论文标题
Kubernetes安全的XI诫命：与Kubernetes安全实践有关的知识的系统化
XI Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices
论文作者
论文摘要
Kubernetes是一种用于自动化计算机服务管理的开源软件。 IBM，Capital One和Adidas等组织使用Kubernetes来部署和管理其容器，并报告了与部署频率有关的好处。尽管有报道的福利，但Kubernetes部署易受安全漏洞的影响，例如2018年在特斯拉发生的漏洞。Kubernetes安全实践的系统化可以帮助从业者减轻其Kubernetes部署中的脆弱性。本文的目的是通过系统化与Kubernetes安全实践相关的知识来帮助从业者确保其Kubernetes装置。我们通过对104个互联网工件进行定性分析来系统化知识。我们确定11种安全实践，包括（i）实施基于角色的访问控制（RBAC）授权以提供最低特权，（ii）应用安全补丁以保持Kubernetes的更新，以及（iii）实施POD和网络特定的安全策略。
Kubernetes is an open-source software for automating management of computerized services. Organizations, such as IBM, Capital One and Adidas use Kubernetes to deploy and manage their containers, and have reported benefits related to deployment frequency. Despite reported benefits, Kubernetes deployments are susceptible to security vulnerabilities, such as those that occurred at Tesla in 2018. A systematization of Kubernetes security practices can help practitioners mitigate vulnerabilities in their Kubernetes deployments. The goal of this paper is to help practitioners in securing their Kubernetes installations through a systematization of knowledge related to Kubernetes security practices. We systematize knowledge by applying qualitative analysis on 104 Internet artifacts. We identify 11 security practices that include (i) implementation of role-based access control (RBAC) authorization to provide least privilege, (ii) applying security patches to keep Kubernetes updated, and (iii) implementing pod and network specific security policies.
