gatekeeper

Re: scanning of images, if you're using Google Container Registry (or Google Artifact Registry) there's also Artifact Analysis and Vulnerability scanning which you can turn on (and pay for)[0] Re: security, defining security contexts for containers and pods are quite important, the container should not run as root, you should drop all capabilities, ...etc. For example securityContext: runAsNonRoot: true runAsGroup: 1000 runAsUser: 1000 privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL You should also use something like kubescape[1] to regularly scan your cluster (or helm files or yaml files). Furthermore, you should use an admission controller[2] like Gatekeeper[3] to enforce certain policies in your clusters e.g. containers should always h

Gatekeeper docs: https://open-policy-agent.github.io/gatekeeper/website/docs/ Gatekeeper src: https://github.com/open-policy-agent/gatekeeper awesome-container-security: https://github.com/kai5263499/awesome-container-security "container-security" GitHub label: https://github.com/topics/container-security

Yes, there's a few listed in this blog post: https://cloud.google.com/blog/products/identity-security/bey... - Kubernetes admission controllers, OSS part of Kubernetes: https://kubernetes.io/docs/reference/access-authn-authz/admi... - Kritis, OSS: https://opensource.google/projects/kritis - OPA Gatekeeper, OSS: https://github.com/open-policy-agent/gatekeeper - Binary Authorization on GKE/Anthos: https://cloud.google.com/binary-authorization/ They don't all do all the pieces. The hardest part is going to be integrating whatever enforcement solution you choose with your upstream CI/CD pipeline. Disclosure: I work at Google and helped write this whitepaper on Binary Authorization for Borg.