Security Defaults and Capabilities in Installable Serverless Platforms : A Comparative Study of Knative and OpenFaaS

Sammanfattning

Serverless computing has emerged as a new cloud computing paradigm and has gained widespread adoption, with installable serverless platforms such as Knative and OpenFaaS emerging as alternatives to proprietary serverless platforms. Unlike proprietary offerings, installable serverless platforms place security responsibility on the practitioner, making it essential to understand the security defaults and capabilities these platforms provide to mitigate known threats. This thesis evaluates and compares the security defaults and capabilities of Knative and OpenFaaS against eight threats relevant to installable serverless platforms with a threat model derived from existing container security and serverless security literature, covering both infrastructure-level threats as well as application-level threats. Both platforms were evaluated against each threat in their default installation state and on the capabilities offered to achieve protection along with the source of those capabilities and the accessibility of official documentation. The comparison shows that OpenFaaS provides stronger default security than Knative, with four out of eight evaluated threats partially mitigated by default, compared to one in Knative. Both platforms provide capabilities to mitigate all eight threats but differ in how protection is achieved, with OpenFaaS providing more native abstractions and features (especially in its Pro edition), while Knative relies more on the underlying Kubernetes mechanisms and pluggable external tools. Neither platform is secure by default and configuration is required regardless of platform, however, OpenFaaS demands less Kubernetes knowledge to achieve protection against the evaluated threats.