Skip to main content

Lab 9.4 - Security Audit

Lab Objectives​

By the end of this lab, you will be able to:

  • Understand security auditing in Kubernetes.
  • Verify user and Service Account permissions.
  • Examine security resources.
  • Identify potential security issues.

Estimated Duration​

45-60 minutes

Prerequisites​

  • kubectl installed and configured.
  • Functional local Kubernetes cluster.
  • Knowledge of Kubernetes security (Previous chapters).

Part 1: Verifying Permissions​

Step 1.1: Verify Permissions with kubectl auth can-i​

Check your own permissions:

# Check all your permissions
kubectl auth can-i --list

# Check specific permissions
kubectl auth can-i create pods
kubectl auth can-i delete deployments
kubectl auth can-i get secrets

Step 1.2: Verify a Service Account's Permissions​

Create a Service Account and check its permissions:

kubectl create serviceaccount test-sa
kubectl auth can-i --list --as=system:serviceaccount:default:test-sa

Part 2: Auditing Roles and RoleBindings​

Step 2.1: List all Roles​

Examine all Roles in the cluster:

# Roles in all namespaces
kubectl get roles --all-namespaces

# Details of a specific Role
kubectl describe role <role-name> -n <namespace>

Step 2.2: List all RoleBindings​

Examine all RoleBindings:

kubectl get rolebindings --all-namespaces
kubectl describe rolebinding <binding-name> -n <namespace>

Part 3: Auditing Secrets​

Step 3.1: List Secrets​

Identify all Secrets:

kubectl get secrets --all-namespaces

Step 3.2: Verify Access to Secrets​

Check who can access Secrets:

kubectl auth can-i get secrets --all-namespaces

Part 4: Auditing Service Accounts​

Step 4.1: List all Service Accounts​

kubectl get serviceaccounts --all-namespaces

Step 4.2: Examine Permissions​

For each Service Account, check its permissions:

kubectl get rolebindings,clusterrolebindings --all-namespaces -o wide | grep <service-account-name>

Part 5: Verifying Security Configuration​

Step 5.1: Verify Pod Security Standards​

Check namespaces with PSS:

kubectl get namespaces --show-labels | grep pod-security

Step 5.2: Verify Network Policies​

Examine Network Policies:

kubectl get networkpolicies --all-namespaces

Part 6: Audit Report​

Create a simple script to generate a report:

#!/bin/bash
echo "=== Kubernetes Security Audit ==="
echo ""
echo "1. Roles and RoleBindings:"
kubectl get roles,rolebindings --all-namespaces
echo ""
echo "2. Service Accounts:"
kubectl get serviceaccounts --all-namespaces
echo ""
echo "3. Secrets:"
kubectl get secrets --all-namespaces | wc -l
echo ""
echo "4. Pod Security Standards:"
kubectl get namespaces --show-labels | grep pod-security

Lab Summary​

In this lab, you conducted a security audit of your Kubernetes cluster. You learned how to verify permissions, examine security resources, and identify potential issues.

Next Steps​

This module on Security and RBAC is now complete. You can proceed to Module 10 on Helm and Package Management.

Module 10: Helm and Package Management

Lab created on: December 2024