Securing Red Hat OpenShift Container Platform
To make your Red Hat OpenShift Container Platform cluster more secure, you should understand the security enhancements you can make to your cluster.
When you deploy Red Hat OpenShift Container Platform, you have the choice of an installer-provisioned infrastructure (there are several available platforms) or your own user-provisioned infrastructure. Some low-level security-related configuration, such as enabling FIPS mode or adding kernel modules required at first boot, might benefit from a user-provisioned infrastructure. Likewise, user-provisioned infrastructure is appropriate for disconnected Red Hat OpenShift Container Platform deployments.
Remember when it comes to making security enhancements and other configuration changes to Red Hat OpenShift Container Platform, the goals should include:
-
Keeping the underlying nodes as generic as possible. You want to be able to easily throw away and spin up similar nodes quickly and in prescriptive ways.
-
Managing modifications to nodes through Red Hat OpenShift Container Platform as much as possible, rather than making direct, one-off changes to the nodes.
In pursuit of those goals, most node changes should be done during installation through Ignition or later using MachineConfigs that are applied to sets of nodes by the Machine Config Operator. Examples of security-related configuration changes you can do in this way include:
-
Adding kernel arguments
-
Adding kernel modules
-
Enabling support for FIPS cryptography
-
Configuring disk encryption
-
Configuring the chrony time service
Besides the Machine Config Operator, there are several other Operators available to configure Red Hat OpenShift Container Platform infrastructure that are managed by the Cluster Version Operator (CVO). The CVO is able to automate many aspects of Red Hat OpenShift Container Platform cluster updates.