search

kubernetes / sig-security

Process documentation, non-code deliverables, and miscellaneous artifacts of Kubernetes SIG Security
Apache License 2.0
166 stars 55 forks source link

Kubernetes Hardening Guide #30

Open raesene opened 3 years ago

raesene commented 3 years ago

What would you like to be added

As part of SIG-Security-Docs, we've been discussing the creation of a hardening guide for Kubernetes. We've got an initial document for the guide's creation here https://docs.google.com/document/d/1teb42X_c5_k8PNOSEEEbVnEr9aVAwWJXezBuf5fdmZU/edit

Why is this needed

The goal of the hardening guide is to provide guidance to cluster operators about how they can improve the security of their clusters. This will be done by discussing the major areas of security relating to a Kubernetes cluster, looking at the options available for hardening and the trade-offs inherent in them. In contrast to existing 3rd party documentation in this area (the CIS benchmark) which is a prescriptive audit style document, this guide should provide a more discursive approach.

Table of Areas

Section Assignee PR(s)
Threat Model @cailynse  
Control Plane Configuration    
API Server Configuration    
Scheduler Configuration @AnshumanTripathi    
Controller Manager Configuration    
File Permissions    
Worker Node Configuration    
PKI Management    
Cluster Authentication @raesene  
Authorization @bjornsen @vinayakankugoyal  
Workload Security Configuration    
Network Policy Configuration @cailynse    
Resource Limits    
Add-On Configuration  

cc @savitharaghunathan @sftim

sftim commented 3 years ago

/sig security

sftim commented 3 years ago

/triage accepted

fejta-bot commented 3 years ago

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale

savitharaghunathan commented 3 years ago

/remove-lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

savitharaghunathan commented 2 years ago

/remove-lifecycle rotten

savitharaghunathan commented 2 years ago

/transfer sig-security

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

sftim commented 2 years ago

/remove-lifecycle rotten

Hope that's OK

cailynse commented 2 years ago

I'd be really interested in helping with this one!

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

cailynse commented 1 year ago

/remove-lifecycle rotten

@savitharaghunathan - is this something we could work on in the next cycle with SIG Security Docs?

cailynse commented 1 year ago

/assign

ericsmalling commented 1 year ago

I'm interested in helping, even if just to help review and learn.

cailynse commented 1 year ago

Awesome! @ericsmalling feel free to pick up a section! I've just been researching and trying to fill in the TODOs from the top down!

cailynse commented 1 year ago

Threat Modelling PR: https://github.com/kubernetes/website/pull/39087

I'll also take Network Policy Configuration, please and thank you!

bjornsen commented 1 year ago

I'm interested in Authorization.

raesene commented 1 year ago

1st Draft for the Authentication section is open for comment on Hackmd https://hackmd.io/kxo4SRN3T3ipJHca2JNPTg

raesene commented 1 year ago

@bjornsen cool! I've added that assignment to the table at the top.

vinayakankugoyal commented 1 year ago

@bjornsen and me are going to be collaborating on Authorization.

PushkarJ commented 1 year ago

This might be of interest to the group here: https://github.com/cncf/tag-security/issues/1054

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

savitharaghunathan commented 1 year ago

/remove-lifecycle stale

raesene commented 1 year ago

Hey all, so I've done some more fix-ups on the authentication section (https://hackmd.io/kxo4SRN3T3ipJHca2JNPTg?both) seems like it's probably in a decent enough spot to open a PR?

I know we had a quick chat about where in the docs site these pages should go, but I'm not sure we came to any firm conclusion.

savitharaghunathan commented 1 year ago

I think concepts -> security is a good home for the hardening guide. If needed we can create a folder and add items there. eg concepts -> security -> hardening guide -> auth mechanisms. @reylejano WDYT? should we bring this up in a sig-docs meeting or create a draft PR to get feedback on the content as well as the location?

sftim commented 1 year ago

I think concepts -> security is a good home for the hardening guide

:+1:

A guide like this might then link to specific task pages, eg “Enable audit logging” “Configure KMS encryption for API objects”.

reylejano commented 1 year ago

I think concepts -> security is a good home for the hardening guide. If needed we can create a folder and add items there. eg concepts -> security -> hardening guide -> auth mechanisms. @reylejano WDYT? should we bring this up in a sig-docs meeting or create a draft PR to get feedback on the content as well as the location?

I think concepts -> security -> hardening guide works which translates to/docs/concepts/security/hardening-guide

sftim commented 1 year ago

I wonder if we want to add a section to the list: cluster network security. That's different from network policy.

For example, you can harden Kubernetes by using MACsec between nodes, with appropriately frequent rekeying (lots of alternatives exist).

raesene commented 1 year ago

yeah I could see cluster network security being a good addition, as the topic is wider than just netpol.

On the organization of the page, that makes sense to me, I'll do a PR for the Authentication section with that structure and we can see if it works well :).

raesene commented 1 year ago

Opened the PR here https://github.com/kubernetes/website/pull/42486

ashish493 commented 10 months ago

I've opened a PR for Authorization Guide - kubernetes/website/#43623. Reviews and feedback are appreciated.

ashish493 commented 10 months ago

I'm planning to pick the Resource Limits topic next. If anyone else is working on this topic, let me know if I can be of any help.

slashben commented 10 months ago

I am happy to work on

AnshumanTripathi commented 7 months ago

I volunteer to work on Scheduler Configuration.