search

FairwindsOps / pentagon

A framework for building repeatable, containerized, cloud-based infrastructure as code with Kubernetes.
https://www.reactiveops.com
Apache License 2.0
183 stars 25 forks source link

Adding some Kops security improvements #140

Closed robscott closed 5 years ago

robscott commented 5 years ago

These changes are intended to improve the security of our default Kops configuration. There are three main parts of this:

1. Audit Logging Audit logging is an important part of any security posture. Of course this is only the first step, we will also want to update Fluentd or similar to actually send these audit logs to a centralized logging service. I'm open to a better way to include all the audit policy config, there's quite a bit there. It's currently based on the GCE one here: https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh#L798.

2. ETCD v3 + TLS + Encryption It's definitely time to upgrade to etcd v3, at least as a default for new clusters. Additionally adding encrypted volumes and TLS will help with security.

3. Using a newer Stretch AMI The default Kops AMIs are rarely updated and therefore end up missing important security patches. This switch to the official Debian stretch AMI as a default matches up with the approach we've already been using in practice. (https://wiki.debian.org/Cloud/AmazonEC2Image/Stretch)

CLAassistant commented 5 years ago

CLA assistant check
All committers have signed the CLA.

ejether commented 5 years ago

Please drop a note in the changelog, bump the version then tag and release! Either in this PR or another is fine.