Kubernetes Hardening Guide #30
Description
What would you like to be added
As part of SIG-Security-Docs, we've been discussing the creation of a hardening guide for Kubernetes. We've got an initial document for the guide's creation here https://docs.google.com/document/d/1teb42X_c5_k8PNOSEEEbVnEr9aVAwWJXezBuf5fdmZU/edit
Why is this needed
The goal of the hardening guide is to provide guidance to cluster operators about how they can improve the security of their clusters. This will be done by discussing the major areas of security relating to a Kubernetes cluster, looking at the options available for hardening and the trade-offs inherent in them. In contrast to existing 3rd party documentation in this area (the CIS benchmark) which is a prescriptive audit style document, this guide should provide a more discursive approach.
Table of Areas
| Section | Assignee | PR(s) |
|---|---|---|
| Threat Model | @cailynse | |
| Control Plane Configuration | ||
| API Server Configuration | ||
| Scheduler Configuration | @AnshumanTripathi | kubernetes/website#45080 |
| Controller Manager Configuration | ||
| File Permissions | ||
| Worker Node Configuration | ||
| PKI Management | ||
| Cluster Authentication | @raesene | |
| Authorization | @bjornsen @vinayakankugoyal | |
| Workload Security Configuration | ||
| Network Policy Configuration | @cailynse | |
| Resource Limits | ||
| Add-On Configuration | ||
| etcd | @krol3 |