Kubernetes Security

Chapter 5. Securing Your Container Images

Until now, we’ve been discussing things mainly from the point of view of a Kubernetes cluster administrator. Going forward, we’ll switch gears and focus more on developers, operators, or even DevOps teams who want to deploy code to run on the cluster.

The software that you run in your Kubernetes cluster gets there in the form of container images. In this chapter, we’ll discuss how to check that your images:

• Don’t include known critical vulnerabilities

• Are the images you intended to use, and haven’t been manipulated or replaced by a third party

• Meet other image policy requirements your organization might have in place

Vulnerabilities

In this context, a vulnerability is a flaw in a piece of code that an attacker can exploit to cause undesirable consequences, and that has been publicly disclosed (typically, through the National Vulnerability Database). For example, the renowned Heartbleed vulnerability was a flaw in the OpenSSL library that allowed attackers to access system memory, and hence steal encrypted information.

Scanning Container Images

To detect vulnerabilities, you need to use a container image scanner. The basic function of a container image scanner is to inspect the packages included in an image, and report on any known vulnerabilities included in those packages. At a minimum, this looks at the packages installed through a package manager (like yum or apt, depending on the OS distribution). Some scanners may also ...