.. _index-security-kub-81153c1254c3:

.. include:: /_includes/toc-title-security-kub.rest

.. only:: partner

   .. include:: /security/index-security-84d0d8aa401b.rst
      :start-after: kub-begin
      :end-before: kub-end

********
Overview
********
.. toctree::
   :maxdepth: 1

   security-kubernets-overview-3fd93307de2a
   authentication-of-software-delivery

****************
UEFI Secure Boot
****************

.. toctree::
   :maxdepth: 1

   overview-of-uefi-secure-boot
   use-uefi-secure-boot
   add-certificate-to-uefi-secure-boot-database-a474c0b1acfc

*******************
Firewall Management
*******************

.. toctree::
   :maxdepth: 1

   security-default-firewall-rules
   security-firewall-options

**********************
Certificate Management
**********************

.. toctree::
   :maxdepth: 2

   https-access-overview
   utility-script-to-display-certificates
   etcd-certificates-c1fc943e4a9c
   kubernetes-certificates-f4196d7cae9c
   kubernetes-root-ca-certificate
   update-renew-kubernetes-certificates-52b00bd0bdae
   manual-kubernetes-root-ca-certificate-update-8e9df2cd7fb9
   kubernetes-root-ca-certificate-update-cloud-orchestration-a627f9d02d6d
   system-local-ca-issuer-9196c5794834
   local-ldap-certificates-4e1df1e39341
   configure-rest-api-apps-and-web-admin-server-certs-after-inst-6816457ab95f
   configure-docker-registry-certificate-after-installation-c519edbfe90a
   oidc-client-dex-server-certificates-dc174462d51a
   migrate-platform-certificates-to-use-cert-manager-c0b1727e4e5d
   portieris-server-certificate-a0c7054844bd
   vault-server-certificate-8573125eeea6
   dc-admin-endpoint-certificates-8fe7adf3f932
   add-a-trusted-ca
   alarm-expiring-soon-and-expired-certificates-baf5b8f73009

Cert Manager
============

.. toctree::
   :maxdepth: 1

   security-cert-manager
   the-cert-manager-bootstrap-process


Cert-Manager Post Installation Setup
------------------------------------

.. toctree::
   :maxdepth: 1

   firewall-port-overrides
   enable-public-use-of-the-cert-manager-acmesolver-image
   enable-use-of-cert-manager-acmesolver-image-in-a-particular-namespace
   enable-the-use-of-cert-manager-apis-by-an-arbitrary-user


Locally creating certificates
=============================

.. toctree::
   :maxdepth: 1

   create-certificates-locally-using-openssl
   create-certificates-locally-using-cert-manager-on-the-controller

***************
User Management
***************

Introduction
============

.. toctree::
   :maxdepth: 3

   introduction-to-user-management-6c0b13c6d325
   example-common-tasks-97773f3a82f0

Reference Material
==================

.. toctree::
   :maxdepth: 3

   user-account-types-51cf01ac63bf
   starlingx-authentication-and-authorization-95bb323e247b
   kubernetes-authentication-and-authorization-5083f8977b9c
   ssh-authentication-and-authorization-664769a1e276


********
Auditing
********

.. toctree::
   :maxdepth: 1

   auditd-support-339a51d8ce16
   operator-login-authentication-logging
   operator-command-logging
   kubernetes-operator-command-logging-663fce5d74e7


.. _portieris-admission-controller-security-index:

************************************************
Container Image Integrity (Signature Validation)
************************************************

.. toctree::
   :maxdepth: 1

   portieris-overview
   install-portieris
   portieris-clusterimagepolicy-and-imagepolicy-configuration
   remove-portieris


**************************
Container AppArmor Profile
**************************

.. toctree::
   :maxdepth: 1

   about-apparmor-ebdab8f1ed87
   enable-disable-apparmor-on-a-host-63a7a184d310
   enable-disable-apparmor-on-a-host-using-horizon-a318ab726396
   install-security-profiles-operator-1b2f9a0f0108
   profile-management-a8df19c86a5d
   apply-a-profile-to-a-pod-c2fa4d958dec
   enable-apparmor-log-bb600560d794
   author-apparmor-profiles-b02de0a22771

***********************
Encrypting Data at Rest
***********************

.. toctree::
   :maxdepth: 1

   partial-disk-transparent-encryption-support-via-software-enc-27a570f3142c
   encrypt-kubernetes-secret-data-at-rest

Vault Secret and Data Management
================================

.. _vault-secret-and-data-management-050a998960d0:
.. _vault-secret-and-data-management-security-index:

.. toctree::
   :maxdepth: 2

   security-vault-overview
   install-vault
   configure-vault
   configure-vault-using-the-cli
   remove-vault

***************************
IPsec on Management Network
***************************

.. toctree::
   :maxdepth: 1

   ipsec-overview-680c2dcfbf3b
   ipsec-configuration-and-enabling-f70964bc49d1
   ipsec-certificates-2c0655a2a888
   ipsec-clis-5f38181d077f


********************************************
Secure Inter-host Pod-to-pod Network Traffic
********************************************

.. toctree::
   :maxdepth: 1

   inter-host-pod-to-pod-security-overview-f44d8d3c7541
   install-ipsec-policy-operator-system-application-95ae437a67e2
   configure-ipsec-for-selected-inter-host-pod-to-pod-traffic-usi-8cb9b4342b5d
   remove-ipsec-policy-operator-system-application-06e7f2e4cdfb

***************
CVE Maintenance
***************

.. toctree::
   :maxdepth: 1

   cve-maintenance-723cd9dd54b3


*******************************************************
Security Feature Configuration for Spectre and Meltdown
*******************************************************

.. toctree::
   :maxdepth: 1

   security-feature-configuration-for-spectre-and-meltdown

************************
Deprecated Functionality
************************

.. toctree::
   :maxdepth: 1

   starlingx-rest-api-applications-and-the-web-administration-server-deprecated
   enable-https-access-for-starlingx-rest-and-web-server-endpoints

******************************************
Appendix: Configurations for CIS benchmark
******************************************

.. toctree::
   :maxdepth: 1

   configuring-system-to-cis-benchmark-for-hosts-standards-bc2c3f582895
   configuring-system-to-cis-benchmark-for-containers-standards-3df0c174ffe2