---
# System prepended metadata

title: "cluster onboardingprod-abc\nst"

---

```
cluster onboarding
prod-abc
stage-123
PSA default configuration
add default policy with exemptions
1. Namespace
---
apiVersion: "accuknox.com/v1"
kind: AccuKnoxPolicyConfig
metadata:
  name: "global-policy-1"
spec:
  selector:
    - clustername: "*"
    - namespace: "workloads-*"
  exemption-selector:
    - clustername: "prod-management"
  exemption-selector:
    - namespace: "kube-system"
  securityPosture:
    fileProcess: audit
    processBasedNetwork: block
  visibility:
    process: true
    file: false
    network: true
  podSecurityAdmission:
    mode: audit
    level: baseline
---
apiVersion: "accuknox.com/v2"
kind: AccuKnoxClusterWidePolicy
metadata:
  name: "global-policy-1"
spec:
- cluster:
  selector:
    - name: "stage-*"
    - namespace: "*"
  exemption-selector:
    - namespace: "kube-system"
  securityPosture:
    fileProcess: block
    processBasedNetwork: block
  podSecurityAdmission:
---
Namespace | mode | level
kube-system | NA | NA
workloads-* | enforce | baseline
VM / ECS / ...
```


- PSA
  - mode 
  - level
- set default kubearmor hardening policies
  - mitre/cis/nist
     - select individual policies
     - exclude kube-system
  - exclude kube-system
  - include 
  - UI Under Policies->Hardening
    - Deployment ABC
        - Show the Policy
    - Deployment XYZ
        - Warn user that Deployment is in exclude list/not in include it
- set default network policies
- set default visibility for KubeArmor
- set default posture for KubeArmor
- create admission controller hardening policies
  - allow images from a specific sources
  - only allow images which don't have critical vulnerabilities
- hardening operator
  - stig/cis/k8tls/kiem
  - 


- Priority Handling
- Default Config for Tenant
- Cluster Specific Config
  - Support Regex? Because Clusters can be ephemeral

GitOps vs Admission Controller?
- What if resources are strictly controlled through GitOps

![PXL_20240126_111634685](https://hackmd.io/_uploads/H1mlTCg3a.jpg)
