|
1 | 1 | ---
|
2 | 2 | title: Security
|
3 |
| -description: |
| 3 | +description: |
4 | 4 | weight: 1500
|
5 | 5 | doctypes: [""]
|
6 | 6 | toc: true
|
7 | 7 | ---
|
8 | 8 |
|
9 | 9 |
|
10 |
| -The security of the Ingress Controller is paramount to the success of our Users, however, the Ingress Controller is deployed by a User in their environment, and as such, the User takes responsibility |
11 |
| -for securing a deployment of the Ingress Controller. |
| 10 | +The security of the Ingress Controller is paramount to the success of our Users, however, the Ingress Controller is deployed by a User in their environment, and as such, the User takes responsibility |
| 11 | +for securing a deployment of the Ingress Controller. |
12 | 12 | We strongly recommend every User read and understand the following security concerns.
|
13 | 13 |
|
14 | 14 | ## Kubernetes
|
15 | 15 | We recommend the Kubernetes [guide to securing a cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/).
|
16 | 16 | In addition, the following relating more specifically to Ingress Controller.
|
17 | 17 |
|
18 | 18 | ### RBAC and Service Account
|
19 |
| -The Ingress Controller is deployed within a Kubernetes environment, this environment must be secured. |
| 19 | +The Ingress Controller is deployed within a Kubernetes environment, this environment must be secured. |
20 | 20 | Kubernetes uses [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) to control the resources and operations available to different types of users.
|
21 |
| -The Ingress Controller requires a service account which is configured using RBAC. |
22 |
| -We strongly recommend using the [RBAC configuration](https://github.com/nginxinc/kubernetes-ingress/blob/master/deployments/rbac/rbac.yaml) provided in our standard deployment configuration. |
| 21 | +The Ingress Controller requires a service account which is configured using RBAC. |
| 22 | +We strongly recommend using the [RBAC configuration](https://github.com/nginxinc/kubernetes-ingress/blob/main/deployments/rbac/rbac.yaml) provided in our standard deployment configuration. |
23 | 23 | It is configured with the least amount of privilege required for the Ingress Controller to work.
|
24 | 24 |
|
25 |
| -We strongly recommend inspecting the RBAC configuration (for [manifests installation](https://github.com/nginxinc/kubernetes-ingress/blob/master/deployments/rbac/rbac.yaml) |
26 |
| -or for [helm](https://github.com/nginxinc/kubernetes-ingress/blob/master/deployments/helm-chart/templates/rbac.yaml)) |
27 |
| -to understand what access the Ingress Controller service account has and to which resources. |
| 25 | +We strongly recommend inspecting the RBAC configuration (for [manifests installation](https://github.com/nginxinc/kubernetes-ingress/blob/main/deployments/rbac/rbac.yaml) |
| 26 | +or for [helm](https://github.com/nginxinc/kubernetes-ingress/blob/main/deployments/helm-chart/templates/rbac.yaml)) |
| 27 | +to understand what access the Ingress Controller service account has and to which resources. |
28 | 28 | For example, by default the service account has access to all Secret resources in the cluster.
|
29 | 29 |
|
30 | 30 | ### Certificates and Privacy Keys
|
31 |
| -Secrets are required by the Ingress Controller for some configurations. |
32 |
| -[Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) are stored by Kubernetes unencrypted by default. |
33 |
| -We strongly recommend configuring Kubernetes to store these Secrets encrypted at rest. |
| 31 | +Secrets are required by the Ingress Controller for some configurations. |
| 32 | +[Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) are stored by Kubernetes unencrypted by default. |
| 33 | +We strongly recommend configuring Kubernetes to store these Secrets encrypted at rest. |
34 | 34 | Kubernetes has [documentation](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) on how to configure this.
|
35 | 35 |
|
36 | 36 | ## Ingress Controller
|
37 | 37 |
|
38 | 38 | ### Recommended Secure Defaults
|
39 | 39 | We recommend the following for the most secure configuration:
|
40 |
| - * If Prometheus metrics are [enabled](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-prometheus-metrics), |
| 40 | + * If Prometheus metrics are [enabled](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-prometheus-metrics), |
41 | 41 | we recommend [configuring HTTPS](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-prometheus-tls-secret) for Prometheus.
|
42 | 42 |
|
43 | 43 | ### Snippets
|
|
0 commit comments