Skip to main content

Lab 9.4 - Security Audit

Lab Objectives​

By the end of this lab, you will be able to:

  • Understand security auditing in Kubernetes.
  • Verify user and Service Account permissions.
  • Examine security resources.
  • Identify potential security issues.

Estimated Duration​

45-60 minutes

Prerequisites​

  • kubectl installed and configured.
  • Local Kubernetes cluster running.
  • Knowledge of Kubernetes security (previous chapters).

Part 1: Permission Verification​

Step 1.1: Check Permissions with kubectl auth can-i​

Check your own permissions:

# Check all your permissions
kubectl auth can-i --list

# Check specific permissions
kubectl auth can-i create pods
kubectl auth can-i delete deployments
kubectl auth can-i get secrets

Step 1.2: Check Service Account Permissions​

Create a Service Account and check its permissions:

kubectl create serviceaccount test-sa
kubectl auth can-i --list --as=system:serviceaccount:default:test-sa

Part 2: Roles and RoleBindings Audit​

Step 2.1: List All Roles​

Examine all Roles in the cluster:

# Roles in all namespaces
kubectl get roles --all-namespaces

# Details of a specific Role
kubectl describe role <role-name> -n <namespace>

Step 2.2: List All RoleBindings​

Examine all RoleBindings:

kubectl get rolebindings --all-namespaces
kubectl describe rolebinding <binding-name> -n <namespace>

Part 3: Secrets Audit​

Step 3.1: List Secrets​

Identify all Secrets:

kubectl get secrets --all-namespaces

Step 3.2: Check Secret Access​

Check who can access Secrets:

kubectl auth can-i get secrets --all-namespaces

Part 4: Service Accounts Audit​

Step 4.1: List All Service Accounts​

kubectl get serviceaccounts --all-namespaces

Step 4.2: Examine Permissions​

For each Service Account, check its permissions:

kubectl get rolebindings,clusterrolebindings --all-namespaces -o wide | grep <service-account-name>

Part 5: Security Configuration Verification​

Step 5.1: Check Pod Security Standards​

Check namespaces with PSS:

kubectl get namespaces --show-labels | grep pod-security

Step 5.2: Check Network Policies​

Examine Network Policies:

kubectl get networkpolicies --all-namespaces

Part 6: Audit Report​

Create a simple script to generate a report:

#!/bin/bash
echo "=== Kubernetes Security Audit ==="
echo ""
echo "1. Roles and RoleBindings:"
kubectl get roles,rolebindings --all-namespaces
echo ""
echo "2. Service Accounts:"
kubectl get serviceaccounts --all-namespaces
echo ""
echo "3. Secrets:"
kubectl get secrets --all-namespaces | wc -l
echo ""
echo "4. Pod Security Standards:"
kubectl get namespaces --show-labels | grep pod-security

Lab Summary​

In this lab, you performed a security audit of your Kubernetes cluster. You learned how to verify permissions, examine security resources, and identify potential issues.

Next Steps​

This module on Security and RBAC is now complete. You can move on to Module 10 on Helm and Package Management.

Module 10: Helm and Package Management

Lab created on: December 2024