How deeply does Google Anthos in Action cover security policy?

Explains policy rationale and container privilege consequences, but stops short of an exhaustive organization-specific policy set.

Security policy

As explained in Google Anthos in Action

A security policy is a set of rules governing the protection of systems, applications, and data from unauthorized access or harmful activity.

A security policy is a set of enforceable rules that reduces unauthorized access, service disruption, and exploitable attack paths across systems and workloads. section 7.4 section 13.3.2

In Kubernetes and hybrid environments, effective policies address:

Data locality, monitoring, auditing, and compliance requirements for regulated applications. section 7.4
Deployment access, workload configuration, and automatic controls that limit service-disrupting changes. section 13.3.2
Container identity and privilege, especially whether processes run as root and whether privileged mode is enabled. section 13.6

Restricting container host access

Treat the container user and privileged setting as separate decisions. A root container without privileged mode receives no host permissions, while privileged mode can provide root host access. section 13.6

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

policy enforcementused by · Policy enforcement is the application of defined rules and controls to permit, prevent, or constrain actions and behavior in accordance with requirements.
privacy policyincludes · A statement or set of rules describing how an organization collects, uses, stores, shares, retains, or protects personal information.
password policyincludes · A password policy is a set of rules governing password creation, strength, use, protection, reuse, changes, and retirement.
acceptable use policyincludes · An acceptable use policy is an organizational set of rules specifying permitted and prohibited uses of technology, information systems, assets, or services.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.