Security book for Azure Arc-enabled Kubernetes and AKS enabled by Azure Arc

Your organization may have Kubernetes deployments that include clusters running at the edge (on-premises in data centers, factories, shops) or in multiple clouds. It's often a challenge to maintain a consistent and scalable security posture in these heterogeneous environments. You can help address this challenge, and simplify your security workflows by running Microsoft-managed clusters using Azure Kubernetes Service (AKS) enabled by Azure Arc on your edge infrastructure, such as on Azure Local. Or you can connect existing non-Microsoft edge clusters using Azure Arc-enabled Kubernetes.

This book explains how these products can help you maintain a consistent and scalable security posture, covering both your cluster infrastructure and your application workloads. It advises how you can help guard against multiple threat vectors across supply chain risks, malicious external actors, or insider attacks. It builds on industry best practices such as those from:

• the National Security Agency / Cybersecurity and Infrastructure Security Agency (NSA/CISA)
• the Center for Internet Security (CIS)
• the Open Worldwide application Security Project (OWASP)
• the National Institute of Standards and Technology (NIST)
• the Kubernetes project itself.

It also aligns with:

• the Microsoft Threat Matrix for Kubernetes
• Microsoft’s security advice for AKS cloud clusters, expanding this advice to include extra considerations for edge clusters
• Microsoft's security advice for IoT solutions.

If you're a security professional, this book surveys all these factors and makes multiple recommendations. If you're a leader or engineer with direct responsibility for Kubernetes development, deployment, or operations, it further points you towards detailed practical advice on steps you can take.

The security challenges fall into five categories:

1. Secure your platform. This category includes configuring your Kubernetes cluster to operate more securely, and doing the same for its underlying OS and hardware infrastructure as needed, appropriately using all their built-in capabilities.
2. Secure your workloads. This category includes building your containers more securely by following Kubernetes and Linux security standards. It also covers how to establish more secure authentication and authorization for requests to/from other services inside and outside of the clusters.
3. Secure your operations. This category includes controlling who can deploy to these clusters. It covers how to unify the cluster-local Kubernetes system for authentication and authorization with Microsoft Entra and Azure role-based access control (Azure RBAC) in the cloud. It also discusses how to better secure your software supply chain and enforce standards on your deployments through policies.
4. Secure your data. This category includes better securing access both to your workload application data and to the data that Kubernetes stores on your behalf, particularly secrets such as passwords.
5. Secure your network. This category includes configuring the extra defense in depth that comes from controlling management and data traffic at the network level. It discusses how to restrict which sources your clusters and workloads can receive from, and which targets they can they send to.

This book provides guidance on these challenges for Arc-enabled Kubernetes clusters in general and for AKS enabled by Azure Arc clusters in particular. There are many deployment options for AKS enabled by Azure Arc. This book covers the Azure Local 23H2 deployment option and builds upon the Azure Local security features and security book. (Other deployment options offer some but not all of the same benefits.)

Next steps

• Learn how to secure your platform