Operating System k8orization

Level 1 k8orized Image: OS Optimization for Kubernetes

Raj Mars Marni February 4, 2024

The first level of k8orization - OS k8orization, focusing on optimizing the operating system (OS) Docker image for Kubernetes deployments. We'll explore its purpose, benefits, and differences compared to standard Docker images.

What is OS k8orization?

It's a process of transforming a pre-built Docker image, like Ubuntu or CentOS, into a lean and secure foundation for K8s deployments. This involves multiple steps:

1. Removal of Unnecessary Elements:

Users and Groups: Redundant user and group entries are purged from several files like /etc/passwd, /etc/group, and /etc/shadow, minimizing potential attack vectors and reducing image size.
Files and Packages: Unneeded OS related files and packages are eliminated, further shrinking the image and optimizing resource utilization.

2. Creation of K8s-Specific Users:

Dedicated users with minimal privileges are created specifically for k8or operations, enhancing security and preventing unauthorized access.

3. Enhanced Security Measures:

Strict System Call Restrictions: Processes are limited to authorized system calls, effectively blocking unauthorized actions and bolstering system integrity.
Unique User IDs and GIDs: K8s users possess unique identifiers, further isolating potential security breaches.
Process Termination: Unauthorized system calls trigger process termination, actively addressing security threats.

4. Abstraction Layer with Infrastructure Integration:

This step introduces a C, Python or Go abstraction layer and acting as a bridge between the OS and the underlying K8s infrastructure. The key purpose of this layer is to enhance security, portability, and extensibility, simplifying integration with various cluster-native tools and services:

Universal Compatibility: The abstraction layer decouples the application from the specifics of the underlying OS, enabling seamless deployment across different K8s environments.
Automated Configuration Management: Imagine your K8s cluster as a complex ecosystem with tools like secret management, DNS configuration, and network connectivity providers. This OS abstraction layer can act as a "smart orchestrator", automatically enabling OS configurations for products, tools, and services.
Simplified Maintenance and Upgrades: With streamlined configurations managed by the OS abstraction layer, updates and maintenance become easier.
Improved Operational Efficiency: By automating tedious OS configuration tasks, human intervention is minimized, freeing up your team to focus on other higher-level development and operational activities.
Think of this OS abstraction layer as a "universal OS translator" for your K8s environment. It takes away the burden of intricate OS configurations and interdependencies, leaving you with a secure, flexible, portable, and easily maintainable OS layer for your K8s ecosystem.

This document presents an example hGraph visualization of the operating system k8orization process implemented at BOTops company.

Sector 1:

The user authorization process requires accessing and verifying credentials across all necessary services: Google, AWS, Jira, Miro, Toggle Tracker, GitHub, and DockerHub.

Sector 2:

This sector outlines the creation of manifest files in YAML format for various Kubernetes resources.

The first manifest defines a StorageClass, enabling volume creation.
The second manifest creates a PersistentVolumeClaim, claiming a volume.
The fourth manifest deploys another service with mounted volumes, focusing specifically on volumes within the /usr directory.

Sector 3:

Section 3 outlines the pre-deployment steps, including authorizing access to a Jump EC2 instance, establishing a connection to the EKS cluster, switching to the appropriate namespace, and verifying connectivity to the Node Group, ensuring a smooth and secure deployment process.

Sector 4:

Section 4 dives into deploying the StorageClass, detailing the steps: uploading the manifest file, establishing the StorageClass itself, and the subsequent automatic volume creation, streamlining storage provisioning for your application.

Sector 5:

Section 5 outlines the deployment of the PersistentVolumeClaim (PVC), guiding you through uploading the manifest file and subsequent PVC creation. This empowers your application to request and utilize persistent storage seamlessly.

Sector 6:

Section 6 delves into the deployment process, guiding you through applying the deployment manifest, creating the deployment resource, spawning a replica set, and finally launching individual pods, orchestrating the entire application rollout in a step-by-step manner.

Sector 7:

Section 7 tackles automated pod storage attachment, demonstrating how to specify StorageClass and PersistentVolumeClaim information within your manifest file. This ensures seamless storage provisioning for your deployed pods.

Sector 8:

Section 8 dives into content migration, guiding you through executing the created pod, copying all files from /usr to the mounted /mnt directory, and then verifying memory usage remains consistent across both directories. This final step confirms successful migration and data persistence within the mounted volume.

Why Do We Do It?

Standard Docker images contain unnecessary elements like unused user accounts, pre-installed packages not relevant to your application, and extraneous files. This adds unnecessary weight and potential security vulnerabilities. Level 1 k8orization tackles these issues by:

Reducing Image Size: Smaller images mean faster downloads, quicker deployments, and lower storage costs.
Enhanced Security: By removing unused elements and implementing K8s-specific users, the attack surface shrinks, leading to a more secure environment.
Optimized Product Utilization: Smaller images consume less CPU, memory, and disk space within your Kubernetes cluster, leading to improved performance and cost-efficiency.

How is it Useful?

k8orized OS images provide a secure and optimized foundation for your K8s deployments. They offer several advantages:

Streamlined Deployments: Smaller images download and start faster, minimizing deployment times.
Improved Scalability: Smaller images allow for denser deployments within your cluster, maximizing resource utilization.
Enhanced Security Posture: The focus on minimal footprint and strict security measures minimizes vulnerabilities and strengthens your K8s environment.
Simplified Maintenance: Consistent images across your deployments simplify management and updates.

Differences from Other Images:

k8orized OS images differ from standard Docker images in multiple ways:

Specificity: They are tailored for K8s environments, focusing on security and resource optimization within that context.
Minimalistic Footprint: They contain only the essential elements needed for K8s operations, leading to smaller image sizes.
Enhanced Security: They implement specific security measures like user isolation and system call restrictions, making them more secure for K8s deployments.
Abstraction Layer: They involve creating a C, Python or Go layer to interact with the underlying OS.

Level 1 k8orization lays the groundwork for secure and efficient K8s deployments by optimizing the OS image. By removing unnecessary elements, implementing dedicated K8s users, and enforcing strict security measures, k8orized OS images provide a lightweight, secure, and efficient foundation for your applications within the Kubernetes ecosystem.

example