NSA Kubernetes Hardening Guidance [pdf] (media.defense.gov)

Article summary

The NSA has released guidance on hardening Kubernetes. The discussion revolves around the trade-offs between spending time hardening one cluster versus building multiple clusters to reduce the blast radius of bugs and misconfigurations. Hardening a single cluster can provide similar benefits to multiple clusters, but multiple clusters can provide better segregation and protection from Kubernetes bugs. However, managing multiple clusters can be more difficult and increase the attack surface.

Main themes

• Kubernetes hardening
• cluster management
• security trade-offs
• scalability
• bureaucracy and governance
• automated tooling

What commenters say

• Spending a ton of time hardening one cluster may be more beneficial than building multiple clusters to reduce the blast radius of bugs and misconfigurations.
• Multiple clusters can provide better segregation and protection from Kubernetes bugs, but increase administrative overhead and costs.
• Having separate clusters is likely to provide better segregation, but the benefits of Kubernetes are reduced, and the attack surface is increased.
• Automated tooling can harden clusters across multiple clusters, reducing the effort required to harden each cluster individually.
• A single cluster can be configured to provide similar benefits to multiple clusters using node pools, affinity, and taints.
• Multiple clusters may have a smaller blast radius, but the increased complexity and attack surface may outweigh the benefits.
• Tooling such as OPA and Kyverno can provide similar security benefits to PodSecurityPolicy, which is deprecated and scheduled to be removed.
• Decentralized government and bureaucracy models may be more effective in promoting security and scalability than traditional models.