New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add page on security model / options for Kubernetes #854

Open

2 of 3 tasks

johnharris85 opened this issue Jun 12, 2022 · 12 comments

Open

2 of 3 tasks

Add page on security model / options for Kubernetes #854

johnharris85 opened this issue Jun 12, 2022 · 12 comments

Labels

kind/feature triage/accepted

Contributor

johnharris85 commented Jun 12, 2022 •

edited by michaelbeaumont

Loading

Description

As the use of admission and security tools like OPA Gatekeeper, Twistlock, Aqua, etc... becomes more prevalent, there are frequently queries like:

Does kuma (sidecar/init) need root? If so, why?
NET_ADMIN and NET_RAW are blocked, can I still run Kuma?
Can I modify UID/GIDs? What is the impact of this?
What is the least privilege container/pod security context I can use for Kuma?
I need to allowlist any secrets/configmaps that are created, where can I find the list?
I don't want to automount service account tokens, what pattern can I use to avoid this?
How can I get granular control over the settings of the injected containers (sidecar/init) to tweak security-related settings?
- ContainerPatch is documented
Reorganize newly added/existing docs into new page

We have a number of tools at our disposal to address the above (CNI, containerpatch, etc...) and should have a docs / faq page going through common requirements / scenarios and explaining the solution / workaround. And if there are permissions / privileges that are absolutely required, we should document the scope of them, and why they are required.

Related: kumahq/kuma#4298

johnharris85 added kind/feature triage/pending labels

lahabana added triage/accepted and removed triage/pending labels

github-actions bot added the triage/stale label

Contributor

github-actions bot commented Jul 14, 2022

This issue was inactive for 30 days it will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant please comment on it promptly or attend the next triage meeting.

lahabana removed the triage/stale label

github-actions bot added the triage/stale label

Contributor

github-actions bot commented Oct 17, 2022

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

slonka removed the triage/stale label

github-actions bot added the triage/stale label

Contributor

github-actions bot commented Jan 30, 2023

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

lukidzi removed the triage/stale label

Contributor

github-actions bot commented May 1, 2023

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

github-actions bot added the triage/stale label

slonka removed the triage/stale label

Contributor

slonka commented May 2, 2023

I think this recently popped up in slack and @bartsmykla with @michaelbeaumont did some digging into this. Can you backfill this issue?

Contributor Author

johnharris85 commented May 3, 2023

Ye we've probably answered / fixed a number of these things since I opened this issue. Maybe we can revisit this and try and get something in the docs for 2.3?

github-actions bot added the triage/stale label

Contributor

github-actions bot commented Aug 2, 2023

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

michaelbeaumont removed the triage/stale label

github-actions bot added the triage/stale label

Contributor

github-actions bot commented Nov 1, 2023

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

lukidzi removed the triage/stale label

Contributor

github-actions bot commented Feb 2, 2024

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

github-actions bot added the triage/stale label

slonka removed the triage/stale label

Contributor

slonka commented Feb 7, 2024

@johnharris85 is this page https://kuma.io/docs/2.6.x/production/#security ok for

Reorganize newly added/existing docs into new page

or did you have something else in mind?

slonka added the triage/needs-information label

jakubdyszkiewicz removed the triage/needs-information label

github-actions bot added the triage/stale label

Contributor

github-actions bot commented May 27, 2024

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

lukidzi removed the triage/stale label

github-actions bot added the triage/stale label

Contributor

github-actions bot commented Aug 26, 2024

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

bartsmykla removed the triage/stale label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment