---
description: Platform security—policy as code (OPA/Gatekeeper, Kyverno), supply chain (signing, scanning), secrets, network policies, RBAC. Defense in depth, least privilege.
alwaysApply: false
---

# Security

Guidelines for implementing security across the platform.

## Core Principles

1. **Defense in Depth** - Multiple layers of controls.
2. **Least Privilege** - Minimal permissions to function.
3. **Zero Trust** - Verify explicitly; never trust implicitly.
4. **Shift Left** - Security early; automate in every pipeline.
5. **Automate** - Policy as code; scans in CI; no manual exceptions.

## Policy as Code

- **OPA/Gatekeeper**: ConstraintTemplates + Constraints to enforce (e.g. required resource limits, labels). Match namespaces/kinds; fail closed in production.
- **Kyverno**: ClusterPolicy for require-labels, disallow-privileged, require-run-as-non-root. Use `validationFailureAction: Enforce` and `background: true` where appropriate.

One example—require resource limits:

```yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredResources
metadata:
  name: require-resource-limits
spec:
  match:
    kinds: [{ apiGroups: [""], kinds: ["Pod"] }]
    namespaces: [production, staging]
  parameters:
    limits: [cpu, memory]
    requests: [cpu, memory]
```

## Supply Chain Security

- **Sign images**: Cosign (keyless or key) in CI after build; attest SBOM.
- **Verify in cluster**: Kyverno verifyImages so only signed images (e.g. from your registry) are allowed; optionally attestation age.
- **Scan**: Trivy (or similar) on FS and image in CI; fail on CRITICAL/HIGH; upload SARIF. Run on PR and main.

## Secrets Management

- **In cluster**: Use External Secrets Operator (or similar) with Vault/AWS Secrets Manager; no raw secrets in Git. ClusterSecretStore + ExternalSecret per app; refreshInterval; template if needed.
- **In Git (GitOps)**: SOPS (or sealed-secrets) with KMS/age; encrypt only secret data; decrypt in CI or at apply time. Never commit plaintext secrets.

## Network Security

- **Default deny**: NetworkPolicy with empty podSelector and policyTypes Ingress+Egress; then allow DNS (egress to kube-dns) and app-specific ingress/egress.
- **Per-app**: Allow ingress only from ingress controller and monitoring; egress only to required services (DB, Redis, external HTTPS). Use podSelector/namespaceSelector; avoid 0.0.0.0/0 except for egress to internet on 443 if needed.
- **Service mesh**: If using Istio, PeerAuthentication STRICT mTLS; AuthorizationPolicy for allow-rules by principal/path/method.

## RBAC

- **Kubernetes**: ClusterRoles with minimal verbs (get, list, watch, update only where needed); RoleBindings per namespace. Avoid cluster-admin except for platform; no wildcard resources.
- **Cloud (e.g. AWS)**: IRSA for pod-to-AWS; IAM roles with least-privilege policies; assume-role condition on service account. No long-lived keys in pods.

## Security Pipeline (CI)

- SAST (e.g. Semgrep) with security/secrets/OWASP rules.
- Secret scanning (e.g. Gitleaks) on checkout.
- Dependency review or Dependabot; fail on high/critical where appropriate.
- Container: build, Trivy scan, fail on CRITICAL/HIGH.
- IaC: tfsec, Checkov (or similar) on terraform/ and fail on high severity.

## Common Pitfalls

- **Overly permissive RBAC** - Prefer specific apiGroups/resources/verbs; never `*` for all three.
- **Secrets in env** - Use secretKeyRef (or External Secrets); never plaintext in Pod spec or Git.
- **Running as root** - Set runAsNonRoot, runAsUser; allowPrivilegeEscalation: false; readOnlyRootFilesystem; drop ALL capabilities.
- **No network segmentation** - Default-deny NetworkPolicies; explicit allow for app-to-app and egress.