0bf77eef8e
Change-Id: I753b0cd3912d2f9bc53c50906c05e90f2443d3f0 Signed-off-by: Suzana Fernandes <Suzana.Fernandes@windriver.com>
257 lines
5.9 KiB
ReStructuredText
257 lines
5.9 KiB
ReStructuredText
.. _index-security-kub-81153c1254c3:
|
|
|
|
.. include:: /_includes/toc-title-security-kub.rest
|
|
|
|
.. only:: partner
|
|
|
|
.. include:: /security/index-security-84d0d8aa401b.rst
|
|
:start-after: kub-begin
|
|
:end-before: kub-end
|
|
|
|
********
|
|
Overview
|
|
********
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
security-kubernets-overview-3fd93307de2a
|
|
authentication-of-software-delivery
|
|
|
|
****************
|
|
UEFI Secure Boot
|
|
****************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
overview-of-uefi-secure-boot
|
|
use-uefi-secure-boot
|
|
add-certificate-to-uefi-secure-boot-database-a474c0b1acfc
|
|
|
|
*******************
|
|
Firewall Management
|
|
*******************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
security-default-firewall-rules
|
|
security-firewall-options
|
|
|
|
**********************
|
|
Certificate Management
|
|
**********************
|
|
|
|
.. toctree::
|
|
:maxdepth: 2
|
|
|
|
https-access-overview
|
|
utility-script-to-display-certificates
|
|
etcd-certificates-c1fc943e4a9c
|
|
kubernetes-certificates-f4196d7cae9c
|
|
kubernetes-root-ca-certificate
|
|
update-renew-kubernetes-certificates-52b00bd0bdae
|
|
manual-kubernetes-root-ca-certificate-update-8e9df2cd7fb9
|
|
kubernetes-root-ca-certificate-update-cloud-orchestration-a627f9d02d6d
|
|
system-local-ca-issuer-9196c5794834
|
|
local-ldap-certificates-4e1df1e39341
|
|
configure-rest-api-apps-and-web-admin-server-certs-after-inst-6816457ab95f
|
|
configure-docker-registry-certificate-after-installation-c519edbfe90a
|
|
oidc-client-dex-server-certificates-dc174462d51a
|
|
migrate-platform-certificates-to-use-cert-manager-c0b1727e4e5d
|
|
portieris-server-certificate-a0c7054844bd
|
|
vault-server-certificate-8573125eeea6
|
|
dc-admin-endpoint-certificates-8fe7adf3f932
|
|
add-a-trusted-ca
|
|
alarm-expiring-soon-and-expired-certificates-baf5b8f73009
|
|
|
|
Cert Manager
|
|
============
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
security-cert-manager
|
|
the-cert-manager-bootstrap-process
|
|
|
|
|
|
Cert-Manager Post Installation Setup
|
|
------------------------------------
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
firewall-port-overrides
|
|
enable-public-use-of-the-cert-manager-acmesolver-image
|
|
enable-use-of-cert-manager-acmesolver-image-in-a-particular-namespace
|
|
enable-the-use-of-cert-manager-apis-by-an-arbitrary-user
|
|
|
|
|
|
Locally creating certificates
|
|
=============================
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
create-certificates-locally-using-openssl
|
|
create-certificates-locally-using-cert-manager-on-the-controller
|
|
|
|
***************
|
|
User Management
|
|
***************
|
|
|
|
Introduction
|
|
============
|
|
|
|
.. toctree::
|
|
:maxdepth: 3
|
|
|
|
introduction-to-user-management-6c0b13c6d325
|
|
example-common-tasks-97773f3a82f0
|
|
|
|
Reference Material
|
|
==================
|
|
|
|
.. toctree::
|
|
:maxdepth: 3
|
|
|
|
user-account-types-51cf01ac63bf
|
|
starlingx-authentication-and-authorization-95bb323e247b
|
|
kubernetes-authentication-and-authorization-5083f8977b9c
|
|
ssh-authentication-and-authorization-664769a1e276
|
|
|
|
|
|
********
|
|
Auditing
|
|
********
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
auditd-support-339a51d8ce16
|
|
operator-login-authentication-logging
|
|
operator-command-logging
|
|
kubernetes-operator-command-logging-663fce5d74e7
|
|
|
|
|
|
.. _portieris-admission-controller-security-index:
|
|
|
|
************************************************
|
|
Container Image Integrity (Signature Validation)
|
|
************************************************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
portieris-overview
|
|
install-portieris
|
|
portieris-clusterimagepolicy-and-imagepolicy-configuration
|
|
remove-portieris
|
|
|
|
|
|
**************************
|
|
Container AppArmor Profile
|
|
**************************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
about-apparmor-ebdab8f1ed87
|
|
enable-disable-apparmor-on-a-host-63a7a184d310
|
|
enable-disable-apparmor-on-a-host-using-horizon-a318ab726396
|
|
install-security-profiles-operator-1b2f9a0f0108
|
|
profile-management-a8df19c86a5d
|
|
apply-a-profile-to-a-pod-c2fa4d958dec
|
|
enable-apparmor-log-bb600560d794
|
|
author-apparmor-profiles-b02de0a22771
|
|
|
|
***********************
|
|
Encrypting Data at Rest
|
|
***********************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
partial-disk-transparent-encryption-support-via-software-enc-27a570f3142c
|
|
encrypt-kubernetes-secret-data-at-rest
|
|
|
|
Vault Secret and Data Management
|
|
================================
|
|
|
|
.. _vault-secret-and-data-management-050a998960d0:
|
|
.. _vault-secret-and-data-management-security-index:
|
|
|
|
.. toctree::
|
|
:maxdepth: 2
|
|
|
|
security-vault-overview
|
|
install-vault
|
|
configure-vault
|
|
configure-vault-using-the-cli
|
|
remove-vault
|
|
|
|
***************************
|
|
IPsec on Management Network
|
|
***************************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
ipsec-overview-680c2dcfbf3b
|
|
ipsec-configuration-and-enabling-f70964bc49d1
|
|
ipsec-certificates-2c0655a2a888
|
|
ipsec-clis-5f38181d077f
|
|
|
|
|
|
********************************************
|
|
Secure Inter-host Pod-to-pod Network Traffic
|
|
********************************************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
inter-host-pod-to-pod-security-overview-f44d8d3c7541
|
|
install-ipsec-policy-operator-system-application-95ae437a67e2
|
|
configure-ipsec-for-selected-inter-host-pod-to-pod-traffic-usi-8cb9b4342b5d
|
|
remove-ipsec-policy-operator-system-application-06e7f2e4cdfb
|
|
|
|
***************
|
|
CVE Maintenance
|
|
***************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
cve-maintenance-723cd9dd54b3
|
|
|
|
|
|
*******************************************************
|
|
Security Feature Configuration for Spectre and Meltdown
|
|
*******************************************************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
security-feature-configuration-for-spectre-and-meltdown
|
|
|
|
************************
|
|
Deprecated Functionality
|
|
************************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
starlingx-rest-api-applications-and-the-web-administration-server-deprecated
|
|
enable-https-access-for-starlingx-rest-and-web-server-endpoints
|
|
|
|
******************************************
|
|
Appendix: Configurations for CIS benchmark
|
|
******************************************
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
|
|
configuring-system-to-cis-benchmark-for-hosts-standards-bc2c3f582895
|
|
configuring-system-to-cis-benchmark-for-containers-standards-3df0c174ffe2
|
|
|