swaphb/kubernetes-security-baseline-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update build status and project roadmap
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Successful in 55s
Details

Browse Source
This commit is contained in:
swaphb
2026-08-15 16:13:42 -04:00
parent e312fd3e88
commit 478cc49e50
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -3
View File
@@ -81,6 +81,11 @@ notifications during local demonstrations. The production-style separate-VM
path gives each node its own kernel. See [`docs/runtime-detection.md`](docs/runtime-detection.md) path gives each node its own kernel. See [`docs/runtime-detection.md`](docs/runtime-detection.md)
for the topology distinction and alerting implications. for the topology distinction and alerting implications.
Falco alerts are forwarded through Falcosidekick to Slack using a manually
populated Kubernetes Secret. The alert path has been tested end to end. Slack
priority filtering is being tuned so lower-priority events remain available in
Falco logs without overwhelming the notification channel.
## Build status ## Build status
- [x] Phase 1: local k3d definition and optional Terraform/Ansible path - [x] Phase 1: local k3d definition and optional Terraform/Ansible path
@@ -88,13 +93,20 @@ for the topology distinction and alerting implications.
- [x] Phase 3: kube-bench CI scan - [x] Phase 3: kube-bench CI scan
- [x] Architecture revision: Flatcar hosts and Falco kernel access - [x] Architecture revision: Flatcar hosts and Falco kernel access
- [x] Phase 4: Kyverno policy set, CIS mapping, and admission tests - [x] Phase 4: Kyverno policy set, CIS mapping, and admission tests
- [ ] Phase 5: Falco rules and webhook alerting (runtime detection verified; webhook pending) - [x] Phase 5: Falco rules, Falcosidekick, and Slack webhook delivery
- [x] Phase 6: test workloads and runtime verification - [x] Phase 6: test workloads and runtime verification
- [ ] Phase 7: architecture and design documentation (repository layout started) - [ ] Phase 7: architecture and design documentation (runtime topology documented; diagram and evidence pending)
- [ ] Phase 8: final portfolio polish - [ ] Phase 8: final portfolio polish
- [ ] Cilium kube-proxy replacement: optional profile configured; production-style runtime validation pending
- [ ] Alert operations: priority filtering and duplicate-event tuning in progress
- [ ] Infrastructure automation: Ansible-driven Flatcar bootstrap and secure optional secret population pending
- [ ] Flatcar lifecycle management: update, rollback, recovery, and image rotation guide pending
## Remaining work ## Remaining work
- Configure a Slack or Discord webhook through a Kubernetes Secret outside Git. - Push and verify the Slack priority filtering change.
- Add the architecture diagram, CIS evidence summary, and demo capture. - Add the architecture diagram, CIS evidence summary, and demo capture.
- Automate Flatcar bootstrap, kubeconfig handling, ArgoCD bootstrap, and optional
secret population with Ansible.
- Write the Flatcar lifecycle management guide.
- Finish the design trade-off documentation and final repository review. - Finish the design trade-off documentation and final repository review.