Create a security checklist for deploying a cluster

[savitharaghunathan]

While there are many checklists available, this could be a recommended checklist for ensuring security in Kubernetes clusters.

Overall guidance:

• Avoid 3rd party tools
• Avoid linking to documentation outside of K8s website (as it might not be maintained)
• If you identify a section that needs more documentation, please create an issue and tag sig-security.

Potential checklist sections:
Cluster level

• AuthN & AuthZ
• Network security - @Skybound1
• Pod security - @mtardy
• Pod placement - @Skybound1
• Secrets - @Skybound1
• Container & Image scanning - @p4ck3t0
• Enabling seccomp - @mtardy

Application/workload:

• Ingress/Network config
• RBAC

[savitharaghunathan]

/sig security docs

[mtardy]

Thanks Savitha! I think I would be glad to write the part about PodSecurity, I took a look at it recently (here) and found it very convenient to use! I could also try to handle the "Enabling seccomp" part also but don't want to take all the good stuff 😄!

I think we could discuss this at the next security documentation meeting, but for this checklist, do you envision something complete in and of itself or a short descriptions and references to the documentation?

[savitharaghunathan]

I think we could discuss this at the next security documentation meeting, but for this checklist, do you envision something complete in and of itself or a short descriptions and references to the documentation?

Thanks @mtardy :) I am thinking that we will have a one liner and also a link to documentation if available. WDYT?

[mtardy]

Yes I agree! I don't think it would be a good idea to repeat what is already well presented in the documentation, but a central page to refer to all the good security features of Kubernetes with a one liner to introduce them and why they are important would be great!

[Skybound1]

I'm happy to pick up Network Security and Secrets. Also, I agree on taking the approach of making this more summary based and linking to relevant detailed guides.

[p4ck3t0]

I can do the Container & Image scanning part. Also agreeing on the summary based approach.

[p4ck3t0]

What about confidential Kubernetes? I could link some interesting stuff to some open source projects, I was involved in.

[savitharaghunathan]

What about confidential Kubernetes? I could link some interesting stuff to some open source projects, I was involved in.

@p4ck3t0 is confidential Kubernetes a part of the Kubernetes ecosystem or core concepts? We want to limit this checklist to that and avoid third party recommendations in order to keep it vendor neutral.

[p4ck3t0]

@p4ck3t0 is confidential Kubernetes a part of the Kubernetes ecosystem or core concepts? We want to limit this checklist to that and avoid third party recommendations in order to keep it vendor neutral.

No it's not a core concept, I will focus on Container & Image scanning.

[savitharaghunathan]

No it's not a core concept, I will focus on Container & Image scanning.

@p4ck3t0 would you like to create a blog post for confidential Kubernetes? It sounds like a beneficial topic.

[p4ck3t0]

@p4ck3t0 would you like to create a blog post for confidential Kubernetes? It sounds like a beneficial topic.

@savitharaghunathan sure I want to write a short blog post about it. I just need to see if I could do both, Confidential Kubernetes blogpost and Container & Image scanning checklist.

[Skybound1]

Based of the conversation in Slack, also happy to pick up pod placement :)

[savitharaghunathan]

Based of the conversation in Slack, also happy to pick up pod placement :)

Added a new task item and assigned it to you. Thanks, @Skybound1 :)

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[cailynse]

@Skybound1 - I'd love to pair on the Network Security section if you're up for it!

[Skybound1]

@cailynse sure, happy to work with others and get their opinions :) We have got some drafts in the PR linked above (kubernetes/website#33992), feel free to have a look and give comments, happy to discuss any of the points as well :) ( Skybound on the Kube slack )

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[mtardy]

/remove-lifecycle rotten

[sftim]

@mtardy, kubernetes/website#34873 added some sound advice - you might want to add that to the checklist too.

[mtardy]

@mtardy, kubernetes/website#34873 added some sound advice - you might want to add that to the checklist too.

Indeed thanks @sftim, it's already present in the RBAC guide best practices that we recommend for that topic, do you think we should make another warning directly on the checklist? https://kubernetes.io/docs/concepts/security/rbac-good-practices/#listing-secrets

[sftim]

do you think we should make another warning directly on the checklist?

I'm fine either way. I'm not sure how you frame a common misunderstanding as a checklist item, but if there's a way then I'm all for it.

[sftim]

I noticed some security advice in kubernetes/website#35511 and thought I'd mention it here.

[mtardy]

Should we close this issue and create a central issue for updates to this page? Or should we edit this one for a follow-up?

If nobody opposes I guess I'll close this one and create another!

[sftim]

We created a checklist.

/close

(folks can reopen if they don't agree this is resolved)

[k8s-ci-robot]

@sftim: Closing this issue.

In response to this:

We created a checklist.

/close

(folks can reopen if they don't agree this is resolved)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sftim]

I like the idea of making another issue to track further improvements.

[mtardy]

(folks can reopen if they don't agree this is resolved)

You are correct I should be more confident 😄