Expand security-hardening/ subsection, reorder howtos/ section #562
Conversation
Signed-off-by: Víctor Cuadrado Juan <[email protected]>
Showcases that Kubewarden is not providing the air gap. Signed-off-by: Víctor Cuadrado Juan <[email protected]>
Signed-off-by: Víctor Cuadrado Juan <[email protected]>
✅ Deploy Preview for docs-kubewarden-io ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
The secure-supply-chain page is about securing Kubewarden only. Signed-off-by: Víctor Cuadrado Juan <[email protected]>
From more general and newbie topics, to more specific and obscure. Signed-off-by: Víctor Cuadrado Juan <[email protected]>
Signed-off-by: Víctor Cuadrado Juan <[email protected]>
Signed-off-by: Víctor Cuadrado Juan <[email protected]>
viccuad
force-pushed
the
from-self-assessment
branch
from
d9238f1 to
acfc73b
Compare
|
@viccuad JFYI, I think that, starting from 1.23, we will be able to run the whole KW stack inside of a namespace where the |
Signed-off-by: Víctor Cuadrado Juan <[email protected]>
|
Hi from Orlando airport! I will be able to review in more detail next week. But looks fine so far. The move from 'air-gap' to 'air gap'. No problem, just wondering what's the driver? Is there a reference that recommends one over the other that you have in mind? It's the sort of thing that we would want to be used consistently. Ideally across SUSE. |
I went for consistency inside docs.kubewarden.io, but I'm ok with any nomenclature! We can discuss about it in the next days, no rush :). |
| ``` | ||
|
|
||
| This provides a default PolicyServer and default policies in protect mode to | ||
| ensure the Kubewarden stack is safe from other workloads. |
There was a problem hiding this comment.
Is 'safe' the right word? Maybe 'partitioned from' or 'separate to'? Just wondering.
| ensure the Kubewarden stack is safe from other workloads. | |
| ensure the Kubewarden stack is safe from other workloads. |
There was a problem hiding this comment.
I would say it's correct, by deploying the kubewarden-defaults chart we ensure the safety of Kubewarden. It's already partitioned, but if we allow other workloads to deploy with privileges (because the kubewarden-defaults chart is not deployed for example) then Kubewarden, and by extension the rest of the cluster, is not safe.
Great. Consistency was a word used a lot in my presentation at SC. It's, in my view, the most important thing in a set of docs. We also have a company-wide technical glossary called termweb, recently adopted, looking for wider usage. Air gap is not in it yet and I'll do something about that. |
Co-authored-by: John Krug <[email protected]> Signed-off-by: Víctor Cuadrado Juan <[email protected]>
|
@jhkrug I found Rancher 1.x docs mention "Air gap" mostly, while in 2.x there's "Air gap" and "Air-gap". Is it ok merging this PR as-is? I'm happy changing the air gap mentions now or later of course. |
I am happy that we are consistent within KW for now. Consistency over cloud native will come over time. Terms that are in the glossary/termweb will become controlled and set as variable/attributes to be used in the markdown/asciidoc. |
|
merging, thanks! |
Description
Related to #558.
While working on kubewarden/community#40, I feel it's easier to provide a more featured security-hardening section than to write the contents of this PR in the self-assessment which is not so accessible.
Expanded with a summary on how to harden Kubewarden installations.
Reorder howtos/ section, from more general and newbie topics, to more specific and obscure.
Test
Additional Information
Tradeoff
Potential improvement