GoWiki | ston1th | Kubernetes Security

# Kubernetes Security

https://kubernetes-security.info

# Cluster

https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/

## API Server

### Transport

TLS/HTTPS

### Authentication

https://kubernetes.io/docs/reference/access-authn-authz/authentication/

https://github.com/dexidp/dex

### Authorization

https://kubernetes.io/docs/reference/access-authn-authz/authorization/

https://kubernetes.io/docs/reference/access-authn-authz/rbac/

### Audit Logging

https://kubernetes.io/docs/tasks/debug-application-cluster/audit/

## Kubelet

These things are done by `kubeadm` automatically.

https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/

## etcd

https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/

https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/hardware.md#example-hardware-configurations

## Resources

https://kubernetes.io/docs/concepts/policy/resource-quotas/

### Memory

https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/memory-default-namespace/

### CPU

https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/cpu-default-namespace/

## Container

### Pods

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

### User

https://kubernetes.io/docs/concepts/policy/pod-security-policy/

## Network

https://www.projectcalico.org/using-network-policy-in-concert-with-istio/

### Network Policies

https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/

### Istio RBAC

https://istio.io/docs/reference/config/authorization/istio.rbac.v1alpha1/

## Secrets

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/

### Dynamic Secrets

https://medium.com/@gmaliar/dynamic-secrets-on-kubernetes-pods-using-vault-35d9094d169

# ACME

https://github.com/jetstack/cert-manager/