Security best practices for Lynq.

[[toc]]

Always use Kubernetes Secrets for sensitive data:

apiVersion: v1
kind: Secret
metadata:
  name: mysql-credentials
  namespace: default
type: Opaque
stringData:
  password: your-secure-password

Reference in LynqHub:

spec:
  source:
    mysql:
      passwordRef:
        name: mysql-credentials
        key: password

::: danger Credential safety Never hardcode credentials in CRDs or templates. Always reference Kubernetes Secrets. :::

1. Update Secret:

kubectl create secret generic mysql-credentials \
  --from-literal=password=new-password \
  --dry-run=client -o yaml | kubectl apply -f -

2. Operator automatically detects change and reconnects.

The operator requires:

CRD Management:

• lynqhubs, lynqforms, lynqnodes: All verbs

Resource Management:

• Managed resources (Deployments, Services, etc.): All verbs in target namespaces
• namespaces: Create, list, watch, get (cluster-scoped)

Supporting Resources:

• events: Create, patch
• leases: Get, create, update (for leader election)
• secrets: Get, list, watch (for credentials, namespace-scoped)

Scope RBAC to specific namespaces when possible:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role  # Not ClusterRole
metadata:
  name: lynq-role
  namespace: production  # Specific namespace
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["*"]

Default service account: lynq-controller-manager

Custom service account:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: custom-sa
  namespace: lynq-system
---
apiVersion: v1
kind: Pod
spec:
  serviceAccountName: custom-sa

::: details Work in progress Document recommended namespace isolation models and network policies. :::

Avoid storing sensitive data in database columns. Instead:

1. Store only references:

-- Good
api_key_ref = "secret-acme-api-key"

-- Bad
api_key = "sk-abc123..."

2. Reference Secrets in templates:

env:
- name: API_KEY
  valueFrom:
    secretKeyRef:
      name: "{{ .uid }}-secrets"
      key: api-key

Configure Kubernetes audit policy:

# audit-policy.yaml
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
  resources:
  - group: "operator.lynq.sh"
    resources: ["lynqhubs", "lynqforms", "lynqnodes"]

Monitor events:

kubectl get events --all-namespaces | grep LynqNode

Configure deletion policies for compliance:

persistentVolumeClaims:
  - id: data
    deletionPolicy: Retain  # Keep data after node deletion

Use CreationPolicy: Once for audit resources:

configMaps:
  - id: audit-log
    creationPolicy: Once  # Never update

Scan operator images:

# Using Trivy
trivy image ghcr.io/k8s-lynq/lynq:latest

# Using Snyk
snyk container test ghcr.io/k8s-lynq/lynq:latest

Keep dependencies updated:

# Update Go dependencies
go get -u ./...
go mod tidy

# Check for vulnerabilities
go list -json -m all | nancy sleuth

1. Never hardcode credentials - Use Secrets with SecretRef
2. Enforce least privilege - Scope RBAC to specific namespaces
3. Apply security contexts - Run as non-root, drop capabilities
4. Enable audit logging - Track all CRD changes
5. Scan container images - Regular vulnerability scanning
6. Rotate credentials - Regular password rotation
7. Apply network policies - Isolate node traffic
8. Enforce resource quotas - Prevent resource exhaustion

• Configuration Guide
• Installation Guide
• RBAC Documentation