whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #31851 from marosset/move-windows-security-1.24

Browse Source 
Moving Windows security info to new page
This commit is contained in:
Kubernetes Prow Robot
2022-03-24 23:09:50 -07:00
committed by GitHub
parent 81aee215f7 9b6876726c
commit 2bdb3fe416
2 changed files with 55 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md
-18
View File
@@ -614,24 +614,6 @@ Windows Server SAC release
The Kubernetes [version-skew policy](/docs/setup/release/version-skew-policy/) also applies.
## Security for Windows nodes {#security}
On Windows, data from Secrets are written out in clear text onto the node's local
storage (as compared to using tmpfs / in-memory filesystems on Linux). As a cluster
operator, you should take both of the following additional measures:
1. Use file ACLs to secure the Secrets' file location.
1. Apply volume-level encryption using [BitLocker](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server).
[RunAsUsername](/docs/tasks/configure-pod-container/configure-runasusername)
can be specified for Windows Pods or containers to execute the container
processes as a node-default user. This is roughly equivalent to
[RunAsUser](/docs/concepts/policy/pod-security-policy/#users-and-groups).
Linux-specific pod security context privileges such as SELinux, AppArmor, Seccomp, or capabilities (POSIX capabilities), and others are not supported.
Privileged containers are [not supported](#compatibility-v1-pod-spec-containers-securitycontext) on Windows.
## Getting help and troubleshooting {#troubleshooting}
Your main source of help for troubleshooting your Kubernetes cluster should start