Document security hardening and enable security for sda platform #163
Conversation
JoergSiebahn
force-pushed
the
document-security-hardening-and-enable-security-for-sda-platform
branch
2 times, most recently
from
3cd4a7d to
9d18686
Compare
JoergSiebahn
force-pushed
the
document-security-hardening-and-enable-security-for-sda-platform
branch
2 times, most recently
from
fa7a13b to
3e59468
Compare
JoergSiebahn
force-pushed
the
document-security-hardening-and-enable-security-for-sda-platform
branch
from
3e59468 to
a5a1f3b
Compare
JoergSiebahn
force-pushed
the
document-security-hardening-and-enable-security-for-sda-platform
branch
from
a5a1f3b to
d87963f
Compare
| attack the operating system after taking over from the container. | ||
|
|
||
| The default configuration is capable to run as no root, listening to ports 8080 and 8081. | ||
| Deployment checks must ensure, that the container is not configured with a root user. |
There was a problem hiding this comment.
Do we want to give an example K8S deployment here?
There was a problem hiding this comment.
Imho that will just add boilerplate to this page and move the focus away from the list of addressed risks.
docs/security/index.md
Outdated
|
|
||
| ## Risk: Loss of source IP address | ||
|
|
||
| We expect, the services built with sda-spring-boot-commons are deployed behind a proxy, e.g. an |
There was a problem hiding this comment.
the -> that? Or "We assume that..."?
There was a problem hiding this comment.
I „expect“ that. If you expose the service directly, you have to disable the filter.
| @@ -11,8 +11,7 @@ Features: | |||
| - [Jackson Object Mapping](#jackson) | |||
| - [Monitoring](#monitoring) | |||
| - [Tracing](#tracing) | |||
| - [Health Checks](#health-checks) | |||
| - [Testing](#testing) | |||
| - [Health Checks](#health-checks--actuator) | |||
There was a problem hiding this comment.
The bullet point list does not include "security". Should we add it?
There was a problem hiding this comment.
Imho not. These links are just anchors within the page. I would not mix it with links to different pages. I added the security page to the mkdocs. Whenever we provide github pages or Backstage docs, it will be visible in the main nav. But that's a separate PR.
| @EnableSdaRestGuide | ||
| @EnableSdaWebSecurity | ||
| @EnableSdaDocs |
There was a problem hiding this comment.
I would've preferred EnableSdaOpenApiDocs or similar but that's not part of the review / changes.
JoergSiebahn
force-pushed
the
document-security-hardening-and-enable-security-for-sda-platform
branch
from
ed92c9c to
001d08d
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
JoergSiebahn
deleted the
document-security-hardening-and-enable-security-for-sda-platform
branch
Note: Security is already available for auto configured services. Users of
@EnableSdaPlatformget the security features as well now.