From 7c1b615c983d0b93bdbf4e78a77f8c584c236503 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 28 Nov 2019 20:45:28 +0000 Subject: [PATCH] Add a note about dropping CAP_NET_RAW in Kubernetes --- site/kubernetes/kube-addon.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 5a80820a..b3e96dff 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -458,3 +458,11 @@ You must pass the `password-secret` option as noted in the previous section to e A different option is to use `trusted-subnets` and whitelist only the subnets that host your k8s nodes. Mind that depending on your circumstances that might allow a malicious container running in your cluster to access the weave dataplane, still. Read on the [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks/) document to see the alternatives. + +To improve security drop `CAP_NET_RAW` from pod capabilities: by default pods can forge packets from anywhere on the network, which enables attacks such as DNS spoofing. + +``` + securityContext: + capabilities: + drop: ["NET_RAW"] +```