Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.
Our use of a self-hosted Gitea setup via KubeAid allows us full authority over our code and data. This arrangement ensures that we can tailor our access policies to meet our specific security requirements.
We safeguard our Gitea environment with Basic Authentication, complemented by Keycloak for identity management. The implementation of two-factor authentication using YubiKeys adds an additional layer of security, ensuring that access is granted only to verified users.
Our approach to access restriction is built upon a clear, well-defined policy. This includes managing access to Linux servers and Kubernetes clusters, where permissions are carefully allocated to prevent unauthorized use.
By leveraging Keycloak's centralized user identity management and employing role-based access control (RBAC) for our Kubernetes environment, we ensure that users are granted only the permissions necessary for their roles, upholding the principle of least privilege.
Sensitive credentials are stored securely utilizing Password store, permitting only users with the correct GPG keys to access them. This method not only protects against unauthorized access but also mitigates the risk of credential exposure.