whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix links and markdown format for some pages

Browse Source
This commit is contained in:
Qiming Teng
2022-02-05 15:19:21 +08:00
parent 517ec927bf
commit 459a3f96ac
3 changed files with 208 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/policy/pod-security-policy.md
+123 -88
View File
@@ -23,7 +23,8 @@ updates.
## What is a Pod Security Policy? ## What is a Pod Security Policy?
A _Pod Security Policy_ is a cluster-level resource that controls security A _Pod Security Policy_ is a cluster-level resource that controls security
sensitive aspects of the pod specification. The [PodSecurityPolicy](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) objects sensitive aspects of the pod specification. The
[PodSecurityPolicy](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) objects
define a set of conditions that a pod must run with in order to be accepted into define a set of conditions that a pod must run with in order to be accepted into
the system, as well as defaults for the related fields. They allow an the system, as well as defaults for the related fields. They allow an
administrator to control the following: administrator to control the following:
@@ -50,10 +51,10 @@ administrator to control the following:
## Enabling Pod Security Policies ## Enabling Pod Security Policies
Pod security policy control is implemented as an optional [admission Pod security policy control is implemented as an optional
controller](/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy). [admission controller](/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy).
PodSecurityPolicies are enforced by [enabling the admission PodSecurityPolicies are enforced by
controller](/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in), [enabling the admission controller](/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in),
but doing so without authorizing any policies **will prevent any pods from being created** in the but doing so without authorizing any policies **will prevent any pods from being created** in the
cluster. cluster.
@@ -65,9 +66,9 @@ controller.
## Authorizing Policies ## Authorizing Policies
When a PodSecurityPolicy resource is created, it does nothing. In order to use When a PodSecurityPolicy resource is created, it does nothing. In order to use
it, the requesting user or target pod's [service it, the requesting user or target pod's
account](/docs/tasks/configure-pod-container/configure-service-account/) must be [service account](/docs/tasks/configure-pod-container/configure-service-account/)
authorized to use the policy, by allowing the `use` verb on the policy. must be authorized to use the policy, by allowing the `use` verb on the policy.
Most Kubernetes pods are not created directly by users. Instead, they are Most Kubernetes pods are not created directly by users. Instead, they are
typically created indirectly as part of a typically created indirectly as part of a
@@ -128,6 +129,7 @@ subjects:
If a `RoleBinding` (not a `ClusterRoleBinding`) is used, it will only grant If a `RoleBinding` (not a `ClusterRoleBinding`) is used, it will only grant
usage for pods being run in the same namespace as the binding. This can be usage for pods being run in the same namespace as the binding. This can be
paired with system groups to grant access to all pods run in the namespace: paired with system groups to grant access to all pods run in the namespace:
```yaml ```yaml
# Authorize all service accounts in a namespace: # Authorize all service accounts in a namespace:
- kind: Group - kind: Group
@@ -139,45 +141,47 @@ paired with system groups to grant access to all pods run in the namespace:
name: system:authenticated name: system:authenticated
``` ```
For more examples of RBAC bindings, see [Role Binding For more examples of RBAC bindings, see
Examples](/docs/reference/access-authn-authz/rbac#role-binding-examples). [RoleBinding examples](/docs/reference/access-authn-authz/rbac#role-binding-examples).
For a complete example of authorizing a PodSecurityPolicy, see For a complete example of authorizing a PodSecurityPolicy, see [below](#example).
[below](#example).
### Recommended Practice ### Recommended Practice
PodSecurityPolicy is being replaced by a new, simplified `PodSecurity` {{< glossary_tooltip PodSecurityPolicy is being replaced by a new, simplified `PodSecurity`
text="admission controller" term_id="admission-controller" >}}. For more details on this change, see {{< glossary_tooltip text="admission controller" term_id="admission-controller" >}}.
[PodSecurityPolicy Deprecation: Past, Present, and For more details on this change, see
Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). Follow these [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/).
guidelines to simplify migration from PodSecurityPolicy to the new admission controller: Follow these guidelines to simplify migration from PodSecurityPolicy to the
new admission controller:
1. Limit your PodSecurityPolicies to the policies defined by the [Pod Security Standards](/docs/concepts/security/pod-security-standards): 1. Limit your PodSecurityPolicies to the policies defined by the
- {{< example file="policy/privileged-psp.yaml" >}}Privileged{{< /example >}} [Pod Security Standards](/docs/concepts/security/pod-security-standards):
- {{< example file="policy/baseline-psp.yaml" >}}Baseline{{< /example >}}
- {{< example file="policy/restricted-psp.yaml" >}}Restricted{{< /example >}}
2. Only bind PSPs to entire namespaces, by using the `system:serviceaccounts:<namespace>` group - {{< example file="policy/privileged-psp.yaml" >}}Privileged{{< /example >}}
- {{< example file="policy/baseline-psp.yaml" >}}Baseline{{< /example >}}
- {{< example file="policy/restricted-psp.yaml" >}}Restricted{{< /example >}}
1. Only bind PSPs to entire namespaces, by using the `system:serviceaccounts:<namespace>` group
(where `<namespace>` is the target namespace). For example: (where `<namespace>` is the target namespace). For example:
```yaml ```yaml
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
# This cluster role binding allows all pods in the "development" namespace to use the baseline PSP. # This cluster role binding allows all pods in the "development" namespace to use the baseline PSP.
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
name: psp-baseline-namespaces name: psp-baseline-namespaces
roleRef: roleRef:
kind: ClusterRole kind: ClusterRole
name: psp-baseline name: psp-baseline
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
subjects: subjects:
- kind: Group - kind: Group
name: system:serviceaccounts:development name: system:serviceaccounts:development
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
- kind: Group - kind: Group
name: system:serviceaccounts:canary name: system:serviceaccounts:canary
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
``` ```
### Troubleshooting ### Troubleshooting
@@ -213,8 +217,8 @@ only non-mutating PodSecurityPolicies are used to validate the pod.
## Example ## Example
_This example assumes you have a running cluster with the PodSecurityPolicy This example assumes you have a running cluster with the PodSecurityPolicy
admission controller enabled and you have cluster admin privileges._ admission controller enabled and you have cluster admin privileges.
### Set up ### Set up
@@ -360,12 +364,24 @@ Let's try that again, slightly differently:
```shell ```shell
kubectl-user create deployment pause --image=k8s.gcr.io/pause kubectl-user create deployment pause --image=k8s.gcr.io/pause
```
```none
deployment "pause" created deployment "pause" created
```
```shell
kubectl-user get pods kubectl-user get pods
No resources found. ```
```
No resources found.
```
```shell
kubectl-user get events | head -n 2 kubectl-user get events | head -n 2
```
```
LASTSEEN FIRSTSEEN COUNT NAME KIND SUBOBJECT TYPE REASON SOURCE MESSAGE LASTSEEN FIRSTSEEN COUNT NAME KIND SUBOBJECT TYPE REASON SOURCE MESSAGE
1m 2m 15 pause-7774d79b5 ReplicaSet Warning FailedCreate replicaset-controller Error creating: pods "pause-7774d79b5-" is forbidden: no providers available to validate pod request 1m 2m 15 pause-7774d79b5 ReplicaSet Warning FailedCreate replicaset-controller Error creating: pods "pause-7774d79b5-" is forbidden: no providers available to validate pod request
``` ```
@@ -386,6 +402,9 @@ is `default`:
kubectl-admin create rolebinding default:psp:unprivileged \ kubectl-admin create rolebinding default:psp:unprivileged \
--role=psp:unprivileged \ --role=psp:unprivileged \
--serviceaccount=psp-example:default --serviceaccount=psp-example:default
```
```none
rolebinding "default:psp:unprivileged" created rolebinding "default:psp:unprivileged" created
``` ```
@@ -394,6 +413,9 @@ eventually succeed in creating the pod:
```shell ```shell
kubectl-user get pods --watch kubectl-user get pods --watch
```
```none
NAME READY STATUS RESTARTS AGE NAME READY STATUS RESTARTS AGE
pause-7774d79b5-qrgcb 0/1 Pending 0 1s pause-7774d79b5-qrgcb 0/1 Pending 0 1s
pause-7774d79b5-qrgcb 0/1 Pending 0 1s pause-7774d79b5-qrgcb 0/1 Pending 0 1s
@@ -407,6 +429,9 @@ Delete the namespace to clean up most of the example resources:
```shell ```shell
kubectl-admin delete ns psp-example kubectl-admin delete ns psp-example
```
```
namespace "psp-example" deleted namespace "psp-example" deleted
``` ```
@@ -415,6 +440,9 @@ up separately:
```shell ```shell
kubectl-admin delete psp example kubectl-admin delete psp example
```
```
podsecuritypolicy "example" deleted podsecuritypolicy "example" deleted
``` ```
@@ -431,7 +459,8 @@ several security mechanisms.
{{< codenew file="policy/restricted-psp.yaml" >}} {{< codenew file="policy/restricted-psp.yaml" >}}
See [Pod Security Standards](/docs/concepts/security/pod-security-standards/#policy-instantiation) for more examples. See [Pod Security Standards](/docs/concepts/security/pod-security-standards/#policy-instantiation)
for more examples.
## Policy Reference ## Policy Reference
@@ -467,17 +496,17 @@ and `max`(inclusive). Defaults to no allowed host ports.
**Volumes** - Provides a list of allowed volume types. The allowable values **Volumes** - Provides a list of allowed volume types. The allowable values
correspond to the volume sources that are defined when creating a volume. For correspond to the volume sources that are defined when creating a volume. For
the complete list of volume types, see [Types of the complete list of volume types, see [Types of
Volumes](/docs/concepts/storage/volumes/#types-of-volumes). Additionally, `*` Volumes](/docs/concepts/storage/volumes/#types-of-volumes). Additionally,
may be used to allow all volume types. `*` may be used to allow all volume types.
The **recommended minimum set** of allowed volumes for new PSPs are: The **recommended minimum set** of allowed volumes for new PSPs are:
- configMap - `configMap`
- downwardAPI - `downwardAPI`
- emptyDir - `emptyDir`
- persistentVolumeClaim - `persistentVolumeClaim`
- secret - `secret`
- projected - `projected`
{{< warning >}} {{< warning >}}
PodSecurityPolicy does not limit the types of `PersistentVolume` objects that PodSecurityPolicy does not limit the types of `PersistentVolume` objects that
@@ -489,10 +518,10 @@ should be granted permission to create `PersistentVolume` objects.
**FSGroup** - Controls the supplemental group applied to some volumes. **FSGroup** - Controls the supplemental group applied to some volumes.
- *MustRunAs* - Requires at least one `range` to be specified. Uses the - *MustRunAs* - Requires at least one `range` to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges. minimum value of the first range as the default. Validates against all ranges.
- *MayRunAs* - Requires at least one `range` to be specified. Allows - *MayRunAs* - Requires at least one `range` to be specified. Allows
`FSGroups` to be left unset without providing a default. Validates against `FSGroups` to be left unset without providing a default. Validates against
all ranges if `FSGroups` is set. all ranges if `FSGroups` is set.
- *RunAsAny* - No default provided. Allows any `fsGroup` ID to be specified. - *RunAsAny* - No default provided. Allows any `fsGroup` ID to be specified.
**AllowedHostPaths** - This specifies a list of host paths that are allowed **AllowedHostPaths** - This specifies a list of host paths that are allowed
@@ -511,7 +540,8 @@ For example:
readOnly: true # only allow read-only mounts readOnly: true # only allow read-only mounts
``` ```
{{< warning >}}There are many ways a container with unrestricted access to the host {{< warning >}}
There are many ways a container with unrestricted access to the host
filesystem can escalate privileges, including reading data from other filesystem can escalate privileges, including reading data from other
containers, and abusing the credentials of system services, such as Kubelet. containers, and abusing the credentials of system services, such as Kubelet.
@@ -552,33 +582,33 @@ spec:
**RunAsUser** - Controls which user ID the containers are run with. **RunAsUser** - Controls which user ID the containers are run with.
- *MustRunAs* - Requires at least one `range` to be specified. Uses the - *MustRunAs* - Requires at least one `range` to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges. minimum value of the first range as the default. Validates against all ranges.
- *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero - *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero
`runAsUser` or have the `USER` directive defined (using a numeric UID) in the `runAsUser` or have the `USER` directive defined (using a numeric UID) in the
image. Pods which have specified neither `runAsNonRoot` nor `runAsUser` settings image. Pods which have specified neither `runAsNonRoot` nor `runAsUser` settings
will be mutated to set `runAsNonRoot=true`, thus requiring a defined non-zero will be mutated to set `runAsNonRoot=true`, thus requiring a defined non-zero
numeric `USER` directive in the container. No default provided. Setting numeric `USER` directive in the container. No default provided. Setting
`allowPrivilegeEscalation=false` is strongly recommended with this strategy. `allowPrivilegeEscalation=false` is strongly recommended with this strategy.
- *RunAsAny* - No default provided. Allows any `runAsUser` to be specified. - *RunAsAny* - No default provided. Allows any `runAsUser` to be specified.
**RunAsGroup** - Controls which primary group ID the containers are run with. **RunAsGroup** - Controls which primary group ID the containers are run with.
- *MustRunAs* - Requires at least one `range` to be specified. Uses the - *MustRunAs* - Requires at least one `range` to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges. minimum value of the first range as the default. Validates against all ranges.
- *MayRunAs* - Does not require that RunAsGroup be specified. However, when RunAsGroup - *MayRunAs* - Does not require that RunAsGroup be specified. However, when RunAsGroup
is specified, they have to fall in the defined range. is specified, they have to fall in the defined range.
- *RunAsAny* - No default provided. Allows any `runAsGroup` to be specified. - *RunAsAny* - No default provided. Allows any `runAsGroup` to be specified.
**SupplementalGroups** - Controls which group IDs containers add. **SupplementalGroups** - Controls which group IDs containers add.
- *MustRunAs* - Requires at least one `range` to be specified. Uses the - *MustRunAs* - Requires at least one `range` to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges. minimum value of the first range as the default. Validates against all ranges.
- *MayRunAs* - Requires at least one `range` to be specified. Allows - *MayRunAs* - Requires at least one `range` to be specified. Allows
`supplementalGroups` to be left unset without providing a default. `supplementalGroups` to be left unset without providing a default.
Validates against all ranges if `supplementalGroups` is set. Validates against all ranges if `supplementalGroups` is set.
- *RunAsAny* - No default provided. Allows any `supplementalGroups` to be - *RunAsAny* - No default provided. Allows any `supplementalGroups` to be
specified. specified.
### Privilege Escalation ### Privilege Escalation
@@ -623,8 +653,8 @@ added. Capabilities listed in `RequiredDropCapabilities` must not be included in
`AllowedCapabilities` or `DefaultAddCapabilities`. `AllowedCapabilities` or `DefaultAddCapabilities`.
**DefaultAddCapabilities** - The capabilities which are added to containers by **DefaultAddCapabilities** - The capabilities which are added to containers by
default, in addition to the runtime defaults. See the [Docker default, in addition to the runtime defaults. See the
documentation](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities) [Docker documentation](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities)
for the default list of capabilities when using the Docker runtime. for the default list of capabilities when using the Docker runtime.
### SELinux ### SELinux
@@ -651,16 +681,17 @@ denoted as the string `Unmasked`.
### AppArmor ### AppArmor
Controlled via annotations on the PodSecurityPolicy. Refer to the [AppArmor Controlled via annotations on the PodSecurityPolicy. Refer to the
documentation](/docs/tutorials/clusters/apparmor/#podsecuritypolicy-annotations). [AppArmor documentation](/docs/tutorials/security/apparmor/#podsecuritypolicy-annotations).
### Seccomp ### Seccomp
As of Kubernetes v1.19, you can use the `seccompProfile` field in the As of Kubernetes v1.19, you can use the `seccompProfile` field in the
`securityContext` of Pods or containers to [control use of seccomp `securityContext` of Pods or containers to
profiles](/docs/tutorials/clusters/seccomp). In prior versions, seccomp was [control use of seccomp profiles](/docs/tutorials/security/seccomp/).
controlled by adding annotations to a Pod. The same PodSecurityPolicies can be In prior versions, seccomp was controlled by adding annotations to a Pod. The
used with either version to enforce how these fields or annotations are applied. same PodSecurityPolicies can be used with either version to enforce how these
fields or annotations are applied.
**seccomp.security.alpha.kubernetes.io/defaultProfileName** - Annotation that **seccomp.security.alpha.kubernetes.io/defaultProfileName** - Annotation that
specifies the default seccomp profile to apply to containers. Possible values specifies the default seccomp profile to apply to containers. Possible values
@@ -677,10 +708,10 @@ are:
flag is not defined, the default path will be used, which is flag is not defined, the default path will be used, which is
`<root-dir>/seccomp` where `<root-dir>` is specified by the `--root-dir` flag. `<root-dir>/seccomp` where `<root-dir>` is specified by the `--root-dir` flag.
{{< note >}} {{< note >}}
The `--seccomp-profile-root` flag is deprecated since Kubernetes The `--seccomp-profile-root` flag is deprecated since Kubernetes
v1.19. Users are encouraged to use the default path. v1.19. Users are encouraged to use the default path.
{{< /note >}} {{< /note >}}
**seccomp.security.alpha.kubernetes.io/allowedProfileNames** - Annotation that **seccomp.security.alpha.kubernetes.io/allowedProfileNames** - Annotation that
specifies which values are allowed for the pod seccomp annotations. Specified as specifies which values are allowed for the pod seccomp annotations. Specified as
@@ -692,18 +723,22 @@ default cannot be changed.
By default, all safe sysctls are allowed. By default, all safe sysctls are allowed.
- `forbiddenSysctls` - excludes specific sysctls. You can forbid a combination of safe and unsafe sysctls in the list. To forbid setting any sysctls, use `*` on its own. - `forbiddenSysctls` - excludes specific sysctls. You can forbid a combination
- `allowedUnsafeSysctls` - allows specific sysctls that had been disallowed by the default list, so long as these are not listed in `forbiddenSysctls`. of safe and unsafe sysctls in the list. To forbid setting any sysctls, use
`*` on its own.
- `allowedUnsafeSysctls` - allows specific sysctls that had been disallowed by
the default list, so long as these are not listed in `forbiddenSysctls`.
Refer to the [Sysctl documentation]( Refer to the [Sysctl documentation](/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy).
/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy).
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
- See [PodSecurityPolicy Deprecation: Past, Present, and - See [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/)
Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/) to learn about to learn about the future of pod security policy.
the future of pod security policy.
- See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for policy recommendations. - See [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
for policy recommendations.
- Refer to [PodSecurityPolicy reference](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy)
for the API details.
- Refer to [Pod Security Policy Reference](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) for the api details.
content/en/docs/reference/using-api/deprecation-policy.md
+1 -1
View File
@@ -85,7 +85,7 @@ might have to add an equivalent field or represent it as an annotation.
* **Beta API versions must be supported for 9 months or 3 releases (whichever is longer) after deprecation** * **Beta API versions must be supported for 9 months or 3 releases (whichever is longer) after deprecation**
* **Alpha API versions may be removed in any release without prior deprecation notice** * **Alpha API versions may be removed in any release without prior deprecation notice**
This ensures beta API support covers the [maximum supported version skew of 2 releases](/docs/setup/release/version-skew-policy/). This ensures beta API support covers the [maximum supported version skew of 2 releases](/releases/version-skew-policy/).
{{< note >}} {{< note >}}
There are no current plans for a major version revision of Kubernetes that removes GA APIs. There are no current plans for a major version revision of Kubernetes that removes GA APIs.
content/en/docs/tutorials/security/ns-level-pss.md
+84 -69
View File
@@ -8,57 +8,63 @@ weight: 10
This tutorial applies only for new clusters. This tutorial applies only for new clusters.
{{% /alert %}} {{% /alert %}}
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated Pod Security admission (PSA) is enabled by default in v1.23 and later, as it
to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission [graduated to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission
is an admission controller that applies is an admission controller that applies
[Pod Security Standards](docs/concepts/security/pod-security-standards/) [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
when pods are created. In this tutorial, you will enforce the `baseline` Pod Security Standard, when pods are created. In this tutorial, you will enforce the `baseline` Pod Security Standard,
one namespace at a time. one namespace at a time.
You can also apply Pod Security Standards to multiple namespaces at once at the cluster You can also apply Pod Security Standards to multiple namespaces at once at the cluster
level. For instructions, refer to [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss). level. For instructions, refer to
[Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss).
## {{% heading "prerequisites" %}} ## {{% heading "prerequisites" %}}
Install the following on your workstation: Install the following on your workstation:
- [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) - [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
- [kubectl](https://kubernetes.io/docs/tasks/tools/) - [kubectl](/docs/tasks/tools/)
## Create cluster ## Create cluster
1. Create a `KinD` cluster as follows: 1. Create a `KinD` cluster as follows:
```shell ```shell
kind create cluster --name psa-ns-level --image kindest/node:v1.23.0 kind create cluster --name psa-ns-level --image kindest/node:v1.23.0
``` ```
The output is similar to this: The output is similar to this:
```
Creating cluster "psa-ns-level" ...
✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦
✓ Writing configuration 📜
✓ Starting control-plane 🕹️
✓ Installing CNI 🔌
✓ Installing StorageClass 💾
Set kubectl context to "kind-psa-ns-level"
You can now use your cluster with:
kubectl cluster-info --context kind-psa-ns-level ```
Creating cluster "psa-ns-level" ...
✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦
✓ Writing configuration 📜
✓ Starting control-plane 🕹️
✓ Installing CNI 🔌
✓ Installing StorageClass 💾
Set kubectl context to "kind-psa-ns-level"
You can now use your cluster with:
Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/ kubectl cluster-info --context kind-psa-ns-level
```
Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/
```
1. Set the kubectl context to the new cluster: 1. Set the kubectl context to the new cluster:
```shell
kubectl cluster-info --context kind-psa-ns-level
```
The output is similar to this:
```
Kubernetes control plane is running at https://127.0.0.1:50996
CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. ```shell
``` kubectl cluster-info --context kind-psa-ns-level
```
The output is similar to this:
```
Kubernetes control plane is running at https://127.0.0.1:50996
CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
```
## Create a namespace ## Create a namespace
@@ -67,7 +73,9 @@ Create a new namespace called `example`:
```shell ```shell
kubectl create ns example kubectl create ns example
``` ```
The output is similar to this: The output is similar to this:
``` ```
namespace/example created namespace/example created
``` ```
@@ -78,63 +86,68 @@ namespace/example created
built-in Pod Security Admission. In this step we will warn on baseline pod built-in Pod Security Admission. In this step we will warn on baseline pod
security standard as per the latest version (default value) security standard as per the latest version (default value)
```shell ```shell
kubectl label --overwrite ns example \ kubectl label --overwrite ns example \
pod-security.kubernetes.io/warn=baseline \ pod-security.kubernetes.io/warn=baseline \
pod-security.kubernetes.io/warn-version=latest pod-security.kubernetes.io/warn-version=latest
``` ```
2. Multiple pod security standards can be enabled on any namespace, using labels. 2. Multiple pod security standards can be enabled on any namespace, using labels.
Following command will `enforce` the `baseline` Pod Security Standard, but Following command will `enforce` the `baseline` Pod Security Standard, but
`warn` and `audit` for `restricted` Pod Security Standards as per the latest `warn` and `audit` for `restricted` Pod Security Standards as per the latest
version (default value) version (default value)
``` ```shell
kubectl label --overwrite ns example \ kubectl label --overwrite ns example \
pod-security.kubernetes.io/enforce=baseline \ pod-security.kubernetes.io/enforce=baseline \
pod-security.kubernetes.io/enforce-version=latest \ pod-security.kubernetes.io/enforce-version=latest \
pod-security.kubernetes.io/warn=restricted \ pod-security.kubernetes.io/warn=restricted \
pod-security.kubernetes.io/warn-version=latest \ pod-security.kubernetes.io/warn-version=latest \
pod-security.kubernetes.io/audit=restricted \ pod-security.kubernetes.io/audit=restricted \
pod-security.kubernetes.io/audit-version=latest pod-security.kubernetes.io/audit-version=latest
``` ```
## Verify the Pod Security Standards ## Verify the Pod Security Standards
1. Create a minimal pod in `example` namespace: 1. Create a minimal pod in `example` namespace:
```shell ```shell
cat <<EOF > /tmp/pss/nginx-pod.yaml cat <<EOF > /tmp/pss/nginx-pod.yaml
apiVersion: v1 apiVersion: v1
kind: Pod kind: Pod
metadata: metadata:
name: nginx name: nginx
spec: spec:
containers: containers:
- image: nginx - image: nginx
name: nginx name: nginx
ports: ports:
- containerPort: 80 - containerPort: 80
EOF EOF
``` ```
1. Apply the pod spec to the cluster in `example` namespace: 1. Apply the pod spec to the cluster in `example` namespace:
```shell
kubectl apply -n example -f /tmp/pss/nginx-pod.yaml ```shell
``` kubectl apply -n example -f /tmp/pss/nginx-pod.yaml
```
The output is similar to this: The output is similar to this:
```
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") ```
pod/nginx created Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
``` pod/nginx created
```
1. Apply the pod spec to the cluster in `default` namespace: 1. Apply the pod spec to the cluster in `default` namespace:
```shell
kubectl apply -n default -f /tmp/pss/nginx-pod.yaml ```shell
``` kubectl apply -n default -f /tmp/pss/nginx-pod.yaml
```
Output is similar to this: Output is similar to this:
```
pod/nginx created ```
``` pod/nginx created
```
The Pod Security Standards were applied only to the `example` The Pod Security Standards were applied only to the `example`
namespace. You could create the same Pod in the `default` namespace namespace. You could create the same Pod in the `default` namespace
@@ -149,11 +162,13 @@ Run `kind delete cluster -name psa-ns-level` to delete the cluster created.
- Run a - Run a
[shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh) [shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh)
to perform all the preceding steps all at once. to perform all the preceding steps all at once.
1. Create KinD cluster 1. Create KinD cluster
2. Create new namespace 2. Create new namespace
3. Apply `baseline` Pod Security Standard in `enforce` mode while applying 3. Apply `baseline` Pod Security Standard in `enforce` mode while applying
`restricted` Pod Security Standard also in `warn` and `audit` mode. `restricted` Pod Security Standard also in `warn` and `audit` mode.
4. Create a new pod with the following pod security standards applied 4. Create a new pod with the following pod security standards applied
- [Pod Security Admission](/docs/concepts/security/pod-security-admission/) - [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
- [Pod Security Standards](/docs/concepts/security/pod-security-standards/) - [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
- [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) - [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/)