68 lines
1.8 KiB
Markdown
68 lines
1.8 KiB
Markdown
|
# Security
|
||
|
|
|
||
|
|
## All the standards
|
||
|
|
|
||
|
|
There are several features that will enhance the security of your system:
|
||
|
|
|
||
|
|
- all components are running rootless by default
|
||
|
|
- all components drop all privileges
|
||
|
|
- all components deny escalation
|
||
|
|
- all components have read only file systems
|
||
|
|
- Access is restricted by NetworkPolicies
|
||
|
|
|
||
|
|
## Additional: The backend Protocol
|
||
|
|
|
||
|
|
Additionally, you can increase security by encrypting communication in the backend. Depending on your network driver, this might already been done automatically beween the Kubernetes Nodes. But you can double that even within a single node by switching the backend Protocol to https:
|
||
|
|
|
||
|
|
|
||
|
|
```yaml
|
||
|
|
global:
|
||
|
|
nappl:
|
||
|
|
port: 8443
|
||
|
|
ssl: true
|
||
|
|
|
||
|
|
# Web and PAM do not speak https by default yet, CRs have been filed.
|
||
|
|
|
||
|
|
nappl:
|
||
|
|
ingress:
|
||
|
|
backendProtocol: https
|
||
|
|
cmis:
|
||
|
|
ingress:
|
||
|
|
backendProtocol: https
|
||
|
|
ilm:
|
||
|
|
ingress:
|
||
|
|
backendProtocol: https
|
||
|
|
webdav:
|
||
|
|
ingress:
|
||
|
|
backendProtocol: https
|
||
|
|
rs:
|
||
|
|
ingress:
|
||
|
|
backendProtocol: https
|
||
|
|
mon:
|
||
|
|
ingress:
|
||
|
|
backendProtocol: https
|
||
|
|
administrator:
|
||
|
|
ingress:
|
||
|
|
backendProtocol: https
|
||
|
|
```
|
||
|
|
|
||
|
|
This will turn every communication to https, **but** leave the unencrypted ports (http) **open** for inter-pod communication.
|
||
|
|
|
||
|
|
|
||
|
|
## Zero Trust Mode
|
||
|
|
|
||
|
|
This will basically do the same as above, **but** also turn **off** any unencrypted port (like http) and also implement NetworkPolicies to drop unencrypted packages.
|
||
|
|
|
||
|
|
This will also affect the way how *probes* are checking the pods health: *nplus* will switch them to use https instead, so even the very internal Healtch Check infrastructure will be encrypted in *zero trust mode*:
|
||
|
|
|
||
|
|
```yaml
|
||
|
|
components:
|
||
|
|
pam: false #TODO: ITSMSD-8771: PAM does not yet support https backend.
|
||
|
|
global:
|
||
|
|
security:
|
||
|
|
zeroTrust: true
|
||
|
|
nappl:
|
||
|
|
port: 8443
|
||
|
|
ssl: true
|
||
|
|
```
|