Infrastructure Security¶
A key aspect of planning your installation and configuration is addressing infrastructure security. By planning your configuration to include industry standard best practices prior to deployment, you can reduce the risk of security and compliance issues.
StarlingX Infrastructure Security Features¶
The security features listed below are available with StarlingX and should be included in your infrastructure security planning.
Regular CVE scanning and fixing of StarlingX Platform’s DEB Kernel and RPM Packages
UEFI Secure Boot on StarlingX Hosts
Signed boot loaders, initramfs, kernel and kernel modules
Signed in formal builds with StarlingX private key on StarlingX secure signing server
Validated by board-specific UEFI Secure Boot Firmware
For more information, see Kubernetes UEFI Secure Boot Planning
Signed ISOs and Patches/Updates
Signed in formal builds with StarlingX private key on StarlingX secure signing server
Public key built into ISO and patch signature validation code
Signatures checked on load import and update import commands
Authentication and Authorization on all interfaces of:
SSH / Local Console (local LDAP)
Linux User/Group Permissions
Linux sudo
StarlingX REST APIs/CLIs (Keystone - local DB)
Keystone Roles - admin, member
Kubernetes APIs/CLIs (Service Accounts and Remote LDAP / Windows Active Directory via OIDC/DEX)
K8S RBAC Policies
StarlingX Dashboard Webserver (Keystone - Local DB)
Keystone Roles - admin, member
Local Docker Registry (Keystone - Local DB)
Keystone - admin, non-admin user
HTTPS Support for all external Platform endpoints including:
System, Kubernetes, local docker registry REST APIs
Platform Dashboard Webserver
Certificate Management for K8S Certificates
Bootstrap configured K8S Root CA Certificates (auto-generated or user-specified)
Cron Jobs for renewing K8S server & client Certificates
Procedure for updating K8S Root CA Certificate
Certificate Management for HTTPS Platform endpoints (StarlingX APIs, Registry, OIDC, …) including use of Cert-Manager for install and auto-renewal of Certificates
Trusted CA Management for local client-side certificate validation
Alarming of soon-to-expired and expired Certificates
‘show-certs.sh’ for displaying status and residual time for all certificates.
Secure (HTTPS) Platform management network communication in Distributed Cloud providing secure management network connectivity between the system controller and subclouds with auto-renewal of certificates
OAM / API Firewall includes default firewall rules automatically applied and customer modifiable through Calico network policies
Helm v3 support including the removal of the default use of Helmv2/Tiller (insecure)
Secure User Management including:
User Password Complexity enforcement
User forced log out on idle activity
User temporary lock out on N consecutive authentication failures
Audit logs for operator commands and authentication events
Shell commands (on SSH / Local Console)
StarlingX REST APIs / CLIs
Linux Auditd support for running on all hosts with configurable rules
OpenScap Modules included in Host ISO
Security Services for Hosted Applications including:
Cert Manager support including integration of the cert-manager project to automate the management and issuance of TLS certificates from various issuing sources (e.g. interface with external CA for certificate signing, auto-renewal of certificates)
Secure secret management and storage (Hashicorp Vault) with the integration of upstream Hashicorp Vault project and Support Vault general secret management for hosted applications
Kubernetes UEFI Secure Boot Planning¶
UEFI Secure Boot Planning allows you to authenticate modules before they are allowed to execute.
The initial installation of StarlingX should be done in UEFI mode if you plan on using the secure boot feature in the future.
The StarlingX secure boot certificate can be found in the StarlingX ISO, on the EFI bootable FAT filesystem. The file is in the directory /CERTS. You must add this certificate database to the motherboard’s UEFI certificate database. How to add this certificate to the database is determined by the UEFI implementation provided by the motherboard manufacturer.
You may need to work with your hardware vendor to have the certificate installed.
There is an option in the UEFI setup utility that allows a user to browse to a file containing a certificate to be loaded in the authorized database. This option may be hidden in the UEFI setup utility unless UEFI mode is enabled, and secure boot is enabled.
Many motherboards ship with Microsoft secure boot certificates pre-programmed in the UEFI certificate database. These certificates may be required to boot UEFI drivers for video cards, RAID controllers, or NICs (for example, the PXE boot software for a NIC may have been signed by a Microsoft certificate). While certificates can be removed from the certificate database (this is UEFI implementation specific) it may be required that you keep the Microsoft certificates to allow for complete system operation.
Mixed combinations of secure boot and non-secure boot nodes are supported. For example, a controller node may secure boot, while a worker node may not. Secure boot must be enabled in the UEFI firmware of each node for that node to be protected by secure boot.
Secure Boot is supported in UEFI installations only. It is not used when booting StarlingX as a legacy boot target.
StarlingX does not currently support switching from legacy to UEFI mode after a system has been installed. Doing so requires a reinstall of the system. This means that upgrading from a legacy install to a secure boot install (UEFI) is not supported.
When upgrading a StarlingX system from a version that did not support secure boot to a version that does, do not enable secure boot in UEFI firmware until the upgrade is complete.
