"use strict"; const {Fragment: _Fragment, jsxDEV: _jsxDEV} = arguments[0]; const {useMDXComponents: _provideComponents} = arguments[0]; function _createMdxContent(props) { const _components = { h1: "h1", h2: "h2", h3: "h3", h4: "h4", input: "input", li: "li", ol: "ol", p: "p", strong: "strong", ul: "ul", ..._provideComponents(), ...props.components }, {CH} = _components; if (!CH) _missingMdxReference("CH", false, "17:1-27:4"); if (!CH.Code) _missingMdxReference("CH.Code", true, "17:1-27:4"); return _jsxDEV(_Fragment, { children: [_jsxDEV("style", { dangerouslySetInnerHTML: { __html: "[data-ch-theme=\"assistance\"] { --ch-t-colorScheme: var(--ch-0);--ch-t-foreground: var(--ch-4);--ch-t-background: var(--ch-16);--ch-t-editor-background: var(--ch-16);--ch-t-editor-foreground: var(--ch-4);--ch-t-editor-rangeHighlightBackground: var(--ch-19);--ch-t-editor-infoForeground: var(--ch-18);--ch-t-editor-selectionBackground: var(--ch-17);--ch-t-tab-activeBackground: var(--ch-16);--ch-t-tab-activeForeground: var(--ch-4);--ch-t-tab-inactiveBackground: var(--ch-21);--ch-t-tab-inactiveForeground: var(--ch-15);--ch-t-tab-border: var(--ch-22);--ch-t-tab-activeBorder: var(--ch-16);--ch-t-editorGroupHeader-tabsBackground: var(--ch-21);--ch-t-editorLineNumber-foreground: var(--ch-20);--ch-t-input-foreground: var(--ch-4);--ch-t-sideBar-foreground: var(--ch-4);--ch-t-list-hoverBackground: var(--ch-25);--ch-t-list-hoverForeground: var(--ch-4); }" } }, undefined, false, { fileName: "" }, this), "\n", _jsxDEV(_components.h1, { id: "kubernetes-security-hardening-complete-production-guide", children: "Kubernetes Security Hardening: Complete Production Guide" }, undefined, false, { fileName: "", lineNumber: 2, columnNumber: 1 }, this), "\n", _jsxDEV(_components.p, { children: "Kubernetes security is a critical concern for organizations running containerized workloads in production. This comprehensive guide covers essential security hardening techniques, from cluster configuration to runtime protection, ensuring your Kubernetes deployments meet enterprise security standards." }, undefined, false, { fileName: "", lineNumber: 4, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "security-fundamentals", children: "Security Fundamentals" }, undefined, false, { fileName: "", lineNumber: 6, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "the-4cs-of-cloud-native-security", children: "The 4C's of Cloud Native Security" }, undefined, false, { fileName: "", lineNumber: 8, columnNumber: 1 }, this), "\n", _jsxDEV(_components.ol, { children: ["\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Cloud" }, undefined, false, { fileName: "", lineNumber: 10, columnNumber: 4 }, this), ": Physical infrastructure, networks, and storage"] }, undefined, true, { fileName: "", lineNumber: 10, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Cluster" }, undefined, false, { fileName: "", lineNumber: 11, columnNumber: 4 }, this), ": Kubernetes components and configuration"] }, undefined, true, { fileName: "", lineNumber: 11, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Container" }, undefined, false, { fileName: "", lineNumber: 12, columnNumber: 4 }, this), ": Application containers and images"] }, undefined, true, { fileName: "", lineNumber: 12, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Code" }, undefined, false, { fileName: "", lineNumber: 13, columnNumber: 4 }, this), ": Application code and dependencies"] }, undefined, true, { fileName: "", lineNumber: 13, columnNumber: 1 }, this), "\n"] }, undefined, true, { fileName: "", lineNumber: 10, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "security-layers", children: "Security Layers" }, undefined, false, { fileName: "", lineNumber: 15, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "┌─────────────────────────────────────┐", "props": {} }] }, { "tokens": [{ "content": "│ Application Code │", "props": {} }] }, { "tokens": [{ "content": "├─────────────────────────────────────┤", "props": {} }] }, { "tokens": [{ "content": "│ Container Runtime │", "props": {} }] }, { "tokens": [{ "content": "├─────────────────────────────────────┤", "props": {} }] }, { "tokens": [{ "content": "│ Kubernetes Cluster │", "props": {} }] }, { "tokens": [{ "content": "├─────────────────────────────────────┤", "props": {} }] }, { "tokens": [{ "content": "│ Cloud/Infrastructure │", "props": {} }] }, { "tokens": [{ "content": "└─────────────────────────────────────┘", "props": {} }] }], "lang": "text" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 17, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "cluster-security-hardening", children: "Cluster Security Hardening" }, undefined, false, { fileName: "", lineNumber: 29, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "1-api-server-security", children: "1. API Server Security" }, undefined, false, { fileName: "", lineNumber: 31, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "secure-api-server-configuration", children: "Secure API Server Configuration" }, undefined, false, { fileName: "", lineNumber: 33, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# kube-apiserver security configuration", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Pod", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " containers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kube-apiserver", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " command", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kube-apiserver", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--advertise-address=192.168.1.100", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--allow-privileged=true", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--authorization-mode=Node,RBAC", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--client-ca-file=/etc/kubernetes/pki/ca.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--enable-bootstrap-token-auth=true", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--etcd-servers=https://127.0.0.1:2379", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--kubelet-certificate-authority=/etc/kubernetes/pki/ca.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--requestheader-allowed-names=front-proxy-client", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--requestheader-extra-headers-prefix=X-Remote-Extra-", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--requestheader-group-headers=X-Remote-Group", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--requestheader-username-headers=X-Remote-User", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--secure-port=6443", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--service-account-issuer=https://kubernetes.default.svc.cluster.local", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--service-account-key-file=/etc/kubernetes/pki/sa.pub", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--service-account-signing-key-file=/etc/kubernetes/pki/sa.key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--service-cluster-ip-range=10.96.0.0/12", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--tls-cert-file=/etc/kubernetes/pki/apiserver.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--tls-private-key-file=/etc/kubernetes/pki/apiserver.key", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 34, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "anonymous-access-control", children: "Anonymous Access Control" }, undefined, false, { fileName: "", lineNumber: 72, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Disable anonymous access", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ConfigMap", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "cluster-config", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kube-system", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "data", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " apiserver", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "|", "props": { "style": { "color": "var(--ch-7)" } } }] }, { "tokens": [{ "content": " anonymous-auth: false", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " enable-admission-plugins:", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - NodeRestriction", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - PodSecurityPolicy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ServiceAccount", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 73, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "2-etcd-security", children: "2. etcd Security" }, undefined, false, { fileName: "", lineNumber: 89, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "secure-etcd-configuration", children: "Secure etcd Configuration" }, undefined, false, { fileName: "", lineNumber: 91, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# etcd security configuration", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Pod", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " containers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "etcd", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " command", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "etcd", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--name=master-1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--data-dir=/var/lib/etcd", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--listen-peer-urls=https://192.168.1.100:2380", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--listen-client-urls=https://127.0.0.1:2379,https://192.168.1.100:2379", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--advertise-client-urls=https://192.168.1.100:2379", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--initial-advertise-peer-urls=https://192.168.1.100:2380", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--initial-cluster=master-1=https://192.168.1.100:2380", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--initial-cluster-token=etcd-cluster", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--initial-cluster-state=new", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--cert-file=/etc/kubernetes/pki/etcd/server.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--key-file=/etc/kubernetes/pki/etcd/server.key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--client-cert-auth=true", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--peer-key-file=/etc/kubernetes/pki/etcd/peer.key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--peer-client-cert-auth=true", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--peer-auto-tls=true", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--auto-tls=true", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 92, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "etcd-encryption-at-rest", children: "etcd Encryption at Rest" }, undefined, false, { fileName: "", lineNumber: 122, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Enable etcd encryption", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "EncryptionConfig", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "secrets", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " providers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "aescbc", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " keys", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "key1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " secret", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "identity", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": {}", "props": { "style": { "color": "var(--ch-4)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 123, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "3-network-security", children: "3. Network Security" }, undefined, false, { fileName: "", lineNumber: 138, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "network-policy-enforcement", children: "Network Policy Enforcement" }, undefined, false, { fileName: "", lineNumber: 140, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Default deny all network policy", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "networking.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "NetworkPolicy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "default-deny-all", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "default", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " podSelector", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": {}", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " policyTypes", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Ingress", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Egress", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 141, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "application-specific-network-policy", children: "Application-Specific Network Policy" }, undefined, false, { fileName: "", lineNumber: 155, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Web application network policy", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "networking.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "NetworkPolicy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "web-app-netpol", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " podSelector", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " matchLabels", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " app", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "web-app", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " policyTypes", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Ingress", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Egress", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " ingress", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "from", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "podSelector", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " matchLabels", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " app", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "load-balancer", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " ports", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "protocol", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "TCP", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " port", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "80", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " egress", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "to", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "podSelector", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " matchLabels", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " app", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "database", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " ports", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "protocol", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "TCP", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " port", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "5432", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "to", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": []", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " ports", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "protocol", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "TCP", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " port", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "53", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "protocol", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "UDP", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " port", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "53", "props": { "style": { "color": "var(--ch-2)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 156, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "cni-network-plugin-security", children: "CNI Network Plugin Security" }, undefined, false, { fileName: "", lineNumber: 194, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Calico network policy example", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "projectcalico.org/v3", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "GlobalNetworkPolicy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "default-deny", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " selector", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "all()", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " types", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Ingress", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Egress", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " egress", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "action", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Allow", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " protocol", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "UDP", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " destination", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " ports", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "53", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "action", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Allow", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " protocol", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "TCP", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " destination", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " ports", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "443", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "80", "props": { "style": { "color": "var(--ch-2)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 195, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "rbac-and-access-control", children: "RBAC and Access Control" }, undefined, false, { fileName: "", lineNumber: 220, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "1-role-based-access-control", children: "1. Role-Based Access Control" }, undefined, false, { fileName: "", lineNumber: 222, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "service-account-management", children: "Service Account Management" }, undefined, false, { fileName: "", lineNumber: 224, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Create dedicated service account", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ServiceAccount", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "web-app-sa", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "---", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": "# Define role with minimal permissions", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "rbac.authorization.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Role", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "web-app-role", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "rules", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "apiGroups", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"pods\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"configmaps\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"secrets\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " verbs", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"get\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"list\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"watch\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "apiGroups", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"apps\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"deployments\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " verbs", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"get\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"list\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"watch\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"update\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"patch\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "---", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": "# Bind role to service account", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "rbac.authorization.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "RoleBinding", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "web-app-binding", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "subjects", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ServiceAccount", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "web-app-sa", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "roleRef", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Role", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "web-app-role", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " apiGroup", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "rbac.authorization.k8s.io", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 225, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "cluster-roles-for-system-components", children: "Cluster Roles for System Components" }, undefined, false, { fileName: "", lineNumber: 263, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Cluster role for system:node", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "rbac.authorization.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ClusterRole", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "system:node", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "rules", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "apiGroups", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"pods\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"pods/status\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"pods/log\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " verbs", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"get\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"list\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"watch\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"update\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"patch\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "apiGroups", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"nodes\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"nodes/status\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " verbs", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"get\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"list\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"watch\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"update\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"patch\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 264, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "2-pod-security-policies", children: "2. Pod Security Policies" }, undefined, false, { fileName: "", lineNumber: 279, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "pod-security-standards", children: "Pod Security Standards" }, undefined, false, { fileName: "", lineNumber: 281, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Pod Security Admission Configuration", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "apiserver.config.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "AdmissionConfiguration", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "plugins", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "PodSecurity", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " configuration", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "pod-security.admission.config.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "PodSecurityConfiguration", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " defaults", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " enforce", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"restricted\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " audit", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"restricted\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " warn", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"restricted\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " exemptions", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " namespaces", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"kube-system\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " runtimeClasses", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"privileged\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " usernames", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"system:serviceaccount:kube-system:replication-controller\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 282, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "restricted-pod-security-policy", children: "Restricted Pod Security Policy" }, undefined, false, { fileName: "", lineNumber: 301, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Restricted security policy", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "policy/v1beta1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "PodSecurityPolicy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "restricted", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " privileged", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "false", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " allowPrivilegeEscalation", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "false", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " requiredDropCapabilities", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ALL", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " volumes", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'configMap'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'emptyDir'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'projected'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'secret'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'downwardAPI'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'persistentVolumeClaim'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " runAsUser", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " rule", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'MustRunAsNonRoot'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " seLinux", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " rule", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'RunAsAny'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " fsGroup", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " rule", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "'RunAsAny'", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " readOnlyRootFilesystem", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "true", "props": { "style": { "color": "var(--ch-2)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 302, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "container-security", children: "Container Security" }, undefined, false, { fileName: "", lineNumber: 329, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "1-image-security", children: "1. Image Security" }, undefined, false, { fileName: "", lineNumber: 331, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "secure-base-images", children: "Secure Base Images" }, undefined, false, { fileName: "", lineNumber: 333, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Use minimal base images", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "FROM", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " gcr.io/distroless/static-debian11 ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "AS", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " base", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "FROM", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " base ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "AS", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " runtime", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "# Multi-stage build for security", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "FROM", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " golang:1.21-alpine ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "AS", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " builder", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "WORKDIR", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " /app", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "COPY", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " go.mod go.sum ./", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "RUN", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " go mod download", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "COPY", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " . .", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "RUN", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " CGO_ENABLED=0 GOOS=linux go build -o /app/server", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "# Final minimal image", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "FROM", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " runtime", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "COPY", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " --from=builder /app/server /server", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "USER", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " 65534:65534", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "EXPOSE", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " 8080", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "ENTRYPOINT", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": " [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"/server\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }], "lang": "dockerfile" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 334, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "image-scanning-with-trivy", children: "Image Scanning with Trivy" }, undefined, false, { fileName: "", lineNumber: 355, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Kubernetes Job for image scanning", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "batch/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Job", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "image-scan", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " template", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " containers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "trivy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " image", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "aquasec/trivy:latest", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " command", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "trivy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "image", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--format", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "json", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--output", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "/reports/scan-report.json", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "nginx:latest", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " volumeMounts", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "reports", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " mountPath", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "/reports", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " volumes", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "reports", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " persistentVolumeClaim", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " claimName", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "scan-reports-pvc", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " restartPolicy", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Never", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 356, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "image-admission-policy", children: "Image Admission Policy" }, undefined, false, { fileName: "", lineNumber: 386, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# OPA Gatekeeper policy for image security", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "templates.gatekeeper.sh/v1beta1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ConstraintTemplate", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "k8sallowedrepos", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " crd", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " names", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "K8sAllowedRepos", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " targets", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "target", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "admission.k8s.gatekeeper.sh", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " rego", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "|", "props": { "style": { "color": "var(--ch-7)" } } }] }, { "tokens": [{ "content": " package k8sallowedrepos", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " violation[{\"msg\": msg}] {", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " container := input.review.object.spec.containers[_]", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " not allowed_repo(container.image)", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " msg := sprintf(\"container %q uses image %q which is not allowed\", [container.name, container.image])", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " }", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " allowed_repo(image) {", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " startswith(image, \"gcr.io/my-company/\")", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " }", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 387, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "2-runtime-security", children: "2. Runtime Security" }, undefined, false, { fileName: "", lineNumber: 414, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "falco-runtime-monitoring", children: "Falco Runtime Monitoring" }, undefined, false, { fileName: "", lineNumber: 416, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Falco configuration for security monitoring", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ConfigMap", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "falco-config", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "falco", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "data", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " falco_rules.yaml", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "|", "props": { "style": { "color": "var(--ch-7)" } } }] }, { "tokens": [{ "content": " - rule: Detect shell in container", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " desc: Detect shell spawned in container", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " condition: >", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " spawned_process and", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " container and", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " proc.name in (bash, sh, zsh, dash) and", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " not user.name = \"root\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " output: >", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " Shell spawned in container (user=%user.name container=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " priority: WARNING", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " tags: [container, shell]", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 417, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "seccomp-profiles", children: "Seccomp Profiles" }, undefined, false, { fileName: "", lineNumber: 439, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Pod with custom seccomp profile", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Pod", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "secure-pod", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " securityContext", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " seccompProfile", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " type", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Localhost", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " localhostProfile", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "profiles/secure-profile.json", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " containers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "app", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " image", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "nginx:latest", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " securityContext", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " allowPrivilegeEscalation", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "false", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " readOnlyRootFilesystem", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "true", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " capabilities", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " drop", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ALL", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " runAsNonRoot", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "true", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " runAsUser", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "1000", "props": { "style": { "color": "var(--ch-2)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 440, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "apparmorselinux-profiles", children: "AppArmor/SELinux Profiles" }, undefined, false, { fileName: "", lineNumber: 464, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Pod with AppArmor profile", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Pod", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "apparmor-pod", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " annotations", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " container.apparmor.security.beta.kubernetes.io/nginx", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "localhost/docker-default", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " containers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "nginx", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " image", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "nginx:latest", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " securityContext", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " appArmorProfile", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " type", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Localhost", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " localhostProfile", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "docker-default", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 465, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "secrets-management", children: "Secrets Management" }, undefined, false, { fileName: "", lineNumber: 483, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "1-kubernetes-secrets", children: "1. Kubernetes Secrets" }, undefined, false, { fileName: "", lineNumber: 485, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "encrypted-secrets", children: "Encrypted Secrets" }, undefined, false, { fileName: "", lineNumber: 487, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Secret with encryption", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Secret", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "database-credentials", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " annotations", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " sealedsecrets.bitnami.com/cluster-wide", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"true\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "type", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Opaque", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "data", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " username", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " password", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " connection-string", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 488, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "sealed-secrets-operator", children: "Sealed Secrets Operator" }, undefined, false, { fileName: "", lineNumber: 504, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# SealedSecret for secure secret management", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "bitnami.com/v1alpha1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "SealedSecret", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "api-key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " encryptedData", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " api-key", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "AgBy3i4OJSWK+PiTySYZZA9rO43cGDEQAx...", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " template", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "api-key", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " type", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Opaque", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 505, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "2-external-secret-management", children: "2. External Secret Management" }, undefined, false, { fileName: "", lineNumber: 522, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "hashicorp-vault-integration", children: "HashiCorp Vault Integration" }, undefined, false, { fileName: "", lineNumber: 524, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Vault Agent Injector", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Pod", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "vault-app", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " annotations", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " vault.hashicorp.com/agent-inject", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"true\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " vault.hashicorp.com/role", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"database\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " vault.hashicorp.com/secret-config-path", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"secret/database\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " containers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "app", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " image", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "myapp:latest", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " env", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "DB_PASSWORD", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " valueFrom", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " secretKeyRef", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "vault-secret-database", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " key", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "password", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 525, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "external-secrets-operator", children: "External Secrets Operator" }, undefined, false, { fileName: "", lineNumber: 547, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# ExternalSecret for AWS Secrets Manager", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "external-secrets.io/v1beta1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ExternalSecret", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "aws-secrets", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " refreshInterval", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "1h", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " secretStoreRef", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "aws-secrets-store", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "SecretStore", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " target", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "app-secrets", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " creationPolicy", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Owner", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " data", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "secretKey", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "database-password", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " remoteRef", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " key", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production/database/password", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 548, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "compliance-and-auditing", children: "Compliance and Auditing" }, undefined, false, { fileName: "", lineNumber: 569, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "1-audit-logging", children: "1. Audit Logging" }, undefined, false, { fileName: "", lineNumber: 571, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "comprehensive-audit-policy", children: "Comprehensive Audit Policy" }, undefined, false, { fileName: "", lineNumber: 573, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# audit-policy.yaml", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "audit.k8s.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Policy", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "rules", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "level", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Metadata", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespaces", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"kube-system\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"default\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"production\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "group", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"secrets\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"configmaps\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"serviceaccounts\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "group", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"rbac.authorization.k8s.io\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"roles\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"rolebindings\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"clusterroles\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"clusterrolebindings\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "level", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Request", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespaces", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"production\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "group", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"apps\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"deployments\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"replicasets\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"daemonsets\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": ", ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"statefulsets\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "group", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"pods\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "- ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "level", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "RequestResponse", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespaces", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"kube-system\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "group", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " resources", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": [", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"nodes\"", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "]", "props": { "style": { "color": "var(--ch-4)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 574, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "audit-log-collection", children: "Audit Log Collection" }, undefined, false, { fileName: "", lineNumber: 600, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Fluentd for audit log collection", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ConfigMap", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "fluentd-config", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kube-system", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "data", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " fluent.conf", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "|", "props": { "style": { "color": "var(--ch-7)" } } }] }, { "tokens": [{ "content": " ", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " @type tail", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " path /var/log/kubernetes/audit.log", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " pos_file /var/log/fluentd-audit.log.pos", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " tag kubernetes.audit", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " format json", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " time_format %Y-%m-%dT%H:%M:%S.%NZ", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " ", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " ", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " @type elasticsearch", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " host elasticsearch.logging.svc.cluster.local", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " port 9200", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " index_name kubernetes-audit", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " type_name _doc", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " ", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 601, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "2-cis-benchmark-compliance", children: "2. CIS Benchmark Compliance" }, undefined, false, { fileName: "", lineNumber: 628, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "cis-compliance-scanner", children: "CIS Compliance Scanner" }, undefined, false, { fileName: "", lineNumber: 630, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# kube-bench job for CIS compliance", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "batch/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Job", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kube-bench", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " template", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " hostPID", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "true", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " containers", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kube-bench", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " image", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "aquasec/kube-bench:latest", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " command", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kube-bench", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "run", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--benchmark", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "cis-1.8", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--format", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "json", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "--outputfile", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "/reports/kube-bench-report.json", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " volumeMounts", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "config", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " mountPath", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "/etc/kubernetes", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "reports", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " mountPath", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "/reports", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " volumes", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "config", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " hostPath", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " path", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "/etc/kubernetes", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "reports", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " persistentVolumeClaim", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " claimName", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "compliance-reports-pvc", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " restartPolicy", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Never", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 631, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "security-monitoring-and-alerting", children: "Security Monitoring and Alerting" }, undefined, false, { fileName: "", lineNumber: 668, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "1-prometheus-security-metrics", children: "1. Prometheus Security Metrics" }, undefined, false, { fileName: "", lineNumber: 670, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "security-metrics-exporter", children: "Security Metrics Exporter" }, undefined, false, { fileName: "", lineNumber: 672, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Prometheus security rules", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "monitoring.coreos.com/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "PrometheusRule", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kubernetes-security-rules", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "monitoring", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " groups", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "kubernetes.security", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " rules", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "alert", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "PodSecurityPolicyViolation", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " expr", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "increase(kube_pod_status_phase{phase=\"Failed\"}[5m]) > 0", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " for", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "0m", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " labels", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " severity", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "warning", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " annotations", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " summary", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"Pod security policy violation detected\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " description", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"Pod {{ $labels.pod }} in namespace {{ $labels.namespace }} failed to start\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "alert", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "UnauthorizedAPIAccess", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " expr", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "increase(apiserver_request_total{verb=\"create\"}[5m]) > 10", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " for", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "2m", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " labels", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " severity", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "critical", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " annotations", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " summary", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"High rate of unauthorized API access\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " description", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"More than 10 create requests detected in 5 minutes\"", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 673, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "2-falco-security-alerts", children: "2. Falco Security Alerts" }, undefined, false, { fileName: "", lineNumber: 703, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "falco-alert-integration", children: "Falco Alert Integration" }, undefined, false, { fileName: "", lineNumber: 705, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Falco alert configuration", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "ConfigMap", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "falco-config", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "falco", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "data", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " falco.yaml", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "|", "props": { "style": { "color": "var(--ch-7)" } } }] }, { "tokens": [{ "content": " output_file: \"/var/log/falco.log\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " stdout_output:", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " enabled: false", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " syslog_output:", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " enabled: true", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " program_output:", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " enabled: true", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " keep_alive: false", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " program: \"jq '{text: .output}' | curl -X POST -H 'Content-Type: application/json' -d @- http://alertmanager:9093/api/v1/alerts\"", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 706, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "disaster-recovery-and-backup", children: "Disaster Recovery and Backup" }, undefined, false, { fileName: "", lineNumber: 726, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "1-etcd-backup-strategy", children: "1. Etcd Backup Strategy" }, undefined, false, { fileName: "", lineNumber: 728, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "automated-etcd-backup", children: "Automated Etcd Backup" }, undefined, false, { fileName: "", lineNumber: 730, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "#!/bin/bash", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "# etcd-backup.sh", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "ETCDCTL_API", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "=", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": "3 ", "props": { "style": { "color": "var(--ch-2)" } } }, { "content": "etcdctl ", "props": { "style": { "color": "var(--ch-3)" } } }, { "content": "snapshot save ", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "\\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --endpoints=https://127.0.0.1:2379 \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --cacert=/etc/kubernetes/pki/etcd/ca.crt \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --cert=/etc/kubernetes/pki/etcd/server.crt \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --key=/etc/kubernetes/pki/etcd/server.key \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " /backup/etcd-snapshot-$(", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "date", "props": { "style": { "color": "var(--ch-3)" } } }, { "content": " +%Y%m%d-%H%M%S).db", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": "# Upload to secure storage", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "aws ", "props": { "style": { "color": "var(--ch-3)" } } }, { "content": "s3 cp /backup/etcd-snapshot-$(", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "date", "props": { "style": { "color": "var(--ch-3)" } } }, { "content": " +%Y%m%d-%H%M%S).db ", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "\\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " s3://secure-backup-bucket/etcd/", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "bash" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 731, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "etcd-restore-procedure", children: "Etcd Restore Procedure" }, undefined, false, { fileName: "", lineNumber: 746, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "#!/bin/bash", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "# etcd-restore.sh", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "ETCDCTL_API", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "=", "props": { "style": { "color": "var(--ch-7)" } } }, { "content": "3 ", "props": { "style": { "color": "var(--ch-2)" } } }, { "content": "etcdctl ", "props": { "style": { "color": "var(--ch-3)" } } }, { "content": "snapshot restore ", "props": { "style": { "color": "var(--ch-8)" } } }, { "content": "\\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --endpoints=https://127.0.0.1:2379 \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --cacert=/etc/kubernetes/pki/etcd/ca.crt \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --cert=/etc/kubernetes/pki/etcd/server.crt \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --key=/etc/kubernetes/pki/etcd/server.key \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " --data-dir=/var/lib/etcd-restore \\", "props": { "style": { "color": "var(--ch-2)" } } }] }, { "tokens": [{ "content": " /backup/etcd-snapshot.db", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "bash" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 747, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "2-velero-backup-integration", children: "2. Velero Backup Integration" }, undefined, false, { fileName: "", lineNumber: 759, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h4, { id: "velero-backup-configuration", children: "Velero Backup Configuration" }, undefined, false, { fileName: "", lineNumber: 761, columnNumber: 1 }, this), "\n", _jsxDEV(CH.Code, { codeConfig: chCodeConfig, northPanel: { "tabs": [""], "active": "", "heightRatio": 1 }, files: [{ "name": "", "focus": "", "code": { "lines": [{ "tokens": [{ "content": "# Velero backup schedule", "props": { "style": { "color": "var(--ch-1)" } } }] }, { "tokens": [{ "content": "apiVersion", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "velero.io/v1", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "kind", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "Schedule", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "metadata", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " name", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "daily-backup", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " namespace", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "velero", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": "spec", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " schedule", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"0 2 * * *\"", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " template", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " includedNamespaces", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "production", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "staging", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " storageLocation", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "aws-backup", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " volumeSnapshotLocations", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ":", "props": { "style": { "color": "var(--ch-4)" } } }] }, { "tokens": [{ "content": " - ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "aws-default", "props": { "style": { "color": "var(--ch-8)" } } }] }, { "tokens": [{ "content": " ttl", "props": { "style": { "color": "var(--ch-6)" } } }, { "content": ": ", "props": { "style": { "color": "var(--ch-4)" } } }, { "content": "\"720h\"", "props": { "style": { "color": "var(--ch-8)" } } }] }], "lang": "yaml" }, "annotations": [] }] }, undefined, false, { fileName: "", lineNumber: 762, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "security-best-practices-checklist", children: "Security Best Practices Checklist" }, undefined, false, { fileName: "", lineNumber: 781, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "cluster-configuration", children: "Cluster Configuration" }, undefined, false, { fileName: "", lineNumber: 783, columnNumber: 1 }, this), "\n", _jsxDEV(_components.ul, { className: "contains-task-list", children: ["\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Enable RBAC and disable anonymous access"] }, undefined, true, { fileName: "", lineNumber: 784, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Use TLS for all API server communication"] }, undefined, true, { fileName: "", lineNumber: 785, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Enable etcd encryption at rest"] }, undefined, true, { fileName: "", lineNumber: 786, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Implement network policies (default deny)"] }, undefined, true, { fileName: "", lineNumber: 787, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Configure audit logging"] }, undefined, true, { fileName: "", lineNumber: 788, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Enable Pod Security Admission"] }, undefined, true, { fileName: "", lineNumber: 789, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Use dedicated service accounts"] }, undefined, true, { fileName: "", lineNumber: 790, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Implement resource quotas and limits"] }, undefined, true, { fileName: "", lineNumber: 791, columnNumber: 1 }, this), "\n"] }, undefined, true, { fileName: "", lineNumber: 784, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "container-security-1", children: "Container Security" }, undefined, false, { fileName: "", lineNumber: 793, columnNumber: 1 }, this), "\n", _jsxDEV(_components.ul, { className: "contains-task-list", children: ["\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Use minimal base images"] }, undefined, true, { fileName: "", lineNumber: 794, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Implement image scanning pipeline"] }, undefined, true, { fileName: "", lineNumber: 795, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Use read-only root filesystem"] }, undefined, true, { fileName: "", lineNumber: 796, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Run as non-root user"] }, undefined, true, { fileName: "", lineNumber: 797, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Drop all capabilities"] }, undefined, true, { fileName: "", lineNumber: 798, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Implement seccomp/AppArmor profiles"] }, undefined, true, { fileName: "", lineNumber: 799, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Use multi-stage builds"] }, undefined, true, { fileName: "", lineNumber: 800, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Sign and verify images"] }, undefined, true, { fileName: "", lineNumber: 801, columnNumber: 1 }, this), "\n"] }, undefined, true, { fileName: "", lineNumber: 794, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "secrets-management-1", children: "Secrets Management" }, undefined, false, { fileName: "", lineNumber: 803, columnNumber: 1 }, this), "\n", _jsxDEV(_components.ul, { className: "contains-task-list", children: ["\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Encrypt secrets at rest"] }, undefined, true, { fileName: "", lineNumber: 804, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Use external secret management"] }, undefined, true, { fileName: "", lineNumber: 805, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Rotate secrets regularly"] }, undefined, true, { fileName: "", lineNumber: 806, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Implement least privilege access"] }, undefined, true, { fileName: "", lineNumber: 807, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Audit secret access"] }, undefined, true, { fileName: "", lineNumber: 808, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Use sealed secrets or similar"] }, undefined, true, { fileName: "", lineNumber: 809, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Avoid secrets in environment variables"] }, undefined, true, { fileName: "", lineNumber: 810, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Implement secret versioning"] }, undefined, true, { fileName: "", lineNumber: 811, columnNumber: 1 }, this), "\n"] }, undefined, true, { fileName: "", lineNumber: 804, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h3, { id: "monitoring-and-compliance", children: "Monitoring and Compliance" }, undefined, false, { fileName: "", lineNumber: 813, columnNumber: 1 }, this), "\n", _jsxDEV(_components.ul, { className: "contains-task-list", children: ["\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Implement comprehensive logging"] }, undefined, true, { fileName: "", lineNumber: 814, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Set up security metrics and alerts"] }, undefined, true, { fileName: "", lineNumber: 815, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Regular security scans and assessments"] }, undefined, true, { fileName: "", lineNumber: 816, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "CIS benchmark compliance"] }, undefined, true, { fileName: "", lineNumber: 817, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Runtime security monitoring"] }, undefined, true, { fileName: "", lineNumber: 818, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Incident response procedures"] }, undefined, true, { fileName: "", lineNumber: 819, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Regular security training"] }, undefined, true, { fileName: "", lineNumber: 820, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { className: "task-list-item", children: [_jsxDEV(_components.input, { type: "checkbox", disabled: true }, undefined, false, { fileName: "" }, this), " ", "Documentation and runbooks"] }, undefined, true, { fileName: "", lineNumber: 821, columnNumber: 1 }, this), "\n"] }, undefined, true, { fileName: "", lineNumber: 814, columnNumber: 1 }, this), "\n", _jsxDEV(_components.h2, { id: "conclusion", children: "Conclusion" }, undefined, false, { fileName: "", lineNumber: 823, columnNumber: 1 }, this), "\n", _jsxDEV(_components.p, { children: "Kubernetes security requires a multi-layered approach addressing cluster configuration, container security, access control, and operational practices. By implementing these comprehensive security measures, organizations can significantly reduce their attack surface and maintain compliance with industry standards." }, undefined, false, { fileName: "", lineNumber: 825, columnNumber: 1 }, this), "\n", _jsxDEV(_components.p, { children: "Key security principles to remember:" }, undefined, false, { fileName: "", lineNumber: 827, columnNumber: 1 }, this), "\n", _jsxDEV(_components.ul, { children: ["\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Defense in Depth" }, undefined, false, { fileName: "", lineNumber: 828, columnNumber: 3 }, this), ": Implement multiple security layers"] }, undefined, true, { fileName: "", lineNumber: 828, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Least Privilege" }, undefined, false, { fileName: "", lineNumber: 829, columnNumber: 3 }, this), ": Grant minimal necessary permissions"] }, undefined, true, { fileName: "", lineNumber: 829, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Zero Trust" }, undefined, false, { fileName: "", lineNumber: 830, columnNumber: 3 }, this), ": Verify everything, trust nothing"] }, undefined, true, { fileName: "", lineNumber: 830, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Continuous Monitoring" }, undefined, false, { fileName: "", lineNumber: 831, columnNumber: 3 }, this), ": Detect and respond to threats quickly"] }, undefined, true, { fileName: "", lineNumber: 831, columnNumber: 1 }, this), "\n", _jsxDEV(_components.li, { children: [_jsxDEV(_components.strong, { children: "Regular Updates" }, undefined, false, { fileName: "", lineNumber: 832, columnNumber: 3 }, this), ": Keep components patched and current"] }, undefined, true, { fileName: "", lineNumber: 832, columnNumber: 1 }, this), "\n"] }, undefined, true, { fileName: "", lineNumber: 828, columnNumber: 1 }, this), "\n", _jsxDEV(_components.p, { children: "Security is an ongoing process, not a one-time implementation. Regular assessments, updates, and improvements are essential to maintain a secure Kubernetes environment in production." }, undefined, false, { fileName: "", lineNumber: 834, columnNumber: 1 }, this)] }, undefined, true, { fileName: "", lineNumber: 1, columnNumber: 1 }, this); } function MDXContent(props = {}) { const {wrapper: MDXLayout} = { ..._provideComponents(), ...props.components }; return MDXLayout ? _jsxDEV(MDXLayout, { ...props, children: _jsxDEV(_createMdxContent, { ...props }, undefined, false, { fileName: "" }, this) }, undefined, false, { fileName: "" }, this) : _createMdxContent(props); } return { default: MDXContent }; function _missingMdxReference(id, component, place) { throw new Error("Expected " + (component ? "component" : "object") + " `" + id + "` to be defined: you likely forgot to import, pass, or provide it." + (place ? "\nIt’s referenced in your code at `" + place + "`" : "")); }