Code module: Security recommendations

This document represents security recommendations for the infrastructure level of a Deckhouse Code installation in Deckhouse Kubernetes Platform: the cluster, the d8-code namespace and the CodeInstance resource. The settings of the application itself, of groups and of projects are described in the Deckhouse Code documentation, see Application settings and daily operation. It contains best known practices from official documentation of related instruments.

Security recommendations for infrastructure level (target DKP)

This section focused on security practices for Deckhouse Code installation on target infrastructure, including product level practices implementations. Requires access to target DKP cluster for administration d8-code namespace and CodeInstance custom resource

Components communication settings (TLS)

Implemented by default

Severity: Critical

All inter-components connections secured with TLS encryption inside namespace

Incoming traffic settings

Implemented by default

Severity: Critical

The nginx.ingress.kubernetes.io/backend-protocol: https, proxy-ssl-verify: 'on' annotations and the use of a dedicated TLS secret (proxy-ssl-secret) in the Ingress resource configuration ensure encryption and authentication of the connection between nginx-ingress-controller and backend services (i.e., Deckhouse Code components directly). This eliminates the possibility of data interception or spoofing within the cluster, enhancing the overall security of internal traffic.

Secret rotation settings for product access

Implemented by default

Severity: Critical

The operator uses the deckhouse-sa service account for fine-tuning and retrieving technical information about Deckhouse Code via API. For authorization, it uses tokens whose values are stored in secrets within the d8-code namespace. The operator automatically rotates the tokens it uses on a schedule to enhance the security level of the product’s perimeter.

Stay on the latest product version

Implemented by default

Severity: Moderate

It is recommended to regularly update the Deckhouse Code module to receive timely fixes for any security-related issues. To fine-tune the update parameters, use the ModuleUpdatePolicy resource.

Access to the d8-code namespace

Severity: Critical

The d8-code namespace contains not only application pods but also configuration with sensitive information, such as encryption keys, TLS certificates and keys, access tokens for the Deckhouse Code API, and so on.

Access to d8-code must be restricted to a limited and verified set of individuals or service accounts. Such access is required for maintaining Deckhouse Code, including manually triggering backup, checking the running application state, and enabling certain features via the rails console.

To access the d8-code namespace, Role / RoleBinding primitives should be used (not ClusterRole, unless required).

For example, the manifest below grants the user with email code@deckhouse.ru the PrivilegedUser access level. More details about the Deckhouse Kubernetes Platform role model can be found at this link.

These permissions are sufficient for accessing containers, reading secrets, and deleting pods of the Deckhouse Code module located in the d8-code namespace.

apiVersion: deckhouse.io/v1
kind: ClusterAuthorizationRule
metadata:
  name: code-test
spec:
  accessLevel: PrivilegedUser
  allowScale: false
  namespaceSelector:
    labelSelector:
      matchExpressions: []
      matchLabels:
        module: code
  portForwarding: false
  subjects:
    - kind: User
      name: code@deckhouse.ru

Rotate the administrator account password

Severity: Critical

Immediately after deploying the product, it is necessary to obtain the administrator password from the initial-root-password secret, change it, and store it in a secure location, thereby invalidating the secret’s content. The password in the secret is intended to be used by the administrator only for the initial system setup.

To obtain the administrator password, use the following command:

kubectl -n d8-code get secret initial-root-password -o jsonpath='{.data.password}' | base64 -d

To change the password, log in to the application interface, click on the user avatar, and select the “Settings” section. In the settings, select the “Password” menu and change the password.

Configure network access policies in the d8-code namespace

Severity: Moderate

To minimize attack vectors and reduce the access surface, it is recommended to configure and use Kubernetes NetworkPolicy in accordance with the organization’s needs. An example of how to configure NetworkPolicy is described at this link.

Network connectivity is described at this link.

Audit event export

Severity: Moderate

It is recommended to configure an event collector to the company’s SIEM system using the streaming of security audit events to stdout by Deckhouse Code components in CEF format.

What to collect:

In the webservice-default and sidekiq-default deployments, there is a sidecar container audit that streams audit events in CEF format to stdout.

Example: kubectl -n d8-code logs deployments/webservice-default -c audit

It is recommended to collect these logs and deliver them to your SIEM system using the log shipper utilized in your Deckhouse Kubernetes Platform installation.

Application settings and daily operation

The security settings of the application itself are described in the Deckhouse Code documentation: the instance-level settings in Security settings, the group and project settings in Group and project security settings.