From 6cc9bf8293db61ac7963acb035bd6167d92c86be Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 23 Jun 2021 17:42:58 -0700 Subject: [PATCH 1/4] Update PodSecurityStandards to match PodSecurity KEP --- .../en/docs/concepts/security/pod-security-standards.md | 5 ++--- content/en/examples/policy/baseline-psp.yaml | 7 ++++--- content/en/examples/policy/restricted-psp.yaml | 3 ++- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index 5a69cc8e64..e41e7de809 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -86,7 +86,7 @@ enforced/disallowed: Capabilities - Adding additional capabilities beyond the default set must be disallowed.
+ Adding additional capabilities beyond the default set (excluding NET_RAW) must be disallowed.

Restricted Fields:
spec.containers[*].securityContext.capabilities.add
spec.initContainers[*].securityContext.capabilities.add
@@ -194,7 +194,7 @@ well as lower-trust users.The following listed controls should be enforced/disal Volume Types - In addition to restricting HostPath volumes, the restricted profile limits usage of non-core volume types to those defined through PersistentVolumes.
+ In addition to restricting HostPath volumes, the restricted profile limits usage of non-ephemeral volume types to those defined through PersistentVolumes.

Restricted Fields:
spec.volumes[*].hostPath
spec.volumes[*].gcePersistentDisk
@@ -216,7 +216,6 @@ well as lower-trust users.The following listed controls should be enforced/disal spec.volumes[*].portworxVolume
spec.volumes[*].scaleIO
spec.volumes[*].storageos
- spec.volumes[*].csi

Allowed Values: undefined/nil
diff --git a/content/en/examples/policy/baseline-psp.yaml b/content/en/examples/policy/baseline-psp.yaml index 36e440588b..97ddc3680e 100644 --- a/content/en/examples/policy/baseline-psp.yaml +++ b/content/en/examples/policy/baseline-psp.yaml @@ -11,15 +11,13 @@ metadata: seccomp.security.alpha.kubernetes.io/defaultProfileName: 'unconfined' spec: privileged: false - # The moby default capability set, defined here: - # https://github.com/moby/moby/blob/0a5cec2833f82a6ad797d70acbf9cbbaf8956017/oci/caps/defaults.go#L6-L19 + # The moby default capability set, minus NET_RAW allowedCapabilities: - 'CHOWN' - 'DAC_OVERRIDE' - 'FSETID' - 'FOWNER' - 'MKNOD' - - 'NET_RAW' - 'SETGID' - 'SETUID' - 'SETFCAP' @@ -67,6 +65,9 @@ spec: runAsUser: rule: 'RunAsAny' seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + # The PSP SELinux API cannot express the SELinux Pod Security Standards, + # so if using SELinux, you must choose a more restrictive default. rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' diff --git a/content/en/examples/policy/restricted-psp.yaml b/content/en/examples/policy/restricted-psp.yaml index 4db57688b1..d7150d9d10 100644 --- a/content/en/examples/policy/restricted-psp.yaml +++ b/content/en/examples/policy/restricted-psp.yaml @@ -22,8 +22,9 @@ spec: - 'projected' - 'secret' - 'downwardAPI' - # Assume that persistentVolumes set up by the cluster admin are safe to use. + # Assume that CSI drivers & persistentVolumes set up by the cluster admin are safe to use. - 'persistentVolumeClaim' + - 'csi' hostNetwork: false hostIPC: false hostPID: false From 46007158991704d3066a65590ba481325778bd9f Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 23 Jun 2021 18:03:24 -0700 Subject: [PATCH 2/4] Document PSP best practices for PodSecurity transition --- .../concepts/policy/pod-security-policy.md | 40 ++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index fac2b1205e..74c6a6b1e0 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -11,7 +11,8 @@ weight: 30 {{< feature-state for_k8s_version="v1.21" state="deprecated" >}} -PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25. +PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25. For more information on the deprecation, +see [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). Pod Security Policies enable fine-grained authorization of pod creation and updates. @@ -110,6 +111,10 @@ roleRef: name: apiGroup: rbac.authorization.k8s.io subjects: +# Authorize all service accounts in a namespace (recommended): +- kind: Group + apiGroup: rbac.authorization.k8s.io + name: system:serviceaccounts: # Authorize specific service accounts: - kind: ServiceAccount name: @@ -139,6 +144,39 @@ Examples](/docs/reference/access-authn-authz/rbac#role-binding-examples). For a complete example of authorizing a PodSecurityPolicy, see [below](#example). +### Best Practices + +PodSecurityPolicy is being replaced by a new, simplified PodSecurity admission controller. The +following recommended best-practices will make the migration to the new PodSecurity admission +controller much simpler. For more details on this change, see +[PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). + +1. Limit your PodSecurityPolicies to the policies defined by the [Pod Security Standards](/docs/concepts/security/pod-security-standards): + - [Privileged](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/privileged-psp.yaml) + - [Baseline](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/baseline-psp.yaml) + - [Restricted](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml) + +2. Only bind PSPs to namespaces, by using the `system:serviceaccounts:` group (where + `` is the target namespace). For example: + + ```yaml + apiVersion: rbac.authorization.k8s.io/v1 + # This cluster role binding allows all pods in the "development" namespace to use the baseline PSP. + kind: ClusterRoleBinding + metadata: + name: psp-baseline-namespaces + roleRef: + kind: ClusterRole + name: psp-baseline + apiGroup: rbac.authorization.k8s.io + subjects: + - kind: Group + name: system:serviceaccounts:development + apiGroup: rbac.authorization.k8s.io + - kind: Group + name: system:serviceaccounts:canary + apiGroup: rbac.authorization.k8s.io + ``` ### Troubleshooting From ae1ae5045431d49b851de255d7ba94744ce80872 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Thu, 24 Jun 2021 09:51:32 -0700 Subject: [PATCH 3/4] Address PR feedback --- .../concepts/policy/pod-security-policy.md | 27 +++++++++++-------- .../security/pod-security-standards.md | 2 +- content/en/examples/policy/baseline-psp.yaml | 9 +++---- .../en/examples/policy/restricted-psp.yaml | 8 +++--- 4 files changed, 24 insertions(+), 22 deletions(-) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 74c6a6b1e0..62232ded51 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -115,7 +115,7 @@ subjects: - kind: Group apiGroup: rbac.authorization.k8s.io name: system:serviceaccounts: -# Authorize specific service accounts: +# Authorize specific service accounts (not recommended): - kind: ServiceAccount name: namespace: @@ -144,20 +144,21 @@ Examples](/docs/reference/access-authn-authz/rbac#role-binding-examples). For a complete example of authorizing a PodSecurityPolicy, see [below](#example). -### Best Practices +### Recommended Practice -PodSecurityPolicy is being replaced by a new, simplified PodSecurity admission controller. The -following recommended best-practices will make the migration to the new PodSecurity admission -controller much simpler. For more details on this change, see -[PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). +PodSecurityPolicy is being replaced by a new, simplified `PodSecurity` {{< glossary_tooltip +text="admission controller" term_id="admission-controller" >}}. For more details on this change, see +[PodSecurityPolicy Deprecation: Past, Present, and +Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). Follow these +guidelines to simplify migration from PodSecurityPolicy to the new admission controller: 1. Limit your PodSecurityPolicies to the policies defined by the [Pod Security Standards](/docs/concepts/security/pod-security-standards): - - [Privileged](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/privileged-psp.yaml) - - [Baseline](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/baseline-psp.yaml) - - [Restricted](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml) + - {{< example file="policy/privileged-psp.yaml" >}}Privileged{{< /example >}} + - {{< example file="policy/baseline-psp.yaml" >}}Baseline{{< /example >}} + - {{< example file="policy/restricted-psp.yaml" >}}Restricted{{< /example >}} -2. Only bind PSPs to namespaces, by using the `system:serviceaccounts:` group (where - `` is the target namespace). For example: +2. Only bind PSPs to entire namespaces, by using the `system:serviceaccounts:` group + (where `` is the target namespace). For example: ```yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -699,6 +700,10 @@ Refer to the [Sysctl documentation]( ## {{% heading "whatsnext" %}} +- See [PodSecurityPolicy Deprecation: Past, Present, and + Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/) to learn about + the future of pod security policy. + - See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for policy recommendations. - Refer to [Pod Security Policy Reference](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) for the api details. diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index e41e7de809..66104d307f 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -86,7 +86,7 @@ enforced/disallowed: Capabilities - Adding additional capabilities beyond the default set (excluding NET_RAW) must be disallowed.
+ Adding NET_RAW or capabilities beyond the default set must be disallowed.

Restricted Fields:
spec.containers[*].securityContext.capabilities.add
spec.initContainers[*].securityContext.capabilities.add
diff --git a/content/en/examples/policy/baseline-psp.yaml b/content/en/examples/policy/baseline-psp.yaml index 97ddc3680e..57258bf313 100644 --- a/content/en/examples/policy/baseline-psp.yaml +++ b/content/en/examples/policy/baseline-psp.yaml @@ -6,9 +6,7 @@ metadata: # Optional: Allow the default AppArmor profile, requires setting the default. apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' - # Optional: Allow the default seccomp profile, requires setting the default. - seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default,unconfined' - seccomp.security.alpha.kubernetes.io/defaultProfileName: 'unconfined' + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: false # The moby default capability set, minus NET_RAW @@ -34,15 +32,16 @@ spec: - 'projected' - 'secret' - 'downwardAPI' - # Assume that persistentVolumes set up by the cluster admin are safe to use. + # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use. + - 'csi' - 'persistentVolumeClaim' + - 'ephemeral' # Allow all other non-hostpath volume types. - 'awsElasticBlockStore' - 'azureDisk' - 'azureFile' - 'cephFS' - 'cinder' - - 'csi' - 'fc' - 'flexVolume' - 'flocker' diff --git a/content/en/examples/policy/restricted-psp.yaml b/content/en/examples/policy/restricted-psp.yaml index d7150d9d10..0837c5a3ce 100644 --- a/content/en/examples/policy/restricted-psp.yaml +++ b/content/en/examples/policy/restricted-psp.yaml @@ -5,14 +5,11 @@ metadata: annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' - seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false # Required to prevent escalations to root. allowPrivilegeEscalation: false - # This is redundant with non-root + disallow privilege escalation, - # but we can provide it for defense in depth. requiredDropCapabilities: - ALL # Allow core volume types. @@ -22,9 +19,10 @@ spec: - 'projected' - 'secret' - 'downwardAPI' - # Assume that CSI drivers & persistentVolumes set up by the cluster admin are safe to use. - - 'persistentVolumeClaim' + # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use. - 'csi' + - 'persistentVolumeClaim' + - 'ephemeral' hostNetwork: false hostIPC: false hostPID: false From 8b5fb9939bf1e8e03676957f202594ab81b97e6b Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Mon, 28 Jun 2021 13:53:17 -0700 Subject: [PATCH 4/4] Don't recommend PSP usage, since it's deprecated --- .../en/docs/concepts/policy/pod-security-policy.md | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 62232ded51..36172faba5 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -49,13 +49,12 @@ administrator to control the following: ## Enabling Pod Security Policies -Pod security policy control is implemented as an optional (but recommended) -[admission -controller](/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy). PodSecurityPolicies -are enforced by [enabling the admission +Pod security policy control is implemented as an optional [admission +controller](/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy). +PodSecurityPolicies are enforced by [enabling the admission controller](/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in), -but doing so without authorizing any policies **will prevent any pods from being -created** in the cluster. +but doing so without authorizing any policies **will prevent any pods from being created** in the +cluster. Since the pod security policy API (`policy/v1beta1/podsecuritypolicy`) is enabled independently of the admission controller, for existing clusters it is @@ -707,5 +706,3 @@ Refer to the [Sysctl documentation]( - See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for policy recommendations. - Refer to [Pod Security Policy Reference](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy) for the api details. - -