unoPlat market place mvp: message broker

[JayGhiya]

Steps to be taken to secure and ensure compliance for Redpanda within a Kubernetes environment(This will include steps that are not needed for compliance but to ensure improvement in usability):

1. Development

• Code/Dependency Analysis (Falls under purview of open source codebase)
• Implement Secure Coding practices and guidelines to minimise the introduction of new vulnerabilities. (Falls under purview of open source codebase)
• Regularly update Redpanda's Dependencies to address known security issues and maintain compliance with relevant standards.

2. Deployment

• Use secure and verified container images for Redpanda from trusted sources such as official Redpanda docker image.
• Scan container images for vulnerabilities during the build process and before deploying them to kubernetes. (use open source engines such as Anchors engine/clair/trivy) - need to land on one.
• Implement security policies to enforce secure configurations and prevent deployment of non-compliant workloads. Also use Role-Based Access control to restrict access to Redpanda resources and ensure the principle of least privilege. ( software/tool to be used - consul and open policy agent)

3. Configuration

• Configure Redpanda to use encryption at rest and in transit as well.
  Encryption at rest will be enabled through Civo volumes(the feature is still not present but going to land soon). Encryption in transit will happen through consul.(mtls)

4. Monitoring

• Enable redpanda's logging features and configure log collection and analysis tools to monitor and track activity for security and compliance purposes.
  This will be done through signoz monitoring software. There will be logs and metrics collected and alerts would be established in signoz based upon any failures/performance issues for Redpanda.

5. Incident Response and Recovery:

• Enable incident response plan that includes identifying, containing and remediating security/performance incidents related to Redpanda deployment.
• Backup Redpanda data and configuration information to ensure we recover from data loss/corruption incidents.
• The incident response and recovery process has to be tested for effectiveness and maintain compliance with relevant standards.

6. Performance

• Enable performance test on redpanda cluster based on user requirements before deployment to ensure it meets the needs of the organisation. This will be done through k6.

7. Chaos

• Enable Chaos Test on redpanda cluster to ensure reliability/up-time score.
  Framework is yet to be decided for chaos.

8. Experience Improvement

• Enable topic creation/monitoring of messages through either UI or GitHub action.

[JayGhiya]

@vipinshreyaskumar @devsinghnaini does this cover all a mvp needs to showcase unoPlat market app?