Top Kubernetes Security Interview Questions

Kubernetes security is a much-needed and scarce skill in the industry today. Interviewers are more interested in hiring Kubernetes workforce in the company. Big companies like Google, Pokeman, SAP, etc., use Kubernetes in their IT infrastructure.

Below is the list of Top Kubernetes Security Interview Questions that may be asked in interviews.

Q. What is Kubernetes?

Ans: Kubernetes is an open-source container orchestration engine for managing deployment, scaling, and management of container applications.

Q. Which product is similar to Kubernetes?

Ans: Docker Swarm is similar to Kubernetes. Remember, Kubernetes is used to manage multiple Dockers, and it helps deploy, scale, and manage it.

Q. Are containers inherently secure? Yes or No.

Ans: Yes or No both. If containers are securely configured, it is secure otherwise not.

Q. How to secure Kubernetes Dashboard?

Ans: Kubernetes Dashboard (GUI) is used to manage container applications. Following are some methods to secure the Kubernetes dashboard:

• Access Kubernetes dashboard only in the local network
• Grant low privileges to the service account of the dashboard
• Turn on Role-based access control (RBAC) 
• Grant access to dashboard based on principle of least privilege

Q. Where are you deploying containers most?

Ans: Listing out in decreasing order:

• Public Cloud
• Private Cloud
• Hybrid Cloud
• Others

Q. List out differences between Kubernetes and Docker Swarm.

Ans: Kubernetes and Docker Swarm both are used to manage dockers. Below are the differences between Kubernetes and Docker Swarm:

Kubernetes	Docker Swarm
Installation is not easy.	Installation is easy.
GUI is available (Kubernetes Dashboard)	No GUI
Auto-Scaling feature is available	No Auto-Scaling feature
Logging and monitoring inbuilt tools are available	Not Available, only third-party tools are available
Automatic updates and rollback mechanisms are available	Only Automatic updates are available.
More stable	Less stable
Highly Scalable but less fast than Docker Swarm	Highly Scalable

Q. Mention methods/requirements for securing containers.

Ans: Below are some methods/requirements for securing containers:

• Ensuring the use of golden images on container hosts by using security policies and guidelines. Apply updates and patches consistently and securely.
• Implementation of Role-Based Access Control (RBAC) based on the principle of least privilege. It is recommended to create a service account for applications on a need basis.
• Implement data encryption in transit within and between clusters. It is recommended to use trusted root certificates for external interfaces (e.g. API server). If possible, integrate auto-renew and auto-issuance features.
• Security Scanning while in runtime and at rest. Implement scanners into CI/CD pipeline.
• Regular monitoring of the security posture of the platform and regularly audit network traffic, security, and performance logs.
• Implement network segmentation and access control. It is recommended to use the CNI plugin to control ingress and egress to clusters and namespaces. Consider protocol-specific policies to secure applications.
• Implement effective secret management practices.

Q. What are the components of the control plane?

Ans: Components of the control plane are used to make decisions about the cluster and its events. Following are the components of the control plane:

• kube-apiserver
• etcd
• kube-scheduler
• kube-controller-manager
• cloud-controller-manager

Q. What are the components of a node?

Ans: Node components running on each node and help in maintaining running pods. It also provides a Kubernetes runtime environment. Following are the components of the node:

• kubelet
• kube-proxy
• container runtime

Q. List out methods to secure Kubernetes hosts.

Ans: Methods are similar to the traditional way of securing hosts available in data centers.

• Always update OS with the latest patches
• Use CIS and other security benchmarks to harden OS
• Implement firewall rules
• Implement other security measures for environmental security

Q. List out methods to secure Kubernetes components.

Ans: Methods for securing Kubernetes components:

• Never allow or minimize direct access to Kubernetes nodes. It is recommended to use kubectl exec which helps in accessing the container environment and mitigates direct access of hosts.
• Allow only authorized personnel to access Kubernetes API
• Use secure API communication by enabling TLS
• Implement role-based access control for API authorization
• Not expose dashboard on internet
• Restrict access to the Kubelet
• etcd store sensitive information such as secrets. It is recommended to restrict access to etcd.