# IT-SiG 2.0 Mapping auf Kubernetes-Konfiguration
apiVersion: v1
kind: ConfigMap
metadata:
  name: it-sig-compliance-mapping
  namespace: kritis-compliance
data:
  requirements.yaml: |
    it-sig-2.0:
      # §8a BSIG - Angriffserkennung
      attack-detection:
        kubernetes-solution: "Falco, Tetragon, Network Policies"
        implementation: "runtime-security, audit-logging"

      # §8a BSIG - Meldepflichten
      incident-reporting:
        kubernetes-solution: "AlertManager, PagerDuty, BSI-Portal-Integration"
        sla: "unverzüglich, spätestens 72h"

      # §8b BSIG - Prüfungen
      audits:
        kubernetes-solution: "Audit-Logs, SIEM-Integration"
        frequency: "alle 2 Jahre"

      # §8c BSIG - Stand der Technik
      state-of-art:
        kubernetes-solution: "BSI IT-Grundschutz, ISO 27001"
        container-hardening: "CIS Benchmarks"

# Falco für Runtime Security in KRITIS
apiVersion: v1
kind: ConfigMap
metadata:
  name: falco-rules-kritis
  namespace: security
data:
  kritis-rules.yaml: |
    - rule: KRITIS Critical Process Modification
      desc: Detect modifications to critical KRITIS processes
      condition: >
        spawned_process and
        container and
        container.image.repository contains "kritis" and
        (proc.name in (critical_process_list) or
         proc.cmdline contains "systemctl" or
         proc.cmdline contains "service")
      output: >
        KRITIS Critical: Process modification detected
        (user=%user.name container=%container.name
        image=%container.image.repository
        command=%proc.cmdline)
      priority: CRITICAL
      tags: [kritis, it-sig-2.0, attack-detection]

    - rule: KRITIS Unauthorized Network Connection
      desc: Detect unauthorized outbound connections from KRITIS systems
      condition: >
        outbound and
        container and
        container.image.repository contains "kritis" and
        not fd.sip in (allowed_ips)
      output: >
        KRITIS Alert: Unauthorized network connection
        (container=%container.name dest=%fd.sip:%fd.sport)
      priority: WARNING
      tags: [kritis, network, exfiltration]

    - rule: KRITIS Crypto Mining Detection
      desc: Detect potential cryptomining in KRITIS environment
      condition: >
        spawned_process and
        container and
        (proc.name in (miner_process_names) or
         proc.cmdline contains "stratum" or
         proc.cmdline contains "mining")
      output: >
        KRITIS Critical: Potential cryptomining detected
        (container=%container.name command=%proc.cmdline)
      priority: CRITICAL
      tags: [kritis, cryptomining, attack]
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: security
spec:
  selector:
    matchLabels:
      app: falco
  template:
    metadata:
      labels:
        app: falco
    spec:
      serviceAccountName: falco
      hostNetwork: true
      hostPID: true
      containers:
        - name: falco
          image: falcosecurity/falco:0.37.0
          securityContext:
            privileged: true
          volumeMounts:
            - name: dev
              mountPath: /host/dev
            - name: proc
              mountPath: /host/proc
              readOnly: true
            - name: rules
              mountPath: /etc/falco/rules.d
          env:
            - name: FALCO_BPF_PROBE
              value: ""
      volumes:
        - name: dev
          hostPath:
            path: /dev
        - name: proc
          hostPath:
            path: /proc
        - name: rules
          configMap:
            name: falco-rules-kritis

# KRITIS Namespace-Struktur für Energieversorger
apiVersion: v1
kind: Namespace
metadata:
  name: scada-integration
  labels:
    kritis-sector: "energy"
    kritis-category: "electricity-distribution"
    security-zone: "ot-integration"
    data-classification: "critical"
  annotations:
    bsi.kritis/registration: "BSI-2024-ENERGY-12345"
    bsi.kritis/last-audit: "2025-06-15"
    bsi.kritis/next-audit: "2027-06-15"
    it-sig/attack-detection: "enabled"
---
apiVersion: v1
kind: Namespace
metadata:
  name: smart-meter-backend
  labels:
    kritis-sector: "energy"
    security-zone: "backend"
---
apiVersion: v1
kind: Namespace
metadata:
  name: grid-analytics
  labels:
    kritis-sector: "energy"
    security-zone: "analytics"

# Strikte Network Policies für OT-Integration
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: scada-isolation
  namespace: scada-integration
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Nur vom OT-Gateway
    - from:
        - ipBlock:
            cidr: 10.100.0.0/24  # OT-Netzwerk
      ports:
        - protocol: TCP
          port: 502   # Modbus
        - protocol: TCP
          port: 20000 # DNP3
  egress:
    # Nur zum internen Backend
    - to:
        - namespaceSelector:
            matchLabels:
              name: smart-meter-backend
      ports:
        - protocol: TCP
          port: 8443
    # Logging für Audit
    - to:
        - namespaceSelector:
            matchLabels:
              name: logging
      ports:
        - protocol: TCP
          port: 514
---
# Default Deny für alle anderen Namespaces
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: scada-integration
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

# Smart Meter Backend mit Hochverfügbarkeit
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: meter-data-processor
  namespace: smart-meter-backend
spec:
  serviceName: meter-processor
  replicas: 5
  template:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: meter-processor
              topologyKey: "topology.kubernetes.io/zone"
      containers:
        - name: processor
          image: smart-meter-processor:v3.0@sha256:...
          resources:
            requests:
              cpu: "2"
              memory: "8Gi"
            limits:
              cpu: "4"
              memory: "16Gi"
          env:
            - name: PROCESSING_MODE
              value: "real-time"
            - name: MAX_LATENCY_MS
              value: "100"
            - name: ENCRYPTION
              value: "AES-256-GCM"
          ports:
            - containerPort: 8443
              name: https
          volumeMounts:
            - name: meter-data
              mountPath: /var/meter-data
  volumeClaimTemplates:
    - metadata:
        name: meter-data
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: encrypted-ssd
        resources:
          requests:
            storage: 1Ti
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: meter-processor-hpa
  namespace: smart-meter-backend
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: StatefulSet
    name: meter-data-processor
  minReplicas: 5
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

# Wasserwerk SCADA Gateway
apiVersion: apps/v1
kind: Deployment
metadata:
  name: scada-gateway
  namespace: water-treatment
  labels:
    kritis-sector: "water"
spec:
  replicas: 2
  template:
    spec:
      containers:
        - name: scada-gw
          image: scada-gateway:v2.0@sha256:...
          ports:
            - containerPort: 502
              name: modbus
            - containerPort: 102
              name: s7comm
          env:
            - name: PROTOCOL_VALIDATION
              value: "strict"
            - name: COMMAND_WHITELIST
              value: "/etc/scada/allowed-commands.yaml"
            - name: ANOMALY_DETECTION
              value: "enabled"
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: scada-config
              mountPath: /etc/scada
              readOnly: true
      volumes:
        - name: scada-config
          secret:
            secretName: scada-allowed-commands

# Krankenhaus KRITIS-System
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hospital-his
  namespace: healthcare-kritis
  labels:
    kritis-sector: "health"
    kritis-category: "inpatient-care"
spec:
  replicas: 3
  template:
    spec:
      containers:
        - name: his-core
          image: hospital-information-system:v8.0@sha256:...
          env:
            - name: HL7_FHIR_ENABLED
              value: "true"
            - name: PATIENT_DATA_ENCRYPTION
              value: "AES-256"
            - name: EMERGENCY_MODE
              value: "auto-failover"
          resources:
            requests:
              cpu: "4"
              memory: "16Gi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8443
              scheme: HTTPS
            periodSeconds: 5
            failureThreshold: 2

# Verkehrsleitzentrale
apiVersion: apps/v1
kind: Deployment
metadata:
  name: traffic-control
  namespace: transport-kritis
  labels:
    kritis-sector: "transport"
spec:
  replicas: 5
  template:
    spec:
      priorityClassName: system-critical
      containers:
        - name: traffic-controller
          image: traffic-management:v4.0@sha256:...
          resources:
            requests:
              cpu: "2"
              memory: "4Gi"
            limits:
              cpu: "4"
              memory: "8Gi"
          env:
            - name: REAL_TIME_MODE
              value: "true"
            - name: MAX_LATENCY_MS
              value: "50"
            - name: FAILSAFE_MODE
              value: "amber-flash"
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: traffic-control-pdb
  namespace: transport-kritis
spec:
  minAvailable: 3
  selector:
    matchLabels:
      app: traffic-control

## KRITIS Kubernetes Dokumentation

### 1. Sicherheitskonzept
- [ ] Schutzbedarfsfeststellung pro Namespace
- [ ] Risikoanalyse und -behandlung
- [ ] TOMs (Technische und organisatorische Maßnahmen)

### 2. Angriffserkennung (IT-SiG 2.0 §8a)
- [ ] Falco/Tetragon Konfiguration
- [ ] Alerting-Regeln und Eskalation
- [ ] 24/7 SOC-Anbindung
- [ ] Incident-Response-Prozess

### 3. Netzwerksicherheit
- [ ] Network Policies dokumentiert
- [ ] Segmentierung OT/IT
- [ ] Firewall-Regeln
- [ ] VPN/Verschlüsselung

### 4. Zugriffsmanagement
- [ ] RBAC-Konzept
- [ ] MFA für alle Admin-Zugänge
- [ ] Protokollierung aller Zugriffe
- [ ] Privileged Access Management

### 5. Notfallmanagement
- [ ] Business Continuity Plan
- [ ] Disaster Recovery Tests
- [ ] RTO/RPO pro System
- [ ] Kommunikationsplan