Added shell script examples

Fixed nits, broken links and numbering

Co-authored-by: Tim Bannister <tim@scalefactory.com>
Co-authored-by: Shannon Kularathna <ax3shannonkularathna@gmail.com>
Co-authored-by: Jim Angel <jimangel@users.noreply.github.com>

content/en/docs/tutorials/_index.md

@@ -59,8 +59,8 @@ Before walking through each tutorial, you may want to bookmark the
 
 ## Security
 
-* [Applying Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/)
+* [Apply Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/)
-* [Applying Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/)
+* [Apply Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/)
 
 ## {{% heading "whatsnext" %}}
 

content/en/docs/tutorials/security/cluster-level-pss.md

@@ -1,5 +1,5 @@
 ---
-title: Applying Pod Security Standards at the cluster level
+title: Apply Pod Security Standards at the Cluster Level
 content_type: tutorial
 weight: 10
 ---
@@ -8,15 +8,16 @@ weight: 10
 This tutorial applies only for new clusters.
 {{% /alert %}}
 
-Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated
+Pod Security admission (PSA) is enabled by default in v1.23 and later, as it has
-to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission
+[graduated to beta](/blog/2021/12/09/pod-security-admission-beta/).
-is an admission controller that applies Pod Security Standards when pods are 
+Pod Security
+is an admission controller that carries out checks against the Kubernetes
+[Pod Security Standards](docs/concepts/security/pod-security-standards/) when new pods are
 created. This tutorial shows you how to enforce the `baseline` Pod Security
 Standard at the cluster level which applies a standard configuration
 to all namespaces in a cluster.
 
-For applying pod security standards one namespace at a time, please [follow this
+To apply Pod Security Standards to specific namespaces, refer to [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss).
-tutorial](/docs/tutorials/security/ns-level-pss).
 
 ## {{% heading "prerequisites" %}}
 
@@ -37,12 +38,12 @@ that are most appropriate for your configuration, do the following:
 1. Create a cluster with no Pod Security Standards applied:
 
     ```shell
-    kind create cluster --name psa-wo-cluster-pss --image kindest/node:latest
+    kind create cluster --name psa-wo-cluster-pss --image kindest/node:v1.23.0
     ```
    The output is similar to this:
     ```
     Creating cluster "psa-wo-cluster-pss" ...
-    ✓ Ensuring node image (kindest/node:latest) 🖼
+    ✓ Ensuring node image (kindest/node:v1.23.0) 🖼
     ✓ Preparing nodes 📦  
     ✓ Writing configuration 📜
     ✓ Starting control-plane 🕹️
@@ -57,7 +58,7 @@ that are most appropriate for your configuration, do the following:
     
     ```
 
-2. Set the kubectl context to the new cluster:
+1. Set the kubectl context to the new cluster:
 
     ```shell
     kubectl cluster-info --context kind-psa-wo-cluster-pss
@@ -72,7 +73,7 @@ that are most appropriate for your configuration, do the following:
     To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
     ```
 
-3. Get a list of namespaces in the cluster:
+1.  Get a list of namespaces in the cluster:
 
     ```shell
     kubectl get ns
@@ -87,7 +88,7 @@ that are most appropriate for your configuration, do the following:
     local-path-storage   Active   9m26s
     ```
 
-4. Use `--dry-run=server` to understand what happens when different Pod Security Standards
+1. Use `--dry-run=server` to understand what happens when different Pod Security Standards
    are applied:
 
    1. Privileged
@@ -148,7 +149,7 @@ warnings, specifically in the `kube-system` namespace.
 
 ## Set modes, versions and standards
 
-In this tutorial, you apply the following Pod Security Standards to the `latest` version:
+In this section, you apply the following Pod Security Standards to the `latest` version:
 
 * `baseline` standard in `enforce` mode.
 * `restricted` standard in `warn` and `audit` mode.
@@ -166,10 +167,11 @@ following:
 1. Based on the risk posture applied to a cluster, a stricter Pod Security
    Standard like `restricted` might be a better choice.
 1. Exempting the `kube-system` namespace allows pods to run as
-   `privileged` in this namespace. We recommend that you apply strict RBAC
+   `privileged` in this namespace. For real world use, the Kubernetes project
+   strongly recommends that you apply strict RBAC
    policies that limit access to `kube-system`, following the principle of least
    privilege.
-
+   To implement the preceding standards, do the following:
 1. Create a configuration file that can be consumed by the Pod Security
    Admission Controller to implement these Pod Security Standards:
 
@@ -197,7 +199,6 @@ plugins:
     EOF
     ```
 
-
 1. Configure the API server to consume this file during cluster creation:
 
     ```
@@ -235,21 +236,21 @@ EOF
     ```
 
    {{<note>}}
-    If you use Docker Desktop with KinD, the `/tmp`
+   If you use Docker Desktop with KinD on macOS, you can
-    directory is added as a Shared Directory under
+   add `/tmp` as a Shared Directory under the menu item
-    **Preferences > Resources > File Sharing** on Mac OS.
+   **Preferences > Resources > File Sharing**.
    {{</note>}}
 
-2. Create a cluster that uses Pod Security Admission to apply
+1. Create a cluster that uses Pod Security Admission to apply
    these Pod Security Standards:
 
    ```shell
-    kind create cluster --name psa-with-cluster-pss --image kindest/node:latest --config /tmp/pss/cluster-config.yaml
+    kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml
    ```
    The output is similar to this:
    ```
     Creating cluster "psa-with-cluster-pss" ...
-     ✓ Ensuring node image (kindest/node:latest) 🖼 
+     ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 
      ✓ Preparing nodes 📦  
      ✓ Writing configuration 📜 
      ✓ Starting control-plane 🕹️ 
@@ -261,17 +262,20 @@ EOF
     kubectl cluster-info --context kind-psa-with-cluster-pss
     
     Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂
+    ```
 
-3. Point kubectl to the cluster 
+1. Point kubectl to the cluster
    ```shell
     kubectl cluster-info --context kind-psa-with-cluster-pss
+    ```
+   The output is similar to this:
+    ```
      Kubernetes control plane is running at https://127.0.0.1:63855
      CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
   
      To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
     ```
-
+1. Create the following Pod specification for a minimal configuration in the default namespace:
-4. Create a Pod with minimal configuration in the default namespace:
 
     ```
     cat <<EOF > /tmp/pss/nginx-pod.yaml
@@ -287,7 +291,7 @@ EOF
             - containerPort: 80
     EOF
     ```
-5. Create Pod after pod security is enabled at cluster level:
+1. Create the Pod in the cluster:
 
    ```shell
     kubectl apply -f /tmp/pss/nginx-pod.yaml
@@ -297,6 +301,7 @@ EOF
     Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
     pod/nginx created
    ```
+
 ## Clean up
 
 Run `kind delete cluster -name psa-with-cluster-pss` and
@@ -306,7 +311,7 @@ created.
 ## {{% heading "whatsnext" %}}
 
 - Run a
-  [gist](https://gist.github.com/PushkarJ/9f7a0045f4bec31097bdd1e9db0f2f6e) 
+  [shell script](/examples/security/kind-with-cluster-level-baseline-pod-security.sh)
   to perform all the preceding steps at once:
   1. Create a Pod Security Standards based cluster level Configuration
   2. Create a file to let API server consumes this configuration
@@ -316,4 +321,4 @@ created.
   6. Apply this file to create a Pod in the new cluster
 - [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
 - [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
-- [Applying Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/)
+- [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/)

content/en/docs/tutorials/security/ns-level-pss.md

@@ -1,5 +1,5 @@
 ---
-title: Applying Pod Security Standards at Namespace level
+title: Apply Pod Security Standards at the Namespace Level
 content_type: tutorial
 weight: 10
 ---
@@ -9,29 +9,32 @@ This tutorial applies only for new clusters.
 {{% /alert %}}
 
 Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated
-to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission
+to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission
-is an admission controller that applies Pod Security Standards when pods are
+is an admission controller that applies 
-created. In this tutorial, we will enforce `baseline` Pod Security Standard, 
+[Pod Security Standards](docs/concepts/security/pod-security-standards/) 
+when pods are created. In this tutorial, you will enforce the `baseline` Pod Security Standard,
 one namespace at a time.
 
-# Pre-requisites
+You can also apply Pod Security Standards to multiple namespaces at once at the cluster
+level. For instructions, refer to [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss).
+## {{% heading "prerequisites" %}}
 
 Install the following on your workstation:
 
 - [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
 - [kubectl](https://kubernetes.io/docs/tasks/tools/)
 
-# Create cluster
+## Create cluster
 
 1. Create a `KinD` cluster as follows:
 
     ```shell
-    kind create cluster --name psa-ns-level --image kindest/node:latest
+    kind create cluster --name psa-ns-level --image kindest/node:v1.23.0
     ```
    The output is similar to this:
     ```
     Creating cluster "psa-ns-level" ...
-     ✓ Ensuring node image (kindest/node:latest) 🖼 
+     ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 
      ✓ Preparing nodes 📦  
      ✓ Writing configuration 📜 
      ✓ Starting control-plane 🕹️ 
@@ -45,7 +48,7 @@ Install the following on your workstation:
     Not sure what to do next? 😅  Check out https://kind.sigs.k8s.io/docs/user/quick-start/
     ```
 
-2. Set the kubectl context to the new cluster
+1. Set the kubectl context to the new cluster:
     ```shell
     kubectl cluster-info --context kind-psa-ns-level
     ```
@@ -57,9 +60,9 @@ Install the following on your workstation:
     To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
     ```
 
-# Create Namespace
+## Create a namespace
 
-Create a new namespace `example` for this tutorial:
+Create a new namespace called `example`:
 
 ```shell
 kubectl create ns example
@@ -69,9 +72,9 @@ The output is similar to this:
 namespace/example created
 ```
 
-# Applying one Pod Security Standard
+## Apply Pod Security Standards
 
-Enable Pod Security Standards on this namespace using labels supported by
+1. Enable Pod Security Standards on this namespace using labels supported by
    built-in Pod Security Admission. In this step we will warn on baseline pod
    security standard as per the latest version (default value)
 
@@ -81,9 +84,7 @@ kubectl label --overwrite ns example \
       pod-security.kubernetes.io/warn-version=latest
     ```
 
-# Applying multiple Pod Security Standards
+2. Multiple pod security standards can be enabled on any namespace, using labels.
-
-Multiple pod security standards can be enabled on any namespace, using labels.
    Following command will `enforce` the `baseline` Pod Security Standard, but
    `warn` and `audit` for `restricted` Pod Security Standards as per the latest
    version (default value)
@@ -98,7 +99,7 @@ kubectl label --overwrite ns example \
       pod-security.kubernetes.io/audit-version=latest
     ```
 
-# Create Pod
+## Verify the Pod Security Standards
 
 1. Create a minimal pod in `example` namespace:
 
@@ -116,7 +117,7 @@ kubectl label --overwrite ns example \
             - containerPort: 80
     EOF
     ```
-2. Apply the pod spec to the cluster in `example` namespace:
+1. Apply the pod spec to the cluster in `example` namespace:
     ```shell
     kubectl apply -n example -f /tmp/pss/nginx-pod.yaml
     ```
@@ -126,7 +127,7 @@ kubectl label --overwrite ns example \
     pod/nginx created
     ```
 
-3. Apply the pod spec to the cluster in `default` namespace:
+1. Apply the pod spec to the cluster in `default` namespace:
     ```shell
      kubectl apply -n default -f /tmp/pss/nginx-pod.yaml
     ```
@@ -135,20 +136,18 @@ kubectl label --overwrite ns example \
     pod/nginx created
     ```
 
-As you can see the Pod Security Standards were applied only to `example` 
+The Pod Security Standards were applied only to the `example`
-namespace. For `default` namespace, pod was created without any warnings. 
+namespace. You could create the same Pod in the `default` namespace
-To apply pod security standards to multiple namespaces at once at cluster 
+with no warnings.
-level, please 
-[follow this tutorial](/docs/tutorials/security/cluster-level-pss).
 
-# Clean up
+## Clean up
 
 Run `kind delete cluster -name psa-ns-level` to delete the cluster created.
 
 ## {{% heading "whatsnext" %}}
 
 - Run a
-[gist](https://gist.github.com/PushkarJ/c694bac35c2d100f906861667474afb5)
+  [shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh)
   to perform all the preceding steps all at once.
   1. Create KinD cluster
   2. Create new namespace
@@ -157,4 +156,4 @@ to perform all the preceding steps all at once.
   4. Create a new pod with the following pod security standards applied
 - [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
 - [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
-- [Applying Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/)
+- [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/)

content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh

@@ -0,0 +1,70 @@
+#!/bin/sh
+mkdir -p /tmp/pss
+cat <<EOF > /tmp/pss/cluster-level-pss.yaml
+apiVersion: apiserver.config.k8s.io/v1
+kind: AdmissionConfiguration
+plugins:
+- name: PodSecurity
+  configuration:
+    apiVersion: pod-security.admission.config.k8s.io/v1beta1
+    kind: PodSecurityConfiguration
+    defaults:
+      enforce: "baseline"
+      enforce-version: "latest"
+      audit: "restricted"
+      audit-version: "latest"
+      warn: "restricted"
+      warn-version: "latest"
+    exemptions:
+      usernames: []
+      runtimeClasses: []
+      namespaces: [kube-system]
+EOF
+cat <<EOF > /tmp/pss/cluster-config.yaml
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+- role: control-plane
+  kubeadmConfigPatches:
+  - |
+    kind: ClusterConfiguration
+    apiServer:
+        extraArgs:
+          admission-control-config-file: /etc/config/cluster-level-pss.yaml
+        extraVolumes:
+          - name: accf
+            hostPath: /etc/config
+            mountPath: /etc/config
+            readOnly: false
+            pathType: "DirectoryOrCreate"
+  extraMounts:
+  - hostPath: /tmp/pss
+    containerPath: /etc/config
+    # optional: if set, the mount is read-only.
+    # default false
+    readOnly: false
+    # optional: if set, the mount needs SELinux relabeling.
+    # default false
+    selinuxRelabel: false
+    # optional: set propagation mode (None, HostToContainer or Bidirectional)
+    # see https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
+    # default None
+    propagation: None
+EOF
+kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml
+kubectl cluster-info --context kind-psa-with-cluster-pss
+# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available
+sleep 15
+cat <<EOF > /tmp/pss/nginx-pod.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+spec:
+  containers:
+    - image: nginx
+      name: nginx
+      ports:
+        - containerPort: 80
+EOF
+kubectl apply -f /tmp/pss/nginx-pod.yaml

content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Until v1.23 is released, kind node image needs to be built from k/k master branch
+# Ref: https://kind.sigs.k8s.io/docs/user/quick-start/#building-images
+kind create cluster --name psa-ns-level --image kindest/node:v1.23.0
+kubectl cluster-info --context kind-psa-ns-level
+# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available
+sleep 15
+kubectl create ns example
+kubectl label --overwrite ns example \
+  pod-security.kubernetes.io/enforce=baseline \
+  pod-security.kubernetes.io/enforce-version=latest \
+  pod-security.kubernetes.io/warn=restricted \
+  pod-security.kubernetes.io/warn-version=latest \
+  pod-security.kubernetes.io/audit=restricted \
+  pod-security.kubernetes.io/audit-version=latest
+cat <<EOF > /tmp/pss/nginx-pod.yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+spec:
+  containers:
+    - image: nginx
+      name: nginx
+      ports:
+        - containerPort: 80
+EOF
+kubectl apply -n example -f /tmp/pss/nginx-pod.yaml