mirror of
https://github.com/jpetazzo/container.training.git
synced 2026-02-14 17:49:59 +00:00
104 lines
1.5 KiB
Markdown
104 lines
1.5 KiB
Markdown
# Cloud Native Security
|
|
|
|
*Non-exhaustive list of best practices for Cloud Native Security.*
|
|
|
|
---
|
|
|
|
## "Less is more"
|
|
|
|
- Less code (build vs buy; Pareto 80/20)
|
|
|
|
- Less permissions (fine-grained vs blanket)
|
|
|
|
- Less dependencies (also a trade-off)
|
|
|
|
*Note: this is not at all specific to Cloud Native.*
|
|
|
|
*But security must be addressed at all layers of the stack!*
|
|
|
|
---
|
|
|
|
## Managed platforms
|
|
|
|
- Operating Kubernetes is complex
|
|
|
|
- Use a managed platform
|
|
|
|
(cloud provider or service provider)
|
|
|
|
- Restrict control plane access
|
|
|
|
- TLS cert management (check "PKI the wrong way")
|
|
|
|
- Enable Pod Security Settings
|
|
|
|
- Restrict access to cloud instance metadata
|
|
|
|
---
|
|
|
|
## K8S upgrades
|
|
|
|
- ALWAYS ALWAYS ALWAYS upgrade
|
|
|
|
(do you prefer your maintenance to be planned or unplanned?)
|
|
|
|
- Upgrades can be smooth if:
|
|
|
|
- we're using a good, managed platform
|
|
|
|
- we stay away from beta APIs
|
|
|
|
---
|
|
|
|
## Isolate compute
|
|
|
|
- Resource requests and limits for ALL workloads
|
|
|
|
- Taints, tolerations, affinities where necessary
|
|
|
|
- Secure container runtime if necessary
|
|
|
|
---
|
|
|
|
## Isolate network
|
|
|
|
- Network policies
|
|
|
|
- Advanced policies (check Cilium)
|
|
|
|
---
|
|
|
|
## Secret management
|
|
|
|
- Secrets vs ConfigMaps
|
|
|
|
- Store secrets in...:
|
|
|
|
- KMS
|
|
- External Secrets
|
|
- Sealed Secrets
|
|
- Vault
|
|
- Kamus
|
|
- SOPS
|
|
- ...
|
|
|
|
- Encrypt secrets at rest if necessary
|
|
|
|
---
|
|
|
|
## AuthN & AuthZ
|
|
|
|
- Authenticate users centrally
|
|
|
|
(e.g. OIDC, certificates)
|
|
|
|
- Have a clear path for access revocation
|
|
|
|
- Fine-grained RBAC
|
|
|
|
---
|
|
|
|
## Software supply chain
|
|
|
|
*I'm not an expert in that field but this should be on your radar!*
|