Zero Trust Architecture in Kubernetes

Chapter 5. Minimal Access in Time

In the previous chapter we talked about why an important step in establishing effective zero trust architecture (ZTA) in which to run Kubernetes is to minimize the size of the resources your namespaces, clusters, and users can access. Doing so lowers the cyberattack surface if a threat actor acquires unauthorized access to a Kubernetes entity, and it also reduces any potential damage from user error or software bugs. But there’s another way to apply the principle of least privilege to minimize access for effective security.

Do you remember when you started learning about physics in school? Or perhaps you’re a real physics nerd and know way more about that branch of science than I do. Either way, we both know that matter is one of the fundamental physical properties. Matter and size are related concepts. So the next step is to think of another fundamental physical property: time! Both time and size are ways to define access. It’s time (ahem) to talk about limiting resource access time.

CronJobs

The main way to implement time management in Kubernetes is with the CronJob object. CronJobs automate a schedule for performing regular tasks, such as creating data backups or generating reports. Backups are particularly important when it comes to the “A” component of the CIA triad of cybersecurity: availability. There are various threats to the availability of your network’s data assets—incidents like ransomware attacks, denial-of-service (DoS) attacks, ...