security hardening

[ReSearchITEng]

• 1. Adopt operator for setting the policies: https://github.com/nirmata/kyverno/blob/master/samples/README.md
• 2. Add additional flags at kubeadm installation time/post install, based on https://www.stackrox.com/post/2019/09/12-kubernetes-configuration-best-practices/
• 3. Post deploy security tests: https://github.com/aquasecurity/kube-bench
• 4. https://blog.sighup.io/announcing-gatekeeper-policy-manager/ viewer

kubectl delete --ignore-not-found --all --now ns aqua-kube-bench
sleep 1
kubectl create ns aqua-kube-bench
kubectl -n aqua-kube-bench apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/master/job.yaml
kubectl -n aqua-kube-bench logs -f $(kubectl -n aqua-kube-bench get po -o jsonpath='{.items[0].metadata.name}')

• 5. when provide workarounds for the kubelet self-signed serving certificate kubernetes/kubeadm#1602 will be fixed, update metrics-server helm flags (v1.19)