1. Docker and Kubernetes Security in ONAP Pawel Pawlak Amy Zwarico
September 26th, 2019

2. Docker Container Security: CIS Docker Benchmarks v1.2
Set of controls to implement with instructions and tests
All ONAP containers configured per
Section 4 Container Images and Build File Configuration
Section 5 Container Runtime Configuration
ONAP is tested in an environment in the following configuration
Linux host: Section 1.2 Linux Hosts Specific Configuration
Docker daemon: Section 2 Docker daemon configuration
Docker daemon configuration files: 3 Docker daemon configuration files
M2: Plan to develop each ONAP release using the latest stable version of Docker
El Alto: Docker x ( minimum)
Latest stable release: / July 25, 2019
El Alto VNF Security Requirements: Containerized VNFs must follow the CIS Docker Benchmarks and must run in a Docker environment that configured with the controls.

3. Deeper Dive Securing Container Images – Project impact
Container Images and Build File Configuration
Containers should run as a non-root user.
19/8/8 – 81 ONAP containers running as root
Ensure that unnecessary packages are not installed in the container
Ensure that HEALTHCHECK instructions have been added to container images
Container Run Time Configuration
Ensure that Linux kernel capabilities are restricted within containers
Ensure that privileged containers are not used
Ensure that only needed ports are open on the container
Securing the Docker Engine
Docker daemon: Section 2 Docker daemon configuration
Ensure network traffic is restricted between containers on the default bridge
Ensure that authorization for Docker client commands is enabled
Ensure Userland Proxy is Disabled
Impact
Layer
Controls
Project
Container images and build file configuration 11
Container run time configuration 31
Total 41
Integration
Linux host 12
Docker daemon 17
Docker daemon configuration files 22 51

4. Docker Security Implementation Path
Release
Milestone
Deliverable
Frankfurt M1
SECCOM, TSC, PTL, Release Manager agree on the mandatory container image, build file and run time controls for the release
SECCOM and Integration teams agree on mandatory Linux host, Docker daemon, and Docker daemon config file controls for the release
SECCOM creates project and Integration Jiras
SECCOM and Integration teams agree on audit tests M2
TSC, Integration, SECCOM, PTL agree on Docker version for release (July 25, 2019) M3
Audit tests delivered to Integration team M4
Integration lab completes implementation of Linux host, Docker daemon and Docker daemon config files controls
Project Docker containers complete implementation of container image, build file and run time controls
RC0
Project RC0 containers configured correctly and execute without Docker errors in the Integration environment

5. Kubernetes Security: CIS Kubernetes Benchmark v1.4.1
Set of controls to implement with instructions and tests
Master Node Security Configurations
API Security, Scheduler, Controller Manager, Configuration Files, etcd, General Security Primitives, PodSecurityPolicies
Worker Node Security Configuration
Kubelet, Configuration Files, Docker daemon configuration files
Plan to develop each ONAP release using the most recent version of Kubernetes at M2.
Current ONAP use
Kubernetes , Helm , RKE (w/ kubernetes_version=v rancher1-1 in cluster.yml)
Latest stable versions
Kubernetes v1.16, Helm v2.14.3, RKE 0.2.8
El Alto VNF Security Requirements: Containerized VNFs must follow the CIS Docker Benchmarks and must run in a Docker environment that configured with the controls.
Impact
Layer
Controls
Master Node
Security
API Security 39
Scheduler 2
Controller Manager 31
etcd 7
General Security Primitives 8
PodSecurityPolicies
Total 94
Worker Node Security
Kubelet 14
Configuration Files 10
Docker daemon configuration files 3 27

6. Kubernetes Security Implementation Path
Release
Milestone
Deliverable
Frankfurt M1
SECCOM, TSC, Release Manager, Integration team agree on the mandatory master node security controls and mandatory worker node security controls for the release
SECCOM creates Jiras
SECCOM and Integration teams agree on implementation of audit tests M2
TSC, Integration, SECCOM, PTL agree on Kubernetes, Helm, RKE versions for release
Kubernetes v1.16, Helm v2.14.3, RKE 0.2.8 M3
Audit tests in place M4
Integration lab completes implementation of master and worker node security controls
RC0
Project RC0 containers configured correctly and execute without Kubernetes errors in the Integration environment

7. Thank you