Abstract:The CMSWEB cluster is pivotal to the activities of the Compact Muon Solenoid (CMS) experiment, as it hosts critical services required for the operational needs of the CMS experiment. The security of these services and the corresponding data is crucial to CMS. Any malicious attack can compromise the availability of our services. Therefore, it is important to construct a robust security infrastructure. In this work, we discuss new security features introduced to the CMSWEB Kubernetes ("k8s") cluster. The new features include the implementation of network policies, deployment of Open Policy Agent (OPA), enforcement of OPA policies, and the integration of Vault. The network policies act as an inside-the-cluster firewall to limit the network communication between the pods to the minimum necessary, and its dynamic nature allows us to work with microservices. The OPA validates the objects against some custom-defined policies during create, update, and delete operations to further enhance security. Without recompiling or changing the configuration of the Kubernetes API server, it can apply customized policies on Kubernetes objects and their audit functionality enabling us to detect pre-existing conflicts and issues. Although Kubernetes incorporates the concepts of secrets, they are only base64 encoded and are not dynamically configured. This is where Vault comes into play: Vault dynamically secures, stores, and tightly controls access to sensitive data. This way, the secret information is encrypted, secured, and centralized, making it more scalable and easier to manage. Thus, the implementation of these three security features corroborate the enhanced security and reliability of the CMSWEB Kubernetes infrastructure.

Securing a HENP Computing Facility

HPC with Enhanced User Separation

Enhancing HPC Security with a User-Based Firewall

Securing HPC using Federated Authentication

Supporting secure collaborative computing in grid environments

HEPCloud, a New Paradigm for HEP Facilities: CMS Amazon Web Services Investigation

US ATLAS and US CMS HPC and Cloud Blueprint

Design of the Personnel Radiation Safety Interlock System for High Intensity D–T Fusion Neutron Generator

Development of a HIPAA-compliant environment for translational research data and analytics

Security Testbed for Preempting Attacks against Supercomputing Infrastructure

Novel Design of a Personnel Safety System for Hefei Light Source-II

Implementation of New Security Features in CMSWEB Kubernetes Cluster at CERN

A Security Monitoring Framework For Virtualization Based HEP Infrastructures

Leveraging OpenStack and Ceph for a Controlled-Access Data Cloud

Autonomous Security Mechanisms for High-Performance Computing Systems: Review and Analysis

Analysis Facilities for HL-LHC

Advancements of Cyber Security of Nuclear Power Plants

A Modern Approach to Securing Critical Infrastructure in Energy Transmission Networks: Integration of Cryptographic Mechanisms and Biometric Data

High-Security Hardware Module with PUF and Hybrid Cryptography for Data Security

Supporting High-Performance and High-Throughput Computing for Experimental Science

Integrating Security Solutions to Support nanoCMOS Electronics Research