Kubernetes Security Architecture

Kubernetes Security Architecture An architecture diagram generated by Archify. Host Security · OS hardening · Infrastructure Security Host Security OS hardening Container Runtime Security · Infrastructure Security Container Runtime Security Network Security · Firewall · Infrastructure Security Network Security Firewall API Server Security · kube-apiserver · Cluster Security API Server Security kube-apiserver Data Encryption · etcd · secret management · Cluster Security Data Encryption etcd · secret management Authentication · identity verification · Cluster Security Authentication identity verification Authorization · RBAC · ABAC · Node · Webhook · Cluster Security Authorization RBAC · ABAC · Node · Webhook Admission Control · Cluster Security Admission Control Audit Logging · event record · Cluster Security Audit Logging event record Network Policy · NetworkPolicy · Workload Security Network Policy NetworkPolicy Image Security · image scanning · signing · Workload Security Image Security image scanning · signing RBAC · Role · RoleBinding · Workload Security RBAC Role · RoleBinding Pod Security Standards · securityContext · Workload Security Pod Security Standards securityContext Infrastructure Security Cluster Security Workload Security Legend API server Data-at-rest protection Infrastructure layer Security control

Infrastructure Security

  • • Covers host OS, container runtime, and network
  • • Owned by the cluster administrator
  • • Defended with firewalls, OS hardening, and container runtime security

Cluster Security

  • • Covers API server, etcd, and kubelet
  • • Defended with authentication, authorization, admission control, and encryption
  • • API request events recorded according to the audit policy

Workload Security

  • • Covers Pods, containers, and Services
  • • Owned by the application developer
  • • Defended with security contexts, network policy, and RBAC