Kubernetes cluster hardening standard (previously "K8s cluster baseline security")

[cah-hbaum]

The "Baseline K8s cluster security" was created previously. In the PR (#376) there were some discussions about the structure and overall usefulness of the standard.
This issue should adapt the standard (since it is still in the draft phase) in order to better adhere to the requirements brought forward.
The standard was also retitled to "Kubernetes cluster hardening".

[artificial-intelligence]

I like the clear explanation of concepts before recommending something, but it could be argued that these in depth details should not be part of the standard itself. I myself find it very handy to have the reasoning in the same file as the decisions itself.

I would like to hear more opinions on this, though (I could imagine @mbuechse has something to say about this from a meta-standard perspective?) because I think the standard at least somewhat deviates in this regard from our other standards.

One solution could be to move the explanations into a dedicated file, but we could as well just keep this as-is. I have no strong opinion on this matter myself, I just wanted to mention it because I think other people might have objections in this regard.

The standard looks mostly good to me, I have made some comments regarding wording and some - I think - incomplete sentences need fixing.

[chess-knight]

Just small typos...

[cah-hbaum]

Rebased the branch.

[mbuechse]

Wow, this is impressive. One problem I have is to find what the standard requires of me. There is a lot of recommendations and best practice suggestions. But can we (in principle) make a succinct list of requirements? Could you please work on an MVP for a test? I think tests are very important to make clear what the standard really requires, and whether it's practical.

[mbuechse]

Sorry, I totally missed the section "Standard". Okay, so we have a succinct list. I think we can drop the introductory paragraph from that section, but I would add a remark somewhere in the beginning of the "Hardening Kubernetes" paragraph that "Hardening Kubernetes" is not authoritative, and that the "Standards" section contains the authoritative part.

[cah-hbaum]

Sorry, I totally missed the section "Standard". Okay, so we have a succinct list. I think we can drop the introductory
paragraph from that section, but I would add a remark somewhere in the beginning of the "Hardening Kubernetes"
paragraph that "Hardening Kubernetes" is not authoritative, and that the "Standards" section contains the authoritative part.

Updated the paragraphs just as mentioned by @mbuechse
Also did some rebasing to remove the merge conflicts

[bitkeks]

LGTM!

I'm approving the draft because it's good work and covers a lot of aspects. The standard paragraph makes sense to me.

Of course these kind of guides always have room for debates around scope and requirements. Does not mean I object to other people's inputs and improvement suggestions 😉

[mbuechse]

This is ready to merge. I trust that you did what you said. So I won't review it now. You can proceed.

[cah-hbaum]

Merging!