From 789935a35d3f1f4b0c3bf3f52854e23418be3dec Mon Sep 17 00:00:00 2001 From: harshitasao Date: Thu, 26 May 2022 12:15:20 +0530 Subject: [PATCH 1/4] fixed the RBAC good practice guide. --- .../en/docs/concepts/security/rbac-good-practices.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/security/rbac-good-practices.md b/content/en/docs/concepts/security/rbac-good-practices.md index 2434b13f75..c366eaf2b6 100644 --- a/content/en/docs/concepts/security/rbac-good-practices.md +++ b/content/en/docs/concepts/security/rbac-good-practices.md @@ -37,13 +37,14 @@ some general rules that can be applied are : can avoid accidental modification of cluster resources. - Avoid adding users to the `system:masters` group. Any user who is a member of this group bypasses all RBAC rights checks and will always have unrestricted superuser access, which cannot be - revoked by removing Role Bindings or Cluster Role Bindings. As an aside, if a cluster is + revoked by removing RoleBindings or ClusterRoleBindings. As an aside, if a cluster is using an authorization webhook, membership of this group also bypasses that webhook (requests from users who are members of that group are never sent to the webhook) ### Minimize distribution of privileged tokens -Ideally, pods shouldn't be assigned service accounts granted powerful permissions (listed [here](#Kubernetes-RBAC---Privilege-Escalation-Risks)). +Ideally, pods shouldn't be assigned service accounts that have been granted powerful permissions (for example, any of the rights listed under +[privilege escalation risks](#privilege-escalation-risks)). In cases where a workload requires powerful permissions, consider the following practices: - Limit the number of nodes running powerful pods. Ensure that any DaemonSets you run @@ -172,4 +173,7 @@ specifically relevant in multi-tenant clusters if semi-trusted or untrusted user are allowed limited access to a system. One option for mitigation of this issue would be to use [resource quotas](/docs/concepts/policy/resource-quotas/#object-count-quota) -to limit the quantity of objects which can be created. \ No newline at end of file +to limit the quantity of objects which can be created. + +## {{% heading "whatsnext" %}} +* To learn more about **RBAC**, see [RBAC documentation](/docs/reference/access-authn-authz/rbac/). \ No newline at end of file From 8ce38a6625a0a3359bf121198e890a038457c5a1 Mon Sep 17 00:00:00 2001 From: harshitasao Date: Thu, 26 May 2022 13:27:44 +0530 Subject: [PATCH 2/4] added what's next in RBAC good practice guide --- content/en/docs/concepts/security/rbac-good-practices.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/rbac-good-practices.md b/content/en/docs/concepts/security/rbac-good-practices.md index c366eaf2b6..9ea851171e 100644 --- a/content/en/docs/concepts/security/rbac-good-practices.md +++ b/content/en/docs/concepts/security/rbac-good-practices.md @@ -176,4 +176,5 @@ One option for mitigation of this issue would be to use [resource quotas](/docs/ to limit the quantity of objects which can be created. ## {{% heading "whatsnext" %}} -* To learn more about **RBAC**, see [RBAC documentation](/docs/reference/access-authn-authz/rbac/). \ No newline at end of file +* To learn more about RBAC, see [RBAC documentation](/docs/reference/access-authn-authz/rbac/). +* To learn more about Authorizing Policies via RBAC, see [Authorizing Policies](/docs/concepts/security/pod-security-policy/#via-rbac). \ No newline at end of file From d686637140d115b2d37a0342139ad9e3c7f3adcd Mon Sep 17 00:00:00 2001 From: harshitasao Date: Fri, 27 May 2022 11:02:15 +0530 Subject: [PATCH 3/4] Removed Authorizing Policies. --- content/en/docs/concepts/security/rbac-good-practices.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/en/docs/concepts/security/rbac-good-practices.md b/content/en/docs/concepts/security/rbac-good-practices.md index 9ea851171e..6b9cf29ed2 100644 --- a/content/en/docs/concepts/security/rbac-good-practices.md +++ b/content/en/docs/concepts/security/rbac-good-practices.md @@ -177,4 +177,3 @@ to limit the quantity of objects which can be created. ## {{% heading "whatsnext" %}} * To learn more about RBAC, see [RBAC documentation](/docs/reference/access-authn-authz/rbac/). -* To learn more about Authorizing Policies via RBAC, see [Authorizing Policies](/docs/concepts/security/pod-security-policy/#via-rbac). \ No newline at end of file From 2517ad6c77d978f658bda17676ad6d565a47bfdf Mon Sep 17 00:00:00 2001 From: harshitasao Date: Sun, 29 May 2022 16:06:25 +0530 Subject: [PATCH 4/4] small modification --- content/en/docs/concepts/security/rbac-good-practices.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/rbac-good-practices.md b/content/en/docs/concepts/security/rbac-good-practices.md index 6b9cf29ed2..a78ee1fe90 100644 --- a/content/en/docs/concepts/security/rbac-good-practices.md +++ b/content/en/docs/concepts/security/rbac-good-practices.md @@ -176,4 +176,4 @@ One option for mitigation of this issue would be to use [resource quotas](/docs/ to limit the quantity of objects which can be created. ## {{% heading "whatsnext" %}} -* To learn more about RBAC, see [RBAC documentation](/docs/reference/access-authn-authz/rbac/). +* To learn more about RBAC, see the [RBAC documentation](/docs/reference/access-authn-authz/rbac/).