More policies to consider

SAP-archive / karydia

Kubernetes Security Walnut

Other

77 stars 10 forks source link

More policies to consider #29

Open alban opened 5 years ago

alban commented 5 years ago

Some policies to consider:

no (Cluster)RoleBinding on a 'default' service account
no (Cluster)RoleBinding for cluster-admin
no ConfigMap containing strings like aws_secret_access_key=

marwinski commented 5 years ago

Some comments / ideas from my side:

(1) Above sounds like a good idea which might complement my other idea (see separate ticket) (2) I don't fully understand. Do you want to prevent this in general or just for service accounts? It appears to make a lot of sense for the latter but not for users / groups. It would also break a lot of admittedly bad behaviour - so it would probably be quite good to do that :-) (3) I believe we should not try to restrict what people put into config maps...

alban commented 5 years ago

re (2): I was thinking of service accounts indeed.