mirror/typhoon
1
0
Fork 0
mirror of https://github.com/poseidon/typhoon synced 2025-01-26 00:50:29 +01:00
Code Issues
gh-pages
typhoon/topics/security/index.html

1902 lines
44 KiB
HTML
Raw Permalink Blame History

<!doctype html>
<html lang="en" class="no-js">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="description" content="A minimal and free Kubernetes distribution">
<meta name="author" content="Dalton Hubble">
<link rel="prev" href="../hardware/">
<link rel="next" href="../performance/">
<link rel="icon" href="../../img/favicon.ico">
<meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.5.49">
<title>Security - Typhoon</title>
<link rel="stylesheet" href="../../assets/stylesheets/main.6f8fc17f.min.css">
<link rel="stylesheet" href="../../assets/stylesheets/palette.06af60db.min.css">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto+Slab:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
<style>:root{--md-text-font:"Roboto Slab";--md-code-font:"Roboto Mono"}</style>
<script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:site" content="@typhoon8s">
<meta name="twitter:creator" content="@dghubble">
<meta name="twitter:title" content="Minimal and free Kubernetes clusters">
<meta name="twitter:description" content="Kubernetes clusters for AWS, Azure, bare-metal, Google Cloud, and DigitalOcean">
<meta name="twitter:image" content="https://storage.googleapis.com/poseidon/typhoon-twitter-card.png">
</head>
<body dir="ltr" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo">
<input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
<input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
<label class="md-overlay" for="__drawer"></label>
<div data-md-component="skip">
<a href="#security" class="md-skip">
Skip to content
</a>
</div>
<div data-md-component="announce">
</div>
<header class="md-header" data-md-component="header">
<nav class="md-header__inner md-grid" aria-label="Header">
<a href="../.." title="Typhoon" class="md-header__button md-logo" aria-label="Typhoon" data-md-component="logo">
<img src="../../img/spin.png" alt="logo">
</a>
<label class="md-header__button md-icon" for="__drawer">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
</label>
<div class="md-header__title" data-md-component="header-title">
<div class="md-header__ellipsis">
<div class="md-header__topic">
<span class="md-ellipsis">
Typhoon
</span>
</div>
<div class="md-header__topic" data-md-component="header-topic">
<span class="md-ellipsis">
Security
</span>
</div>
</div>
</div>
<form class="md-header__option" data-md-component="palette">
<input class="md-option" data-md-color-media="(prefers-color-scheme)" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo" aria-label="Switch to light mode" type="radio" name="__palette" id="__palette_0">
<label class="md-header__button md-icon" title="Switch to light mode" for="__palette_1" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m14.3 16-.7-2h-3.2l-.7 2H7.8L11 7h2l3.2 9zM20 8.69V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12zm-9.15 3.96h2.3L12 9z"/></svg>
</label>
<input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="blue" data-md-color-accent="pink" aria-label="Switch to dark mode" type="radio" name="__palette" id="__palette_1">
<label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_2" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m17.75 4.09-2.53 1.94.91 3.06-2.63-1.81-2.63 1.81.91-3.06-2.53-1.94L12.44 4l1.06-3 1.06 3zm3.5 6.91-1.64 1.25.59 1.98-1.7-1.17-1.7 1.17.59-1.98L15.75 11l2.06-.05L18.5 9l.69 1.95zm-2.28 4.95c.83-.08 1.72 1.1 1.19 1.85-.32.45-.66.87-1.08 1.27C15.17 23 8.84 23 4.94 19.07c-3.91-3.9-3.91-10.24 0-14.14.4-.4.82-.76 1.27-1.08.75-.53 1.93.36 1.85 1.19-.27 2.86.69 5.83 2.89 8.02a9.96 9.96 0 0 0 8.02 2.89m-1.64 2.02a12.08 12.08 0 0 1-7.8-3.47c-2.17-2.19-3.33-5-3.49-7.82-2.81 3.14-2.7 7.96.31 10.98 3.02 3.01 7.84 3.12 10.98.31"/></svg>
</label>
<input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="blue" data-md-color-accent="pink" aria-label="Switch to system preference" type="radio" name="__palette" id="__palette_2">
<label class="md-header__button md-icon" title="Switch to system preference" for="__palette_0" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 7a5 5 0 0 1 5 5 5 5 0 0 1-5 5 5 5 0 0 1-5-5 5 5 0 0 1 5-5m0 2a3 3 0 0 0-3 3 3 3 0 0 0 3 3 3 3 0 0 0 3-3 3 3 0 0 0-3-3m0-7 2.39 3.42C13.65 5.15 12.84 5 12 5s-1.65.15-2.39.42zM3.34 7l4.16-.35A7.2 7.2 0 0 0 5.94 8.5c-.44.74-.69 1.5-.83 2.29zm.02 10 1.76-3.77a7.131 7.131 0 0 0 2.38 4.14zM20.65 7l-1.77 3.79a7.02 7.02 0 0 0-2.38-4.15zm-.01 10-4.14.36c.59-.51 1.12-1.14 1.54-1.86.42-.73.69-1.5.83-2.29zM12 22l-2.41-3.44c.74.27 1.55.44 2.41.44.82 0 1.63-.17 2.37-.44z"/></svg>
</label>
</form>
<script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
<label class="md-header__button md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
</label>
<div class="md-search" data-md-component="search" role="dialog">
<label class="md-search__overlay" for="__search"></label>
<div class="md-search__inner" role="search">
<form class="md-search__form" name="search">
<input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
<label class="md-search__icon md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
</label>
<nav class="md-search__options" aria-label="Search">
<button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg>
</button>
</nav>
</form>
<div class="md-search__output">
<div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
<div class="md-search-result" data-md-component="search-result">
<div class="md-search-result__meta">
Initializing search
</div>
<ol class="md-search-result__list" role="presentation"></ol>
</div>
</div>
</div>
</div>
</div>
<div class="md-header__source">
<a href="https://github.com/poseidon/typhoon" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 480 512"><!--! Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M186.1 328.7c0 20.9-10.9 55.1-36.7 55.1s-36.7-34.2-36.7-55.1 10.9-55.1 36.7-55.1 36.7 34.2 36.7 55.1M480 278.2c0 31.9-3.2 65.7-17.5 95-37.9 76.6-142.1 74.8-216.7 74.8-75.8 0-186.2 2.7-225.6-74.8-14.6-29-20.2-63.1-20.2-95 0-41.9 13.9-81.5 41.5-113.6-5.2-15.8-7.7-32.4-7.7-48.8 0-21.5 4.9-32.3 14.6-51.8 45.3 0 74.3 9 108.8 36 29-6.9 58.8-10 88.7-10 27 0 54.2 2.9 80.4 9.2 34-26.7 63-35.2 107.8-35.2 9.8 19.5 14.6 30.3 14.6 51.8 0 16.4-2.6 32.7-7.7 48.2 27.5 32.4 39 72.3 39 114.2m-64.3 50.5c0-43.9-26.7-82.6-73.5-82.6-18.9 0-37 3.4-56 6-14.9 2.3-29.8 3.2-45.1 3.2-15.2 0-30.1-.9-45.1-3.2-18.7-2.6-37-6-56-6-46.8 0-73.5 38.7-73.5 82.6 0 87.8 80.4 101.3 150.4 101.3h48.2c70.3 0 150.6-13.4 150.6-101.3m-82.6-55.1c-25.8 0-36.7 34.2-36.7 55.1s10.9 55.1 36.7 55.1 36.7-34.2 36.7-55.1-10.9-55.1-36.7-55.1"/></svg>
</div>
<div class="md-source__repository">
poseidon/typhoon
</div>
</a>
</div>
</nav>
</header>
<div class="md-container" data-md-component="container">
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
<div class="md-grid">
<ul class="md-tabs__list">
<li class="md-tabs__item">
<a href="../.." class="md-tabs__link">
Home
</a>
</li>
<li class="md-tabs__item">
<a href="../../announce/" class="md-tabs__link">
Announce
</a>
</li>
<li class="md-tabs__item">
<a href="../../architecture/concepts/" class="md-tabs__link">
Architecture
</a>
</li>
<li class="md-tabs__item">
<a href="../../fedora-coreos/aws/" class="md-tabs__link">
Fedora CoreOS
</a>
</li>
<li class="md-tabs__item">
<a href="../../flatcar-linux/aws/" class="md-tabs__link">
Flatcar Linux
</a>
</li>
<li class="md-tabs__item md-tabs__item--active">
<a href="../maintenance/" class="md-tabs__link">
Topics
</a>
</li>
<li class="md-tabs__item">
<a href="../../advanced/overview/" class="md-tabs__link">
Advanced
</a>
</li>
<li class="md-tabs__item">
<a href="../../addons/overview/" class="md-tabs__link">
Addons
</a>
</li>
</ul>
</div>
</nav>
<main class="md-main" data-md-component="main">
<div class="md-main__inner md-grid">
<div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
<label class="md-nav__title" for="__drawer">
<a href="../.." title="Typhoon" class="md-nav__button md-logo" aria-label="Typhoon" data-md-component="logo">
<img src="../../img/spin.png" alt="logo">
</a>
Typhoon
</label>
<div class="md-nav__source">
<a href="https://github.com/poseidon/typhoon" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 480 512"><!--! Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M186.1 328.7c0 20.9-10.9 55.1-36.7 55.1s-36.7-34.2-36.7-55.1 10.9-55.1 36.7-55.1 36.7 34.2 36.7 55.1M480 278.2c0 31.9-3.2 65.7-17.5 95-37.9 76.6-142.1 74.8-216.7 74.8-75.8 0-186.2 2.7-225.6-74.8-14.6-29-20.2-63.1-20.2-95 0-41.9 13.9-81.5 41.5-113.6-5.2-15.8-7.7-32.4-7.7-48.8 0-21.5 4.9-32.3 14.6-51.8 45.3 0 74.3 9 108.8 36 29-6.9 58.8-10 88.7-10 27 0 54.2 2.9 80.4 9.2 34-26.7 63-35.2 107.8-35.2 9.8 19.5 14.6 30.3 14.6 51.8 0 16.4-2.6 32.7-7.7 48.2 27.5 32.4 39 72.3 39 114.2m-64.3 50.5c0-43.9-26.7-82.6-73.5-82.6-18.9 0-37 3.4-56 6-14.9 2.3-29.8 3.2-45.1 3.2-15.2 0-30.1-.9-45.1-3.2-18.7-2.6-37-6-56-6-46.8 0-73.5 38.7-73.5 82.6 0 87.8 80.4 101.3 150.4 101.3h48.2c70.3 0 150.6-13.4 150.6-101.3m-82.6-55.1c-25.8 0-36.7 34.2-36.7 55.1s10.9 55.1 36.7 55.1 36.7-34.2 36.7-55.1-10.9-55.1-36.7-55.1"/></svg>
</div>
<div class="md-source__repository">
poseidon/typhoon
</div>
</a>
</div>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../.." class="md-nav__link">
<span class="md-ellipsis">
Home
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../announce/" class="md-nav__link">
<span class="md-ellipsis">
Announce
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" >
<label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="0">
<span class="md-ellipsis">
Architecture
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_3">
<span class="md-nav__icon md-icon"></span>
Architecture
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../architecture/concepts/" class="md-nav__link">
<span class="md-ellipsis">
Concepts
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../architecture/operating-systems/" class="md-nav__link">
<span class="md-ellipsis">
Operating Systems
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../architecture/aws/" class="md-nav__link">
<span class="md-ellipsis">
AWS
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../architecture/azure/" class="md-nav__link">
<span class="md-ellipsis">
Azure
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../architecture/bare-metal/" class="md-nav__link">
<span class="md-ellipsis">
Bare-Metal
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../architecture/digitalocean/" class="md-nav__link">
<span class="md-ellipsis">
DigitalOcean
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../architecture/google-cloud/" class="md-nav__link">
<span class="md-ellipsis">
Google Cloud
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
<label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
<span class="md-ellipsis">
Fedora CoreOS
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4">
<span class="md-nav__icon md-icon"></span>
Fedora CoreOS
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../fedora-coreos/aws/" class="md-nav__link">
<span class="md-ellipsis">
AWS
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../fedora-coreos/azure/" class="md-nav__link">
<span class="md-ellipsis">
Azure
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../fedora-coreos/bare-metal/" class="md-nav__link">
<span class="md-ellipsis">
Bare-Metal
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../fedora-coreos/digitalocean/" class="md-nav__link">
<span class="md-ellipsis">
DigitalOcean
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../fedora-coreos/google-cloud/" class="md-nav__link">
<span class="md-ellipsis">
Google Cloud
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" >
<label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
<span class="md-ellipsis">
Flatcar Linux
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_5">
<span class="md-nav__icon md-icon"></span>
Flatcar Linux
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../flatcar-linux/aws/" class="md-nav__link">
<span class="md-ellipsis">
AWS
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../flatcar-linux/azure/" class="md-nav__link">
<span class="md-ellipsis">
Azure
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../flatcar-linux/bare-metal/" class="md-nav__link">
<span class="md-ellipsis">
Bare-Metal
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../flatcar-linux/digitalocean/" class="md-nav__link">
<span class="md-ellipsis">
DigitalOcean
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../flatcar-linux/google-cloud/" class="md-nav__link">
<span class="md-ellipsis">
Google Cloud
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" checked>
<label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="">
<span class="md-ellipsis">
Topics
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="true">
<label class="md-nav__title" for="__nav_6">
<span class="md-nav__icon md-icon"></span>
Topics
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../maintenance/" class="md-nav__link">
<span class="md-ellipsis">
Maintenance
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../hardware/" class="md-nav__link">
<span class="md-ellipsis">
Hardware
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--active">
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
<label class="md-nav__link md-nav__link--active" for="__toc">
<span class="md-ellipsis">
Security
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<a href="./" class="md-nav__link md-nav__link--active">
<span class="md-ellipsis">
Security
</span>
</a>
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#overview" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#precautions" class="md-nav__link">
<span class="md-ellipsis">
Precautions
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#container-images" class="md-nav__link">
<span class="md-ellipsis">
Container Images
</span>
</a>
<nav class="md-nav" aria-label="Container Images">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#flannel-cni" class="md-nav__link">
<span class="md-ellipsis">
flannel-cni
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#terraform-providers" class="md-nav__link">
<span class="md-ellipsis">
Terraform Providers
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#kube-system" class="md-nav__link">
<span class="md-ellipsis">
kube-system
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#disclosures" class="md-nav__link">
<span class="md-ellipsis">
Disclosures
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="../performance/" class="md-nav__link">
<span class="md-ellipsis">
Performance
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../faq/" class="md-nav__link">
<span class="md-ellipsis">
FAQ
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" >
<label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0">
<span class="md-ellipsis">
Advanced
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_7">
<span class="md-nav__icon md-icon"></span>
Advanced
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../advanced/overview/" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../advanced/arm64/" class="md-nav__link">
<span class="md-ellipsis">
ARM64
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../advanced/customization/" class="md-nav__link">
<span class="md-ellipsis">
Customization
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../advanced/nodes/" class="md-nav__link">
<span class="md-ellipsis">
Nodes
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../advanced/worker-pools/" class="md-nav__link">
<span class="md-ellipsis">
Worker Pools
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" >
<label class="md-nav__link" for="__nav_8" id="__nav_8_label" tabindex="0">
<span class="md-ellipsis">
Addons
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_8">
<span class="md-nav__icon md-icon"></span>
Addons
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../addons/overview/" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../addons/ingress/" class="md-nav__link">
<span class="md-ellipsis">
Nginx Ingress
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../addons/prometheus/" class="md-nav__link">
<span class="md-ellipsis">
Prometheus
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../addons/grafana/" class="md-nav__link">
<span class="md-ellipsis">
Grafana
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../addons/fleetlock/" class="md-nav__link">
<span class="md-ellipsis">
fleetlock
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#overview" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#precautions" class="md-nav__link">
<span class="md-ellipsis">
Precautions
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#container-images" class="md-nav__link">
<span class="md-ellipsis">
Container Images
</span>
</a>
<nav class="md-nav" aria-label="Container Images">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#flannel-cni" class="md-nav__link">
<span class="md-ellipsis">
flannel-cni
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#terraform-providers" class="md-nav__link">
<span class="md-ellipsis">
Terraform Providers
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#kube-system" class="md-nav__link">
<span class="md-ellipsis">
kube-system
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#disclosures" class="md-nav__link">
<span class="md-ellipsis">
Disclosures
</span>
</a>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-content" data-md-component="content">
<article class="md-content__inner md-typeset">
<h1 id="security">Security<a class="headerlink" href="#security" title="Permanent link">&para;</a></h1>
<p>Typhoon aims to be minimal and secure. We're running it ourselves after all.</p>
<h2 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link">&para;</a></h2>
<p><strong>Kubernetes</strong></p>
<ul>
<li>etcd with peer-to-peer and client-auth TLS</li>
<li>Kubelets TLS bootstrap certificates (72 hours)</li>
<li>Generated TLS certificate (365 days) for admin <code>kubeconfig</code></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/node/">NodeRestriction</a> is enabled to limit Kubelet authorization</li>
<li><a href="https://kubernetes.io/docs/admin/authorization/rbac/">Role-Based Access Control</a> is enabled. Apps must define RBAC policies for API access</li>
<li>Workloads run on worker nodes only, unless they tolerate the master taint</li>
<li>Kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/">Network Policy</a> and Cilium <a href="https://docs.cilium.io/en/latest/security/policy/index.html">NetworkPolicy</a> support <sup id="fnref:1"><a class="footnote-ref" href="#fn:1">1</a></sup></li>
</ul>
<p><strong>Hosts</strong></p>
<ul>
<li>Container Linux auto-updates are enabled</li>
<li>Hosts limit logins to SSH key-based auth (user "core")</li>
<li>SELinux enforcing mode <sup id="fnref:2"><a class="footnote-ref" href="#fn:2">2</a></sup></li>
</ul>
<p><strong>Platform</strong></p>
<ul>
<li>Cloud firewalls limit access to ssh, kube-apiserver, and ingress</li>
<li>No cluster credentials are stored in Matchbox (used for bare-metal)</li>
<li>No cluster credentials are stored in Digital Ocean metadata</li>
<li>Cluster credentials are stored in AWS metadata (for ASGs)</li>
<li>Cluster credentials are stored in Azure metadata (for scale sets)</li>
<li>Cluster credentials are stored in Google Cloud metadata (for managed instance groups)</li>
<li>No account credentials are available to Digital Ocean droplets</li>
<li>No account credentials are available to AWS EC2 instances (no IAM permissions)</li>
<li>No account credentials are available to Azure instances (no IAM permissions)</li>
<li>No account credentials are available to Google Cloud instances (no IAM permissions)</li>
</ul>
<h2 id="precautions">Precautions<a class="headerlink" href="#precautions" title="Permanent link">&para;</a></h2>
<p>Typhoon limits exposure to many security threats, but it is not a silver bullet. As usual,</p>
<ul>
<li>Do not run untrusted images or accept manifests from strangers</li>
<li>Do not give untrusted users a shell behind your firewall</li>
<li>Define network policies for your namespaces</li>
</ul>
<h2 id="container-images">Container Images<a class="headerlink" href="#container-images" title="Permanent link">&para;</a></h2>
<p>Typhoon uses upstream container images (where possible) and upstream binaries.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Kubernetes releases <code>kubelet</code> as a binary for distros to package, either as a DEB/RPM on traditional distros or as a container image for container-optimized operating systems.</p>
</div>
<p>Typhoon <a href="https://github.com/poseidon/kubelet">packages</a> the upstream Kubelet and its dependencies as a <a href="https://quay.io/repository/poseidon/kubelet">container image</a>. Builds fetch the upstream Kubelet binary and verify its checksum.</p>
<p>The Kubelet image is published to Quay.io and Dockerhub.</p>
<ul>
<li><a href="https://quay.io/repository/poseidon/kubelet">quay.io/poseidon/kubelet</a> (official)</li>
<li><a href="https://hub.docker.com/r/psdn/kubelet">docker.io/psdn/kubelet</a> (fallback)</li>
</ul>
<p>Two tag styles indicate the build strategy used.</p>
<ul>
<li>Typhoon internal infra publishes single and multi-arch images (e.g. <code>v1.18.4</code>, <code>v1.18.4-amd64</code>, <code>v1.18.4-arm64</code>, <code>v1.18.4-2-g23228e6-amd64</code>, <code>v1.18.4-2-g23228e6-arm64</code>)</li>
<li>Quay automated builds publish verifiable images (e.g. <code>build-SHA</code> on Quay)</li>
</ul>
<p>The Typhoon-built Kubelet image is used as the official image. Automated builds provide an alternative image for those preferring to trust images built by Quay (albeit lacking multi-arch). To use the fallback registry or an alternative tag, see <a href="/advanced/customization/#system-images">customization</a>.</p>
<h3 id="flannel-cni">flannel-cni<a class="headerlink" href="#flannel-cni" title="Permanent link">&para;</a></h3>
<p>Typhoon packages the <a href="https://github.com/poseidon/flannel-cni">flannel-cni</a> container image to provide security patches.</p>
<ul>
<li><a href="https://quay.io/repository/poseidon/flannel-cni">quay.io/poseidon/flannel-cni</a> (official)</li>
</ul>
<h2 id="terraform-providers">Terraform Providers<a class="headerlink" href="#terraform-providers" title="Permanent link">&para;</a></h2>
<p>Typhoon publishes Terraform providers to the Terraform Registry, GPG signed by 0x8F515AD1602065C8.</p>
<table>
<thead>
<tr>
<th>Name</th>
<th>Source</th>
<th>Registry</th>
</tr>
</thead>
<tbody>
<tr>
<td>ct</td>
<td><a href="https://github.com/poseidon/terraform-provider-ct">github</a></td>
<td><a href="https://registry.terraform.io/providers/poseidon/ct/latest">poseidon/ct</a></td>
</tr>
<tr>
<td>matchbox</td>
<td><a href="https://github.com/poseidon/terraform-provider-matchbox">github</a></td>
<td><a href="https://registry.terraform.io/providers/poseidon/matchbox/latest">poseidon/matchbox</a></td>
</tr>
</tbody>
</table>
<h2 id="kube-system">kube-system<a class="headerlink" href="#kube-system" title="Permanent link">&para;</a></h2>
<table>
<thead>
<tr>
<th>Name</th>
<th>user</th>
<th>hostNet</th>
<th>privileged</th>
</tr>
</thead>
<tbody>
<tr>
<td>kube-apiserver</td>
<td>nobody</td>
<td>true</td>
<td>false</td>
</tr>
<tr>
<td>kube-controller-manager</td>
<td>nobody</td>
<td>true</td>
<td>false</td>
</tr>
<tr>
<td>kube-scheduler</td>
<td>nobody</td>
<td>true</td>
<td>false</td>
</tr>
<tr>
<td>coredns</td>
<td>NA</td>
<td>false</td>
<td>false</td>
</tr>
<tr>
<td>kube-proxy</td>
<td>root</td>
<td>true</td>
<td>true</td>
</tr>
<tr>
<td>cilium</td>
<td>root</td>
<td>true</td>
<td>true</td>
</tr>
<tr>
<td>flannel</td>
<td>root</td>
<td>true</td>
<td>true</td>
</tr>
</tbody>
</table>
<table>
<thead>
<tr>
<th>Name</th>
<th>priorityClassName</th>
</tr>
</thead>
<tbody>
<tr>
<td>kube-apiserver</td>
<td>system-cluster-critical</td>
</tr>
<tr>
<td>kube-controller-manager</td>
<td>system-cluster-critical</td>
</tr>
<tr>
<td>kube-scheduler</td>
<td>system-cluster-critical</td>
</tr>
<tr>
<td>coredns</td>
<td>system-cluster-critical</td>
</tr>
<tr>
<td>kube-proxy</td>
<td>system-node-critical</td>
</tr>
<tr>
<td>cilium</td>
<td>system-node-critical</td>
</tr>
<tr>
<td>flannel</td>
<td>system-node-critical</td>
</tr>
</tbody>
</table>
<h2 id="disclosures">Disclosures<a class="headerlink" href="#disclosures" title="Permanent link">&para;</a></h2>
<p>If you find security issues, please email <code>security@psdn.io</code>. If the issue lies in upstream Kubernetes, please inform upstream Kubernetes as well.</p>
<div class="footnote">
<hr />
<ol>
<li id="fn:1">
<p>Requires <code>networking = "cilium"</code>. Cilium is the default on all platforms (AWS, Azure, bare-metal, DigitalOcean, and Google Cloud).&#160;<a class="footnote-backref" href="#fnref:1" title="Jump back to footnote 1 in the text">&#8617;</a></p>
</li>
<li id="fn:2">
<p>SELinux is enforcing on Fedora CoreOS, permissive on Flatcar Linux.&#160;<a class="footnote-backref" href="#fnref:2" title="Jump back to footnote 2 in the text">&#8617;</a></p>
</li>
</ol>
</div>
</article>
</div>
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
</div>
</main>
<footer class="md-footer">
<div class="md-footer-meta md-typeset">
<div class="md-footer-meta__inner md-grid">
<div class="md-copyright">
<div class="md-copyright__highlight">
Poseidon Laboratories
</div>
Made with
<a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
Material for MkDocs
</a>
</div>
<div class="md-social">
<a href="https://github.com/poseidon" target="_blank" rel="noopener" title="github.com" class="md-social__link">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 480 512"><!--! Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M186.1 328.7c0 20.9-10.9 55.1-36.7 55.1s-36.7-34.2-36.7-55.1 10.9-55.1 36.7-55.1 36.7 34.2 36.7 55.1M480 278.2c0 31.9-3.2 65.7-17.5 95-37.9 76.6-142.1 74.8-216.7 74.8-75.8 0-186.2 2.7-225.6-74.8-14.6-29-20.2-63.1-20.2-95 0-41.9 13.9-81.5 41.5-113.6-5.2-15.8-7.7-32.4-7.7-48.8 0-21.5 4.9-32.3 14.6-51.8 45.3 0 74.3 9 108.8 36 29-6.9 58.8-10 88.7-10 27 0 54.2 2.9 80.4 9.2 34-26.7 63-35.2 107.8-35.2 9.8 19.5 14.6 30.3 14.6 51.8 0 16.4-2.6 32.7-7.7 48.2 27.5 32.4 39 72.3 39 114.2m-64.3 50.5c0-43.9-26.7-82.6-73.5-82.6-18.9 0-37 3.4-56 6-14.9 2.3-29.8 3.2-45.1 3.2-15.2 0-30.1-.9-45.1-3.2-18.7-2.6-37-6-56-6-46.8 0-73.5 38.7-73.5 82.6 0 87.8 80.4 101.3 150.4 101.3h48.2c70.3 0 150.6-13.4 150.6-101.3m-82.6-55.1c-25.8 0-36.7 34.2-36.7 55.1s10.9 55.1 36.7 55.1 36.7-34.2 36.7-55.1-10.9-55.1-36.7-55.1"/></svg>
</a>
<a href="https://twitter.com/typhoon8s" target="_blank" rel="noopener" title="twitter.com" class="md-social__link">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!--! Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253"/></svg>
</a>
</div>
</div>
</div>
</footer>
</div>
<div class="md-dialog" data-md-component="dialog">
<div class="md-dialog__inner md-typeset"></div>
</div>
<script id="__config" type="application/json">{"base": "../..", "features": ["navigation.tabs", "navigation.instant"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script>
<script src="../../assets/javascripts/bundle.88dd0f4e.min.js"></script>
</body>
</html>
View Git Blame Copy Permalink