SRE Thailand Bootcamp

Week 16: Security & Compliance

Theme: Security scanning, pod security standards, supply chain security, compliance frameworks.

Learning Objectives

1. Implement Pod Security Standards (Baseline, Restricted)
2. Set up container image signing with Cosign
3. Implement admission controllers (OPA Gatekeeper or Kyverno)
4. Understand compliance frameworks (PCI-DSS, SOC2, ISO 27001)

Reading Materials

• Pod Security Standards
• Pod Security Admission
• Cosign (Sigstore)
• OPA Gatekeeper
• Kyverno Policies
• SLSA Framework
• Docker Content Trust

Finger Exercises (choose 2)

1. Apply a Pod Security Standard of "Restricted" to the prod namespace. Fix the Go app Deployment to comply.
2. Sign a container image with Cosign (keyless mode). Verify the signature before deployment in CI.
3. Write a Kyverno policy: deny images with :latest tag. Only allow semver-tagged images.

Project

• Implement supply chain security:
  • Sign all container images with Cosign (keyless via GitHub OIDC)
  • Verify signatures in the CI pipeline before pushing
  • Add SLSA provenance attestation
• Enforce Pod Security Standards:
  • prod namespace: Restricted (enforce)
  • staging namespace: Baseline (warn)
  • dev namespace: Privileged (permissive)
• Write Kyverno policies:
  • disallow-latest-tag: deny :latest image tags
  • require-readiness-probe: all Deployments must have readiness probes
  • require-resource-limits: all containers must have CPU/memory limits
  • disallow-host-network: deny hostNetwork: true
• Audit compliance:
  • Run kubectl audit or use a compliance tool (e.g., kube-bench)
  • Generate a compliance report
  • Document how the stack would map to PCI-DSS requirements (if needed)

Time Budget