Security and compliance validation

[Akatuoro]

Description

Add tooling to visualize insecure or non-compliant configurations and workloads. The validation needs to be possible for the whole cluster and can also be shown as warning when creating resources. Since security and compliance needs differ for applications, the rules need to be configurable.

Reasons

Keeping the Kyma runtime cluster secure and compliant is an important but sometimes not easy activity. Even if Kyma is shipping the cluster secure by default, the responsibility to keep it secure is on the user side. On application side, there may also be non-compliant or insecure configuration changes, e.g. when new features are introduced.
Validation tooling can help visualize and give a report on whether the cluster is secure and whether it complies with specific standards.

Tasks

• This is a core functionality that needs to have in mind performance and try not to choke the API server.
  • We evaluate the use of javascript workers, to allow background work
  • We evaluate the use of a queue, that allows the control of requests. The concurrency will be configurable allowing for at least 2 options: aggressive/active scan or background scan
  • It's acceptable that between scans the resource can change and we don't capture that. There is no need for a watch the resource approach
  • Evaluate the possibility of using an in-memory DB that can be used as a cache and also as a source for the workers.
  • Various workers ( that can run different rulesets ) can run at different intervals.

[kyma-bot]

This issue or PR has been automatically marked as stale due to the lack of recent activity.
Thank you for your contributions.

This bot triages issues and PRs according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 7d of inactivity since lifecycle/stale was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Close this issue or PR with /close

If you think that I work incorrectly, kindly raise an issue with the problem.

/lifecycle stale