CI/CD Pipeline

The previous chapter showed us how to threat-model Kubernetes using the STRIDE model. In this chapter, we’ll learn about security-related challenges we’re likely to encounter when implementing Kubernetes in the real world.

The chapter's goal is to show us things from the high-level view of a security architect. It does not provide cookbook-style solutions.

Security in the software delivery pipeline

Containers revolutionized the way we build, ship, and run applications. Unfortunately, this has also made it easier than ever to run dangerous code.

Let’s look at some ways we can secure the supply chain that gets application code from a developer’s laptop onto production servers.

Image repositories

We store images in public and private registries that we divide into repositories.

Public registries are on the internet and are the easiest way to push and pull images. However, we should be very careful when using them:

1. We need to adequately protect the images we store on public registries

2. We should not trust the images we pull from public registries

Some public registries have the concept of official images and community images. As a general rule, official images are safer than community images, but we should always do our due diligence.

Official images are usually provided by product vendors and undergo vigorous vetting processes to ensure quality. We should expect them to implement good practices, be regularly scanned for vulnerabilities, and contain up-to-date patches and fixes. Some of them may even be supported by the product vendor or the company hosting the registry.

Community images do not undergo rigorous vetting, and we should practice extreme caution when using them.

With these points in mind, we should implement a standardized way for developers to obtain and consume images. We should also make the process as frictionless as possible so that developers don’t feel the need to bypass the process.

Let’s discuss a few things that might help.

Use approved base images

Most images start with a base layer and then add other layers to form a useful image.

The following figure shows an oversimplified example of an image with three layers. The base layer has the core OS and filesystem components, the middle layer has the libraries and dependencies, and the top layer has our app. The combination of the three is the image and contains everything needed to run the application.