@@ -30,25 +30,25 @@ performance:
3030 - Depletion as denial of service
3131 - PVC
3232 - Ephemeral
33- - Networking
34- - Encryption (mTLS)
35- - Certificates
36- - TLS certificates presented by ` coderd `
37- - TLS certificats presented by the applications with which Coder
38- interacts
39- - Boundaries (e.g., network policies)
40- - External interactions (ingress and egress)
41- - IP address depletion as denial of service
42- - Each workspace gets an IP address in the ` pod ` subset
43- - Each dev URL gets an IP address in the ` services ` subnet
44- - Kubernetes roles
45- - Service accounts for Coder to create pods
46- - Cluster admins (use of cluster admins can pose a security risk)
47- - Cloud access to the control plane
48- - Node security
49- - Upgrades to keep up with Kubernetes
50- - Access to node user accounts
51- - Cloud access to nodes
33+ - Networking
34+ - Encryption (mTLS)
35+ - Certificates
36+ - TLS certificates presented by ` coderd `
37+ - TLS certificats presented by the applications with which Coder
38+ interacts
39+ - Boundaries (e.g., network policies)
40+ - External interactions (ingress and egress)
41+ - IP address depletion as denial of service
42+ - Each workspace gets an IP address in the ` pod ` subset
43+ - Each dev URL gets an IP address in the ` services ` subnet
44+ - Kubernetes roles
45+ - Service accounts for Coder to create pods
46+ - Cluster admins (use of cluster admins can pose a security risk)
47+ - Cloud access to the control plane
48+ - Node security
49+ - Upgrades to keep up with Kubernetes
50+ - Access to node user accounts
51+ - Cloud access to nodes
5252
5353### Recommendations
5454
@@ -72,14 +72,14 @@ deploying security controls:
7272 - Site admins could convert a user authenticating via OIDC to built-in,
7373 allowing the admin to impersonate the user
7474- Container registry
75- - The registry account used to add the registry should be a specific
75+ - The registry account used to access images should be a specific
7676 Coder-only account so that Coder users can only pull approved images
7777 - CVMs can only pull unauthenticated containers, which means that any user can
7878 reference any container within the registry
7979- Git provider
8080 - OAuth linkage allows Coder admins to perform actions as the linked Git user
8181 - SSH keys generated by Coder and added to workspaces can be used to
82- facilitate 2FA to Coder via GitLab
82+ circumvent 2FA to GitLab via Coder
8383 - Git integration request both SSH and HTTPS access to function
8484 - Access to all user repos must be added to a Coder workspace to clone private
8585 dotfiles repos
0 commit comments