How can Kubernetes help you?

Kubernetes, also known as K8s, is an open-source system for automating deployment, scaling, and managing containerized applications. Kubernetes is most efficacious when working containers at scale. Users can get a streamlined delivery pipeline to support the entire application lifecycle once a K8 cluster is set up and plugged into a DevOps pipeline. 

What role does Kubernetes play in container orchestration?

The primary reason for using Kubernetes is orchestrating containers in a containerized application. Containerization allows users to package applications into a single immutable and isolated container with all the dependencies deployed virtually anywhere. It makes managing a single or handful of containers more miniature of a hassle. 

With containerization, users can quickly deploy containers as a function based on different uses cases. This can lead to the accumulation of several containers in a production environment and a management overhead that would burden even a large team of engineers. Therefore, Kubernetes can help manage most container management tasks automatically, allowing organizations to effectively manage deployments and updates of containers and scaling, availability, storage, security, and networking within the Kubernetes Cluster by using K8s to handle these containers.

Key features Kubernetes can provide: 

Automated rollouts and rollbacks

K8 provides various deployment solutions to an ecosystem. It gives the ability to roll out changes to an application and its configurations while monitoring the application's health to ensure it doesn't destroy any or all your instances simultaneously. Kubernetes can roll back a change if something goes awry. 

Service discovery and load balancing

Kubernetes offers pods their IP addresses and a single DNS name for a set of Pods to perform efficient load balancing. Therefore, if an unknown service discovery mechanism is to be used, there would be no need to modify an application. 

Storage orchestration

Storage orchestration capabilities allow mounting of the storage system of choice, e.g., local storage, a cloud provider such as AWS or GCP, or network storage such as Ceph, Flocker, etc. 

Secret and configuration management

Application configuration and secrets can be deployed and updated with rebuilding an image or exposing secrets within a stack. 

Automatic bin packing

K8s mixes critical and best efforts workloads to save resources and drive utilization. It automatically positions containers based on resource requirements and other limitations while not sacrificing availability. 

Batch execution

Kubernetes can handle batch executions and CI workloads, substituting containers that fail, if preferred.

IPv4/IPv6 dual-stack

K8s provides allocation of IPv4 and IPv6 addresses to Pods and Services.

Horizontal scaling

With simple UI commands, K8s can scale up and down an application. 

Self-healing

K8s can self-heal an application by restarting failed containers replacing and rescheduling when nodes die. It can also kill containers that don't answer user-defined health checks and promote them to clients until they are ready to serve.

Designed for extensibility

Without changing any upstream source code, one can add multiple features to a Kubernetes cluster.

How can one secure their Kubernetes environment?

Secure the cluster

• It is essential to restrict access to a K8 cluster when managed by users. It starts with limiting access to kubectl, the command-line tools used to control a Kubernetes cluster. Every request to kubectl must be authenticated and validated via token-based authentication or a public-private key pair.

• Use role-based access control (RBAC) to implement more advanced access models using RBAC. The Kubernetes RBAC functionality assures that each request is authorized depending on the role of the current user or service account. Even if a Kubernetes component is compromised, RBAC ensures that the damage is limited to a user's access permissions.  Remember that Kubernetes RBAC supports Normal roles and is limited to specific namespaces in a Kubernetes cluster. Misuse of cluster roles can provide an attacker access to the cluster, so it is vital to use them intermittently. 

Maintain a good security hygiene

• System updates— Update Kubernetes regularly as it is an open-source project; therefore, security issues and vulnerabilities are regularly discovered. Managed Kubernetes services can be automated and soothe the process as updating Kubernetes is complex in a production cluster.

• Minimal operating system— Use a lightweight image and minimal operating system for the Kubernetes nodes to restrict the attack surface.

• Minimal identity and access management (IAM) - IAM roles define Kubernetes as it is often managed in the cloud, and IAM roles define permissions to cloud resources. Assure that each IAM role only grants permission to the minimal resources required by the role owners. RBAC permissions are tended at the cluster or namespace level.

Secure workloads

• Workload security— It is vital to know which container engines are running on the Kubernetes nodes. For example, Docker has its own security best practices as a container engine. An engineer should update all applications running on the K8s cluster regularly, and patch management should be applied with solid authentication when required.

• Declarative configuration—Kubernetes uses declarative configuration, defined using YAML files, Helm charts, or various templating technologies. Declarative configuration is susceptible because it explains how workloads should run and provides credentials for sensitive systems. Kubernetes configurations should always be encrypted to protect secrets across clusters. They carefully defend access to configurations to circumvent malicious modification and should never be revealed or contained as plaintext credentials.

References: https://kubernetes.io/docs/home/