52b70f81c2
Added topic on new expiring/expired cert alarms. Added 2x alarms to 500 series alarms messages page. NB. Details need to be confirmed. Minor update for clarity around use of kubernetes edit ... Added sample fm output Updtes to alarm definitions based on events.yaml Incorporated (Word) updates from Greg W. Patchset 4 review updates. Patchset 5 review updates. Fixed merge conflict in sec/kub/index Patchset 7 review updates. Patchset 8 review update (note about cert expiry check frequency) Story: 2008946 Task: 43568 Signed-off-by: Ron Stone <ronald.stone@windriver.com> Change-Id: Ifeeba7484e49abcaf2d1ad2afc9afc876d479ded
5.9 KiB
partner
System Accounts
types-of-system-accounts overview-of-system-accounts kube-service-account keystone-accounts remote-windows-active-directory-accounts starlingx-system-accounts-system-account-password-rules
Access the System
configure-local-cli-access remote-access-index security-access-the-gui security-rest-api-access connect-to-container-registries-through-a-firewall-or-proxy
Manage Non-Admin Type Users
private-namespace-and-restricted-rbac pod-security-policies enable-pod-security-policy-checking disable-pod-security-policy-checking assign-pod-security-policies resource-management
User Authentication Using Windows Active Directory
overview-of-windows-active-directory configure-kubernetes-for-oidc-token-validation-while-bootstrapping-the-system configure-kubernetes-for-oidc-token-validation-after-bootstrapping-the-system configure-oidc-auth-applications centralized-oidc-authentication-setup-for-distributed-cloud configure-users-groups-and-authorization configure-kubectl-with-a-context-for-the-user
Obtain the Authentication Token
obtain-the-authentication-token-using-the-oidc-auth-shell-script obtain-the-authentication-token-using-the-browser
Deprovision Windows Active Directory
deprovision-windows-active-directory-authentication
Firewall Options
security-default-firewall-rules security-firewall-options
HTTPS Certificate Management
https-access-overview utility-script-to-display-certificates starlingx-rest-api-applications-and-the-web-administration-server kubernetes-certificates-f4196d7cae9c etcd-certificates-c1fc943e4a9c security-install-update-the-docker-registry-certificate oidc-client-dex-server-certificates-dc174462d51a portieris-server-certificate-a0c7054844bd vault-server-certificate-8573125eeea6 dc-admin-endpoint-certificates-8fe7adf3f932 add-a-trusted-ca one-single-root-ca-multiple-server-client-certificates-0692df6ce16d alarm-expiring-soon-and-expired-certificates-baf5b8f73009
Cert Manager
security-cert-manager the-cert-manager-bootstrap-process cert-manager-post-installation-setup
Portieris Admission Controller
portieris-overview install-portieris portieris-clusterimagepolicy-and-imagepolicy-configuration remove-portieris
Vault Secret and Data Management
security-vault-overview install-vault configure-vault configure-vault-using-the-cli remove-vault
Encrypt Kubernetes Secret Data at Rest
encrypt-kubernetes-secret-data-at-rest
Linux Auditing System
auditd-support-339a51d8ce16
Operator Login/Authentication Logging
operator-login-authentication-logging
Operator Command Logging
operator-command-logging
UEFI Secure Boot
overview-of-uefi-secure-boot use-uefi-secure-boot
Authentication of Software Delivery
authentication-of-software-delivery
Security Feature Configuration for Spectre and Meltdown
security-feature-configuration-for-spectre-and-meltdown
Security Hardening Guidelines
security-hardening-intro
Recommended Security Features with a Minimal Performance Impact
uefi-secure-boot
Secure System Accounts
local-linux-account-for-sysadmin local-and-ldap-linux-user-accounts starlingx-accounts web-administration-login-timeout ssh-and-console-login-timeout system-account-password-rules
Security Features
secure-https-external-connectivity security-hardening-firewall-options isolate-starlingx-internal-cloud-management-network
Appendix: Locally creating certificates
create-certificates-locally-using-openssl create-certificates-locally-using-cert-manager-on-the-controller