Security Reference

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: graphpolaris-default-deny
  namespace: graphpolaris
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ingress-gateway
  namespace: graphpolaris
spec:
  podSelector:
    matchLabels:
      app: client-gateway
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: istio-system
    ports:
    - protocol: TCP
      port: 3000

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: graphpolaris
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: graphpolaris-authz
  namespace: graphpolaris
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        principals:
        - "cluster.local/ns/graphpolaris/sa/client-gateway"

# Rate limiting configuration
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "100"
    nginx.ingress.kubernetes.io/limit-connections: "50"

# Create encrypted secrets
kubectl create secret generic graphpolaris-secrets \
  --namespace graphpolaris \
  --from-literal=jwt-secret=$(openssl rand -base64 32) \
  --from-literal=encryption-key=$(openssl rand -base64 32) \
  --from-literal=db-password=<secure-password>

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secret-reader
  namespace: graphpolaris
rules:
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["graphpolaris-secrets"]
  verbs: ["get"]

# Store secrets in Key Vault
az keyvault secret set \
  --vault-name kv-graphpolaris \
  --name jwt-secret \
  --value $(openssl rand -base64 32)

# Enable managed identity access
az keyvault set-policy \
  --name kv-graphpolaris \
  --object-id <managed-identity-id> \
  --secret-permissions get list

# Kubernetes secret rotation with External Secrets
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: graphpolaris-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: azure-key-vault
    kind: ClusterSecretStore
  target:
    name: graphpolaris-secrets
  data:
  - secretKey: jwt-secret
    remoteRef:
      key: jwt-secret

{
  "timestamp": "2024-01-15T10:30:00Z",
  "level": "info",
  "event": "user.login",
  "userId": "user-123",
  "organizationId": "org-456",
  "ip": "192.168.1.1",
  "userAgent": "Mozilla/5.0...",
  "success": true
}

# Fluentd configuration for SIEM
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluentd-config
data:
  fluent.conf: |
    <source>
      @type tail
      path /var/log/graphpolaris/*.log
      tag graphpolaris.*
    </source>
    <match graphpolaris.**>
      @type forward
      <server>
        host siem.company.com
        port 24224
      </server>
    </match>