The allocation and use of privileged access rights shall be restricted and managed.
We maintain a comprehensive list of users with their public SSH keys, managed through LinuxAid and Puppet for efficient access control. This ensures that only authorized SREs and Admins have privileged access, all configured via GitOps for transparency and automation.
Access to our Kubernetes clusters is governed by an RBAC mechanism, allowing us to assign specific permissions to users based on their roles across various environments (test/QA, production, development). We utilize Keycloak, Netbird to access these k8s clusters, and linux servers.
All other services require authentication through Keycloak, leveraging a standard user-password combination along with 2FA using YubiKeys. This adds an extra layer of protection for sensitive data.
Sensitive credentials in our self-hosted Gitea are stored securely using Password store. Only users whose GPG keys are authorized can decrypt these credentials, minimizing the risk of leakage and enhancing overall security.