Comments (1)
Stephen-ONeil
commented on August 23, 2024
Additional, newer, infrastructure to capture:
- ensure that all relevant security APIs are enabled
- GKE autopilot cluster (+ bootstrapping?)
- service account for cert manager (DNS solver)
- service account and storage bucket for CloudnativePG backups
- service account for SOPS
Infrastructure not currently found in the experimental project, but planned/anticipated for prod:
- custom VPC with limited subnets
- logging:
- set appropriate retention window (default might be fine, but setting it explicitly will make it easier to document enforcement)
- create sinks to copy audit level logs (GCP audit logs, logs about flux changes, new app images, app-level audit logs, etc) to a bucket with a longer retention window. May need to also send these logs to a DTB logging endpoint, TBD
- might be worth implementing these suggestions in general
- if we want Cloud Armor's WAF capabilities:
- a regional external application load balancer (+ certificate, although it could use the cluster cert I believe)
- Cloud Armor Security Policy with WAF rules
- Identity aware proxy configured for HC's AD
from cpho-phase2.
Related Issues (20)
- Configure k8s postgres to autoscale storage capacity
- Review the k8s logs
- Pre-prod (dev/test) environment HOT 3
- Configure Istio HTTP health checks
- Flux GitHub commit status updates HOT 2
- logging out redirects to admin view logout
- Streamline project specific configurations as Kustomize patch HOT 1
- Dependent pods should restart when SealedSecret resources are modified. HOT 3
- Confirm functionality of the automated database backup feature, set retention policy HOT 7
- Disable username/pw login when ENABLE_LEGACY_LOGIN is false
- Use k8s ResourceQuota's HOT 1
- GKE upgrade breaks postgres cluster HOT 2
- Path based vs sub domain based routing HOT 3
- CR00001: Search Functionality
- Use IaD for Cloud Armor Security Policy
- figure out sequential-ID requirements
- Add cleanup policies for Artifact Registry HOT 3
- API: figure out how to output text in both languages
- API: expose available years
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cpho-phase2.