DataFlow Analytics — Políticas de Seguridad Kubernetes

Controles Implementados

de 27 planificados

Namespaces Seguros

ingestion · processing · frontend

Puntuación CIS

87%

+62 pts vs baseline

Políticas OPA

ConstraintTemplates activas

mTLS Coverage

100%

Istio STRICT mode

🔒 Segmentación de Red — NetworkPolicy

Default Deny All

namespace: ingestion

PSS: baseline

kafka-consumer

api-gateway

validator

→

:8080
✓ TCP

directo
bloqueado

namespace: processing

PSS: restricted

ml-pipeline

aggregator

exporter

→

:3000
✓ TCP

namespace: frontend

PSS: baseline

dashboard-ui

auth-service

bff-api

network-policy/default-deny-all.yaml NetworkPolicy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: ingestion  # aplicado en los 3 ns
spec:
  podSelector: {}           # todos los pods
  policyTypes:
    - Ingress
    - Egress

network-policy/allow-ingestion-to-processing.yaml NetworkPolicy

spec:
  podSelector:
    matchLabels:
      app: aggregator
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingestion
          podSelector:
            matchLabels:
              app: validator
      ports:
        - protocol: TCP
          port: 8080

👥 RBAC — Mínimo Privilegio por Equipo

3 Roles definidos

Equipo / SA	Scope	Recursos	Verbos permitidos
backend-dev	ingestion, processing	pods, deployments, services	✓ get, list, watch
backend-dev	ingestion, processing	deployments	✓ update, patch
frontend-dev	frontend	pods, services, configmaps	✓ get, list
frontend-dev	❌ ingestion, processing	todos	✗ sin acceso
sre-ops	cluster-wide	nodes, namespaces, events	✓ get, list, watch
sre-ops	cluster-wide	networkpolicies, rbac	✓ CRUD
sa/ml-pipeline	processing	secrets	✓ get (solo propios)

rbac/backend-team-rolebinding.yaml RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: backend-dev-binding
  namespace: processing
subjects:
  - kind: Group
    name: dataflow:backend  # Google OIDC group
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: backend-developer
  apiGroup: rbac.authorization.k8s.io

🛡️ Pod Security Standards + OPA Gatekeeper

restricted en processing

Pod Security Context — ml-pipeline

manifests/ml-pipeline-deployment.yaml (extracto) Pod Security

spec:
  securityContext:
    runAsNonRoot: true       # ✓ no root
    runAsUser: 1001            # uid unprivileged
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault   # syscall filter
  containers:
    - name: ml-pipeline
      image: eu.gcr.io/dataflow/ml:2.1.4
      securityContext:
        allowPrivilegeEscalation: false  # ✓
        readOnlyRootFilesystem: true    # ✓
        capabilities:
          drop: ["ALL"]               # ✓ zero caps
      resources:
        limits:
          memory: "512Mi"
          cpu: "500m"               # DoS mitigation

OPA Gatekeeper — Labels obligatorios

gatekeeper/require-labels-constraint.yaml OPA

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: dataflow-require-labels
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
    namespaces:
      - ingestion
      - processing
      - frontend
  parameters:
    labels: ["app", "environment", "team", "version"]

🔐 Istio mTLS + Cumplimiento Normativo

STRICT mode

Istio — PeerAuthentication mTLS

istio/peer-authentication-processing.yaml Istio

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: processing
spec:
  mtls:
    mode: STRICT   # todo tráfico cifrado
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-ingestion-to-aggregator
  namespace: processing
spec:
  selector:
    matchLabels: {app: aggregator}
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - "cluster.local/ns/ingestion/sa/validator"

Cumplimiento por Framework

CIS Kubernetes Benchmark v1.8 87%

NIST CSF — Access Control (PR.AC) 92%

GDPR — Cifrado en tránsito 100%

ISO 27001 — A.12 Operaciones 78%

OPA Policies — Admission Control 100%

✅ Checklist de Implementación — Estado Actual

23 completados 4 pendientes

✅

Default Deny All NetworkPolicy en los 3 namespacesCIS 5.3.2

kubectl apply -f network-policy/default-deny-all.yaml
✅

RBAC por equipo con mínimo privilegioCIS 5.1.3

Eliminados ClusterAdmin de dev teams; 3 Roles + 3 RoleBindings
✅

Pod Security Standards: restricted en processingCIS 5.2.2

PSS enforce/audit/warn configurados via namespace labels
✅

runAsNonRoot + readOnlyRootFilesystem en todos los podsCIS 5.2.6

Validado con: kubectl get pods -o jsonpath='..securityContext'
✅

capabilities: drop ALL en todos los contenedoresCIS 5.2.9

Solo kafka-consumer requiere NET_BIND_SERVICE (documentado)
✅

OPA Gatekeeper instalado (v3.14) + 6 ConstraintTemplatesCIS 5.1.1

Rechaza deployments sin labels: app, environment, team, version
✅

Istio PeerAuthentication STRICT en namespace processingNIST PR.DS-2

Todos los pods del namespace con mTLS mutual obligatorio
✅

Istio AuthorizationPolicy — allow-list por service account

Solo validator@ingestion puede llamar a aggregator@processing
✅

ResourceQuota + LimitRange en los 3 namespacesCIS 5.6.4

Protección contra DoS y resource starvation entre namespaces
✅

Secrets cifrados en reposo (GKE Application Layer Encryption)

KMS key: projects/dataflow-prod/global/keyRings/k8s-secrets
✅

Audit logging habilitado en GKE (nivel RequestResponse)CIS 3.2.1

Exportado a Cloud Logging con retención de 90 días (GDPR)

✅

Trivy image scanning en CI/CD pipelineNIST ID.RA-1

GitHub Actions: falla build si CRITICAL/HIGH sin parche
✅

NetworkPolicy: allow-dns solo hacia kube-system:53/UDP

Evita DNS exfiltration desde pods comprometidos
✅

ServiceAccount automount: false en pods que no usan API

kubectl patch sa default -p '{"automountServiceAccountToken":false}'
✅

Workload Identity (GKE) — sin service account keys en disco

SA de K8s mapeadas a Google Service Accounts vía WI
✅

Falco instalado para runtime threat detectionNIST DE.CM-7

Alertas: shell en container, escritura a /etc, carga de módulo kernel
✅

Node pool hardening: Shielded Nodes + Secure Boot

GKE: --enable-shielded-nodes --shielded-secure-boot
✅

Private cluster: nodos sin IP pública, master authorizedNetworks

API server solo accesible desde CIDR corporativa 10.0.0.0/16
✅

OPA Constraint: prohibir imagen :latest y tag sin digest

K8sDisallowedTags aplicado — solo imágenes con SHA digest
✅

Renovación automática de certificados TLS (cert-manager)

Let's Encrypt ACME + ingress-nginx; renovación 30 días antes
✅

Istio mTLS STRICT en namespace ingestion y frontend

Completado tras migrar dashboard-ui a sidecar proxy
✅

Documentación de evidencias para auditor (este informe)

Screenshots kubectl + YAML manifests + scores CIS benchmark
⏳

Secrets rotation automatizada (Vault / Secret Manager)

Pendiente: integrar External Secrets Operator con GCP Secret Manager
⏳

OPA Policy: prohibir hostPath volumes

Pendiente: K8sHostFilesystemUsagePolicy — semana 3
⏳

Cilium Network Policy (reemplazo CNI nativo GKE)

Evaluando eBPF-based L7 policies para mayor visibilidad
⏳

Penetration testing del clúster (kube-bench + kube-hunter)

Programado para semana 4 — pre-entrega al auditor