Azure Kubernetes Service (AKS) Security

AKS Security Best Practices

Securing your Azure Kubernetes Service (AKS) clusters is paramount to protecting your applications and sensitive data. This document outlines key security considerations and best practices for AKS.

1. Cluster Identity and Access Control

Implement robust identity and access management using Azure Active Directory (Azure AD) integration with AKS. This allows you to leverage existing Azure AD identities and groups for controlling access to your cluster resources.

Role-Based Access Control (RBAC)

• Use Kubernetes RBAC to grant fine-grained permissions to users and service accounts.
• Define roles with the principle of least privilege.
• Integrate Azure AD roles with Kubernetes RBAC for centralized management.

Service Principals and Managed Identities

• Use managed identities for AKS to allow your cluster to authenticate with other Azure services securely, without managing credentials.
• If using service principals, rotate their secrets regularly.

2. Network Security

Secure the network traffic within and to your AKS cluster.

Network Policies

• Deploy Kubernetes Network Policies to control the traffic flow between pods.
• By default, all pods can communicate with each other. Network Policies restrict this, enhancing security.
• Consider using a Network Policy provider like Azure Network Policy or Calico.

Azure Firewall and Application Gateway Integration

• Integrate AKS with Azure Firewall for centralized network security management and advanced threat protection.
• Use Azure Application Gateway with AKS Ingress Controller for WAF (Web Application Firewall) capabilities, SSL termination, and traffic routing.

Private Clusters

• Consider deploying AKS as a private cluster to restrict API server access to a private network.

3. Container Image Security

Ensure the integrity and security of the container images deployed to your AKS cluster.

Image Scanning

• Regularly scan your container images for known vulnerabilities using tools like Azure Container Registry (ACR) Tasks, Trivy, or Clair.
• Integrate scanning into your CI/CD pipeline.

Trusted Image Sources

• Use trusted and verified base images.
• Sign your container images to ensure their authenticity and integrity.

4. Secrets Management

Securely manage sensitive information like passwords, API keys, and certificates.

Azure Key Vault Integration

• Integrate AKS with Azure Key Vault to store and manage secrets.
• Use CSI Secrets Store driver for AKS to mount secrets from Key Vault as volumes.

Kubernetes Secrets (with caution)

• While Kubernetes Secrets can store sensitive data, they are only base64 encoded by default.
• Ensure etcd encryption is enabled if using Kubernetes Secrets directly.

5. Pod Security Standards and Policies

Enforce security best practices at the pod level.

Pod Security Admission (PSA) / Pod Security Policies (PSP - deprecated)

• Utilize Pod Security Admission (PSA) to enforce security standards on pods. PSA is the successor to Pod Security Policies (PSP).
• Configure PSA with profiles like privileged, baseline, or restricted to define acceptable pod behavior.

Security Contexts

• Configure securityContext for pods and containers to define privilege and access control settings (e.g., running as non-root, read-only root filesystem).

6. Monitoring and Auditing

Continuously monitor your cluster for suspicious activity and audit access.

Azure Monitor and Azure Sentinel

• Integrate AKS with Azure Monitor for collecting logs and metrics.
• Forward AKS audit logs to Azure Sentinel for advanced threat detection, analysis, and response.

Audit Logs

• Enable and review Kubernetes audit logs to track API server requests and identify potential security incidents.

7. Node Security

Secure the underlying virtual machines that host your AKS nodes.

Node Image Updates

• Use AKS image upgrades to regularly update your node images with the latest security patches.
• Consider using automated node image upgrades.

Azure Security Center Integration

• Leverage Azure Security Center for continuous security monitoring, threat detection, and recommendations for your AKS nodes and cluster.

8. Admission Controllers

Use admission controllers to intercept requests to the Kubernetes API server and modify or reject them.

• AKS supports several built-in admission controllers.
• Consider third-party admission controllers for more advanced security policies, such as validating resource configurations or enforcing custom security rules.

By implementing these security practices, you can significantly enhance the security posture of your Azure Kubernetes Service clusters and protect your workloads.