Skip to content

security-guide.md

Latest commit

 

History

History
140 lines (109 loc) · 11 KB

security-guide.md

File metadata and controls

140 lines (109 loc) · 11 KB
sidebar_position 3
title Deployment Security Guide
description Security configuration inventory, deployment responsibilities, and considerations for the Physical AI Toolchain
author Microsoft Robotics-AI Team
ms.date 2026-02-10
ms.topic concept
keywords
security
deployment
network
identity
kubernetes

Security configurations included in this reference architecture and responsibilities for teams operating in production environments.

Important

This document provides security guidance for informational purposes only. It does not constitute professional security advice and is not a substitute for your own security assessment. This reference architecture is licensed under the MIT License, provided "AS IS" without warranty of any kind. You are solely responsible for the security of your deployment, including configuration, operational practices, and compliance with applicable regulations. The project maintainers accept no liability for security incidents arising from the use of this architecture. Refer to official Azure security documentation for authoritative, current guidance.

Security Configuration Included in This Architecture

This architecture ships with these security configurations enabled by default. They represent a reasonable starting point for development and testing, not a production-ready security posture.

Network Security

Configuration Default Reference
Private AKS cluster Enabled by default (Terraform variable) AKS private cluster
Azure CNI networking Enabled Azure CNI overview
Network policy support Enabled AKS network policies
NAT Gateway for egress Configured AKS outbound connectivity

Identity and Access

Configuration Default Reference
Managed identities User-assigned for AKS AKS managed identity
Workload identity Federated credentials for OSMO AKS workload identity
Entra ID integration RBAC enabled AKS Entra integration

Secret Management

Configuration Default Reference
Azure Key Vault CSI driver configured Key Vault CSI driver
Terraform state Local backend (not encrypted) Terraform Azure backend

Container Security

Configuration Default Reference
Microsoft Defender Configurable (should_enable_microsoft_defender) Defender for Containers
Azure Policy for AKS Enabled Azure Policy for AKS

Kubernetes Security

Configuration Default Reference
RBAC Enabled AKS RBAC
Pod security Default namespace policies Pod security standards

Your Deployment Responsibilities

Before Deployment

  • Conduct a security assessment for your target environment
  • Review all Terraform variables and override defaults inappropriate for your security posture
  • Evaluate network topology (private vs. public endpoints) for your requirements
  • Establish secret management policies (rotation schedules, access controls)
  • Verify Azure subscription security baselines (Azure Policy, Defender for Cloud)

During Operation

  • Monitor AKS cluster security events through Azure Monitor
  • Review Kubernetes RBAC bindings and service account permissions
  • Manage container image provenance and vulnerability scanning
  • Maintain network policy definitions appropriate for running workloads

Ongoing Maintenance

  • Update Terraform provider versions and module references
  • Patch base container images and NVIDIA runtime components
  • Review Azure Advisor security recommendations
  • Reassess security posture when adding workloads or scaling

Security Considerations Checklist

Note

This checklist highlights common security considerations for Azure and Kubernetes deployments. It is not exhaustive. Your organization's security requirements, compliance obligations, and threat model determine the complete set of controls you need.

Category Consideration Reference
Network Evaluate private vs. public AKS API server AKS private cluster
Network Define Kubernetes network policies for workload isolation AKS network policies
Identity Review managed identity permissions and scope AKS managed identity
Identity Verify workload identity audience restrictions Workload identity
Secrets Configure Key Vault access policies and rotation Key Vault rotation
Secrets Migrate Terraform state to a remote encrypted backend Terraform Azure backend
Compute Enable Defender for Containers (should_enable_microsoft_defender) Defender for Containers
Compute Scan container images for vulnerabilities Container image scanning
Monitoring Enable diagnostic settings on AKS and Key Vault AKS diagnostics
Compliance Review Azure compliance offerings for your industry Azure compliance

Terraform State Security

This architecture uses a local Terraform state backend by default. Local state stores infrastructure details including resource IDs, network addresses, and configuration values in an unencrypted file on disk.

For team environments or production deployments, consider migrating to a remote backend with encryption. Refer to the Terraform Azure backend documentation for configuration details.

References

Resource Description
Azure security documentation Authoritative security guidance for Azure services
AKS baseline architecture Production-ready AKS security and networking patterns
Azure compliance documentation Compliance offerings and certifications
Terraform Azure backend Remote state backend configuration
Threat Model STRIDE-based threat analysis and remediation roadmap
Contributing security review Contributor security checklist for pull requests

🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.