Distroless K8s Operator
Kubernetes controller for automated zero-privilege container hardening.
System Overview & Motivation
Distroless K8s Operator is a cloud-native security automation controller built using the Kubebuilder framework. It intercepts pod creation requests, validates security contexts against CIS benchmarks, and automatically patches manifests with read-only root filesystems, non-root user IDs, and dropped Linux capabilities.
Key Architectural Highlights
- Dynamic Mutating and Validating Admission Webhook controller written in Go
- Enforces NSA/CISA Kubernetes Hardening Guidance out of the box
- Automated migration from bloated base images to GoogleContainerTools distroless containers
- Generates continuous cluster compliance audit reports in Prometheus format
- Integrated with cert-manager for automated webhook TLS certificate rotation
Technical Architecture & Data Pipeline
The Kubernetes API server invokes the operator's mutating webhook on pod creation. The controller inspects `securityContext` parameters, applies hardening patches, and logs admissions to a structured audit topic.
Production Challenges & Edge Cases Solved
Preventing breaking legacy workloads that legitimately require write access to specific directories. Solved by introducing selective ephemeral volume mounting and granular namespace annotation overrides.