Secure Multi-Tenant Application Deployments in Kubernetes

Authors: Anil Kumar Manukonda

DOI: https://doi.org/10.37082/IJIRMPS.v11.i4.232600

Short DOI: https://doi.org/g9q4bc

Country: USA

Full-text Research PDF File:   View   |   Download

Abstract: Multi-tenant deployments in Kubernetes make it simple for businesses to allocate cluster resources between teams or customers, while offering safety and avoidance of interference. We review important architectures and secure measures for running multi-tenant applications on Kubernetes used in the financial industry and within the scope of PCI-DSS. We explore the issue of shared clusters, identifying crossover threats and teaching you how to prevent them. After that, we discuss how clusters can be organized, comparing those shared by many users with those used by only one, along with how clusters, namespaces, virtual clusters and node isolation are used. Full coverage is given on security arrangements, for example, namespace organization, Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), restricting access via Kyverno, OPA/Gatekeeper, network separation by Kubernetes Network Policies and service mesh and protection for pods (Pod Security Standards, seccomp, SELinux/AppArmor). We also show how to use Kubernetes on a multi-tenant platform by presenting a case study of a fictitious bank with example configurations (YAML code) for namespaces, RBAC roles, network policies and admission policies. The paper shows images of a secure shared architecture, different service mesh designs for each tenant and how CI/CD pipelines take care of supporting multiple tenants. We also include diagrams that show the process an attacker could take on a shared cluster and the way new tenants are introduced. We discuss what is coming next such as different multi-tenancy options, uses of sandboxing and changing compliance rules and how these will affect the way financial institutions manage Kubernetes multi-tenancy. This information, though sometimes personally viewed, is guided by practical DevSecOps skills designed to support both Kubernetes platform engineers and cloud security architects in building safe, compliance-based multi-tenant Kubernetes environments.

Keywords:

Paper Id: 232600

Published On: 2023-08-11

Published In: Volume 11, Issue 4, July-August 2023

Share this