in different Kubernetes Cluster components.  TLS Certificates for Kubernetes Cluster components is basic thing to do a High Availability(HA) in Production configurations and troubleshoot various security for users, applications, and administration level issues. Public Key Infrastructure used in the Kubernetes Cluster Security Certificate files The certificate files are nothing but key pair that have private key, public key. And Public Key which we can consider as a Lock visible to public. The example certificate file can be having extension as .crt or .pem the files like server.crt, server.pem client.crt or client.pem. Whereas Private key it will be owned by the person who generated it. This file cannot be distributed, instead it will be used when Lock is visible to it uses...

Hello DevOps Engineers, DevSecOps Engineers, SREs, and Kubernetes Administrators! As organizations continue adopting microservices and cloud-native architectures, Kubernetes has become the preferred platform for container orchestration. However, deploying applications is only part of the journey. One of the most critical responsibilities is protecting sensitive information such as passwords, API keys, tokens, certificates, and database credentials. Hardcoding secrets inside application code, container images, or deployment manifests is a serious security risk. Kubernetes addresses this challenge through Secret Objects , which are specifically designed to store and manage sensitive information securely. In this article, we will explore Kubernetes Secrets, understand how they work, create them using different methods, and learn how to consume them inside Pods using environment variables and mounted volumes. What are Kubernetes Secrets? A Kubernetes Secret is an object that stores sensiti...

Here in this post we will be exploring in deep dive on the Node Affinity. Node Affinity is more capable alternative to node lables and selector on the Kubernetes cluster. There are three types of affinities in Kubernetes Node affinity Pod affinity Pod anti-affinity Node Affinit y meaning that the pod should only be scheduled on target nodes with specific lables, this is basically what the node selector does for example only schedule the db-pod on the size=large Then, We have Pod affinity for dictates that the pod should only be scheduled on nodes where other specific pods are already running. For example cache pod  scheduled only on nodes where the webserver pods already running. In generic way we could say "Schedule Pod X  ' only on where ' Pod Y". Its like Indian girl marrying boy she stay with him! This way we can reduce the network latency between the two pods which need to communication(think about web pod connects with db pods). Finally, the Pod anti-affinity ...

Hello guys! I am back with new learning on the Kubernetes Storage Volume section series of posts, We have already seen that how we can create a PV, And then claiming that with different PVC, then you can use the PVC in the Pod manifestation under volumes section, But, in this post we will be exploring the various options available for Dynamic Provisioning with StorageClass. StorageClass - PersistentVolumeClaim used in Pod Wanted to know Kubernetes StorageClasses in depth. Visited many blog posts with different cloud choices people are working. Initially I've gone through the Mumshadmohammad session and practice lab, triedout on GCP platform. Previous Storage related posts Kubernetes Storage - EmptyDir Kubernetes HostPath Kubernetes NFS Volume as PV Basically, Kubernetes maintains two types of StorageClasses: Default storage class (Standard Storage class) User-defined storage class (Additional which is created with kubectl ) The additional storage-class will depend on t...