Security reference links

[taylor]

This discussion is to give a place to dump any K8s-related security references

Starting it with https://kubernetes.io/docs/concepts/security/overview/

This overview defines a model for thinking about Kubernetes security in the context of Cloud Native security.

The 4C's of Cloud Native security
You can think about security in layers. The 4C's of Cloud Native security are Cloud, Clusters, Containers, and Code.

K8s docs

• https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/
• https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/
• https://kubernetes.io/docs/concepts/configuration/overview/ - Configuration Best Practices
• https://kubernetes.io/docs/concepts/security/pod-security-standards/
• https://kubernetes.io/docs/concepts/security/pod-security-admission/
• https://kubernetes.io/docs/concepts/security/controlling-access/

Cloud provider docs on best practices

• https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security
• https://aws.amazon.com/about-aws/whats-new/2020/05/introducing-amazon-eks-best-practices-guide-for-security/
• https://developer.ibm.com/articles/ibm-best-practices-for-the-kubernetes-cicd-secure-container-image-pipeline/
• https://cloud.redhat.com/blog/openshift-security-best-practices-for-kubernetes-cluster-design
• https://cloud.redhat.com/blog/openshift-runtime-security-best-practices
• https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster
• https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
• https://services.google.com/fh/files/misc/security_whitepapers_march2018.pdf

[taylor]

https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/

NSA and CISA 52-page cybersecurity technical report on securing K8s

[electrocucaracha]

What about tools related to that topic like Kubescape