Deployment Security Guide
Security configurations included in this reference architecture and responsibilities for teams operating in production environments.
[!IMPORTANT] This document provides security guidance for informational purposes only. It does not constitute professional security advice and is not a substitute for your own security assessment. This reference architecture is licensed under the MIT License, provided "AS IS" without warranty of any kind. You are solely responsible for the security of your deployment, including configuration, operational practices, and compliance with applicable regulations. The project maintainers accept no liability for security incidents arising from the use of this architecture. Refer to official Azure security documentation for authoritative, current guidance.
Security Configuration Included in This Architecture
This architecture ships with these security configurations enabled by default. They represent a reasonable starting point for development and testing, not a production-ready security posture.
Network Security
| Configuration | Default | Reference |
|---|---|---|
| Private AKS cluster | Enabled by default (Terraform variable) | AKS private cluster |
| Azure CNI networking | Enabled | Azure CNI overview |
| Network policy support | Enabled | AKS network policies |
| NAT Gateway for egress | Configured | AKS outbound connectivity |
Identity and Access
| Configuration | Default | Reference |
|---|---|---|
| Managed identities | User-assigned for AKS | AKS managed identity |
| Workload identity | Federated credentials for OSMO | AKS workload identity |
| Entra ID integration | RBAC enabled | AKS Entra integration |
Secret Management
| Configuration | Default | Reference |
|---|---|---|
| Azure Key Vault | CSI driver configured | Key Vault CSI driver |
| Terraform state | Local backend (not encrypted) | Terraform Azure backend |
Container Security
| Configuration | Default | Reference |
|---|---|---|
| Microsoft Defender | Configurable (should_enable_microsoft_defender) | Defender for Containers |
| Azure Policy for AKS | Enabled | Azure Policy for AKS |
Kubernetes Security
| Configuration | Default | Reference |
|---|---|---|
| RBAC | Enabled | AKS RBAC |
| Pod security | Default namespace policies | Pod security standards |
Your Deployment Responsibilities
Before Deployment
- Conduct a security assessment for your target environment
- Review all Terraform variables and override defaults inappropriate for your security posture
- Evaluate network topology (private vs. public endpoints) for your requirements
- Establish secret management policies (rotation schedules, access controls)
- Verify Azure subscription security baselines (Azure Policy, Defender for Cloud)
During Operation
- Monitor AKS cluster security events through Azure Monitor
- Review Kubernetes RBAC bindings and service account permissions
- Manage container image provenance and vulnerability scanning
- Maintain network policy definitions appropriate for running workloads
Ongoing Maintenance
- Update Terraform provider versions and module references
- Patch base container images and NVIDIA runtime components
- Review Azure Advisor security recommendations
- Reassess security posture when adding workloads or scaling
Security Considerations Checklist
[!NOTE] This checklist highlights common security considerations for Azure and Kubernetes deployments. It is not exhaustive. Your organization's security requirements, compliance obligations, and threat model determine the complete set of controls you need.
| Category | Consideration | Reference |
|---|---|---|
| Network | Evaluate private vs. public AKS API server | AKS private cluster |
| Network | Define Kubernetes network policies for workload isolation | AKS network policies |
| Identity | Review managed identity permissions and scope | AKS managed identity |
| Identity | Verify workload identity audience restrictions | Workload identity |
| Secrets | Configure Key Vault access policies and rotation | Key Vault rotation |
| Secrets | Migrate Terraform state to a remote encrypted backend | Terraform Azure backend |
| Compute | Enable Defender for Containers (should_enable_microsoft_defender) | Defender for Containers |
| Compute | Scan container images for vulnerabilities | Container image scanning |
| Monitoring | Enable diagnostic settings on AKS and Key Vault | AKS diagnostics |
| Compliance | Review Azure compliance offerings for your industry | Azure compliance |
Terraform State Security
This architecture uses a local Terraform state backend by default. Local state stores infrastructure details including resource IDs, network addresses, and configuration values in an unencrypted file on disk.
For team environments or production deployments, consider migrating to a remote backend with encryption. Refer to the Terraform Azure backend documentation for configuration details.
References
| Resource | Description |
|---|---|
| Azure security documentation | Authoritative security guidance for Azure services |
| AKS baseline architecture | Production-ready AKS security and networking patterns |
| Azure compliance documentation | Compliance offerings and certifications |
| Terraform Azure backend | Remote state backend configuration |
| Threat Model | STRIDE-based threat analysis and remediation roadmap |
| Contributing security review | Contributor security checklist for pull requests |
🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.