Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Self-Assessment: [STRIDE-MULTIPLE] End-User Cluster API Security Guidance #6152

Open
randomvariable opened this issue Feb 16, 2022 · 11 comments
Open

Security Self-Assessment: [STRIDE-MULTIPLE] End-User Cluster API Security Guidance #6152

randomvariable opened this issue Feb 16, 2022 · 11 comments
Assignees
@PushkarJ
Labels
area/security Issues or PRs related to security good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. kind/documentation Categorizes issue or PR as related to documentation. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. sig/security Categorizes an issue or PR as relevant to SIG Security. triage/accepted Indicates an issue or PR is ready to be actively worked on.

Comments

@randomvariable
Copy link
Member

randomvariable commented Feb 16, 2022 •
edited
Loading

User Story

As a cluster operator, I want to know how to use Cluster API securely.

Detailed Description

Follow up to #4139, security guidance should be given for end users

Covers the following in the security self-assessment:

  • Second pair of eyes are applied when executing privileged actions such as creating/deleting/updating a cluster (possibly using gitops)
  • Enabling auditing on the management cluster (STRIDE-SPOOF-1)
  • Using least permissions for infrastructure providers. (STRIDE-SPOOF-1)
  • Files system monitoring (STRIDE-TAMPER-2)
  • During runtime: Alert on modification or restarts of cluster API components to detect for potential tampering (STRIDE-TAMPER-1)

Anything else you would like to add:

[Miscellaneous information that will assist in solving the issue.]

/kind feature
/area security
@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. area/security Issues or PRs related to security labels Feb 16, 2022
@randomvariable randomvariable changed the title End-User Cluster API Security Guidance Security Self-Assessment: End-User Cluster API Security Guidance Feb 16, 2022
@randomvariable randomvariable mentioned this issue Feb 16, 2022
Closed
@fabriziopandini
Copy link
Member

fabriziopandini commented Feb 16, 2022 •
edited
Loading

/kind cleanup
/remove-kind feature

FYI there is a new set of tooling around owner files being used in the ecosystem, including also periodic checks on maintainers not active anymore. We should leverage on the same tooling
@dims ^^

@k8s-ci-robot k8s-ci-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. and removed kind/feature Categorizes issue or PR as related to a new feature. labels Feb 16, 2022
@sbueringer
Copy link
Member

/milestone v1.2

@k8s-ci-robot k8s-ci-robot added this to the v1.2 milestone Feb 18, 2022
@PushkarJ PushkarJ mentioned this issue Mar 24, 2022
Closed
This was referenced Apr 11, 2022
Merged
Merged
@PushkarJ
Copy link
Member

/retitle Security Self-Assessment: [STRIDE-MULTIPLE] End-User Cluster API Security Guidance
/sig security

@k8s-ci-robot k8s-ci-robot changed the title Security Self-Assessment: End-User Cluster API Security Guidance Security Self-Assessment: [STRIDE-MULTIPLE] End-User Cluster API Security Guidance May 13, 2022
@k8s-ci-robot k8s-ci-robot added the sig/security Categorizes an issue or PR as relevant to SIG Security. label May 13, 2022
@PushkarJ PushkarJ moved this from Implemented to Planned in [Cluster API] SIG Security Self-Assessment May 13, 2022
@PushkarJ
Copy link
Member

/assign pushkarj

(Planning on writing this up in next few weeks)

@fabriziopandini fabriziopandini added the triage/accepted Indicates an issue or PR is ready to be actively worked on. label Jul 29, 2022
@fabriziopandini fabriziopandini removed this from the v1.2 milestone Jul 29, 2022
@fabriziopandini fabriziopandini removed the triage/accepted Indicates an issue or PR is ready to be actively worked on. label Jul 29, 2022
@fabriziopandini
Copy link
Member

/triage accepted
/remove-kind cleanup
/kind documentation

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. kind/documentation Categorizes issue or PR as related to documentation. and removed kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. labels Sep 30, 2022
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 29, 2022
@fabriziopandini
Copy link
Member

/lifecycle frozen

@k8s-ci-robot k8s-ci-robot added lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Dec 30, 2022
@k8s-triage-robot
Copy link

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

  • Confirm that this issue is still relevant with /triage accepted (org members only)
  • Close this issue with /close

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

@k8s-ci-robot k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. and removed triage/accepted Indicates an issue or PR is ready to be actively worked on. labels Jan 20, 2024
@fabriziopandini
Copy link
Member

/priority backlog

@k8s-ci-robot k8s-ci-robot added the priority/backlog Higher priority than priority/awaiting-more-evidence. label Apr 11, 2024
@fabriziopandini fabriziopandini added priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. and removed priority/backlog Higher priority than priority/awaiting-more-evidence. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. labels Apr 11, 2024
@fabriziopandini
Copy link
Member

What we need is a new page in the book under security with the list of Recommended Mitigations from the description above. I would also add

From: #6518

  • Implement safe defaults (soft and hard) on how many CRD objects a Cluster API
    component can create, especially in a management cluster
  • Implement threshold based alerts when a particular soft limit is exceeded for number of CRD

From #6517

  • Create safe defaults (soft and hard) for the maximum number of nodes that can be created using a management cluster
  • Implement threshold based alerts when a particular soft limit is exceeded for number of nodes

#6516

  • Create safe defaults (soft and hard) for the maximum number of clusters that can be created using a management cluster
  • Implement threshold based alerts when a particular soft limit is exceeded for number of clusters

From #6515

  • Create safe defaults (soft and hard) for the maximum number of cloud resources that can be created.
  • Implement threshold based alerts when a particular soft limit is exceeded

/remove-help
/good-first issue

This was referenced Apr 22, 2024
Closed
Closed
@fabriziopandini
Copy link
Member

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Apr 22, 2024
This was referenced Apr 22, 2024
Closed
Closed
@fabriziopandini fabriziopandini added the good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. label Apr 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@PushkarJ PushkarJ

Labels
area/security Issues or PRs related to security good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. kind/documentation Categorizes issue or PR as related to documentation. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. sig/security Categorizes an issue or PR as relevant to SIG Security. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@randomvariable @PushkarJ @sbueringer @fabriziopandini @k8s-ci-robot @k8s-triage-robot