Platform security

Servers (LinuxAid)

• Known vulnerabilities. The portal lists each server's open CVEs, with severity and the next update window.
• End of life. An alert from 75 days before the OS release stops getting free security updates. Where the release has paid extended support, it keeps firing until that ends too.
• Firewall. Each server reports its firewall's packet counts per rule as metrics, but no alert fires on dropped traffic.
• Hardening. SSH only allows strong key exchange, ciphers and MACs, except on RHEL 6. auditd can be switched on per server, and SELinux on RHEL-family servers.
• Repo snapshots. Where your config pins a snapshot date, packages come from that snapshot. The day before each update cycle we push a branch that moves the date forward, so every server in the cycle gets the same updates once it is merged.

Kubernetes (KubeAid)

• Supply chain security.
  • Image scanning. Trivy scans the container images you run and keeps the critical and high findings that have a fix. On clusters that report to Obmondo, the portal shows them.
  • Registry mirror. Harbor can mirror those images and scan them too.
• Firewall. Cilium network policies can filter ingress and egress traffic. Cilium exports every dropped packet as a Hubble metric, but no alert fires when denied traffic stays high.
• Runtime security. Tetragon records process execution, kernel module loads and privilege changes, and follows network and file access only once a policy for it is added. KubeArmor can block what your policies forbid.
• Admission policies. Kyverno or Gatekeeper can stop workloads that break your rules before they start.

Network policies, image scanning, runtime detection and admission policies are options you switch on per cluster.

Fixes roll out in the service windows you choose. When one needs a change in the config repository, such as a new KubeAid version or snapshot date, it comes first as a branch to merge.