WE'RE HIRING!
n4-logo
CONTACT

Security in Kubernetes

How we fix the flaw in kubectl!

Kubernetes has established itself as the leading container orchestrator. It acts like a conductor in an orchestra, ensuring that your applications run in the desired configuration and scale. With Kubernetes, you can abstract the infrastructure and create highly automated processes that improve both the quality and efficiency of your IT environment.

Bild mit folgendem Text: Was bedeutet Lesbarkeit?Lesbarkeit bedeutet in diesem Zusammenhang, dass der strukturierte Datensatz maschinell auswertebar sein muss. Daher ist die zusätzliche Erstellung eines menschenlesbaren Dokuments nicht erforderlich. Die maschinelle Auswertbarkeit ermöglicht es auch, dass die Datei z. B. durch eine Visualisierungsanwendung menschenlesbar angezeigt werden kann. Die zusätzliche Übermittlung eines menschenlesbaren Dokuments ist somit nicht erforderlich, aber optional möglich.

In a time when automation and rapid responsiveness are crucial competitive advantages, Kubernetes offers companies the ability to adapt flexibly and cost-effectively to market changes. However, this flexibility also comes with risks, especially if security aspects are not sufficiently considered.

The flaw in kubectl

Bild mit folgendem Text: Was bedeutet Lesbarkeit?Lesbarkeit bedeutet in diesem Zusammenhang, dass der strukturierte Datensatz maschinell auswertebar sein muss. Daher ist die zusätzliche Erstellung eines menschenlesbaren Dokuments nicht erforderlich. Die maschinelle Auswertbarkeit ermöglicht es auch, dass die Datei z. B. durch eine Visualisierungsanwendung menschenlesbar angezeigt werden kann. Die zusätzliche Übermittlung eines menschenlesbaren Dokuments ist somit nicht erforderlich, aber optional möglich.

One of the critical vulnerabilities that can occur when using kubectl is the unencrypted handling of Kubeconfig files.These files contain important information, including the token used to authenticate with the Kubernetes API. The issue is that these tokens are stored in plain text. If a Kubeconfig file falls into the wrong hands, an attacker could gain unauthorized access to your Kubernetes cluster, potentially with disastrous consequences for your company.

Our solution: How we circumvent the flaw with a plug-in

To minimize this security risk, we developed the “kubectl encrypted kubeconfig” plug-in. This tool allows you to store the tokens in your Kubeconfig files in encrypted form, making them more secure. The encryption uses the age method, a modern and secure encryption technique.

Our plug-in offers the ability to convert unencrypted Kubeconfig files into encrypted files. The keys required to decrypt the Kubeconfig files are securely stored in the system keyring of the respective operating system, applicable to Linux, Mac, and Windows. This provides an additional layer of security, ensuring effective protection even in worst-case scenarios like the loss of a Kubeconfig file.

Three highlights of our solution

With our tool, we elevate security to a new level: Tokens used for authentication in Kubeconfigs are now stored in an encrypted format and securely protected. This means that sensitive information is no longer in plain text, offering much better protection against misuse.

  • Lightweight and simple usability: Security software is often perceived as cumbersome. However, our plug-in is extremely user-friendly and requires minimal changes to users' workflows. As our COO Joachim says, "Users don't really need to change their way of working, but we have significantly improved security."
  • No loss of convenience: Despite the added security, the plug-in does not impact the ease of handling Kubeconfig files. The usual workflow can be maintained.
  • Compatibility with other tools: The plug-in is designed to work seamlessly with other tools that build on kubectl and use the v1 specification of the client-go Credentials Plugin.

Since we are constantly evolving and aiming to improve, we welcome your feedback on our development directly on GitHub.

Joachim Müller (Chief Cloud Officer): " Security is not achieved behind closed doors but through transparency and active feedback from users. By openly presenting our security solutions and continuously gathering feedback, we can identify vulnerabilities and address them effectively."

Challenges during development

During the development process, we faced the challenge of creating a solution that works across different operating systems while still being easy to use. Our goal was to keep the maintenance and support effort as low as possible without compromising on security. It was important to us to develop software that is compatible with all common operating systems. For this purpose, the tool is compiled specifically for each operating system, ensuring unified and secure usage.

Maximum security with our plug-in for encrypted Kubeconfig files

Security in Kubernetes environments is not just a technical necessity but a business imperative. Our “kubectl encrypted kubeconfig” plug-in provides a simple yet effective solution to secure your Kubeconfig files. It protects your sensitive data from unauthorized access without sacrificing ease of use. For any company utilizing Kubernetes, fixing this vulnerability is essential to ensuring the integrity and security of the IT infrastructure. With our solution, you are well-equipped to meet this challenge.

joachim-rund

JOACHIM Müller
chief cloud officer

LinkedIn
lena-schoenleben

LENA SCHÖNLEBEN
junior marketing manager

LinkedIn

Other articles that might be interesting for you

n4-logo
WE'RE HIRING!
n4-logo
WE'RE HIRING!