MicroK8s-alustan koventaminen : Case: WIMMA Capstone
Koivisto, Sami (2025)
2025
All rights reserved. This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:amk-2025051913240
https://urn.fi/URN:NBN:fi:amk-2025051913240
Tiivistelmä
Konttiteknologian ja Kubernetesin käytön yleistyminen muokkasi tietoteknisiä ympäristöjä entistä monimutkaisimmiksi. Mikropalveluarkkitehtuuri, kevyet Kubernetes-jakelut sekä nopea kehitystahti lisäsivät myös tietoturvaan liittyviä huolia. Tietoturvan parantamiseksi toteutettiin kovennustoimenpiteitä MicroK8s-ympäristöön, jota käytetään pääasiassa testausympäristöissä ja pienissä tuotantoympäristöissä. Tavoitteena oli selvittää, mitä haavoittuvuuksia Kubernetesiin kohdistuu ja miten ne vaikuttavat MicroK8s-ympäristöön sekä koventaa ympäristöä, dokumentoida ratkaisut ja osoittaa kovennusten toimivuus. Toteutus perustui tutkimukselliseen kehittämistyöhön, jossa yhdistyivät käytännön ongelmien ratkaisu ja tutkimuksellinen lähestymistapa. Tietoperusta kerättiin virallisista dokumentaatioista, ajantasaisesta kirjallisuudesta ja tietoturvaan liittyvistä tieteellisistä artikkeleista. Tuloksena syntyi viisi kovennustoimenpidettä MicroK8s-ympäristöön. Kovennustoimenpiteet sisälsivät Trivy-tietoturvaskannerin käyttöönoton haavoittuvuuksien tunnistamiseksi, Ingress-ohjaimen päivittämisen haavoittuneesta versiosta uudempaan, TLS-varmenteen hankkimisen Let’s Encrypt -palvelun avulla, verkkopolitiikan määrittelyn kapselien väliseen liikenteeseen sekä roolipohjaisen pääsynhallinnan käyttöönoton. Kovennustoimenpiteiden toimivuus varmennettiin käytännön esimerkein. MicroK8s-ympäristöä pystyttiin koventamaan tietoturvallisemmaksi yksinkertaisilla ja toistettavilla menetelmillä, jotka paransivat ympäristön tietoturvatasoa. Tuloksena syntyneet kovennustoimenpiteet muodostivat toimeksiantajalle pohjan, jonka avulla ympäristön tietoturvaa voidaan kehittää edelleen.
The increasing use of container technology and Kubernetes has made IT environments more complex. Microservice architecture, lightweight Kubernetes distributions and rapid development have also increased concerns about security. To improve security, hardening measures were implemented for the MicroK8s environment, which is mainly used in testing environments and small production environments. The objective was to identify vulnerabilities affecting Kubernetes and how they impact the MicroK8s environment, as well as to harden the environment, document the solutions, and demonstrate the effectiveness of the hardening measures.
The implementation was based on research-based development work that combined practical problem solving with a research-based approach. The theoretical base was gathered from official documentation, up-to-date literature and scientific articles related to information security.
The result was five hardening measures were created for the MicroK8s environment. These hardening measures included deployment of the Trivy security scanner to identify vulnerabilities, upgrading the Ingress controller from a vulnerable version to a newer one, obtaining a TLS certificate using Let’s Encrypt service, defining network policy for traffic between pods and implementing role-based access control. The functionality of the hardening measures was verified with practical examples.
The MicroK8s environment was successfully hardened using simple and repeatable methods that improved the overall security level of the environment. The resulting hardening measures formed a basis for the client to further develop the security of the environment.
The increasing use of container technology and Kubernetes has made IT environments more complex. Microservice architecture, lightweight Kubernetes distributions and rapid development have also increased concerns about security. To improve security, hardening measures were implemented for the MicroK8s environment, which is mainly used in testing environments and small production environments. The objective was to identify vulnerabilities affecting Kubernetes and how they impact the MicroK8s environment, as well as to harden the environment, document the solutions, and demonstrate the effectiveness of the hardening measures.
The implementation was based on research-based development work that combined practical problem solving with a research-based approach. The theoretical base was gathered from official documentation, up-to-date literature and scientific articles related to information security.
The result was five hardening measures were created for the MicroK8s environment. These hardening measures included deployment of the Trivy security scanner to identify vulnerabilities, upgrading the Ingress controller from a vulnerable version to a newer one, obtaining a TLS certificate using Let’s Encrypt service, defining network policy for traffic between pods and implementing role-based access control. The functionality of the hardening measures was verified with practical examples.
The MicroK8s environment was successfully hardened using simple and repeatable methods that improved the overall security level of the environment. The resulting hardening measures formed a basis for the client to further develop the security of the environment.