github/awesome-kubernetes
1
0
Fork 0
mirror of https://github.com/nubenetes/awesome-kubernetes.git synced 2026-03-06 03:30:44 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
220e843bb46cc05bc73663fcf838fa9dbf547632
awesome-kubernetes/docs/openshift.md
Inaki Fernandez 220e843bb4 updates
2020-05-07 11:47:45 +02:00

41 KiB
Raw Blame History

OpenShift

OpenShift Container Platform 3 (OCP 3)

OpenShift Cheat Sheets

Helm Charts and OpenShift 3

Chaos Monkey for kubernetes/Openshift

OpenShift GitOps

Debugging apps

Capacity Management

OpenShift High Availability

Troubleshooting Java applications on Openshift

Red Hat Communities of Practice

Identity Management

Quota Management

OpenShift Container Platform 4 (OCP 4)

OpenShift 4 roadmap

OpenShift Kubernetes Engine (OKE)

openshift4 architecture

Storage in OCP 4

OpenShift Pipelines. Tekton CI/CD Pipelines

OpenShift 4 Training

Red Hat Advanced Cluster Management for Kubernetes

Red Hat CodeReady Containers. OpenShift 4 on your laptop

OpenShift Hive: Cluster-as-a-Service. Easily provision new PaaS environments for developers

OpenShift 4 Master API Protection in Public Cloud

Backup and Migrate to OpenShift 4

OKD4. OpenShift 4 without enterprise-level support

OpenShift Serverless with Knative

Helm Charts and OpenShift 4

Red Hat Marketplace

Kubestone. Benchmarking Operator for K8s and OpenShift

OpenShift Cost Management

Operators in OCP 4

Quay Container Registry

E-books

Online Learning

Local Installers

Cluster Installers

OKD 3

OpenShift 3

OpenShift 4

Networking (OCP 3 and OCP 4)

Security

How is OpenShift Container Platform Secured?

Managing Security Context Constraints

Review Security Context Constraints

  • Security Context Constraints (SCCs) control what actions pods can perform and what resources they can access.
  • SCCs combine a set of security configurations into a single policy object that can be applied to pods. These security configurations include, but are not limited to, Linux Capabilities, Seccomp Profiles, User and Group ID Ranges, and types of mounts.
  • OpenShift ships with several SCCs. The most constrained is the restricted SCC, and the least constrained in the privileged SCC. The other SCCs provide intermediate levels of constraint for various use cases. The restricted SCC is granted to all authenticated users by default.
  • The default SCC for most pods should be the restricted SCC. If required, a cluster administrator may allow certain pods to run with different SCCs. Pods should be run with the most restrictive SCC possible.
  • Pods inherit their SCC from the Service Account used to run the pod. With the default project template, new projects get a Service Account named default that is used to run pods. This default service account is only granted the ability to run the restricted SCC.
  • Recommendations:
    • Use OpenShift's Security Context Constraint feature, which has been contributed to Kubernetes as Pod Security Policies. PSPs are still beta in Kubernetes 1.10, 1.11, and 1.12.
    • Use the restricted SCC as the default
    • For pods that require additional access, use the SCC that grants the least amount of additional privileges or create a custom SCC Audit
    • To show all available SCCs: oc describe scc
    • To audit a single pod: oc describe pod <POD> | grep openshift.io\/scc
    • Remediation: Apply the SCC with the least privilege required

Network Policy

Network Security Zones

Demos

Openshift Compliant Docker Images

OpenShift on AWS

Other Awesome Lists

Videos

Slides

Reference in New Issue View Git Blame Copy Permalink