docs(compliance): add CIS Benchmark, GDPR and DORA pages - #657
Merged
Conversation
Two more frameworks under Compliance, written the same way as the PCI DSS page: measured on a live cluster, with the commands to reproduce every claim. CIS Benchmark reports a full kube-bench run — 54 pass, 24 fail, 53 warn — and then does the work that makes the report usable: fifteen failures are file-mode checks against paths an immutable node does not keep, three test a flag that structured authorization replaced, two target components that are not installed, and four are real. Three of those four are deliberate platform decisions with their reasoning stated, and the page says what closing each one would cost. The audit-policy section deserves its own note. The obvious remedy for a Metadata-level policy is to raise everything to RequestResponse, and that is the wrong move: request bodies carry Secret values and personal data, so the audit log becomes a second copy of what it was meant to protect. The page recommends a per-resource split instead, which is also how the upstream reference policy handles Secrets. The PCI DSS page carried the naive advice and is corrected here. Kubernetes conformance explains what the CNCF suite proves and what it does not, points at the published results in cncf/k8s-conformance, and names the submitting entity and product rather than hinting at them — the project holds no listing of its own and says so. It also documents two traps found while running the suite here: the default systemd-logs plugin never finishes on Talos, and sonobuoy status can report zero progress while tests are completing. Trademark note: 'Certified Kubernetes' is licensed to a product, not to an upstream project, and the page carries that disclaimer. Signed-off-by: Timur Tukaev <timur.tukaev@aenix.io>
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…icated run GDPR and DORA complete the set of frameworks that were asked for. Both keep the frame the PCI DSS page set: a platform supplies measures, an organization holds the obligation, and the page says which is which. GDPR covers the Article 32 measures one at a time — where data physically sits, the three encryption layers and which of them are on by default, access control, tenant separation, restore. It spends most of its length on erasure, because that is where infrastructure and law actually collide: deleting a row is easy, deleting it from backups is not, and documented retention is the workable answer. It also warns that raising the audit policy to capture request bodies writes personal data into the audit log. DORA leads with ICT third-party risk, since that is the chapter where the choice of platform changes the answer rather than adding a checkbox: open source, own hardware, and an exit that can be rehearsed. Resilience features are listed with their limits, including the absence of automated VM failover after node loss. The Kubernetes conformance page is withdrawn for now. The certified-conformance run against the shared cluster hung after repeated failures of a single [sig-network] Services test, so there are no results worth publishing yet. It needs a dedicated cluster, and the page can follow the run. Signed-off-by: Timur Tukaev <timur.tukaev@aenix.io>
Timur Tukaev (tym83)
changed the title
…egal detail Two rounds of review, and both changed the pages substantially. The first was framing. Every page opened by naming a limitation — 'not certified', 'not something a platform can have', 'two dozen failures' — which is a defensive posture that reads as an apology before the reader knows what is being apologised for. The openings now state what the platform provides, and the caveats keep their place a paragraph later, where they inform rather than ambush. The merged PCI DSS page had the same problem and is corrected here. The second was legal accuracy, and it caught real errors: - GDPR mixed up the roles. Self-hosting makes you a controller for data whose purposes and means you determine, not a processor; a processor appears only where you host for someone else. The FAQ said the opposite. - 'Personal data encrypted at rest by default' was answered yes on the strength of secrets and backups, while the volumes that actually hold personal data are not encrypted unless you enable it. - Tenant network isolation was presented as separation of processing. It is not: control plane, etcd, LINSTOR and identity are shared, administrators cross every tenant, and platform backups share one bucket separated by path. - Article 32(1)(b) integrity was missing entirely, including the absence of intrusion detection and file-integrity monitoring. - Remote access from a third country is itself a transfer under the EDPB's reading, so self-hosting narrows Chapter V rather than closing it. - DORA promised redundant storage 'by default'; replication is a property of the StorageClass, and local classes exist. - DORA omitted that platform backups default to a bucket inside the cluster they protect, which meets neither Article 12(2) nor 12(3). - TLPT was tied to 'significant entities', a category DORA does not use, and a tenant copy was implied to substitute for tests Article 26 runs against live production. Also: the audit log is already a store of personal data at Metadata level, since it records usernames, groups and source addresses — it needs its own Article 30 entry regardless of policy level. Signed-off-by: Timur Tukaev <timur.tukaev@aenix.io>
Timur Tukaev (tym83)
marked this pull request as ready for review
August 18, 2026 14:01
Timur Tukaev (tym83)
requested review from
Andrei Kvapil (kvaps),
Timofei Larkin (lllamnyp) and
myasnikovdaniil
as code owners
August 18, 2026 14:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three more frameworks under
Compliance, written the same way as the PCI DSS page: measured on a live cluster where measurable, honest about the boundary between what the platform supplies and what the organization holds.The section now reads: PCI DSS · GDPR · CIS Benchmark · DORA.
CIS Benchmark
A full kube-bench run — 54 pass, 24 fail, 53 warn — followed by the work that makes such a report usable. Fifteen failures are file-mode checks against paths an immutable node does not keep, three test a flag that structured authorization replaced, two target components that are not installed, and four are real.
Three of the four are deliberate platform decisions; the page states the reasoning and what closing each would cost. It also warns that the benchmark's own remediation is wrong twice over here:
--bind-address=127.0.0.1breaks metrics collection, and setting--kubelet-certificate-authoritywithoutserverTLSBootstrapbreakskubectl logs.GDPR
The Article 32 measures one at a time — data residency, the three encryption layers and which are on by default, access control, tenant separation, restore — and a longer section on erasure, where infrastructure and law actually collide. Deleting a row is easy; deleting it from backups is not, and documented retention is the position that survives scrutiny.
DORA
Leads with ICT third-party risk, the chapter where the choice of platform changes the answer rather than adding a checkbox: open source, own hardware, an exit that can be rehearsed. Resilience features are listed with their limits, including the absence of automated VM failover after node loss.
A correction that touches the PCI DSS page
The obvious remedy for a
Metadata-level audit policy is to raise everything toRequestResponse. That is wrong: request bodies carry Secret values and personal data, so the audit log becomes a second copy of what it was meant to protect — and under GDPR, a new liability. All pages now recommend a per-resource split, which is how the upstream reference policy treats Secrets. This corrects advice that shipped in the merged PCI DSS page, hence the change to that file here.Not included: Kubernetes conformance
A page was written and then withdrawn. The
certified-conformancerun against the shared cluster hung after a single[sig-network] Servicestest failed repeatedly on timeout, so there are no results worth publishing. It needs a dedicated cluster; the page can follow the run.Two findings from that attempt are worth keeping for whoever picks it up: the default
systemd-logsplugin never finishes on Talos and has to be excluded with--plugin e2e, andsonobuoy statuscan report zero progress while tests are completing, so the e2e pod log is the only reliable signal.Follow-up, not in this PR
The blog post
2025-06-06-cozystack-became-a-certified-kubernetes-platform.mdstates that "Cozystack has achieved Certified Kubernetes Platform status". "Certified Kubernetes" is licensed to a product at a version, not to an upstream project. Worth correcting separately.Review
Each page went through a domain review against the live cluster and a language and search pass. The domain reviews are what produced the scope statements, the maintainer rationale behind the four CIS findings, and the audit-policy correction above.