Files
gh-project-codeguard-rules/skills/software-security/rules/codeguard-0-cloud-orchestration-kubernetes.md
2025-11-30 08:48:30 +08:00

1.7 KiB
Raw Blame History

description, languages, alwaysApply
description languages alwaysApply
Kubernetes hardening (RBAC, admission policies, network policies, secrets, supply chain)
javascript
yaml
false

rule_id: codeguard-0-cloud-orchestration-kubernetes

Cloud & Orchestration (Kubernetes)

Kubernetes cluster and workload hardening: identity, policy, networking, secrets, and supply chain controls.

Controls

  • Identity & RBAC: least privilege for users and service accounts; separate namespaces; bind only needed roles.
  • Policy: admission controls (OPA/Gatekeeper/Kyverno) for image sources, capabilities, root, network policies, and required labels/annotations.
  • Networking: defaultdeny with network policies; explicit egress allowlists; service identity/mTLS within mesh where applicable.
  • Secrets: use KMS providers; avoid plaintext in manifests; rotate regularly; restrict secret mount paths.
  • Nodes: hardened OS, autoupdates, minimal attack surface; isolate sensitive workloads with taints/tolerations and dedicated nodes.
  • Supply chain: verify image signatures; enforce provenance (SLSA/Sigstore) in admission.

Checklist

  • Namespaces per team/app; RBAC roles scoped; audit logging enabled.
  • Admission policies enforce image provenance, nonroot, dropped capabilities, readonly root FS, and network policy presence.
  • Network policies in place for ingress/egress; service accounts scoped per deployment.

Verification

  • Cluster conformance and CIS benchmark scans.
  • Policy tests in CI for manifests (OPA unit tests); periodic admission dryrun.

Incident Readiness

  • Enable audit logs and centralize; restrict access to etcd; backup/restore tested.
  • Define breakglass roles with MFA and timebound approvals.