Harden EKS/GKE Clusters

upodroid commented 1 year ago

Our build clusters run untrusted code and we should try to harden the cluster configuration and the pod configuration.

Kubernetes Best Practices:

Prow pods which run untrusted should only be ran in the test-pods namespace
hostNetwork should not be set to true for pods in the test-pods namespace
Pods should be run with privileged set to false unless required, such as DinD jobs.
Use the relevant cross-cloud workload identity tooling to access resources in a different cloud provider. We have workloads on AWS and GCP that access resources on a different cloud provider securely.

GKE Best Practices:

GKE Nodes should be running with a custom Google service account with minimal privileges
Workload Identity must be enabled and should be used to assume Google Service accounts
Apply all the GKE hardening suggestions. https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster

EKS Best Practices:

EKS nodes should be running with IAM principals with minimal privileges
IRSA should be used to assume AWS IAM roles
Apply all the EKS hardening suggestions. https://aws.github.io/aws-eks-best-practices/security/docs/iam/#recommendations

upodroid commented 1 year ago

/area infra /area infra/aws /area infra/gcp /priority important-soon

xmudrii commented 1 year ago

EKS-related IAM improvements are tracked as part of #5160

k8s-triage-robot commented 7 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

xmudrii commented 7 months ago

/remove-lifecycle stale

k8s-triage-robot commented 4 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

xmudrii commented 4 months ago

/remove-lifecycle stale

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

xmudrii commented 1 month ago

/remove-lifecycle stale

kubernetes / k8s.io