CCE Security Guide

Least privilege

1. Use the sudo whitelist to restrict the Docker commands that can be run in containers by common users.
2. It is recommended that privileged containers be disabled for Kubernetes pods. To be specific, do not use the following settings:

   apiVersion: v1
   kind: Pod
   metadata:
     name: hello-world
   spec:
     containers:
       - name: hello-world-container
         # The container definition
         # ...
         securityContext:
           privileged: true

By default, the token of ServiceAccount default is not used.

• The automatic mounting function is disabled for ServiceAccount default by default. If automountServiceAccountToken is set to false, the created workload will not be mounted to a token by default.
  CAUTION:

  Set this field for each namespace as required. After the setting is complete, perform a rolling restart for the pods in the corresponding namespace.

  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: default
  automountServiceAccountToken: false

• Mount the token of ServiceAccount default to specific workloads.

  ...
  spec:
    template:
      spec:
        serviceAccountName: default
        automountServiceAccountToken: true
        ...

Network isolation

Network isolation between containers in a cluster

Use network policies to implement access control.

Network isolation between containers and hosts outside the cluster

Use security groups in a VPC to implement access control.

Network isolation between containers and the cluster control plane

CCE clusters are private and workloads would access the cluster API server. Therefore, CCE does not restrict the network communication between containers and the Kubernetes control plane. You can harden the network security by limiting the pod QoS.

Mounting of sensitive host directories

• If not necessary, do not mount the /var/run/docker.sock file on the host to a container when starting the container.
• Do not mount the hostPath directory, such as /, /boot, /dev, /etc, /lib, /proc, /sys, and /usr, on the host to the container. If necessary, mount the hostPath directory in read-only mode.