Safety

The security of a Kubernetes cluster is divided into two levels: the infrastructure operated by centron and the configuration within the cluster, for which you are responsible. This page describes both.

Managed by centron

Data centre

Operations take place exclusively at the centron data centre in Hallstadt near Bamberg, Germany. The data centre is certified to ISO 27001 and is protected by enterprise firewalls and DDoS protection.

As all data is processed exclusively in Germany, it is subject to German and European data protection law at all times.

Control Plane

The control plane is operated and maintained by centron. Direct access – for example, via SSH – is not possible, either for you or from outside the system; communication takes place exclusively via the authenticated API endpoint.

Patches and updates

centron automatically installs security-critical updates for the control plane and node operating systems. Installation takes place on a rolling basis within the configured upgrade window, node by node and without any downtime.

See Supported versions.

Network isolation

All resources in a data centre are located within a VPC network and communicate via private IP addresses. Pod and service networks are internal to the cluster and cannot be accessed from outside.

Your responsibility

Accessing the configuration file

The configuration file (kubeconfig) contains an authentication token with extensive privileges on your cluster. Treat it as you would a password:

Do not check in to version control systems
Do not share via unencrypted channels

Set restrictive file permissions:

chmod 600 /<pfad>/<cluster-name>-kubeconfig.yaml

Assigning permissions within the cluster

Grant permissions according to the principle of least privilege. Applications should not run with cluster administrator permissions. Use RoleBindings to restrict permissions to individual namespaces.

See Setting up RoleBindings.

Secrets

Access credentials, tokens and certificates belong in Secret objects, not in container images or manifests:

kubectl create secret generic db-credentials \
  --from-literal=username=app \
  --from-literal=password=<passwort>

Warnung

The contents of a Kubernetes secret are simply Base64-encoded, not encrypted. Anyone with read access to secrets in the namespace can view them. Restrict these permissions accordingly.

Network policies

By default, in Kubernetes, any pod can communicate with any other pod. You can use NetworkPolicy objects to restrict data traffic in a targeted manner:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nur-aus-frontend
  namespace: produktion
spec:
  podSelector:
    matchLabels:
      app: datenbank
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 5432

Container security

Use images from trusted sources and keep them up to date.
Use fixed image tags or digests instead of latest to ensure that it is clear what has been rolled out.

Where possible, run containers without root privileges:

    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
      containers:
        - name: app
          image: registry.example.com/app:1.4.2
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true

Set limits so that a single container cannot fully utilise a node.

Accessing the API endpoint

Where possible, restrict access to the Kubernetes API to known source addresses.

An overview of the division of responsibilities

Area	Responsibility
Physical security of the data centre	centron
Operation and patching of the control plane	centron
Operating system updates for the nodes	centron
Network isolation at infrastructure level	centron
Handling the configuration file	Customer
RBAC rules and namespaces	Customer
Network policies within the cluster	Customer
Security of container images	Customer
Management of secrets	Customer
Backing up application data	Customer

Managed by centron​

Data centre​

Control Plane​

Patches and updates​

Network isolation​

Your responsibility​

Accessing the configuration file​

Assigning permissions within the cluster​

Secrets​

Network policies​

Container security​

Accessing the API endpoint​

An overview of the division of responsibilities​

Related topics​