From 77d08557d72e7c0abec15aaf8fdff6c02dae63cd Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Mon, 8 Jan 2018 14:52:12 -0800 Subject: [PATCH] securing a cluster: add recommendations about cloud metadata APIs (#6659) --- docs/tasks/administer-cluster/securing-a-cluster.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/tasks/administer-cluster/securing-a-cluster.md b/docs/tasks/administer-cluster/securing-a-cluster.md index b95317fea6..befd59315b 100644 --- a/docs/tasks/administer-cluster/securing-a-cluster.md +++ b/docs/tasks/administer-cluster/securing-a-cluster.md @@ -128,6 +128,16 @@ Additional protections may be available that control network rules on a per plug environment basis, such as per-node firewalls, physically separating cluster nodes to prevent cross talk, or advanced networking policy. +### Restricting cloud metadata API access + +Cloud platforms (AWS, Azure, GCE, etc.) often expose metadata services locally to instances. +By default these APIs are accessible by pods running on an instance and can contain cloud +credentials for that node, or provisioning data such as kubelet credentials. These credentials +can be used to escalate within the cluster or to other cloud services under the same account. + +When running Kubernetes on a cloud platform limit permissions given to instance credentials, use +[network policies](/docs/tasks/administer-cluster/declare-network-policy/) to restrict pod access +to the metadata API, and avoid using provisioning data to deliver secrets. ### Controlling which nodes pods may access