Checks

Verplichte checks (16)

FUNDAMENTAL

Haven clusters must stay up to date

In order for the Haven Compliancy Checker to function properly elevated privileges are required.

INFRASTRUCTURE

Running a cluster on a single availability zone means a higher risk of downtime when that single zone runs into problems.

This ensures a highly available control plane.

This enables running highly available workloads.

Security matters on every layer of a system and should an attacker break out of a deployment onto a node increased node security will help prevent further escalation.

Not directly exposing masters or workers to the public internet can increase the security of the cluster.

CLUSTER

This allows cluster users to access new functionality quickly and encourages a well-implemented update mechanism.

Basic security option which is enabled by default in order to control who can do what on a cluster.

Basic authentication is hard to maintain. We encourage to use OpenID Connect for user authentication.

This ensures that storage can be created which can be used by highly available deployments.

EXTERNAL

Cloud Native Computing Foundation's Kubernetes checks ensure the Kubernetes cluster adheres to the standard Kubernetes API's.

DEPLOYMENT

This makes it easy for engineers to expose an Ingress with a valid SSL certificate which automatically renews.

In order to be in control of the workload on a cluster it's mandatory to aggregate all container logs.

In order to be in control of a cluster it's mandatory to have eyes and ears on the cluster resources.

VALIDATION

Haven CLI should be validated by SHA

Voorgestelde checks (2)

EXTERNAL

Center for Internet Security's Kubernetes benchmark assists in following the best practices of securing a cluster.

Aqua Security's Kubescape tool assists in following the best practices of securing a cluster.