-
Notifications
You must be signed in to change notification settings - Fork 124
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #706 from RainbowMango/pr_update_line_terminator
Update file line terminator from CRLF to LF
- Loading branch information
Showing
15 changed files
with
1,904 additions
and
1,904 deletions.
There are no files selected for viewing
472 changes: 236 additions & 236 deletions
472
docs/administrator/migration/migration-from-kubefed.md
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,32 @@ | ||
| --- | ||
| title: Security Considerations | ||
| --- | ||
|
|
||
| ## Security Considerations | ||
|
|
||
| The Karmada Security Considerations document aims to assist users in ensuring the security of their Karmada deployments. This document provides a series of best practices and recommendations to help users protect their Karmada clusters and related resources from potential security risks. It covers various aspects of security, including artifacts verifying and component configurations. By following the recommendations in this guide, users can enhance the security of their Karmada environments and reduce potential security vulnerabilities and attack surfaces. Please note that this document is for reference purposes only, and users should adjust and implement the recommendations according to their specific circumstances and requirements. | ||
|
|
||
| ### Verify artifacts： | ||
|
|
||
| Karmada introduced the use of Cosign for image verification starting from v1.7.0 release. For detailed information, please refer to [Verify Artifacts](verify-artifacts). | ||
|
|
||
| ### Component Configurations： | ||
|
|
||
| #### TLS Configuration | ||
|
|
||
| Karmada components set the TLS configuration options for client-to-server communication using the startup parameters `--tls-min-version` and `--cipher-suites`. | ||
|
|
||
| To avoid the use of insecure algorithms such as 3DES during the communication process, the TLS configuration is set during the installation of Karmada-related components. The specific configuration is as follows: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite. | ||
|
|
||
| --- | ||
| title: Security Considerations | ||
| --- | ||
|
|
||
| ## Security Considerations | ||
|
|
||
| The Karmada Security Considerations document aims to assist users in ensuring the security of their Karmada deployments. This document provides a series of best practices and recommendations to help users protect their Karmada clusters and related resources from potential security risks. It covers various aspects of security, including artifacts verifying and component configurations. By following the recommendations in this guide, users can enhance the security of their Karmada environments and reduce potential security vulnerabilities and attack surfaces. Please note that this document is for reference purposes only, and users should adjust and implement the recommendations according to their specific circumstances and requirements. | ||
|
|
||
| ### Verify artifacts： | ||
|
|
||
| Karmada introduced the use of Cosign for image verification starting from v1.7.0 release. For detailed information, please refer to [Verify Artifacts](verify-artifacts). | ||
|
|
||
| ### Component Configurations： | ||
|
|
||
| #### TLS Configuration | ||
|
|
||
| Karmada components set the TLS configuration options for client-to-server communication using the startup parameters `--tls-min-version` and `--cipher-suites`. | ||
|
|
||
| To avoid the use of insecure algorithms such as 3DES during the communication process, the TLS configuration is set during the installation of Karmada-related components. The specific configuration is as follows: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite. | ||
|
|
64 changes: 32 additions & 32 deletions
64
...s-plugin-content-docs/current/administrator/security/security-considerations.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,32 @@ | ||
| --- | ||
| title: 安全考虑 | ||
| --- | ||
|
|
||
| ## 安全考虑 | ||
|
|
||
| Karmada 安全考虑文档旨在帮助用户确保他们在使用 Karmada 时的安全性。本文档提供了一系列的最佳实践和建议，以帮助用户保护他们的 Karmada 集群和相关资源免受潜在的安全风险。文档涵盖了各个方面的安全问题，包括验证发布组件和组件配置等。通过遵循本指南中的建议，用户可以加强他们的 Karmada 环境的安全性，并减少潜在的安全漏洞和攻击面。请注意，本文档仅供参考，用户应根据自己的具体情况和需求进行适当的调整和实施。 | ||
|
|
||
| ### 验证发布组件： | ||
|
|
||
| Karmada 从 v1.7.0 版本开始引入 cosign 对发布的组件进行验证。详细信息请参考[验证发布组件](verify-artifacts)。 | ||
|
|
||
| ### 组件配置： | ||
|
|
||
| #### TLS 配置 | ||
|
|
||
| Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设置客户端到服务端通讯的 tls 配置选项。 | ||
|
|
||
| 为避免通讯过程中使用到了不安全算法，如 3Des，Karmada 相关组件安装时，对 tls 配置进行了设置。具体如下: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。 | ||
|
|
||
| --- | ||
| title: 安全考虑 | ||
| --- | ||
|
|
||
| ## 安全考虑 | ||
|
|
||
| Karmada 安全考虑文档旨在帮助用户确保他们在使用 Karmada 时的安全性。本文档提供了一系列的最佳实践和建议，以帮助用户保护他们的 Karmada 集群和相关资源免受潜在的安全风险。文档涵盖了各个方面的安全问题，包括验证发布组件和组件配置等。通过遵循本指南中的建议，用户可以加强他们的 Karmada 环境的安全性，并减少潜在的安全漏洞和攻击面。请注意，本文档仅供参考，用户应根据自己的具体情况和需求进行适当的调整和实施。 | ||
|
|
||
| ### 验证发布组件： | ||
|
|
||
| Karmada 从 v1.7.0 版本开始引入 cosign 对发布的组件进行验证。详细信息请参考[验证发布组件](verify-artifacts)。 | ||
|
|
||
| ### 组件配置： | ||
|
|
||
| #### TLS 配置 | ||
|
|
||
| Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设置客户端到服务端通讯的 tls 配置选项。 | ||
|
|
||
| 为避免通讯过程中使用到了不安全算法，如 3Des，Karmada 相关组件安装时，对 tls 配置进行了设置。具体如下: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。 | ||
|
|
64 changes: 32 additions & 32 deletions
64
...in-content-docs/version-v1.10/administrator/security/security-considerations.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,32 @@ | ||
| --- | ||
| title: 安全考虑 | ||
| --- | ||
|
|
||
| ## 安全考虑 | ||
|
|
||
| Karmada 安全考虑文档旨在帮助用户确保他们在使用 Karmada 时的安全性。本文档提供了一系列的最佳实践和建议，以帮助用户保护他们的 Karmada 集群和相关资源免受潜在的安全风险。文档涵盖了各个方面的安全问题，包括验证发布组件和组件配置等。通过遵循本指南中的建议，用户可以加强他们的 Karmada 环境的安全性，并减少潜在的安全漏洞和攻击面。请注意，本文档仅供参考，用户应根据自己的具体情况和需求进行适当的调整和实施。 | ||
|
|
||
| ### 验证发布组件： | ||
|
|
||
| Karmada 从 v1.7.0 版本开始引入 cosign 对发布的组件进行验证。详细信息请参考[验证发布组件](verify-artifacts)。 | ||
|
|
||
| ### 组件配置： | ||
|
|
||
| #### TLS 配置 | ||
|
|
||
| Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设置客户端到服务端通讯的 tls 配置选项。 | ||
|
|
||
| 为避免通讯过程中使用到了不安全算法，如 3Des，Karmada 相关组件安装时，对 tls 配置进行了设置。具体如下: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。 | ||
|
|
||
| --- | ||
| title: 安全考虑 | ||
| --- | ||
|
|
||
| ## 安全考虑 | ||
|
|
||
| Karmada 安全考虑文档旨在帮助用户确保他们在使用 Karmada 时的安全性。本文档提供了一系列的最佳实践和建议，以帮助用户保护他们的 Karmada 集群和相关资源免受潜在的安全风险。文档涵盖了各个方面的安全问题，包括验证发布组件和组件配置等。通过遵循本指南中的建议，用户可以加强他们的 Karmada 环境的安全性，并减少潜在的安全漏洞和攻击面。请注意，本文档仅供参考，用户应根据自己的具体情况和需求进行适当的调整和实施。 | ||
|
|
||
| ### 验证发布组件： | ||
|
|
||
| Karmada 从 v1.7.0 版本开始引入 cosign 对发布的组件进行验证。详细信息请参考[验证发布组件](verify-artifacts)。 | ||
|
|
||
| ### 组件配置： | ||
|
|
||
| #### TLS 配置 | ||
|
|
||
| Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设置客户端到服务端通讯的 tls 配置选项。 | ||
|
|
||
| 为避免通讯过程中使用到了不安全算法，如 3Des，Karmada 相关组件安装时，对 tls 配置进行了设置。具体如下: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。 | ||
|
|
64 changes: 32 additions & 32 deletions
64
...in-content-docs/version-v1.11/administrator/security/security-considerations.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,32 @@ | ||
| --- | ||
| title: 安全考虑 | ||
| --- | ||
|
|
||
| ## 安全考虑 | ||
|
|
||
| Karmada 安全考虑文档旨在帮助用户确保他们在使用 Karmada 时的安全性。本文档提供了一系列的最佳实践和建议，以帮助用户保护他们的 Karmada 集群和相关资源免受潜在的安全风险。文档涵盖了各个方面的安全问题，包括验证发布组件和组件配置等。通过遵循本指南中的建议，用户可以加强他们的 Karmada 环境的安全性，并减少潜在的安全漏洞和攻击面。请注意，本文档仅供参考，用户应根据自己的具体情况和需求进行适当的调整和实施。 | ||
|
|
||
| ### 验证发布组件： | ||
|
|
||
| Karmada 从 v1.7.0 版本开始引入 cosign 对发布的组件进行验证。详细信息请参考[验证发布组件](verify-artifacts)。 | ||
|
|
||
| ### 组件配置： | ||
|
|
||
| #### TLS 配置 | ||
|
|
||
| Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设置客户端到服务端通讯的 tls 配置选项。 | ||
|
|
||
| 为避免通讯过程中使用到了不安全算法，如 3Des，Karmada 相关组件安装时，对 tls 配置进行了设置。具体如下: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。 | ||
|
|
||
| --- | ||
| title: 安全考虑 | ||
| --- | ||
|
|
||
| ## 安全考虑 | ||
|
|
||
| Karmada 安全考虑文档旨在帮助用户确保他们在使用 Karmada 时的安全性。本文档提供了一系列的最佳实践和建议，以帮助用户保护他们的 Karmada 集群和相关资源免受潜在的安全风险。文档涵盖了各个方面的安全问题，包括验证发布组件和组件配置等。通过遵循本指南中的建议，用户可以加强他们的 Karmada 环境的安全性，并减少潜在的安全漏洞和攻击面。请注意，本文档仅供参考，用户应根据自己的具体情况和需求进行适当的调整和实施。 | ||
|
|
||
| ### 验证发布组件： | ||
|
|
||
| Karmada 从 v1.7.0 版本开始引入 cosign 对发布的组件进行验证。详细信息请参考[验证发布组件](verify-artifacts)。 | ||
|
|
||
| ### 组件配置： | ||
|
|
||
| #### TLS 配置 | ||
|
|
||
| Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设置客户端到服务端通讯的 tls 配置选项。 | ||
|
|
||
| 为避免通讯过程中使用到了不安全算法，如 3Des，Karmada 相关组件安装时，对 tls 配置进行了设置。具体如下: | ||
|
|
||
| - karmada-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-aggregated-apiserver: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-search: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - karmada-metrics-adapter: `--tls-min-version=VersionTLS13` | ||
|
|
||
| - etcd: `--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` | ||
|
|
||
| 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。 | ||
|
|
Oops, something went wrong.