castai-security-basics

# CAST AI Security Basics ## Overview Secure your CAST AI integration: API key management, RBAC least-privilege, Kvisor runtime security agent, and network policy configuration. ## Prerequisites - CAST AI agent installed on cluster - Cluster admin access for RBAC configuration - Secrets manager (AWS Secrets Manager, Vault, etc.) ## Instructions ### Step 1: API Key Management ```bash # Use separate keys per environment # console.cast.ai > API > API Access Keys # Development: Read-Only key (monitoring only) # Staging: Full Access key with limited cluster scope # Production: Full Access key, rotated every 90 days # Store in secrets manager, never in code aws secretsmanager create-secret \ --name "castai/prod/api-key" \ --secret-string "${CASTAI_API_KEY}" # Rotate key procedure: # 1. Generate new key in console # 2. Update secrets manager # 3. Restart CAST AI agent pods to pick up new key # 4. Verify agent reconnects # 5. Revoke old key in console ``` ### Step 2: RBAC Least-Privilege Review ```bash # Audit CAST AI ClusterRoles kubectl get clusterroles -l app.kubernetes.io/managed-by=castai -o yaml # The CAST AI agent needs these minimum permissions: # - get/list/watch: pods, nodes, events, namespaces, replicasets # - get: persistentvolumes, storageclasses # The cluster controller additionally needs: # - create/delete: nodes (for autoscaling) # - patch: pods/eviction (for evictor) # Check for overly broad permissions kubectl auth can-i --list --as=system:servicea...