Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0f9c142

Browse files
authored
docs: add k8s security reference (#12334)
* docs: add k8s security reference* make fmt
1 parent30772b8 commit0f9c142

File tree

1 file changed

+58
-68
lines changed

1 file changed

+58
-68
lines changed

‎docs/install/kubernetes.md

Lines changed: 58 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,64 @@ helm upgrade coder coder-v2/coder \
142142
-f values.yaml
143143
```
144144

145+
##Kubernetes Security Reference
146+
147+
Below are common requirements we see from our enterprise customers when
148+
deploying an application in Kubernetes. This is intended to serve as a
149+
reference, and not all security requirements may apply to your business.
150+
151+
1.**All container images must be sourced from an internal container registry.**
152+
153+
- Control plane - To pull the control plane image from the appropriate
154+
registry,
155+
[update this Helm chart value](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/helm/coder/values.yaml#L43-L50).
156+
- Workspaces - To pull the workspace image from your registry,
157+
[update the Terraform template code here](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/examples/templates/kubernetes/main.tf#L271).
158+
This assumes your cluster nodes are authenticated to pull from the internal
159+
registry.
160+
161+
2.**All containers must run as non-root user**
162+
163+
- Control plane - Our control plane pod
164+
[runs as non-root by default](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/helm/coder/values.yaml#L124-L127).
165+
- Workspaces - Workspace pod UID is
166+
[set in the Terraform template here](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/examples/templates/kubernetes/main.tf#L274-L276),
167+
and are not required to run as`root`.
168+
169+
3.**Containers cannot run privileged**
170+
171+
- Coder's control plane does not run as privileged.
172+
[We disable](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/helm/coder/values.yaml#L141)
173+
`allowPrivilegeEscalation`
174+
[by default](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/helm/coder/values.yaml#L141).
175+
- Workspace pods do not require any elevated privileges, with the exception
176+
of our`envbox` workspace template (used for docker-in-docker workspaces,
177+
not required).
178+
179+
4.**Containers cannot mount host filesystems**
180+
181+
- Both the control plane and workspace containers do not require any host
182+
filesystem mounts.
183+
184+
5.**Containers cannot attach to host network**
185+
186+
- Both the control plane and workspaces use the Kubernetes networking layer
187+
by default, and do not require host network access.
188+
189+
6.**All Kubernetes objects must define resource requests/limits**
190+
191+
- Both the control plane and workspaces set resource request/limits by
192+
default.
193+
194+
7.**All Kubernetes objects must define liveness and readiness probes**
195+
196+
- Control plane - The control plane Deployment has liveness and readiness
197+
probes
198+
[configured by default here](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/helm/coder/templates/_coder.tpl#L98-L107).
199+
- Workspaces - the Kubernetes Deployment template does not configure
200+
liveness/readiness probes for the workspace, but this can be added to the
201+
Terraform template, and is supported.
202+
145203
##Load balancing considerations
146204

147205
###AWS
@@ -192,74 +250,6 @@ was needed. The Application Gateway supports:
192250
-Websocket traffic (required for workspace connections)
193251
-TLS termination
194252

195-
## PostgreSQL Certificates
196-
197-
Your organization may require connecting to the database instance over SSL. To
198-
supply Coder with the appropriate certificates, and have it connect over SSL,
199-
follow the steps below:
200-
201-
### Client verification (server verifies the client)
202-
203-
1. Create the certificate as a secret in your Kubernetes cluster, if not already
204-
present:
205-
206-
```shell
207-
kubectl create secret tls postgres-certs -n coder --key="postgres.key" --cert="postgres.crt"
208-
```
209-
210-
1. Define the secret volume and volumeMounts in the Helm chart:
211-
212-
```yaml
213-
coder:
214-
volumes:
215-
- name: "pg-certs-mount"
216-
secret:
217-
secretName: "postgres-certs"
218-
volumeMounts:
219-
- name: "pg-certs-mount"
220-
mountPath: "$HOME/.postgresql"
221-
readOnly: true
222-
```
223-
224-
1. Lastly, your PG connection URL will look like:
225-
226-
```shell
227-
postgres://<user>:<password>@databasehost:<port>/<db-name>?sslmode=require&sslcert="$HOME/.postgresql/postgres.crt&sslkey=$HOME/.postgresql/postgres.key"
228-
```
229-
230-
### Server verification (client verifies the server)
231-
232-
1. Download the CA certificate chain for your database instance, and create it
233-
as a secret in your Kubernetes cluster, if not already present:
234-
235-
```shell
236-
kubectl create secret tls postgres-certs -n coder --key="postgres-root.key" --cert="postgres-root.crt"
237-
```
238-
239-
1. Define the secret volume and volumeMounts in the Helm chart:
240-
241-
```yaml
242-
coder:
243-
volumes:
244-
- name: "pg-certs-mount"
245-
secret:
246-
secretName: "postgres-certs"
247-
volumeMounts:
248-
- name: "pg-certs-mount"
249-
mountPath: "$HOME/.postgresql/postgres-root.crt"
250-
readOnly: true
251-
```
252-
253-
1. Lastly, your PG connection URL will look like:
254-
255-
```shell
256-
postgres://<user>:<password>@databasehost:<port>/<db-name>?sslmode=verify-full&sslrootcert="/home/coder/.postgresql/postgres-root.crt"
257-
```
258-
259-
> More information on connecting to PostgreSQL databases using certificates can
260-
> be found
261-
> [here](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-CLIENTCERT).
262-
263253
## Troubleshooting
264254

265255
You can view Coder's logs by getting the pod name from `kubectl get pods` and

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp