search

kubernetes / website

Kubernetes website and documentation repo:
https://kubernetes.io
Creative Commons Attribution 4.0 International
4.6k stars 14.49k forks source link

Improve security-related documentation #25119

Open sftim opened 4 years ago

sftim commented 4 years ago

This is an umbrella issue

What would you like to be added Review and possibly revise the existing pages on the topic of Kubernetes security.

Why is this needed It's important to help readers understand how to make sure a Kubernetes cluster has appropriate security controls.

Comments

Look at the overall body of topics related to security context and policy. Do we have the right set of topics? Have we covered all the important points?. Is there overlap that could be reduced? Here are some of the existing topics:

/sig security

kbhawkey commented 4 years ago

/triage accepted

kbhawkey commented 4 years ago

The docs security overview concept page contains a table of links as well as more links (Secrets, encryption at rest, ...) at the bottom of the page.

sftim commented 3 years ago

I reckon it'd be handy if we could find a way to link to https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ and maybe draw inspiration from https://aws.github.io/aws-eks-best-practices/security/docs/

savitharaghunathan commented 3 years ago

/priority important-longterm

fejta-bot commented 3 years ago

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale

kbhawkey commented 3 years ago

/remove-lifecycle stale

sftim commented 3 years ago

Also see issue #27515

fejta-bot commented 3 years ago

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale

k8s-triage-robot commented 3 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

savitharaghunathan commented 3 years ago

/remove-lifecycle rotten

sftim commented 3 years ago

https://github.com/kubernetes/website/issues/27370#issuecomment-900397304 feels relevant too

sftim commented 3 years ago

/remove-lifecycle rotten

k8s-triage-robot commented 3 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

savitharaghunathan commented 3 years ago

/remove-lifecycle stale

shannonxtreme commented 3 years ago

/lifecycle frozen

sftim commented 2 years ago

Is this issue still needed? It might be too broad.

shannonxtreme commented 2 years ago

Might be too broad yes. I think there are useful asks in it though. Some have been improved on since this was opened. Maybe this could morph into a collection of the various umbrella issues like ServiceAccount, Secrets, etc? Or we can just close this

raesene commented 1 year ago

One point on this is that I think "securing a cluster" would be replaced by a combination of the hardening guide that's in progress and the security checklist.

sftim commented 1 year ago

If people have bookmarked https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/ and go to that URL, what should (eventually) happen?

sftim commented 1 year ago

Also see https://github.com/kubernetes/website/issues/44169

sftim commented 11 months ago

Also see https://github.com/kubernetes/website/issues/44430

adityasamant25 commented 11 months ago

Will it be good to add more content to the Security Tutorials on topics that complement Kubernetes security by using 3rd party tools? I'm thinking of step-by-step guides that people can follow along on their local K8S clusters (minikube?).

Topic examples could be implementing policies using OPA Gatekeeper, Runtime sandboxes like gvisor, trivy for vulnerability scanning etc. I know these topics are discussed in older blog posts or the community forums, but could be good to have them listed in the official tutorials. The basic commands and tutorials can be explained with reference to the official documentation of the 3rd party tools if people want to get into the details.

kumarankit999 commented 11 months ago

Yes, @adityasamant25 I'm agree with you that we can add more content like this above!!

sftim commented 11 months ago

Topic examples could be implementing policies using OPA Gatekeeper, Runtime sandboxes like gvisor, trivy for vulnerability scanning etc. I know these topics are discussed in older blog posts or the community forums, but could be good to have them listed in the official tutorials.

Those might be better handled as newer blog posts. We try not to document too much about 3rd party software, as it is harder to maintain. If the original blog article's author supports it, we could also link a new article to the previous article and vice versa.

kumarankit999 commented 11 months ago

Yes @sftim, how are we achieving that?

sftim commented 11 months ago

Yes @sftim, how are we achieving that?

My role here is principally as reporter; I'm the person who suggested that an improvement is needed.

Specifically to @adityasamant25's question:

Will it be good to add more content to the Security Tutorials on topics that complement Kubernetes security by using 3rd party tools?

then the answer is in my opinion ”No”.

If you'd like to write more blogs about using 3rd party tools to secure your cluster, that could be handy. I think using a separate issue to track that work would help, though. Doing that leaves this issue to track the topic at hand.

sftim commented 1 month ago

Also see https://github.com/kubernetes/website/issues/48546