Notes / tag / security

#security

49 notes across 9 topics

# Agentic Ai Projects And Mastery

All Agentic Ai Projects And Mastery notes →

1 — Identity & Access Management

Covers identity and access management for a CI/CD platform — workload identity, human access, and the boundary between the two.

ci-cd security book

2 — Secret Management

Covers how a CI/CD platform stores, rotates, injects, and audits secrets used by pipelines and deployments.

ci-cd security book

3 — Policy as Code

Covers expressing security and compliance rules as versioned, testable policy-as-code enforced at pipeline gates.

ci-cd security book

4 — Secure Pipeline Design

Covers the design practices — least privilege, isolation, signed artifacts, hardened runners — that make a pipeline itself resistant to compromise.

ci-cd security book

5 — Software Supply Chain Security

Covers securing the end-to-end software supply chain from source to production — see kubernetes/08-supply-chain-security for SBOM, signing, and SLSA implementation detail.

ci-cd security book

6 — Compliance Automation

Covers automating compliance evidence collection and control enforcement directly inside the CI/CD platform rather than as a manual audit exercise.

ci-cd security book

7 — GitHub Actions: Authentication

Covers the GITHUB_TOKEN, fine-grained PATs, GitHub Apps, and OIDC federation to Azure, AWS, and GCP as the four authentication mechanisms available to a workflow.

ci-cd security book

8 — GitHub Actions: Secrets Management

Covers repository, organization, and environment secrets and variables, secret rotation, and least-privilege scoping for CI credentials.

ci-cd security book

9 — GitHub Actions: Secure Pipelines

Covers dependency review, CodeQL, secret scanning, artifact attestations, branch protection, required reviews, signed commits, and supply chain security gates enforced inside a workflow.

ci-cd security book

1 — Pod Security Standards

Pod Security Standards replaced the removed PodSecurityPolicy admission controller with three built-in profiles (Privileged, Baseline, Restricted) enforced declaratively via namespace labels.

kubernetes security book

10 — Protecting the Control Plane

Because etcd stores every cluster secret unencrypted by default, encryption at rest, mutual TLS between control plane components, and tightly scoped RBAC on kube-system are the highest-leverage hardening steps, not just API server firewalling.

kubernetes security book

2 — Security Contexts

A securityContext can be set at both pod and container level to drop capabilities, force non-root execution, or make the root filesystem read-only, and container-level fields always override pod-level defaults.

kubernetes security book

3 — Seccomp

Seccomp filters which syscalls a container's process is allowed to make at the kernel level, and the RuntimeDefault profile alone blocks dozens of dangerous syscalls that ordinary application workloads never legitimately need.

kubernetes security book

4 — AppArmor

AppArmor confines a process with path-based file, network, and capability rules rather than syscall filtering, and since Kubernetes 1.30 it is configured as a first-class securityContext field instead of only through legacy annotations.

kubernetes security book

5 — SELinux

SELinux enforces mandatory access control by comparing security-context labels on processes and objects rather than relying on discretionary Unix permissions, and label mismatches are the most common cause of unexplained permission-denied errors in hardened clusters.

kubernetes security book

6 — Capabilities

Linux capabilities split root's monolithic power into roughly forty discrete privileges, so dropping ALL and adding back only what's needed, like NET_BIND_SERVICE, is a far narrower grant than running the container as root.

kubernetes security book

7 — Linux Kernel Isolation

Containers isolate processes using namespaces and cgroups on a single shared host kernel rather than virtualizing hardware, so a kernel-level exploit inside one container can compromise every other container scheduled on that node.

kubernetes security book

8 — RuntimeClass

RuntimeClass lets a pod select a different container runtime, such as runc, gVisor, or Kata, so untrusted or multi-tenant workloads can get stronger isolation without changing the cluster-wide default runtime for every other workload.

kubernetes security book

9 — Sandboxed Containers (gVisor, Kata)

gVisor intercepts syscalls through a userspace kernel while Kata runs each pod inside a lightweight VM, and both trade some raw performance for a dramatically smaller attack surface than a shared-kernel container runtime.

kubernetes security book

1 — Identity and Access Management

Who can do what, to which system, and how that access is granted, reviewed, and revoked — the control plane every other security chapter in this Part depends on.

sre security book

10 — Business Continuity

The organizational plan for keeping the business running through a disaster, of which technical disaster recovery is only one component.

sre security book

2 — Secrets Management

Why a secret hardcoded in a config file or env var is a standing incident waiting for a git history search, and the vault-backed rotation that closes that gap.

sre security book

3 — Zero Trust

Verifying every request regardless of network origin, on the assumption the perimeter is already compromised — and what that means for how services actually authenticate to each other.

sre security book

4 — Network Security

Segmentation, firewalling, and the assumption that lateral movement is possible the moment any single node is compromised.

sre security book

5 — Kubernetes Security

RBAC, pod security standards, and network policies — the layers that keep a compromised container from becoming a compromised cluster.

sre security book

6 — Runtime Security

Detecting anomalous behavior in a running workload — the security signal that exists only after static scanning and admission control have already passed.

sre security book

7 — Incident Response for Security

Why a security incident's containment-first response differs from a reliability incident's restore-service-first one, and where the two response models collide.

sre security book

8 — Compliance

Where audit and regulatory obligations intersect with the reliability practice — access logs, retention policies, and the postmortem review process itself.

sre security book

9 — Disaster Recovery

RTO and RPO as the two numbers that actually define a DR plan, and the difference between a plan that exists on paper and one that's been tested.

sre security book