This subsection describes the architecture of the Security subsystem of Deckhouse Platform (DP).
The Security subsystem includes the following modules:
admission-policy-engine: Lets you use security policies in the cluster according to Kubernetes Pod Security Standards. The module uses Gatekeeper to enforce these policies.runtime-audit-engine: Implements runtime audit (threat detection based on Linux kernel events and Kubernetes API audit events using Falco). The architecture is described in “Runtime audit”.security-events-manager: Performs declarative collection, processing, normalization, and delivery of security events from logs of applications and Kubernetes infrastructure components. The architecture is described in “Security events”.operator-trivy: Performs periodic vulnerability scanning of the DP cluster.cert-manager: Manages TLS certificates in the cluster.secrets-store-integration: Delivers secrets to Kubernetes applications by integrating secrets, keys, and certificates stored in external secret stores.secret-copier: Automatically copies secrets to cluster namespaces.