Understanding the requirements

Environment

  • The server on which SDS for Kubernetes init container is installed must be healthy. There must be an information system security policy whose requirements are met on the server. This policy shall ensure that the installed software is regularly updated and the system is protected against viruses and spyware or malware (firewall properly configured, antivirus updates, etc.). It is imperative to follow:

  • Access to the administrative functions of the workstation system is restricted only to system administrators.

  • The operating system must manage the logs generated by the product in accordance with the security policy of the company. It must for example restrict read access to these logs to only those explicitly permitted. For more information, refer to the section Logging prerequisites.

  • You must set up a system upstream of SDS for Kubernetes init container to protect against distributed denial-of-service (DDoS) and brute-force attacks. Please follow the ANSSI recommendations (in French only).

  • SDS for Kubernetes init container must be installed on a server whose system and OpenSource contributions are kept up to date.

  • The server hosting the solution must be located in a secure physical environment with access control protocols and must be trusted.

Administration

  • SDS for Kubernetes init container administrators are considered as trusted. They are responsible for defining SDS for Kubernetes init container security policy in compliance with the state-of-the-art standards.

  • The system administrator is also considered as trusted. He/She is responsible for the installation and maintenance of the application and server. He/She applies the security policy defined by SDS for Kubernetes init container administrators.

Kubernetes

The KMaaS API key is a very sensitive security material. Do not store it in clear text, and use it only via environment variables and Kubernetes secrets.

In the pod manifest, you must specify a volume of type emptyDir: { medium: Memory } to store the decrypted data so that it can be accessed only during the pod lifetime.

KMaaS

Stormshield recommends having a dedicated tenant for SDS for Kubernetes init container to allow the API key to be revoked without interfering with other applications. We also recommend using only one API key per init container.

The SDS for Kubernetes init container requires:

  • A Kubernetes cluster version v1.10 or higher, able to support both the init container and the ephemeral volume features,

  • An image registry to host the SDS for Kubernetes init container docker images to be used by the Kubernetes cluster,

  • An available KMaaS instance version 4.5 or higher. The instance requires:

    • A base KMaaS URL,

    • A tenant identifier with enabled KAS feature,

    • An API key for authentication.

    For more information, refer to section Configuring the KMaaS and the KMaaS Administration Guide.

  • Node.js 22 or higher to run the preliminary encryptor.cjs script that encrypts the sensitive data.

  • The following network streams must be open:

    Description

    Protocol

    Source

    		 Base URL Port Route

    KMaaS

    for init container

    		 The pod protected by SDS for Kubernetes init container must be able to reach the KMaaS decrypt route. Kubernetes Pod to be protected <KMAAS_URL> <KMAAS_PORT> api/v1/<tenant_id>/kas/decrypt
    KMaaS
    for encryptor.cjs    		 The encryptor.cjs script must be able to reach the KMaaS encrypt route. Encryptor script host <KMAAS_URL> <KMAAS_PORT> api/v1/<tenant_id>/kas/encrypt

Contact your KMaaS administrator to get the KMaaS URL and port.