├── .markdown-link-check.json ├── .gitattributes ├── .markdownlint.json ├── .gitignore ├── media ├── image_1.png ├── image_10.png ├── image_11.png ├── image_2.png ├── image_3.png ├── image_4.png ├── image_5.png ├── image_6.png ├── image_7.png ├── image_8.png └── image_9.png ├── .github ├── dependabot.yml ├── workflows │ ├── markdownlint-problem-matcher.json │ ├── link-check.yml │ └── markdownlint.yml ├── ISSUE_TEMPLATE │ ├── bug.md │ └── feature.md └── PULL_REQUEST_TEMPLATE │ └── general.md ├── _config.yml ├── package.json ├── assets └── css │ └── style.scss ├── _layouts └── core.html ├── SECURITY.md ├── LICENSE ├── link-check.js ├── Gemfile ├── CONTRIBUTING.md ├── en ├── 1_Introduction.md ├── 3_Threat-Environment.md ├── 4_Implementation-Recommendations.md ├── 2_Context.md └── 5_Microservice_Security.md ├── README.md └── CODE_OF_CONDUCT.md /.markdown-link-check.json: -------------------------------------------------------------------------------- 1 | { 2 | "ignorePatterns": [ 3 | "http://esdc*" 4 | ] 5 | } 6 | -------------------------------------------------------------------------------- /.gitattributes: -------------------------------------------------------------------------------- 1 | # Set the default behavior, in case people don't have core.autocrlf set. 2 | * text=auto 3 | -------------------------------------------------------------------------------- /.markdownlint.json: -------------------------------------------------------------------------------- 1 | { 2 | "default": true, 3 | "MD013": false, 4 | "MD033": false, 5 | "MD041": false 6 | } 7 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | _site 2 | .sass-cache 3 | .jekyll-cache 4 | .jekyll-metadata 5 | vendor 6 | node_modules 7 | Gemfile.lock 8 | -------------------------------------------------------------------------------- /media/image_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_1.png -------------------------------------------------------------------------------- /media/image_10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_10.png -------------------------------------------------------------------------------- /media/image_11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_11.png -------------------------------------------------------------------------------- /media/image_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_2.png -------------------------------------------------------------------------------- /media/image_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_3.png -------------------------------------------------------------------------------- /media/image_4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_4.png -------------------------------------------------------------------------------- /media/image_5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_5.png -------------------------------------------------------------------------------- /media/image_6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_6.png -------------------------------------------------------------------------------- /media/image_7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_7.png -------------------------------------------------------------------------------- /media/image_8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_8.png -------------------------------------------------------------------------------- /media/image_9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/canada-ca/platform-security_securite-de-plateforme/HEAD/media/image_9.png -------------------------------------------------------------------------------- /.github/dependabot.yml: -------------------------------------------------------------------------------- 1 | version: 2 2 | updates: 3 | - package-ecosystem: npm 4 | directory: "/" 5 | schedule: 6 | interval: daily 7 | time: "11:00" 8 | open-pull-requests-limit: 99 9 | - package-ecosystem: github-actions 10 | directory: "/" 11 | schedule: 12 | interval: daily 13 | time: "11:00" 14 | open-pull-requests-limit: 99 15 | -------------------------------------------------------------------------------- /_config.yml: -------------------------------------------------------------------------------- 1 | remote_theme: wet-boew/gcweb-jekyll 2 | title: Guidance on Secure Containers and Microservices 3 | global: 4 | lang: en 5 | defaults: 6 | - scope: 7 | path: "" # Ensure it's applied to all pages 8 | values: 9 | layout: default 10 | markdown: gfm 11 | plugins: 12 | - jekyll-titles-from-headings 13 | titles_from_headings: 14 | enabled: true 15 | strip_title: true 16 | collections: true 17 | -------------------------------------------------------------------------------- /.github/workflows/markdownlint-problem-matcher.json: -------------------------------------------------------------------------------- 1 | { 2 | "problemMatcher": [ 3 | { 4 | "owner": "markdownlint", 5 | "pattern": [ 6 | { 7 | "regexp": "^([^:]*):(\\d+):?(\\d+)?\\s([\\w-\\/]*)\\s(.*)$", 8 | "file": 1, 9 | "line": 2, 10 | "column": 3, 11 | "code": 4, 12 | "message": 5 13 | } 14 | ] 15 | } 16 | ] 17 | } -------------------------------------------------------------------------------- /package.json: -------------------------------------------------------------------------------- 1 | { 2 | "scripts": { 3 | "link-check": "node link-check.js", 4 | "lint": "markdownlint -i node_modules \"**/*.md\"", 5 | "test": "npm run lint && npm run link-check" 6 | }, 7 | "type": "module", 8 | "repository": { 9 | "type": "git", 10 | "url": "https://github.com/canada-ca/template-gabarit" 11 | }, 12 | "license": "MIT", 13 | "devDependencies": { 14 | "chalk": "^5.3.0", 15 | "glob": "^11.0.0", 16 | "markdown-link-check": "^3.13.6", 17 | "markdownlint-cli": "^0.42.0" 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /assets/css/style.scss: -------------------------------------------------------------------------------- 1 | --- 2 | --- 3 | table { 4 | width: 100%; 5 | border-collapse: collapse; 6 | margin-bottom: 2em; 7 | } 8 | 9 | h1, h2, h3 { 10 | margin: 1em 0 2em 0 !important; 11 | } 12 | 13 | tbody tr:first-child td { 14 | padding-top: 0.8em !important; 15 | } 16 | 17 | th { 18 | border-bottom: solid #ddd .18em; 19 | padding: 0.3em 0.8em 0.3em 0.2em !important; 20 | } 21 | 22 | td { 23 | padding: 0 0.8em 0.6em 0 !important; 24 | } 25 | 26 | td em, td b, td strong { 27 | color: #037A8C; 28 | background-color: #f9f2f4; 29 | border-radius: 0.2em; 30 | padding: 2px 4px; 31 | font-weight: normal; 32 | } 33 | 34 | p { 35 | margin: 1em 0 !important; 36 | } 37 | 38 | img { 39 | display: block; 40 | clear: both; 41 | } -------------------------------------------------------------------------------- /.github/workflows/link-check.yml: -------------------------------------------------------------------------------- 1 | name: Link Check 2 | 3 | on: 4 | pull_request: 5 | paths: 6 | - ".github/workflows/link-check.yml" 7 | - ".markdown-link-check.json" 8 | - "link-check.js" 9 | - "package*.json" 10 | - "**/*.md" 11 | 12 | push: 13 | branches-ignore: 14 | - "dependabot/**" 15 | paths: 16 | - ".github/workflows/link-check.yml" 17 | - ".markdown-link-check.json" 18 | - "link-check.js" 19 | - "package*.json" 20 | - "**/*.md" 21 | 22 | jobs: 23 | link-check: 24 | runs-on: ubuntu-latest 25 | 26 | steps: 27 | - uses: actions/setup-node@v4 28 | with: 29 | node-version: 23 30 | 31 | - uses: actions/checkout@v4 32 | 33 | - name: Install Dependencies 34 | run: npm ci 35 | 36 | - name: Run link checks 37 | run: npm run link-check 38 | -------------------------------------------------------------------------------- /.github/workflows/markdownlint.yml: -------------------------------------------------------------------------------- 1 | name: Markdownlint 2 | 3 | on: 4 | pull_request: 5 | paths: 6 | - ".github/workflows/markdownlint-problem-matcher.json" 7 | - ".github/workflows/markdownlint.yml" 8 | - ".markdownlint.json" 9 | - "package*.json" 10 | - "**/*.md" 11 | 12 | push: 13 | branches-ignore: 14 | - "dependabot/**" 15 | paths: 16 | - ".github/workflows/markdownlint-problem-matcher.json" 17 | - ".github/workflows/markdownlint.yml" 18 | - ".markdownlint.json" 19 | - "package*.json" 20 | - "**/*.md" 21 | 22 | jobs: 23 | lint: 24 | runs-on: ubuntu-latest 25 | 26 | steps: 27 | - uses: actions/setup-node@v4 28 | with: 29 | node-version: 23 30 | 31 | - uses: actions/checkout@v4 32 | 33 | - name: Install Dependencies 34 | run: npm ci 35 | 36 | - name: Run Markdownlint 37 | run: | 38 | echo "::add-matcher::.github/workflows/markdownlint-problem-matcher.json" 39 | npm run lint 40 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Report Bug 3 | about: For reporting on bugs in the repository. 4 | title: 'Bug - ' 5 | labels: bug 6 | assignees: '' 7 | 8 | --- 9 | 10 | ### Summary 11 | 12 | 13 | 14 | ### Steps to reproduce 15 | 16 | 17 | 18 | ### Example 19 | 20 | 21 | 22 | ### What is the current *bug* behavior? 23 | 24 | 25 | 26 | ### What is the expected *correct* behavior? 27 | 28 | 29 | 30 | ### Relevant logs and/or screenshots 31 | 32 | 34 | 35 | ### Possible fixes 36 | 37 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE/general.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: General 3 | about: This a general pull request template to be used for any reason 4 | title: '' 5 | labels: '' 6 | assignees: '' 7 | --- 8 | 9 | ### What does this MR do? 10 | 11 | 22 | 23 | ### General checklist 24 | 25 | - [ ] [Documentation](README.md) created/updated 26 | - [ ] Changelog entry added, if necessary 27 | - [ ] Tests added for this feature/bug 28 | - [ ] Conforms to the [style guides](https://www.canada.ca/en/government/about/design-system.html) 29 | 30 | ### Related issues 31 | 32 | -------------------------------------------------------------------------------- /_layouts/core.html: -------------------------------------------------------------------------------- 1 | {%- include variable-core.liquid -%} 2 | {%- capture page-title -%} 3 | {%- if page.title -%} 4 | {{ page.title }} 5 | {%- else -%} 6 | Page untitled 7 | {%- endif -%} 8 | {%- endcapture -%} 9 | 10 | 11 | 12 | 13 | {% include license.html %} 14 | {{ page-title }} - {{ i18nText-siteTitle }} 15 | 16 | 17 | {% include metadata.html %} 18 | {% include resources-inc/head.html %} 19 | 20 | 21 | {%- if page.archived -%} 22 | {% include headers-includes/archive.html %} 23 | {%- endif -%} 24 | {% include skiplinks/skiplinks.html %} 25 | {% include header/header.html %} 26 | {{ content }} 27 | {% include footers/footer.html %} 28 | {% include resources-inc/footer.html %} 29 | 30 | -------------------------------------------------------------------------------- /SECURITY.md: -------------------------------------------------------------------------------- 1 | ([Français](#signalement-des-problèmes-de-sécurité)) 2 | 3 | # Reporting Security Issues 4 | 5 | To report a security issue, email [zztbscybers@tbs-sct.gc.ca](mailto:zztbscybers@tbs-sct.gc.ca) and include the word "SECURITY" in the subject line. 6 | 7 | The TBS team will send a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance. 8 | ______________________ 9 | 10 | ([English](#reporting-security-issues)) 11 | 12 | ## Signalement des problèmes de sécurité 13 | 14 | Pour signaler un problème de sécurité, envoyez un courriel à [zztbscybers@tbs-sct.gc.ca](mailto:zztbscybers@tbs-sct.gc.ca) et ajoutez le mot « SÉCURITÉ » à la ligne d’objet. 15 | 16 | L’équipe du SCT enverra une réponse indiquant les prochaines étapes de la gestion de votre rapport. Après la réponse initiale à votre rapport, l’équipe de sécurité vous tiendra au courant des progrès vers une solution et l’annonce complète, et peut demander des informations ou des conseils supplémentaires. 17 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) Her Majesty the Queen in Right of Canada, as represented by the Treasury Board of Canada Secretariat, 2018 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /link-check.js: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env node 2 | 3 | 'use strict'; 4 | import fs from 'fs'; 5 | import {sync} from 'glob'; 6 | import path from 'path'; 7 | import chalk from 'chalk'; 8 | 9 | import markdownLinkCheck from 'markdown-link-check'; 10 | 11 | const files = sync("**/*.md", {ignore: ["node_modules/**/*.md"]}) 12 | 13 | const config = JSON.parse(fs.readFileSync(".markdown-link-check.json")); 14 | config.timeout = '30s' 15 | 16 | files.forEach(function(file) { 17 | const markdown = fs.readFileSync(file).toString(); 18 | const opts = Object.assign({}, config); 19 | 20 | opts.baseUrl = path.dirname(path.resolve(file)) + '/'; 21 | 22 | markdownLinkCheck(markdown, opts, function (err, results) { 23 | if (err) { 24 | console.error('Error', err); 25 | return; 26 | } 27 | 28 | console.log(chalk.green("Reading: " + file)); 29 | 30 | results.forEach(function (result) { 31 | if(result.status === "dead") { 32 | if (result.statusCode == 500) { 33 | console.log(chalk.yellow("Server error on target: " + result.link)); 34 | } 35 | else { 36 | process.exitCode = 1 37 | console.log(chalk.red("Dead: " + result.link)); 38 | } 39 | } 40 | }); 41 | }); 42 | }); 43 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | about: For requesting new features or enhancements. 4 | title: '' 5 | labels: enhancement 6 | assignees: '' 7 | 8 | --- 9 | 10 | ### Problem to solve 11 | 12 | 13 | 14 | ### Intended users 15 | 16 | 17 | 18 | ### Further details 19 | 20 | 21 | 22 | ### Proposal 23 | 24 | 25 | 26 | ### Permissions and Security 27 | 28 | 29 | 30 | ### What does success look like, and how can we measure that? 31 | 32 | 33 | 34 | ### Links / references 35 | -------------------------------------------------------------------------------- /Gemfile: -------------------------------------------------------------------------------- 1 | source "https://rubygems.org" 2 | # Hello! This is where you manage which Jekyll version is used to run. 3 | # When you want to use a different version, change it below, save the 4 | # file and run `bundle install`. Run Jekyll with `bundle exec`, like so: 5 | # 6 | # bundle exec jekyll serve 7 | # 8 | # This will help ensure the proper Jekyll version is running. 9 | # Happy Jekylling! 10 | #gem "jekyll", "~> 4.3.4" 11 | # This is the default theme for new Jekyll sites. You may change this to anything you like. 12 | #gem "jekyll-theme-minimal" 13 | # If you want to use GitHub Pages, remove the "gem "jekyll"" above and 14 | # uncomment the line below. To upgrade, run `bundle update github-pages`. 15 | gem "github-pages", group: :jekyll_plugins 16 | # If you have any plugins, put them here! 17 | group :jekyll_plugins do 18 | gem "jekyll-feed", "~> 0.12" 19 | gem "jekyll-titles-from-headings", "~> 0.5" 20 | end 21 | 22 | # Windows and JRuby does not include zoneinfo files, so bundle the tzinfo-data gem 23 | # and associated library. 24 | platforms :mingw, :x64_mingw, :mswin, :jruby do 25 | gem "tzinfo", ">= 1", "< 3" 26 | gem "tzinfo-data" 27 | end 28 | 29 | # Performance-booster for watching directories on Windows 30 | gem "wdm", "~> 0.2", :platforms => [:mingw, :x64_mingw, :mswin] 31 | 32 | # Lock `http_parser.rb` gem to `v0.6.x` on JRuby builds since newer versions of the gem 33 | # do not have a Java counterpart. 34 | gem "http_parser.rb", "~> 0.6.0", :platforms => [:jruby] 35 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing 2 | 3 | ([Français](#comment-contribuer)) 4 | 5 | ## How to Contribute 6 | 7 | When contributing, post comments and discuss changes you wish to make via Issues. 8 | 9 | Feel free to propose changes by creating Pull Requests. If you don't have write access, editing a file will create a Fork of this project for you to save your proposed changes to. Submitting a change to a file will write it to a new Branch in your Fork, so you can send a Pull Request. 10 | 11 | If this is your first time contributing on GitHub, don't worry! Let us know if you have any questions. 12 | 13 | ### Security 14 | 15 | **Do not post any security issues on the public repository!** See [SECURITY.md](SECURITY.md) 16 | 17 | ______________________ 18 | 19 | ## Comment contribuer 20 | 21 | Lorsque vous contribuez, veuillez également publier des commentaires et discuter des modifications que vous souhaitez apporter par l'entremise des enjeux (Issues). 22 | 23 | N'hésitez pas à proposer des modifications en créant des demandes de tirage (Pull Requests). Si vous n'avez pas accès au mode de rédaction, la modification d'un fichier créera une copie (Fork) de ce projet afin que vous puissiez enregistrer les modifications que vous proposez. Le fait de proposer une modification à un fichier l'écrira dans une nouvelle branche dans votre copie (Fork), de sorte que vous puissiez envoyer une demande de tirage (Pull Request). 24 | 25 | Si c'est la première fois que vous contribuez à GitHub, ne vous en faites pas! Faites-nous part de vos questions. 26 | 27 | ### Sécurité 28 | 29 | **Ne publiez aucun problème de sécurité sur le dépôt publique!** Voir [SECURITY.md](SECURITY.md) 30 | -------------------------------------------------------------------------------- /en/1_Introduction.md: -------------------------------------------------------------------------------- 1 | # 1. Introduction 2 | 3 | ([Back](../README.md)) 4 | 5 | > **Note:** Generative artificial intelligence was used in the editing process of this publication in accordance with the FASTER principles outlined in the [Guide on the use of generative artificial intelligence - Canada.ca](https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/responsible-use-ai/guide-use-generative-ai.html#toc-4). 6 | 7 | ## 1.1 Background 8 | 9 | With the introduction of cloud services and the adoption of "continuous deployment" of software services, the movement of applications from one environment to another (Data Centre ↔ Public Cloud) and within an environment is required to be agile and predictable. Container technology (OS virtualization) enables software to deploy quickly and run predictably when moved from one environment to another. Further, microservices are established when a set of containers work together to compose an application. While this approach improves flexibility and scalability for application development and simplifies functionality, it adds another layer of abstraction that must be secured. 10 | 11 | ## 1.2 Document Purpose and Scope 12 | 13 | This document provides guidance to developers and operators when deploying applications and services using containers and microservices. It is based on [GC Cloud Reference Architecture](https://gccollab.ca/file/view/590020/gc-cloud-reference-architecture) (v0.95) and is aligned with the [GC Enterprise Security Architecture Program](). 14 | 15 | ## 1.3 Audience 16 | 17 | This document is to be used by developers, operators, business owners, project managers, system and system security practitioners leveraging containers and microservices to deliver Government of Canada (GC) services. 18 | 19 | ## 1.4 Document Overview 20 | 21 | This document is structured as follows: 22 | 23 | > [Section 1](#11-background) identifies this document and its purpose, 24 | > 25 | > [Section 2](./2_Context.md) provides context, including definitions and scope 26 | > 27 | > [Section 3](./3_Threat-Environment.md) introduces the threat environment and common attack vectors in a microservice architecture 28 | > 29 | > [Section 4](./4_Implementation-Recommendations.md) provides implementation recommendations to secure containers and microservices, including the hosts, orchestrators and security brokers; and 30 | > 31 | > [Section 5](./5_Microservice_Security.md) provides additional guidance on securing microservices, including the Kubernetes tenancy, service mesh, and network traffic. 32 | > 33 | > [Section 6](./6_References.md) identifies the applicable references cited in this document. 34 | -------------------------------------------------------------------------------- /en/3_Threat-Environment.md: -------------------------------------------------------------------------------- 1 | # 3. Threat Environment 2 | 3 | ([Back](../README.md)) 4 | 5 | Cloud native applications based on containers and microservices have vulnerability and attack vectors that need to be mitigated. Container and container orchestrators inherit typical IT vulnerabilities as well as introduce some of their own, especially if containers are started with escalated privileges. The following is a list of potential threats to a containerized environment: 6 | 7 | | Threat | Description | 8 | | --- | --- | 9 | | **Container Compromise** | An attacker can exploit application vulnerabilities or misconfigurations to gain unauthorized access to a container. Once inside, they may:
| 10 | | **Lateral Movement** | Compromised containers can attempt to communicate with other containers or nodes within the cluster to spread the attack. | 11 | | **Data Exfiltration** | Attackers can steal sensitive data from containers, often using techniques like reverse shells or covert channels. | 12 | | **Host Compromise** | If the host system is compromised, an attacker can gain access to all containers running on that host, potentially escalating privileges. | 13 | | **Kubernetes API Server and Kubelet Attacks** | Attackers may target the Kubernetes API server or kubelets to disrupt the cluster or gain unauthorized access to secrets, resources, or containers. | 14 | | **Supply Chain Attacks** | Malicious actors can introduce vulnerabilities into the software supply chain, compromising images, libraries, or dependencies. | 15 | 16 | ## Additional Considerations 17 | 18 | In addition to the threats listed above, organizations should consider the following security aspects when deploying containerized environments: 19 | 20 | | Consideration | Description | 21 | | --- | --- | 22 | | **Image Security** | Ensuring the security of container images, including scanning for vulnerabilities and using trusted registries. | 23 | | **Network Security** | Implementing network segmentation, firewalls, and intrusion detection systems to protect container networks. | 24 | | **Identity and Access Management** | Controlling access to Kubernetes resources and enforcing least privilege principles. | 25 | | **Monitoring and Logging** | Continuously monitoring container environments for suspicious activity and maintaining detailed logs for forensic analysis. | 26 | | **Incident Response Planning** | Developing a robust incident response plan to quickly detect, contain, and remediate security incidents. | 27 | | **Compliance and Auditing** | Ensuring that containerized environments comply with relevant security standards and regulations and conducting regular audits to verify compliance. | 28 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Guideline for Secure Application Development Annex A: Secure Containers and Microservices 2 | 3 | ([Français](#gabarit-pour-dépôts-de-code-source-ouvert-du-gouvernement-du-canada)) 4 | 5 | *Microservices* are established when a set of functional components work together to compose an application. While this approach improves flexibility and scalability for application development and simplifies functionality, it adds another layer of abstraction that must be secured. 6 | 7 | *Container* technology (OS virtualization) enables software to be deployed quickly and run predictably when moved from one environment to another. In modern deployments, containers are often orchestrated by a container orchestration tool, such as Kubernetes (K8s) or a cloud provider, to manage the lifecycle of the containers. 8 | 9 | *Microservices* are often deployed in *containers* to take advantage of the benefits of both technologies. 10 | 11 | This guidance provides recommendations to secure *containers* and *microservices* when deploying Government of Canada (GC) services. It highlights the controls, configuration and tools to secure GC workloads running in *containers* and orchestrators and recommendations for compliance verification. 12 | 13 | ## Table of Contents 14 | 15 | - [1. Introduction](en/1_Introduction.md) 16 | - [1.1 Background](en/1_Introduction.md/#11-background) 17 | - [1.2 Document Purpose and Scope](en/1_Introduction.md/#12-document-purpose-and-scope) 18 | - [1.3 Audience](en/1_Introduction.md/#13-audience) 19 | - [1.4 Document Overview](en/1_Introduction.md/#14-document-overview) 20 | - [2. Context](en/2_Context.md/#2-context) 21 | - [2.1 Definitions](en/2_Context.md/#21-definitions) 22 | - [2.2 Infrastructure](en/2_Context.md/#22-infrastructure) 23 | - [2.3 Containers](en/2_Context.md/#23-containers) 24 | - [2.4 Container Security](en/2_Context.md/#24-container-security) 25 | - [2.5 Microservices](en/2_Context.md/#25-microservices) 26 | - [2.6 Orchestration](en/2_Context.md/#26-orchestration) 27 | - [2.6.1 Service Mesh](en/2_Context.md/#261-service-mesh) 28 | - [2.7 Functions as a Service](en/2_Context.md/#26-functions-as-a-service) 29 | - [3. Threat Environment](en/3_Threat-Environment.md) 30 | - [4. Implementation Recommendations](en/4_Implementation-Recommendations.md) 31 | - [4.1 Host Recommendations](en/4_Implementation-Recommendations.md/#41-host-recommendations) 32 | - [4.2 Image Builds](en/4_Implementation-Recommendations.md/#42-image-builds) 33 | - [4.3 Container Deployment Security](en/4_Implementation-Recommendations.md/#43-container-deployment-security) 34 | - [4.4 Orchestration - Kubernetes](en/4_Implementation-Recommendations.md/#44-orchestration---kubernetes) 35 | - [5. Additional Microservices and Container Security Guidelines](en/5_Microservice_Security.md) 36 | - [5.1 Securing Platform](en/5_Microservice_Security.md#51-securing-platform) 37 | - [5.2 Securing Container Runtime](en/5_Microservice_Security.md#52-securing-container-runtime) 38 | - [5.3 Securing Traffic](en/5_Microservice_Security.md#53-securing-traffic) 39 | - [5.4 Securing Coding Practices](en/5_Microservice_Security.md#54-secure-coding-practices) 40 | - [5.5 Architecting Your Application for Cloud](en/5_Microservice_Security.md#55-architecting-your-application-for-cloud) 41 | - [5.6 Securing Container Images](en/5_Microservice_Security.md#56-securing-container-images) 42 | - [5.7 Observability](en/5_Microservice_Security.md#57-observability) 43 | - [5.8 Secrets Management](en/5_Microservice_Security.md#58-secrets-management) 44 | - [5.9 Continuous Integration/Continuous Deployment (CI/CD)](en/5_Microservice_Security.md#59-continuous-integrationcontinuous-deployment-cicd) 45 | - [5.10 Infrastructure as Code](en/5_Microservice_Security.md#510-infrastructure-as-code) 46 | 47 | ## List of Figures 48 | 49 | - [Figure 2‑1 Monolithic versus Microservice](en/2_Context.md#figure-2-1) 50 | - [Figure 2‑2 High-level overview of VMs, containers, and serverless](en/2_Context.md#figure-2-2) 51 | - [Figure 2‑3 Shared Responsibility Model with Containers](en/2_Context.md#figure-2-3) 52 | - [Figure 2‑4 Container Technologies](en/2_Context.md#figure-2-4) 53 | - [Figure 2‑5 Microservices Architecture (MSA)](en/2_Context.md#figure-2-5) 54 | - [Figure 5-1 VMs vs Containers](en/5_Microservice_Security.md#figure-5-1) 55 | - [Figure 5-2 Kubernetes Attack Surface](en/5_Microservice_Security.md#figure-5-2) 56 | - [Figure 5-3 RBAC in Kubernetes](en/5_Microservice_Security.md#figure-5-3) 57 | - [Figure 5-4 Service Mesh](en/5_Microservice_Security.md#figure-5-4) 58 | - [Figure 5-5 API Gateway with OPA](en/5_Microservice_Security.md#figure-5-5) 59 | - [Figure 5-6 Securing Container Images](en/5_Microservice_Security.md#figure-5-6) 60 | 61 | ## List of Abbreviations and Acronyms 62 | 63 | | Abbreviation | Definition | 64 | | ------------ | -------------------------------------------------- | 65 | | CaaS | Containers as a service | 66 | | CSP | Cloud Service Provider | 67 | | FaaS | Functions as a service | 68 | | GC | Government of Canada | 69 | | IaaS | Infrastructure as a Service | 70 | | IaC | Infrastructure as code | 71 | | IDS | Intrusion Detection System | 72 | | IT | Information Technology | 73 | | JSON | JavaScript Object Notation | 74 | | JWT | JSON Web Tokens | 75 | | K8s | Kubernetes | 76 | | MSA | Microservices Architecture | 77 | | mTLS | Mutual Transport Layer Security | 78 | | NIST | National Institute of Standard and Technology | 79 | | OAuth | Open Authentication | 80 | | OS | Operating system | 81 | | PaaS | Platform as a Service | 82 | | PBMM | Protected B, Medium Integrity, Medium Availability | 83 | | RBAC | Role-base Access Control | 84 | | SaaS | Software as a Service | 85 | | SSH | Secure Shell | 86 | | TBS | Treasury Board of Canada Secretariat | 87 | | TLS | Transport Layer Security | 88 | | VM | Virtual Machine | 89 | 90 | ### How to Contribute 91 | 92 | See [CONTRIBUTING.md](CONTRIBUTING.md) 93 | 94 | ### License 95 | 96 | Unless otherwise noted, the source code of this project is covered under Crown Copyright, Government of Canada, and is distributed under the [MIT License](LICENSE). 97 | 98 | The Canada wordmark and related graphics associated with this distribution are protected under trademark law and copyright law. No permission is granted to use them outside the parameters of the Government of Canada's corporate identity program. For more information, see [Federal identity requirements](https://www.canada.ca/en/treasury-board-secretariat/topics/government-communications/federal-identity-requirements.html). 99 | 100 | --- 101 | 102 | ## Gabarit pour dépôts de code source ouvert du gouvernement du Canada 103 | 104 | - Quel est ce projet? 105 | - Comment ça marche? 106 | - Qui utilisera ce projet? 107 | - Quel est le but de ce projet? 108 | 109 | ### Comment contribuer 110 | 111 | Voir [CONTRIBUTING.md](CONTRIBUTING.md) 112 | 113 | ### Licence 114 | 115 | Sauf indication contraire, le code source de ce projet est protégé par le droit d'auteur de la Couronne du gouvernement du Canada et distribué sous la [licence MIT](LICENSE). 116 | 117 | Le mot-symbole « Canada » et les éléments graphiques connexes liés à cette distribution sont protégés en vertu des lois portant sur les marques de commerce et le droit d'auteur. Aucune autorisation n'est accordée pour leur utilisation à l'extérieur des paramètres du programme de coordination de l'image de marque du gouvernement du Canada. Pour obtenir davantage de renseignements à ce sujet, veuillez consulter les [Exigences pour l'image de marque](https://www.canada.ca/fr/secretariat-conseil-tresor/sujets/communications-gouvernementales/exigences-image-marque.html). 118 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Contributor Covenant Code of Conduct for the [`project_name`] project 2 | 3 | ([Français](#code-de-conduite-pour-le-projet-nom-du-projet)) 4 | 5 | Contributors to repositories hosted in [`project_name`] are expected to follow the Contributor Covenant Code of Conduct, and those working within Government are also expected to follow the Values and Ethics Code for the Public Sector 6 | 7 | ## Values and Ethics Code for the Public Sector 8 | 9 | The [Values and Ethics Code for the Public Sector](https://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=25049) 10 | 11 | ## Our Pledge 12 | 13 | In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. 14 | 15 | ## Our Standards 16 | 17 | Examples of behavior that contributes to creating a positive environment include: 18 | 19 | * Using welcoming and inclusive language 20 | * Being respectful of differing viewpoints and experiences 21 | * Gracefully accepting constructive criticism 22 | * Focusing on what is best for the department 23 | * Showing empathy towards other members 24 | 25 | Examples of unacceptable behavior by participants include: 26 | 27 | * The use of sexualized language or imagery and unwelcome sexual attention or advances 28 | * Trolling, insulting/derogatory comments, and personal or political attacks 29 | * Public or private harassment 30 | * Publishing others' private information, such as a physical or electronic address, without explicit permission 31 | * Other conduct which could reasonably be considered inappropriate in a professional setting 32 | 33 | ## Our Responsibilities 34 | 35 | Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. 36 | 37 | Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. 38 | 39 | ## Scope 40 | 41 | This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project, members or [`department`]. 42 | Examples of representing a project, members or [`department`] include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. 43 | Representation of a project may be further defined and clarified by project maintainers. 44 | 45 | ## Enforcement 46 | 47 | Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at [`project email`]. 48 | All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. 49 | The project team is obligated to maintain confidentiality with regard to the reporter of an incident. 50 | Further details of specific enforcement policies may be posted separately. 51 | 52 | Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. 53 | 54 | ## Attribution [EN] 55 | 56 | This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, 57 | available at [https://www.contributor-covenant.org/version/1/4/code-of-conduct.html](https://www.contributor-covenant.org/version/1/4/code-of-conduct.html) 58 | 59 | [homepage]: https://www.contributor-covenant.org 60 | 61 | This Code of Conduct is also inspired by GDS' `alphagov` [Code of conduct](https://github.com/alphagov/code-of-conduct) 62 | 63 | --- 64 | 65 | # Code de conduite pour le projet [`nom du projet`] 66 | 67 | 68 | ([English](#contributor-covenant-code-of-conduct-for-the-project_name-project)) 69 | 70 | Les contributeurs aux dépôts hébergés dans [`nom du projet`] sont tenus de respecter le Code de conduite du Pacte des contributeurs, et ceux qui travaillent au sein du gouvernement sont également tenus de respecter le Code de valeurs et d'éthique du secteur public. 71 | 72 | ## Notre engagement 73 | 74 | Dans le but de favoriser un environnement ouvert et accueillant, nous nous engageons, en tant que collaborateurs et responsables, à faire de la participation à notre projet et à notre communauté une expérience sans harcèlement pour tous, quels que soient leur âge, leur taille, leur handicap, leur origine ethnique, leurs caractéristiques sexuelles, leur identité et expression sexuelles, leur niveau d'expérience, leur éducation, leur statut socio-économique, leur nationalité, leur apparence, leur race, leur religion et leur orientation sexuelle et leur identité. 75 | 76 | ## Nos normes 77 | 78 | Exemples de comportements qui contribuent à créer un environnement positif incluent : 79 | 80 | * Utiliser un langage accueillant et inclusif 81 | * Être respectueux des différents points de vue et expériences 82 | * Accepter gracieusement les critiques constructives 83 | * Se concentrer sur ce qui est le mieux pour la communauté 84 | * Faire preuve d'empathie envers les autres membres de la communauté 85 | 86 | Voici des exemples de comportements inacceptables de la part des participants : 87 | 88 | * L'utilisation d'un langage ou d'images sexualisés et d'une attention sexuelle importunée, ou percées 89 | * Trollage, commentaires insultants ou méprisants, et attaques personnelles ou politiques 90 | * Harcèlement public ou privé 91 | * La publication d'informations privées d'autrui, telles que des informations physiques ou électroniques. adresse, sans autorisation explicite 92 | * Tout autre comportement qui pourrait raisonnablement être considéré comme inapproprié dans le cadre d'une enquête du contexte professionnel 93 | 94 | ## Nos responsabilités 95 | 96 | Les responsables de la mise à jour du projet ont la responsabilité de clarifier les normes d'acceptabilité du et on s'attend à ce qu'ils prennent des mesures correctives appropriées et équitables en cas de comportement inacceptable. 97 | 98 | Les responsables de projet ont le droit et la responsabilité de supprimer, d'éditer ou de rejeter les commentaires, les soumissions (commits), le code, les éditions du wiki, les problèmes et autres contributions qui ne sont pas conformes au présent Code de conduite, ou d'interdire temporairement ou définitivement tout contributeur pour d'autres comportements qu'ils jugent inappropriés, menaçant, offensant ou nuisible. 99 | 100 | ## Portée 101 | 102 | Ce Code de conduite s'applique dans tous les espaces du projet, et il s'applique également lorsque une personne représente le projet ou sa communauté dans les espaces publics. 103 | Des exemples de représentation d'un projet ou d'une collectivité comprennent l'utilisation d'un représentant officiel de la l'adresse électronique du projet, l'affichage par l'entremise d'un compte officiel de médias sociaux ou le fait d'agir à titre intérimaire en tant que représentant désigné lors d'un événement en ligne ou hors ligne. 104 | La représentation d'un projet peut être mieux défini et clarifié par les responsables du projet. 105 | 106 | ## Application des règles 107 | 108 | Les cas de comportement abusif, de harcèlement ou d'autres comportements inacceptables peuvent être rapportés en communiquant avec l'équipe de projet à l'adresse suivante :[`courriel`]. 109 | Toutes les plaintes feront l'objet d'un examen et d'une enquête et donneront lieu à une réponse qui est jugée nécessaire et appropriée dans les circonstances. 110 | L'équipe de projet est dans l'obligation de respecter la confidentialité à l'égard du déclarant d'un incident. 111 | De plus amples détails sur les politiques d'application spécifiques peuvent être affichés séparément. 112 | 113 | Les responsables de projet qui ne respectent pas ou n'appliquent pas le Code de conduite en bonne et due formepeuvent faire face à des répercussions temporaires ou permanentes déterminées par d'autres membres de la les membres de la direction du projet. 114 | 115 | ## Attribution [FR] 116 | 117 | Le présent Code de conduite est adapté de la version 1.4 du [Pacte du contributeur][page d'accueil], 118 | disponible à l'adresse [https://www.contributor-covenant.org/version/1/4/code-of-conduct.html](https://www.contributor-covenant.org/version/1/4/code-of-conduct.html) 119 | 120 | [page d'accueil]: https://www.contributor-covenant.org 121 | 122 | Le présent Code de conduite s'inspire également du " Code de conduite " du [alphaGov](https://github.com/alphagov/code-of-conduct) de GDS. 123 | -------------------------------------------------------------------------------- /en/4_Implementation-Recommendations.md: -------------------------------------------------------------------------------- 1 | # 4. Implementation Recommendations 2 | 3 | ([Back](../README.md)) 4 | 5 | The following are general recommendations for securing containers and Kubernetes. 6 | 7 | ## 4.1 Host Recommendations 8 | 9 | The following are recommendations for securing the host: 10 | 11 | 1. Run docker engine with flags per [CIS Docker Community Edition Benchmark](https://www.cisecurity.org/benchmark/docker/) and [NIST Special Publication 800-190](https://doi.org/10.6028/NIST.SP.800-190). 12 | 2. Check for compliance by running tools like [docker-bench](https://github.com/docker/docker-bench-security) against the host. Recommended flags and settings can also be found in the [_Security Controls Mapping to Docker and Kubernetes_](https://www.gcpedia.gc.ca/gcwiki/images/4/48/Security_Controls_Mapping_to_Docker_and_Kubernetes.xlsx) document available on GCpedia. 13 | 14 | 3. While the benchmarks are the primary reference, consider these additional security best practices: 15 | 16 | | Best Practice | Description | 17 | | --- | --- | 18 | | **Container Runtime Security** | | 19 | | **Software Supply Chain Security** | | 20 | | **Network Security** |