Typhoon aims to be minimal and secure. We're running it ourselves after all.
- etcd with peer-to-peer and client-auth TLS
- Kubelets TLS bootstrap certificates (72 hours)
- Generated TLS certificate (365 days) for admin
- NodeRestriction is enabled to limit Kubelet authorization
- Role-Based Access Control is enabled. Apps must define RBAC policies for API access
- Workloads run on worker nodes only, unless they tolerate the master taint
- Kubernetes Network Policy and Calico NetworkPolicy support 1
- Container Linux auto-updates are enabled
- Hosts limit logins to SSH key-based auth (user "core")
- SELinux enforcing mode 2
- Cloud firewalls limit access to ssh, kube-apiserver, and ingress
- No cluster credentials are stored in Matchbox (used for bare-metal)
- No cluster credentials are stored in Digital Ocean metadata
- Cluster credentials are stored in AWS metadata (for ASGs)
- Cluster credentials are stored in Azure metadata (for scale sets)
- Cluster credentials are stored in Google Cloud metadata (for managed instance groups)
- No account credentials are available to Digital Ocean droplets
- No account credentials are available to AWS EC2 instances (no IAM permissions)
- No account credentials are available to Azure instances (no IAM permissions)
- No account credentials are available to Google Cloud instances (no IAM permissions)
Typhoon limits exposure to many security threats, but it is not a silver bullet. As usual,
- Do not run untrusted images or accept manifests from strangers
- Do not give untrusted users a shell behind your firewall
- Define network policies for your namespaces
Typhoon uses upstream container images (where possible) and upstream binaries.
kubelet as a binary for distros to package, either as a DEB/RPM on traditional distros or as a container image for container-optimized operating systems.
The Kubelet image is published to Quay.io and Dockerhub.
Two tag styles indicate the build strategy used.
- Typhoon internal infra publishes single and multi-arch images (e.g.
- Quay automated builds publish verifiable images (e.g.
The Typhoon-built Kubelet image is used as the official image. Automated builds provide an alternative image for those preferring to trust images built by Quay (albeit lacking multi-arch). To use the fallback registry or an alternative tag, see customization.
Typhoon packages the flannel-cni container image to provide security patches.
- quay.io/poseidon/flannel-cni (official)
Typhoon publishes Terraform providers to the Terraform Registry, GPG signed by 0x8F515AD1602065C8.
If you find security issues, please email
firstname.lastname@example.org. If the issue lies in upstream Kubernetes, please inform upstream Kubernetes as well.