Preface
Kubernetes is not secure by default. Existing approaches to enterprise and cloud security are challenged by the dynamic nature of Kubernetes and the often associated goal of increased organizational agility. Successfully securing, observing and troubleshooting mission critical microservices in this new environment requires a holistic understanding of the breadth of considerations, including organizational challenges, how new cloud native approaches can help meet the challenges, and the new best practices and how to operationalize them.
While there is no shortage of resources that provide education on a particular aspect of Kubernetes, navigating through these ad hoc resources and formulating a comprehensive security and observability strategy can be a daunting task, and in many cases leads to security gaps that significantly undermine the desired security posture.
That’s why we wrote this book—to guide you towards a holistic security and observability strategy across the breadth of these considerations, and to give you best practices and tools to help you accelerate your Kubernetes adoption.
Over the years working at Tigera and building Calico, a networking and security tool for Kubernetes, we have gotten to see the Kubernetes user journey up close. We have seen many users focus on getting their workloads deployed in Kubernetes without thinking through their security or observability strategy, and then struggle as they try to understand how to secure and observe such a complex distributed system. Our goal with this book is to help minimize this pain as much as possible by sharing with you what we’ve learned. We mention a number of tool examples throughout, and Calico is among them. We believe that Calico is an excellent and popular option, but there are many good tools to choose from. Ultimately, only you can decide which is best for your needs.
Let’s start by looking at what a typical adoption journey looks like.
The Stages of Kubernetes Adoption
Any successful Kubernetes adoption journey follows three distinct stages.
-
The Learning Stage. As a new user, you begin by learning how Kubernetes works, setting up a sandbox environment, and starting to think about how you can use Kubernetes in your environment. In this stage you want to leverage the online Kubernetes resources available and use open source technologies.
-
The Pilot / Pre-Production Stage. Once you familiarize yourself with Kubernetes and understand how it works, you start thinking about a high level strategy to adopt Kubernetes. In this stage you typically start a pilot project to set up your cluster and onboard a couple of applications. As you progress in this stage, you will have an idea about which platforms you’re going to use, and whether they will be on-premise or in the cloud. If you choose cloud, you will decide whether to host the cluster yourself or leverage a managed Kubernetes service from a cloud provider. You also need to think about strategies to secure your applications. By this time, you would have realized that Kubernetes is different due to its declarative nature. This means that the platform abstracts a lot of details about the network, infrastructure, host, etc., and therefore makes it very easy for you to use the platform for your applications. Because of this, the current methods you use to secure your applications, infrastructure and networks simply do not work, so you now need to think about security that is native to Kubernetes.
-
The Production Stage. By this point you have completed your pilot project and successfully onboarded a few applications. Your focus is on running mission-critical applications in production, and on considering whether to migrate most of your applications to Kubernetes. In this stage you need to have a detailed plan for security, compliance, troubleshooting and observability in order to safely and efficiently move your applications to production and realize all the benefits of the Kubernetes platform.
Warning
The popularity and success of Kubernetes as a platform for container based applications has many people eager to adopt it. In the past couple of years, there has been an effort by managed Kubernetes service providers to innovate and make adoption easier. New users may be tempted to go past the learning and pilot stages in order to get to the “Production Stage” quickly. We caution against skipping due diligence. You must consider security and observability as critical first steps before you onboard mission-critical applications to Kubernetes; your Kubernetes adoption is incomplete and potentially insecure without them.
Who This Book Is For
This book is for a broad range of Kubernetes practitioners who are in the Pilot/Pre-Production stage of adoption. You may be a platform engineer, or part of the security or DevOps team. Some of you are the first in your organization to adopt Kubernetes and want to do security and observability right from the start. Others are helping to establish best practices within an organization that has already adopted Kubernetes but has not yet solved the security and observability challenges Kubernetes presents. We assume you have basic knowledge of Kubernetes—what it is, and how to use it as an orchestration tool for hosting applications. We also assume you understand how applications are deployed, and about their distributed nature in a Kubernetes cluster.
Within this broad audience, there are many different roles. Here is a non exhaustive list of teams that help design and implement Kubernetes-based architectures, that will find value in this book.
The Platform team
The platform engineering team is responsible for the design and implementation of the Kubernetes platform. Many enterprises choose to implement a “container as a service platform” (CaaS) strategy. This is a platform that is used enterprise wide to implement container based workloads. The platform engineering team is responsible for the platform components and provides this as a service to application teams. This book helps you understand the importance of securing the platform and best practices to help secure the platform layer. This way you can provide application teams a way to onboard applications on a secure Kubernetes platform. It helps you learn how to manage the security risk of new applications to the platform.
The Networking team
The networking team is responsible for integrating Kubernetes clusters in an enterprise network. We see these teams play different roles in an on-premise deployment of Kubernetes and in a cloud environment where Kubernetes clusters are self hosted or leverage a managed Kubernetes service. You will understand the importance of network security and how to build networks with a strong security posture. Best practices for exposing applications outside the Kubernetes platform as well as network access for applications to external networks are examples of topics covered in this book. You will also learn how to collaborate with other teams to implement network security to protect elements external to Kubernetes from workloads inside Kubernetes.
The Security team
The security team in enterprises is the most impacted by the movement toward cloud native applications. Cloud native applications are applications designed for cloud environments and are different from traditional applications. As an example these applications are distributed across the infrastructure in your network. This book will help you understand details about how to secure a Kubernetes platform that is used to host applications. It will provide you a complete view of how to secure mission critical workloads. You will learn how to collaborate with various teams to effectively implement security in the new and different world of Kubernetes.
The Compliance team
The compliance team in an enterprise is responsible for ensuring operations and processes in an organization meet the requirements of compliance standards adopted by an organization. You understand how to implement various compliance requirements and how to monitor ongoing compliance in a Kubernetes based platform. Note that we will not cover detailed compliance requirements and various standards but we will provide you with strategies, examples about tools to help you meet compliance requirements.
The Operations team
The operations team is the team of developers/tools/operations engineers responsible for building and maintaining applications. They are also known as “DevOps” or Site Reliability Engineers (SREs). They ensure that applications are onboarded and meet the required Service Level Agreements (SLAs). In this book you will learn about your role in securing the Kubernetes cluster and collaboration with the security team. We will cover the concept of “Shift Left” Security, which says security needs to happen very early in the application development lifecycle. Observability in a Kubernetes platform means the ability to infer details about the operation of your cluster by viewing data from the platform. This is the modern way of monitoring a distributed application and you will learn how to implement observability and its importance to security.
What You Will Learn
In this book you will learn how to think about security as you implement your Kubernetes strategy. For example, building applications, building infrastructure to host applications, deploying applications and running applications. We will present security best practices for each of these with examples and tools to help you secure your Kubernetes platform. We will cover how to implement auditing, compliance, and other enterprise security controls like encryption.
You will also learn best practices with tools and examples that show you how to implement observability, and that demonstrate its relevance to security and troubleshooting. This enhanced visibility into your Kubernetes platform will drive actionable insights relevant to your unique situation.
By the end you will be able to implement these best practices, and make informed decisions about your infrastructure, networking and network security choices.