Security-Focused Workflows

This document details the security-focused workflows that emphasize enhanced security controls for container scanning.

Security Workflow Overview

The security-focused workflows build upon the standard, distroless, and sidecar approaches with additional security controls to meet stringent security requirements.

Enhanced Security Controls

Security-focused workflows implement the following enhanced controls:

1. Least Privilege RBAC

flowchart TD
    A[Start] --> B[Create Namespace-scoped Service Account]
    B --> C[Create Minimal Role with Specific Resources]
    C --> D[Limit Role to Specific Pods via Labels]
    D --> E[Create Time-limited RoleBinding]
    E --> F[Validate RBAC Configuration]
    F --> G[End]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style C fill:#4C366B,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style D fill:#4C366B,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

Controls

1. Target-Specific Permissions:
2. Role limited to specific pod by name or label
3. Exact resource permissions defined

4. No wildcard permissions

5. Time-Limited Access:

6. RoleBinding created with time-limited validity
7. Automatic expiration of permissions

2. Ephemeral Credentials

flowchart TD
    A[Start] --> B[Generate Short-lived Service Account Token]
    B --> C[Set Minimal Token Expiration]
    C --> D[Create Single-use Kubeconfig]
    D --> E[Apply File Security Controls]
    E --> F[Validate Token Restrictions]
    F --> G[End]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style B fill:#4C366B,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style C fill:#4C366B,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

Controls

1. Token Security:
2. Token generated with minimal lifespan
3. Token intended for single use only

4. No persistent token storage

5. Credential Protection:

6. Kubeconfig stored with restricted permissions
7. Kubeconfig created in memory when possible
8. Kubeconfig deleted immediately after use

3. Secure Network Communication

flowchart TD
    A[Start] --> B[Enforce TLS for API Communication]
    B --> C[Verify API Server Certificate]
    C --> D[Use Secure Network Policies]
    D --> E[Restrict Egress Traffic]
    E --> F[Validate Connection Security]
    F --> G[End]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

Controls

1. Transport Security:
2. TLS enforced for all API communication
3. Certificate validation required

4. No insecure connections allowed

5. Network Isolation:

6. Network policies restrict scanner traffic
7. Egress limited to required endpoints
8. Communication isolation between namespaces

4. Automated Resource Cleanup

flowchart TD
    A[Start] --> B[Register Cleanup Handlers]
    B --> C[Implement Timed Cleanup Fallback]
    C --> D[Verify Resource Deletion]
    D --> E[Secure Deletion of Credentials]
    E --> F[Log Cleanup Operations]
    F --> G[End]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

Controls

1. Reliable Cleanup:
2. Multiple cleanup mechanisms (trap handlers)
3. Fallback cleanup processes

4. Verification of resource removal

5. Secure Deletion:

6. Secure credential wiping
7. Complete removal of all temporary resources
8. Cleanup logs for audit trail

Security-Enhanced Standard Container Workflow

The security-enhanced standard container workflow adds these additional steps to the standard container workflow:

1. Pre-Scan Security Verification

flowchart TD
    A[Start] --> B[Verify Target Container Integrity]
    B --> C[Check for Privileged Status]
    C --> D[Validate Container Image Source]
    D --> E[Scan Network Connections]
    E --> F{Security Checks Pass?}
    F -->|Yes| G[Proceed with Scan]
    F -->|No| H[Abort with Security Alert]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style F fill:#DD6100,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#217645,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style H fill:#DD6100,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

2. Enhanced RBAC with Label Targeting

# Example of label-targeted RBAC for enhanced security
cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: scanner-role
  namespace: ${NAMESPACE}
spec:
  rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get"]
    resourceNames: ["${POD_NAME}"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
    resourceNames: ["${POD_NAME}"]
EOF

3. Post-Scan Security Audit

flowchart TD
    A[Start] --> B[Record Scanning Activity in Audit Log]
    B --> C[Validate Resource Cleanup Completion]
    C --> D[Verify No Credential Artifacts]
    D --> E[Scan for Unintended Side Effects]
    E --> F[Generate Security Report]
    F --> G[End]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

Security-Enhanced Distroless Container Workflow

The security-enhanced distroless container workflow adds these additional steps to the distroless container workflow:

1. Enhanced Debug Container Controls

flowchart TD
    A[Start] --> B[Apply SecurityContext Restrictions]
    B --> C[Set Non-root User for Debug Container]
    C --> D[Apply Pod Security Policies]
    D --> E[Limit Debug Container Capabilities]
    E --> F[Mount Volumes Read-Only]
    F --> G[End]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

2. Debug Container Isolation

# Example of security-enhanced debug container configuration
securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  capabilities:
    drop:
    - ALL
    add:
    - CHOWN
    - DAC_OVERRIDE
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true

Security-Enhanced Sidecar Workflow

The security-enhanced sidecar workflow adds these additional steps to the sidecar container workflow:

1. Secure Sidecar Configuration

flowchart TD
    A[Start] --> B[Apply Pod Security Policy]
    B --> C[Set Non-root User for Sidecar]
    C --> D[Limit Sidecar Container Capabilities]
    D --> E[Apply Seccomp Profile]
    E --> F[Implement AppArmor Profile]
    F --> G[End]

    style A fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF
    style G fill:#505050,stroke:#FFFFFF,stroke-width:2px,color:#FFFFFF

2. Secure Pod Manifest

# Example of security-enhanced sidecar pod configuration
securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  seccompProfile:
    type: RuntimeDefault

Implementation Guidelines

To implement security-focused workflows:

1. Baseline Identification:
2. Identify baseline security requirements

3. Choose appropriate scanning approach based on security needs

4. RBAC Enhancement:

5. Use label-based targeting for specific pods
6. Implement time-limited RoleBindings

7. Apply namespace isolation

8. Credential Hardening:

9. Generate shortest-lived tokens possible
10. Implement secure credential handling

11. Use in-memory credential storage when available

12. Network Security:

13. Apply network policies for scanner isolation
14. Restrict egress traffic

15. Enforce TLS for all communication

16. Automated Security Processes:

17. Implement pre-scan security verification
18. Configure post-scan security auditing
19. Enable automated cleanup with verification

Security-Enhanced Script Example

The security-enhanced scripts are available in the /scripts/security-enhanced/ directory:

• secure-scan-container.sh - Enhanced standard container scanning
• secure-scan-distroless-container.sh - Enhanced distroless container scanning
• secure-scan-with-sidecar.sh - Enhanced sidecar container scanning

These scripts implement all the security controls described in this document.