From Complexity to Control: Using Teleport for Simplified Kubernetes Access Management

Securely managing access to modern infrastructure is a paramount concern, whether it's on-premises servers, cloud instances, Kubernetes clusters, databases, or other critical resources. The challenge lies in striking a balance between providing seamless access and maintaining airtight security, all while ensuring compliance with regulatory requirements. This is where Teleport steps in, offering a robust solution to streamline infrastructure access and management while prioritizing security, auditability, and compliance.

Kubernetes access management, also known as Role-Based Access Control (RBAC), is a method of controlling who can access the Kubernetes API and what actions they can perform across the cluster. It is a critical part of the overall Kubernetes security strategy. Here is a detailed demonstration of Kubernetes access management:

Users and Service Accounts:

Users: Kubernetes does not manage user identities directly. Instead, it relies on external identity management systems. Users are authenticated and then bound to roles or cluster roles through RoleBindings or ClusterRoleBindings.

Service Accounts: These are used to authenticate pods and services within the cluster. Each pod is associated with a service account, and the service account's credentials are used to authenticate the pod's requests to the Kubernetes API.

Roles and ClusterRoles:

Roles: Define a set of permissions within a namespace. They specify what actions can be performed on resources within that namespace.

ClusterRoles: Similar to roles but apply to cluster-wide resources and are not limited to a specific namespace.

RoleBindings and ClusterRoleBindings:

RoleBindings: Bind a role to a user or service account within a namespace, granting the specified permissions.

ClusterRoleBindings: Bind a cluster role to a user or service account, granting cluster-wide permissions.

Challenge

Managing access to a Kubernetes cluster can be a complex and challenging task. It requires balancing security, scalability, and usability while ensuring compliance with regulatory requirements. As the number of users and clusters grows, managing access can become increasingly difficult, making it essential to have a robust access management system in place.

Here are some of the challenges that organizations may face when giving access to a Kubernetes cluster:

• Securing Kubernetes clusters presents significant challenges. Exposing the cluster to unauthorized access increases the risk of security breaches, data theft, and unauthorized modifications. 

• The complexity of Kubernetes environments makes managing access and ensuring appropriate permissions difficult, especially as the number of users and clusters grows. Multi-tenant setups amplify these challenges, requiring robust isolation of resources. Managing keys, certificates, and credentials adds overhead and potential error points. 

• Auditing, compliance, and providing temporary access to external parties further complicate the security landscape. Implementing least privilege access and effective monitoring and logging are essential but require careful planning and execution.

Solution

Teleport is a robust and versatile tool that serves as a secure gateway to access SSH and Windows servers, Kubernetes clusters, databases, and web applications with unparalleled ease and reliability. It not only facilitates secure connectivity across diverse infrastructure components but also enhances operational efficiency by centralizing access management and enforcing stringent security policies. 

Whether managing containerized applications in Kubernetes environments or ensuring controlled access to critical databases and web services, Teleport offers comprehensive solutions tailored to meet the complex security and compliance needs of modern enterprises.

Teleport provides a more efficient and secure way to manage access to Kubernetes clusters. It offers granular control over user permissions, audit logs, and session recordings. This allows us to streamline administration, reduce the attack surface, and ensure compliance with regulatory requirements.

Deployment Guide

Step 1: Add the Teleport Helm Repository

https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-cluster

Open a terminal and run the following command to add the Teleport Helm repository

helm repo add teleport https://charts.releases.teleport.dev

helm repo update

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: teleport
  namespace: teleport
spec:
  chart:
    spec:
      chart: teleport-cluster
      reconcileStrategy: ChartVersion
      version: 16.2.0
      sourceRef:
        kind: HelmRepository
        name: teleport-helm-source
        namespace: flux-system
  interval: 10m0s
  values:
    clusterName: teleport.improwised.com
    proxyListenerMode: multiplex
    persistence:
      volumeSize: 3Gi
    proxy:
      service:
        type: ClusterIP
      annotations:
        ingress:
          nginx.ingress.kubernetes.io/backend-protocol: 'HTTPS'
          cert-manager.io/cluster-issuer: letsencrypt-prod
      highAvailability:
        replicaCount: 1
    ingress:
      enabled: true
      suppressAutomaticWildcards: true
      spec:
        ingressClassName: nginx
    authentication:
      secondFactor: "off"
    kubeClusterName: "cluster-name"
    highAvailability:
      replicaCount: 1
      certManager:
        enabled: true
        issuerName: "letsencrypt-prod"
        issuerKind: ClusterIssuer

helm install teleport-cluster teleport/teleport-cluster \
  --create-namespace \
  --version 16.0.3 \
  --values teleport-cluster-values.yaml

kind: role
version: v7
metadata:
  name: alice
spec:
  allow:
    logins: ['admin']
    kubernetes_groups: ['edit']
    node_labels:
      '*': '*'
    kubernetes_labels:
      '*': '*'
    kubernetes_resources:
      - kind: '*'
        namespace: '*'
        name: '*'
        verbs: ['*']
---
kind: role
version: v7
metadata:
  name: bob
spec:
  allow:
    logins: ['ubuntu']
    kubernetes_groups: ['view']
    node_labels:
      '*': '*'
    kubernetes_labels:
      '*': '*'
    kubernetes_resources:
      - kind: '*'
        namespace: '*'
        name: '*'
        verbs: ['*']

helm repo add teleport https://charts.releases.teleport.dev

helm repo update

helm install teleport-cluster teleport/teleport-cluster \
  --create-namespace \
  --version 16.2.0 \
  --values teleport-cluster-values.yaml

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: teleport
  namespace: teleport
spec:
  chart:
    spec:
      chart: teleport-cluster
      reconcileStrategy: ChartVersion
      version: 16.2.0
      sourceRef:
        kind: HelmRepository
        name: teleport-helm-source
        namespace: flux-system
  interval: 10m0s
  values:
    clusterName: teleport.improwised.com
    proxyListenerMode: multiplex
    persistence:
      volumeSize: 3Gi
    proxy:
      service:
        type: ClusterIP
      annotations:
        ingress:
          nginx.ingress.kubernetes.io/backend-protocol: 'HTTPS'
          cert-manager.io/cluster-issuer: letsencrypt-prod
      highAvailability:
        replicaCount: 1
    ingress:
      enabled: true
      suppressAutomaticWildcards: true
      spec:
        ingressClassName: nginx
    authentication:
      secondFactor: "off"
    kubeClusterName: "cluster-name"
    highAvailability:
      replicaCount: 1
      certManager:
        enabled: true
        issuerName: "letsencrypt-prod"
        issuerKind: ClusterIssuer

helm repo add teleport https://charts.releases.teleport.dev
helm repo update

helm install ${RELEASE_NAME} teleport/teleport-kube-agent \
  --create-namespace \
  --namespace ${NAMESPACE} \
  --set roles="kube" \
  --set proxyAddr=${PROXY_ENDPOINT} \
  --set authToken=${JOIN_TOKEN} \
  --set kubeClusterName=${KUBERNETES_CLUSTER_NAME}

kubectl -n teleport-agent get pods

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: app-pod-viewer
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "watch", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: app-pod-viewer
subjects:
- kind: Group
  name: app-developers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: app-pod-viewer
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f clusterrole.yaml
kubectl apply -f clusterrolebinding.yaml 

kind: role
metadata:
  name: app-pod-viewer
spec:
  allow:
    kubernetes_groups:
    - app-developers
    kubernetes_labels:
      '*': '*'
    kubernetes_resources:
    - kind: pod
      name: '*'
      namespace: app
    kubernetes_users:
    - app-pod-viewer
  deny: {}
  options:
    cert_format: standard
    create_db_user: false
    create_desktop_user: false
    desktop_clipboard: true
    desktop_directory_sharing: true
    enhanced_recording:
    - command
    - network
    forward_agent: false
    idp:
      saml:
        enabled: true
    max_session_ttl: 30h0m0s
    pin_source_ip: false
    port_forwarding: true
    record_session:
      default: best_effort
      desktop: true
    ssh_file_copy: true
version: v7

tsh logout 
tsh login --proxy= --user=app 
tsh kube login  --as app-pod-viewer 

tsh kubectl get pods -n app 
tsh kubectl logs pods/app-ui-svc-xyz -n app

Example:
version: v3
teleport:
  Storage:
# ...

version: v3
teleport:
  storage:
    # ...
  auth_service:
    enabled: true
    cluster_name: "mycluster.example.com"
    # Remove this if not using Teleport Enterprise
    license_file: "/var/lib/teleport/license.pem"
  Proxy_service:
enabled: false

proxy:
  teleportConfig:
    proxy_service:
      public_addr: "mycluster.example.com:443"
auth:
  teleportConfig:
    auth_service:
      enabled: true
cluster_name: "mycluster.example.com"