|
| 1 | +# Security hardening guide |
| 2 | + |
| 3 | +This document provides an overview of security features and guidance for hardening the security of [Charmed PostgreSQL K8s](https://charmhub.io/postgresql-k8s) deployments, including setting up and managing a secure environment. |
| 4 | + |
| 5 | +## Environment |
| 6 | + |
| 7 | +The environment where Charmed PostgreSQL K8s operates can be divided into two components: |
| 8 | + |
| 9 | +1. Kubernetes |
| 10 | +2. Juju |
| 11 | + |
| 12 | +### Kubernetes |
| 13 | + |
| 14 | +Charmed PostgreSQL K8s can be deployed on top of several Kubernetes distributions. The following table provides references for the security documentation for the main supported cloud platforms. |
| 15 | + |
| 16 | +|Cloud|Security guides| |
| 17 | +| --- | --- | |
| 18 | +|Canonical Kubernetes|[Security overview](https://ubuntu.com/kubernetes/docs/security), [How to secure a cluster](https://ubuntu.com/kubernetes/docs/how-to-security)| |
| 19 | +|microK8s|[CIS compliance](https://microk8s.io/docs/cis-compliance), [Cluster hardening guide](https://microk8s.io/docs/how-to-cis-harden)| |
| 20 | +|AWS EKS|[Best Practices for Security, Identity and Compliance](https://aws.amazon.com/architecture/security-identity-compliance), [AWS security credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#access-keys-and-secret-access-keys), [Security in EKS](https://docs.aws.amazon.com/eks/latest/userguide/security.html)| |
| 21 | +|Azure AKS|[Azure security best practices and patterns](https://learn.microsoft.com/en-us/azure/security/fundamentals/best-practices-and-patterns), [Managed identities for Azure resource](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/), [Security in AKS](https://learn.microsoft.com/en-us/azure/aks/concepts-security)| |
| 22 | +|GCP GKE|[Google security overview](https://cloud.google.com/kubernetes-engine/docs/concepts/security-overview), [Harden your cluster’s security](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster)| |
| 23 | + |
| 24 | +### Juju |
| 25 | + |
| 26 | +Juju is the component responsible for orchestrating the entire lifecycle, from deployment to Day 2 operations. For more information on Juju security hardening, see the [Juju security page](https://canonical-juju.readthedocs-hosted.com/en/latest/user/explanation/juju-security/) and the [How to harden your deployment](https://juju.is/docs/juju/harden-your-deployment) guide. |
| 27 | + |
| 28 | +#### Cloud credentials |
| 29 | + |
| 30 | +When configuring cloud credentials to be used with Juju, ensure that users have the correct permissions to operate at the required level on the Kubernetes cluster. Juju superusers responsible for bootstrapping and managing controllers require elevated permissions to manage several kinds of resources. For this reason, the K8s user for bootstrapping and managing the deployments should have full permissions, such as: |
| 31 | + |
| 32 | +* create, delete, patch, and list: |
| 33 | + * namespaces |
| 34 | + * services |
| 35 | + * deployments |
| 36 | + * stateful sets |
| 37 | + * pods |
| 38 | + * PVCs |
| 39 | + |
| 40 | +In general, it is common practice to run Juju using the admin role of K8s, to have full permissions on the Kubernetes cluster. |
| 41 | + |
| 42 | +#### Juju users |
| 43 | + |
| 44 | +It is very important that Juju users are set up with minimal permissions depending on the scope of their operations. Please refer to the [User access levels](https://juju.is/docs/juju/user-permissions) documentation for more information on the access levels and corresponding abilities. |
| 45 | + |
| 46 | +Juju user credentials must be stored securely and rotated regularly to limit the chances of unauthorized access due to credentials leakage. |
| 47 | + |
| 48 | +## Applications |
| 49 | + |
| 50 | +In the following sections, we provide guidance on how to harden your deployment using: |
| 51 | + |
| 52 | +1. Base images |
| 53 | +2. Charmed operator security upgrades |
| 54 | +3. Encryption |
| 55 | +4. Authentication |
| 56 | +5. Monitoring and auditing |
| 57 | + |
| 58 | +### Base images |
| 59 | + |
| 60 | +Charmed PostgreSQL K8s and Charmed PgBouncer K8s run on top of rockcraft-based images shipping the PostgreSQL and PgBouncer distribution binaries built by Canonical. These images (rocks) are available in a GitHub registry for [PostgreSQL](https://github.com/canonical/charmed-postgresql-rock/pkgs/container/charmed-postgresql) and [PgBouncer](https://github.com/orgs/canonical/packages/container/package/charmed-pgbouncer) respectively. Both images are based on Ubuntu 22.04. |
| 61 | + |
| 62 | +### Charmed operator security upgrades |
| 63 | + |
| 64 | +[Charmed PostgreSQL K8s](https://charmhub.io/postgresql-k8s) operator and [Charmed PgBouncer K8s](https://charmhub.io/pgbouncer-k8s) operator install pinned versions of their respective rocks to provide reproducible and secure environments. |
| 65 | + |
| 66 | +New versions (revisions) of the charmed operators can be released to update the operator's code, workloads, or both. It is important to refresh the charms regularly to make sure the workloads are as secure as possible. |
| 67 | + |
| 68 | +For more information on upgrading Charmed PostgreSQL K8s, see the [How to upgrade PostgreSQL K8s](https://canonical.com/data/docs/postgresql/k8s/h-upgrade) and [How to upgrade PgBouncer K8s](https://charmhub.io/pgbouncer-k8s/docs/h-upgrade) guides, as well as the respective Release notes for [PostgreSQL](https://canonical.com/data/docs/postgresql/k8s/r-releases) and [PgBouncer](https://charmhub.io/pgbouncer-k8s/docs/r-releases). |
| 69 | + |
| 70 | +### Encryption |
| 71 | + |
| 72 | +To utilise encryption at transit for all internal and external cluster connections, integrate Charmed PostgreSQL K8s and Charmed PgBouncer K8s with a TLS certificate provider. Please refer to the [Charming Security page](https://charmhub.io/topics/security-with-x-509-certificates) for more information on how to select the right certificate provider for your use case. |
| 73 | + |
| 74 | +Encryption in transit for backups is provided by the storage service (Charmed PostgreSQL K8s is a client for an S3-compatible storage). |
| 75 | + |
| 76 | +For more information on encryption, see the [Cryptography](/t/charmed-postgresql-k8s-explanations-encryption/16851) explanation page and [How to enable encryption](https://canonical.com/data/docs/postgresql/k8s/h-enable-tls) guide. |
| 77 | + |
| 78 | +### Authentication |
| 79 | + |
| 80 | +Charmed PostgreSQL K8s supports the password-based `scram-sha-256` authentication method for authentication between: |
| 81 | + |
| 82 | +* External connections to clients |
| 83 | +* Internal connections between members of cluster |
| 84 | +* PgBouncer connections |
| 85 | + |
| 86 | +For more implementation details, see the [PostgreSQL documentation](https://www.postgresql.org/docs/14/auth-password.html). |
| 87 | + |
| 88 | +### Monitoring and auditing |
| 89 | + |
| 90 | +Charmed PostgreSQL K8s provides native integration with the [Canonical Observability Stack (COS)](https://charmhub.io/topics/canonical-observability-stack). To reduce the blast radius of infrastructure disruptions, the general recommendation is to deploy COS and the observed application into separate environments, isolated from one another. Refer to the [COS production deployments best practices](https://charmhub.io/topics/canonical-observability-stack/reference/best-practices) for more information or see the How to guides for PostgreSQL [monitoring](https://canonical.com/data/docs/postgresql/k8s/h-enable-monitoring), [alert rules](https://canonical.com/data/docs/postgresql/k8s/h-enable-alert-rules), and [tracing](https://canonical.com/data/docs/postgresql/k8s/h-enable-tracing) for practical instructions. |
| 91 | + |
| 92 | +PostgreSQL logs are stored in `/var/log/postgresql` within the postgresql container of each unit. It’s recommended to integrate the charm with [COS](https://canonical.com/data/docs/postgresql/k8s/h-enable-monitoring), from where the logs can be easily persisted and queried using [Loki](https://charmhub.io/loki-k8s)/[Grafana](https://charmhub.io/grafana). |
| 93 | + |
| 94 | +## Additional Resources |
| 95 | + |
| 96 | +For details on the cryptography used by Charmed PostgreSQL K8s, see the [Cryptography](/t/charmed-postgresql-k8s-explanations-encryption/16851) explanation page. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments