From 9b6876726cdf566a6694587bc470fb3f5366db07 Mon Sep 17 00:00:00 2001 From: Mark Rossetti Date: Tue, 22 Feb 2022 13:24:43 -0800 Subject: [PATCH] Moving Windows security info to new page Signed-off-by: Mark Rossetti --- .../concepts/security/windows-security.md | 55 +++++++++++++++++++ .../windows/intro-windows-in-kubernetes.md | 18 ------ 2 files changed, 55 insertions(+), 18 deletions(-) create mode 100644 content/en/docs/concepts/security/windows-security.md diff --git a/content/en/docs/concepts/security/windows-security.md b/content/en/docs/concepts/security/windows-security.md new file mode 100644 index 0000000000..1341f38c59 --- /dev/null +++ b/content/en/docs/concepts/security/windows-security.md @@ -0,0 +1,55 @@ +--- +reviewers: +- jayunit100 +- jsturtevant +- marosset +- perithompson +title: Security For Windows Nodes +content_type: concept +weight: 75 +--- + + + +This page describes security considerations and best practices specific to the Windows operating system. + + + +## Protection for Secret data on nodes + +On Windows, data from Secrets are written out in clear text onto the node's local +storage (as compared to using tmpfs / in-memory filesystems on Linux). As a cluster +operator, you should take both of the following additional measures: + +1. Use file ACLs to secure the Secrets' file location. +1. Apply volume-level encryption using [BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server). + +## Container users + +[RunAsUsername](/docs/tasks/configure-pod-container/configure-runasusername) +can be specified for Windows Pods or containers to execute the container +processes as specific user. This is roughly equivalent to +[RunAsUser](/docs/concepts/policy/pod-security-policy/#users-and-groups). + +Windows containers offer two default user accounts, ContainerUser and ContainerAdministrator. +The differences between these two user accounts are covered in +[When to use ContainerAdmin and ContainerUser user accounts](https://docs.microsoft.com/virtualization/windowscontainers/manage-containers/container-security#when-to-use-containeradmin-and-containeruser-user-accounts) within Microsoft's _Secure Windows containers_ documentation. + +Local users can be added to container images during the container build process. + +{{< note >}} + +* [Nano Server](https://hub.docker.com/_/microsoft-windows-nanoserver) based images run as `ContainerUser` by default +* [Server Core](https://hub.docker.com/_/microsoft-windows-servercore) based images run as `ContainerAdministrator` by default + +{{< /note >}} + +Windows containers can also run as Active Directory identities by utilizing [Group Managed Service Accounts](/docs/tasks/configure-pod-container/configure-gmsa/) + +## Pod-level security isolation + +Linux-specific pod security context mechanisms (such as SELinux, AppArmor, Seccomp, or custom +POSIX capabilities) are not supported on Windows nodes. + +Privileged containers are [not supported](#compatibility-v1-pod-spec-containers-securitycontext) on Windows. +Instead [HostProcess containers](/docs/tasks/configure-pod-container/create-hostprocess-pod) can be used on Windows to perform many of the tasks performed by privileged containers on Linux. diff --git a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md index 91118c4d6c..6b85eb830c 100644 --- a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md +++ b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md @@ -684,24 +684,6 @@ Windows Server SAC release The Kubernetes [version-skew policy](/docs/setup/release/version-skew-policy/) also applies. -## Security for Windows nodes {#security} - -On Windows, data from Secrets are written out in clear text onto the node's local -storage (as compared to using tmpfs / in-memory filesystems on Linux). As a cluster -operator, you should take both of the following additional measures: - -1. Use file ACLs to secure the Secrets' file location. -1. Apply volume-level encryption using [BitLocker](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server). - -[RunAsUsername](/docs/tasks/configure-pod-container/configure-runasusername) -can be specified for Windows Pods or containers to execute the container -processes as a node-default user. This is roughly equivalent to -[RunAsUser](/docs/concepts/policy/pod-security-policy/#users-and-groups). - -Linux-specific pod security context privileges such as SELinux, AppArmor, Seccomp, or capabilities (POSIX capabilities), and others are not supported. - -Privileged containers are [not supported](#compatibility-v1-pod-spec-containers-securitycontext) on Windows. - ## Getting help and troubleshooting {#troubleshooting} Your main source of help for troubleshooting your Kubernetes cluster should start