Move and revise overview for Security section #43176

sftim · 2023-09-23T20:27:19Z

A fix for #36591 (fixes #36591)

Change https://kubernetes.io/docs/concepts/security/ to be an overview of security (preview)
Add another page about cloud native security and Kubernetes, based on the CNCF security white paper (preview)
Remove https://kubernetes.io/docs/concepts/security/overview/ (with a redirect)

We should make this change because https://kubernetes.io/docs/concepts/security/overview/ is not really giving readers a good overview of how to secure a Kubernetes cluster. That page was much better than no advice; this PR aims to improve it further by explicitly aligning with the CNCF security white paper.

/language en
/sig security

sftim · 2023-09-23T20:28:15Z

content/en/docs/concepts/security/_index.md

+* [Certified Kubernetes Security Specialist](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)
+  certification and official training course.
+
+Read more in this section:


This relies on simple_list: true in the front matter. See the preview.

sftim · 2023-09-23T20:28:41Z

/label refactor

netlify · 2023-09-23T20:40:21Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`9323995`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/65cf4b639588670008aea233
😎 Deploy Preview	https://deploy-preview-43176--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Gauravpadam

Thanks,

A partial review from my end

content/en/docs/concepts/security/_index.md

Gauravpadam · 2023-10-27T15:04:40Z

content/en/docs/concepts/security/_index.md

+
+### Observbility and runtime security
+
+As your applications run they - and the cluster they run on -  give you ways to


The statement is semantically and grammatically correct, But should we make this more clear and concise?

Suggested change

As your applications run they - and the cluster they run on - give you ways to

Kubernetes enables you to observe and monitor your applications and the clusters they are running on

This change doesn't produce a sentence that makes sense. I'll adapt it.

How's this now?

aj11anuj

Some minor suggestions from my side

content/en/docs/concepts/security/_index.md

aj11anuj · 2023-10-28T04:45:30Z

content/en/docs/concepts/security/_index.md

+## _Deploy_ lifecycle phase {#lifecycle-phase-deploy}
+
+Ensure appropriate restrictions on what can be deployed, who can deploy it,
+and where it can be deployed to.


Suggested change

and where it can be deployed to.

and where it can be deployed.

I (still) think “where it can be deployed to” is how people who speak English would say it.

+1 to what Tim said.

content/en/docs/concepts/security/_index.md

sftim · 2023-10-29T14:07:18Z

Thanks for the review @aj11anuj. However, please watch out for making suggestions that change text from good use of English to invalid or unidiomatic English.

sftim · 2023-11-04T18:10:58Z

Part of #25119

divya-mohan0209

Overall this LGTM. However, I am just curious if we want to link to the hardening guide for further reading?

divya-mohan0209 · 2023-12-08T11:16:19Z

content/en/docs/concepts/security/_index.md

+## _Deploy_ lifecycle phase {#lifecycle-phase-deploy}
+
+Ensure appropriate restrictions on what can be deployed, who can deploy it,
+and where it can be deployed to.


+1 to what Tim said.

content/en/docs/concepts/security/_index.md

sftim · 2023-12-08T12:09:06Z

link to the hardening guide

We actually have several (some are labelled as good practice, one as hardening, another as a security checklist).

I'd love to see a follow-up land that tidies things up. See https://deploy-preview-43176--kubernetes-io-main-staging.netlify.app/docs/concepts/security/#what-s-next for a selection of what we have now.

PushkarJ · 2024-02-03T22:53:02Z

Looks good to me now.

Hopefully one more person from sig security can review too

content/en/docs/concepts/security/_index.md

tabbysable · 2024-02-05T23:25:24Z

content/en/docs/concepts/security/_index.md

+A key security mechanism for any Kubernetes is to
+[control access to the Kubernetes API](/docs/concepts/security/controlling-access).
+
+You can define [encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)


Nit: Recommend calling out TLS first in this paragraph, since it is essential to virtually any effort to secure a kubernetes cluster. Then move to "You can also configure encryption at rest..." because it's a good idea but less critical for many common use cases.

tabbysable · 2024-02-05T23:32:15Z

content/en/docs/concepts/security/cloud-native-security.md

+{{< glossary_tooltip text="Containers" term_id="container" >}} provide two
+things: isolation between different applications, and a mechanism to combine
+those isolated applications to run on the same host computer. Those two
+aspects, isolation and aggregation, mean that runtime security involves


Just wanna say that I LOVE this sentence especially.

content/en/docs/concepts/security/cloud-native-security.md

tabbysable · 2024-02-05T23:38:21Z

I left several nits, none of which should be interpreted as merge-blocking.

This is beautiful! Thank you for the huge amount of thoughtful work that has gone into it.

/lgtm

Please ping me to re-LGTM if you choose to address any of the nits and the LGTM thus falls off.

k8s-ci-robot · 2024-02-05T23:38:29Z

LGTM label has been added.

Git tree hash: ccf8350debc22d3f702fda57085974e2bc413e0b

AnshumanTripathi · 2024-02-06T04:08:27Z

content/en/docs/concepts/security/_index.md

+The [Secret](/docs/concepts/configuration/secret/) API provides basic protection for
+configuration values that require confidentiality.


Should we add that secrets are only base64 encoded and are stored unencrypted in the API server? (A premonition to the caution block under the secrets documentation)

Maybe you'd like to propose that for a follow-up PR?

content/en/docs/concepts/security/cloud-native-security.md

AnshumanTripathi · 2024-02-06T04:14:29Z

content/en/docs/concepts/security/cloud-native-security.md

+You can enforce measures from the _distribute_ phase, such as verifying the
+cryptographic identity of container image artefacts.
+
+When you deploy Kubernetes, you also set the foundation for your


Suggested change

When you deploy Kubernetes, you also set the foundation for your

When you deploy Kubernetes, you also set the foundation for your

When you deploy Kubernetes seems confusing. Do mean Deploy to Kubernetes or Deploy a Kubernetes cluster?

I mean deploy at least one Kubernetes cluster; is that not as obvious as I'd've hoped?

I guess it makes sense. 👍

AnshumanTripathi · 2024-02-10T07:53:00Z

Missed to comment lgtm

/lgtm

k8s-ci-robot · 2024-02-10T07:53:05Z

@AnshumanTripathi: changing LGTM is restricted to collaborators

In response to this:

Missed to comment lgtm

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Co-authored-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Co-authored-by: Anuj Tiwari <aj11anuj123@gmail.com> Co-authored-by: Gaurav Padam <1032201077@tcetmumbai.in> Co-authored-by: Tabitha Sable <51767484+tabbysable@users.noreply.github.com>

sftim · 2024-02-16T11:49:20Z

@tabbysable, I think this is ready for another LGTM if you're happy with it.

PushkarJ · 2024-02-16T17:31:41Z

/lgtm

( @tabbysable hoping to save you some keystrokes )

k8s-ci-robot · 2024-02-16T17:31:49Z

LGTM label has been added.

Git tree hash: a1b1242f846cb0ea779b57876b229ff1720b9a6a

reylejano · 2024-02-16T19:34:30Z

This PR improves the security content in the docs
Thank you
/approve

k8s-ci-robot · 2024-02-16T19:34:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: reylejano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [reylejano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added language/en Issues or PRs related to English language sig/security Categorizes an issue or PR as relevant to SIG Security. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 23, 2023

sftim commented Sep 23, 2023

View reviewed changes

k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label Sep 23, 2023

k8s-ci-robot requested review from divya-mohan0209 and mehabhalodiya September 23, 2023 20:28

k8s-ci-robot added the refactor Indicates a PR with large refactoring changes e.g. removes files or moves content label Sep 23, 2023

sftim mentioned this pull request Sep 23, 2023

remove https://kubernetes.io/docs/concepts/security/overview/ #43170

Closed

sftim force-pushed the 20230923_revise_security_concept_section branch from d3fea01 to 8a368b9 Compare September 23, 2023 21:08

sftim mentioned this pull request Sep 27, 2023

Document security restrictions (eg AppArmor) in Pods concept #39601

Closed

shannonxtreme mentioned this pull request Sep 27, 2023

Improve the Security Overview #43228

Closed

sftim force-pushed the 20230923_revise_security_concept_section branch from 8a368b9 to d7c996a Compare October 24, 2023 09:14

Gauravpadam reviewed Oct 27, 2023

View reviewed changes

sftim force-pushed the 20230923_revise_security_concept_section branch 3 times, most recently from 6c62b42 to 857eb1b Compare October 27, 2023 15:30

aj11anuj suggested changes Oct 28, 2023

View reviewed changes

sftim force-pushed the 20230923_revise_security_concept_section branch 2 times, most recently from 08439ea to 2f45b51 Compare November 16, 2023 12:47

sftim mentioned this pull request Dec 1, 2023

Encrypting Confidential Data at Rest task implies recommendation against AES CBC is due to padding oracle risk #44169

Open

sftim force-pushed the 20230923_revise_security_concept_section branch 2 times, most recently from f56031d to cf22354 Compare December 7, 2023 19:56

divya-mohan0209 reviewed Dec 8, 2023

View reviewed changes

sftim force-pushed the 20230923_revise_security_concept_section branch from f414fc6 to fc9f380 Compare February 3, 2024 17:23

tabbysable reviewed Feb 5, 2024

View reviewed changes

content/en/docs/concepts/security/_index.md Outdated Show resolved Hide resolved

tabbysable reviewed Feb 5, 2024

View reviewed changes

content/en/docs/concepts/security/cloud-native-security.md Outdated Show resolved Hide resolved

k8s-ci-robot assigned tabbysable Feb 5, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 5, 2024

AnshumanTripathi reviewed Feb 6, 2024

View reviewed changes

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 16, 2024

k8s-ci-robot requested a review from tabbysable February 16, 2024 11:38

sftim and others added 4 commits February 16, 2024 11:43

Add section overview for Security

872808b

Co-authored-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Co-authored-by: Anuj Tiwari <aj11anuj123@gmail.com> Co-authored-by: Gaurav Padam <1032201077@tcetmumbai.in> Co-authored-by: Tabitha Sable <51767484+tabbysable@users.noreply.github.com>

Remove legacy security overview page

18cdba2

Move cloud native security out of section overview

8929789

Add note to localizers

9323995

sftim force-pushed the 20230923_revise_security_concept_section branch from 9a51f85 to 9323995 Compare February 16, 2024 11:47

k8s-ci-robot assigned PushkarJ Feb 16, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 16, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 16, 2024

k8s-ci-robot merged commit da14ff8 into kubernetes:main Feb 16, 2024
6 checks passed

sftim deleted the 20230923_revise_security_concept_section branch February 18, 2024 00:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Move and revise overview for Security section #43176

Move and revise overview for Security section #43176

sftim commented Sep 23, 2023 •

edited

Loading

sftim Sep 23, 2023

sftim commented Sep 23, 2023

netlify bot commented Sep 23, 2023 •

edited

Loading

Gauravpadam left a comment

Gauravpadam Oct 27, 2023

sftim Oct 27, 2023

sftim Dec 1, 2023

aj11anuj left a comment

aj11anuj Oct 28, 2023

sftim Oct 29, 2023 •

edited

Loading

divya-mohan0209 Dec 8, 2023

sftim commented Oct 29, 2023

sftim commented Nov 4, 2023

divya-mohan0209 left a comment

divya-mohan0209 Dec 8, 2023

sftim commented Dec 8, 2023

PushkarJ commented Feb 3, 2024

tabbysable Feb 5, 2024

sftim Feb 16, 2024

tabbysable Feb 5, 2024

tabbysable commented Feb 5, 2024

k8s-ci-robot commented Feb 5, 2024

AnshumanTripathi Feb 6, 2024

sftim Feb 16, 2024

AnshumanTripathi Feb 6, 2024

sftim Feb 16, 2024 •

edited

Loading

AnshumanTripathi Feb 16, 2024

AnshumanTripathi commented Feb 10, 2024

k8s-ci-robot commented Feb 10, 2024

sftim commented Feb 16, 2024

PushkarJ commented Feb 16, 2024

k8s-ci-robot commented Feb 16, 2024

reylejano commented Feb 16, 2024

k8s-ci-robot commented Feb 16, 2024


		### Observbility and runtime security

		As your applications run they - and the cluster they run on - give you ways to

	As your applications run they - and the cluster they run on - give you ways to
	Kubernetes enables you to observe and monitor your applications and the clusters they are running on

	and where it can be deployed to.
	and where it can be deployed.

		The [Secret](/docs/concepts/configuration/secret/) API provides basic protection for
		configuration values that require confidentiality.

	When you deploy Kubernetes, you also set the foundation for your
	When you deploy Kubernetes, you also set the foundation for your

Move and revise overview for Security section #43176

Move and revise overview for Security section #43176

Conversation

sftim commented Sep 23, 2023 • edited Loading

Choose a reason for hiding this comment

sftim commented Sep 23, 2023

netlify bot commented Sep 23, 2023 • edited Loading

✅ Pull request preview available for checking

Gauravpadam left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aj11anuj left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim Oct 29, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Oct 29, 2023

sftim commented Nov 4, 2023

divya-mohan0209 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Dec 8, 2023

PushkarJ commented Feb 3, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tabbysable commented Feb 5, 2024

k8s-ci-robot commented Feb 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim Feb 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AnshumanTripathi commented Feb 10, 2024

k8s-ci-robot commented Feb 10, 2024

sftim commented Feb 16, 2024

PushkarJ commented Feb 16, 2024

k8s-ci-robot commented Feb 16, 2024

reylejano commented Feb 16, 2024

k8s-ci-robot commented Feb 16, 2024

sftim commented Sep 23, 2023 •

edited

Loading

netlify bot commented Sep 23, 2023 •

edited

Loading

sftim Oct 29, 2023 •

edited

Loading

sftim Feb 16, 2024 •

edited

Loading