Zero Trust Architecture in Kubernetes

Chapter 4. Minimal Access in Size

Now let’s discuss how to reduce your cyberattack surfaces as much as possible. A useful paradigm is the principle of least privilege. Every single user, application, and machine within a computer network must only have access to what’s absolutely necessary for operation and nothing more. For example, in a role-based access control (RBAC) system, only the financial user groups can access the financial data servers, only administrators can modify configuration files, and so on.

RBAC isn’t merely an effective security control in computer networks in general. It’s strongly recommended in Kubernetes networks specifically. Sometimes accounts for human users will be assigned roles. But in Kubernetes, you’ll also be focused on the roles assigned to Pods, applications, machines, and other nonhuman entities. I’ll get into RBAC implementation in Kubernetes in greater detail soon. For now, let’s get back to the basics.

Granting any entity more access than is absolutely necessary increases the possible cyberattack surface if a malicious agent acquires unauthorized control of said entity. In addition to malicious activity, security incidents can be caused by human error and application bugs. Therefore, we design our systems so that if something goes wrong, as little damage as possible will result. And every experienced network administrator and application developer knows that lots of things will inevitably go wrong.

Reducing Access in Size

In implementing ...