fluxcd / flux2

Security for https://github.com/fluxcd/flux2/

Discussion on the security features and protocols in Flux v2, including authentication, authorization, and encryption.

What is Security?

According to the Flux documentation (https://docs.fluxcd.io/en/latest/security/), FluxCD’s GitOps workflow tool, Flux v2, includes several security features to ensure the secure deployment and management of applications.

Why is Security important?

As stated in the Flux documentation (https://docs.fluxcd.io/en/latest/security/), “Security is a critical aspect of any production system. FluxCD provides several features to help secure your deployments.”

Authentication

Flux v2 supports several authentication methods, including:

  1. GitHub: Flux can be configured to use GitHub for authentication. This can be done by setting the github.token secret in the Flux configuration file. For more information, see the Flux documentation on GitHub authentication.
  2. GitLab: Flux can also be configured to use GitLab for authentication. This can be done by setting the gitlab.token secret in the Flux configuration file. For more information, see the Flux documentation on GitLab authentication.
  3. OIDC: Flux supports OpenID Connect (OIDC) for authentication. This can be configured by setting the oidc.clientID, oidc.issuerURL, and oidc.secret secrets in the Flux configuration file. For more information, see the Flux documentation on OIDC authentication.

Authorization

Flux v2 includes several authorization features, including:

  1. Kubernetes RBAC: Flux can be configured to use Kubernetes Role-Based Access Control (RBAC) for authorization. This can be done by creating Kubernetes roles and role bindings. For more information, see the Flux documentation on Kubernetes RBAC.
  2. GitHub Teams: Flux can be configured to use GitHub Teams for authorization. This can be done by setting up GitHub teams and their corresponding members. For more information, see the Flux documentation on GitHub Teams.
  3. GitLab Groups: Flux can also be configured to use GitLab Groups for authorization. This can be done by setting up GitLab groups and their corresponding members. For more information, see the Flux documentation on GitLab Groups.

Encryption

Flux v2 includes several encryption features, including:

  1. TLS: Flux supports Transport Layer Security (TLS) for secure communication between the Flux controller and the Kubernetes API server. This can be configured by setting the tls.cert and tls.key secrets in the Flux configuration file. For more information, see the Flux documentation on TLS encryption.
  2. Encrypted Secrets: Flux supports encrypted secrets for storing sensitive information, such as passwords and API keys. This can be done by encrypting the secret data using a tool like kubeseal or sops. For more information, see the Flux documentation on Encrypted Secrets.