WIP

Summary

NIC is currently (3.x) required to run as a privileged POD with added capabilities. This is not ideal from a security perspective and not aligned with best practice container security guidelines and standards such as:

• CIS Kubernetes as briefly explained by Aquasec
• NSA Kubernetes Hardening guide

To improve the security posture, NIC should be able to run with the restricted POD security level. See Pod Security Standards for more information.

Motivation

NIC is usually exposed to the Internet and thus a target for all kinds of attacks. The project should always strive to improve the security of NIC.

Goals

• Secure by default
• Restricted security level in deployment resources

Non-goals

• Other security improvements not required by the restricted level such as read-only root filesystem (Run Ngninx Kubernetes Ingress controller with readOnlyRootFilesystem: true  #1677 )

Proposal

TBD