Update netdata-kubernetes.md
Costa Tsaousis committed
Apr 21, 2025 at 01:50 UTC
2398c9999230c58483fca135b0403807bb893455
1 file changed
+16
docs/security-and-privacy-design/netdata-kubernetes.md
+16
@@ -265,6 +265,22 @@ flowchart TB
265
class Child agentGroup
266
```
267
268
+Netdata's design incorporates specific strategies aimed at mitigating practical attack vectors:
269
+
270
+#### Multiple Layers of Validation
271
+
272
+Any malicious request must pass rigorous input sanitization at multiple points, initially by the unprivileged parent and subsequently by the unprivileged child agent. This redundancy ensures a robust defense against attempts to exploit vulnerabilities via malformed inputs.
273
+
274
+#### Limited Plugin Interaction
275
+
276
+Privileged helpers (`local-listeners` and `cgroup-network`) execute predefined operations at specific events (startup and container creation respectively), not in response to dynamic external inputs. Consequently, these components cannot be externally manipulated by an attacker.
277
+
278
+Privileged plugins (`apps.plugin`, `network-viewer.plugin`, `systemd-journal.plugin`, and `debugfs.plugin`) perform strictly defined, hardcoded tasks, insulated from dynamic external influence. They merely respond to straightforward data-fetch requests.
279
+
280
+#### Functional Isolation
281
+
282
+Privileged plugins are structurally isolated, interacting with the broader system through highly controlled interfaces, thereby substantially reducing their susceptibility to injection or remote execution exploits.
283
+
284
## Configuration Strategies and Monitoring Scope
285
286
Administrators can configure Netdata `child` agents with varying levels of host access, directly impacting both the depth of observability achieved and the security posture of the deployment. Understanding the trade-offs associated with different configurations is essential for aligning Netdata with organizational security policies and monitoring requirements. We outline three primary approaches below: