security: implement group 4 - GKE cluster security hardening

[rshade]

GKE Cluster Security Hardening

Reference: security-groups/group-4-cluster-security.md

Tasks

1. Pod Security Admission (PSA) — apply namespace-level PSA labels (restricted for app namespaces, baseline for system namespaces). Note: PodSecurityPolicy (v1beta1) was removed in K8s 1.25; the cluster runs K8s 1.30+ — use PSA labels, not PSP.
2. Kubernetes NetworkPolicy — default-deny with explicit allow rules for app traffic and DNS
3. Binary Authorization — image verification for deployed containers
4. Workload Identity — secure pod-to-GCP authentication
5. Private cluster endpoint — evaluate enabling private endpoint for management access

Important Notes

• Do NOT use podSecurityPolicyConfig or k8s.policy.v1beta1.PodSecurityPolicy — these are removed in K8s 1.25+
• Use Pod Security Admission via namespace labels instead
• GKE Autopilot enforces some security features natively

Acceptance Criteria

• PSA labels applied to all application namespaces
• NetworkPolicy resources deployed
• Binary Authorization configured
• Workload Identity bindings functional
• All applications running without violations