Kubernetes Security

https://kubernetes-security.info

Cluster

https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/

API Server

Transport

TLS/HTTPS

Authentication

https://kubernetes.io/docs/reference/access-authn-authz/authentication/

https://github.com/dexidp/dex

Authorization

https://kubernetes.io/docs/reference/access-authn-authz/authorization/

https://kubernetes.io/docs/reference/access-authn-authz/rbac/

Audit Logging

https://kubernetes.io/docs/tasks/debug-application-cluster/audit/

Kubelet

These things are done by kubeadm automatically.

https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/

etcd

https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/

https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/hardware.md#example-hardware-configurations

Resources

https://kubernetes.io/docs/concepts/policy/resource-quotas/

Memory

https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/memory-default-namespace/

CPU

https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/cpu-default-namespace/

Container

Pods

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

User

https://kubernetes.io/docs/concepts/policy/pod-security-policy/

Network

https://www.projectcalico.org/using-network-policy-in-concert-with-istio/

Network Policies

https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/

Istio RBAC

https://istio.io/docs/reference/config/authorization/istio.rbac.v1alpha1/

Secrets

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/

Dynamic Secrets

https://medium.com/@gmaliar/dynamic-secrets-on-kubernetes-pods-using-vault-35d9094d169

ACME

https://github.com/jetstack/cert-manager/