whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added shell script examples

Browse Source 
Fixed nits, broken links and numbering

Co-authored-by: Tim Bannister <tim@scalefactory.com>
Co-authored-by: Shannon Kularathna <ax3shannonkularathna@gmail.com>
Co-authored-by: Jim Angel <jimangel@users.noreply.github.com>
This commit is contained in:
Pushkar Joglekar
2021-12-07 03:42:39 +05:30
committed by Pushkar Joglekar
parent d29e93acbb
commit d1e25451d3
5 changed files with 286 additions and 184 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tutorials/_index.md
+2 -2
View File
@@ -59,8 +59,8 @@ Before walking through each tutorial, you may want to bookmark the
## Security ## Security
* [Applying Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/) * [Apply Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/)
* [Applying Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/) * [Apply Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/)
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
content/en/docs/tutorials/security/cluster-level-pss.md
+129 -124
View File
@@ -1,5 +1,5 @@
--- ---
title: Applying Pod Security Standards at the cluster level title: Apply Pod Security Standards at the Cluster Level
content_type: tutorial content_type: tutorial
weight: 10 weight: 10
--- ---
@@ -8,15 +8,16 @@ weight: 10
This tutorial applies only for new clusters. This tutorial applies only for new clusters.
{{% /alert %}} {{% /alert %}}
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated Pod Security admission (PSA) is enabled by default in v1.23 and later, as it has
to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission [graduated to beta](/blog/2021/12/09/pod-security-admission-beta/).
is an admission controller that applies Pod Security Standards when pods are Pod Security
created. This tutorial shows you how to enforce the `baseline` Pod Security is an admission controller that carries out checks against the Kubernetes
Standard at the cluster level which applies a standard configuration [Pod Security Standards](docs/concepts/security/pod-security-standards/) when new pods are
created. This tutorial shows you how to enforce the `baseline` Pod Security
Standard at the cluster level which applies a standard configuration
to all namespaces in a cluster. to all namespaces in a cluster.
For applying pod security standards one namespace at a time, please [follow this To apply Pod Security Standards to specific namespaces, refer to [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss).
tutorial](/docs/tutorials/security/ns-level-pss).
## {{% heading "prerequisites" %}} ## {{% heading "prerequisites" %}}
@@ -37,12 +38,12 @@ that are most appropriate for your configuration, do the following:
1. Create a cluster with no Pod Security Standards applied: 1. Create a cluster with no Pod Security Standards applied:
```shell ```shell
kind create cluster --name psa-wo-cluster-pss --image kindest/node:latest kind create cluster --name psa-wo-cluster-pss --image kindest/node:v1.23.0
``` ```
The output is similar to this: The output is similar to this:
``` ```
Creating cluster "psa-wo-cluster-pss" ... Creating cluster "psa-wo-cluster-pss" ...
✓ Ensuring node image (kindest/node:latest) 🖼 ✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦 ✓ Preparing nodes 📦
✓ Writing configuration 📜 ✓ Writing configuration 📜
✓ Starting control-plane 🕹️ ✓ Starting control-plane 🕹️
@@ -57,12 +58,12 @@ that are most appropriate for your configuration, do the following:
``` ```
2. Set the kubectl context to the new cluster: 1. Set the kubectl context to the new cluster:
```shell ```shell
kubectl cluster-info --context kind-psa-wo-cluster-pss kubectl cluster-info --context kind-psa-wo-cluster-pss
``` ```
The output is similar to this: The output is similar to this:
``` ```
Kubernetes control plane is running at https://127.0.0.1:61350 Kubernetes control plane is running at https://127.0.0.1:61350
@@ -72,7 +73,7 @@ that are most appropriate for your configuration, do the following:
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
``` ```
3. Get a list of namespaces in the cluster: 1. Get a list of namespaces in the cluster:
```shell ```shell
kubectl get ns kubectl get ns
@@ -87,60 +88,60 @@ that are most appropriate for your configuration, do the following:
local-path-storage Active 9m26s local-path-storage Active 9m26s
``` ```
4. Use `--dry-run=server` to understand what happens when different Pod Security Standards 1. Use `--dry-run=server` to understand what happens when different Pod Security Standards
are applied: are applied:
1. Privileged 1. Privileged
```shell ```shell
kubectl label --dry-run=server --overwrite ns --all \ kubectl label --dry-run=server --overwrite ns --all \
pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/enforce=privileged
``` ```
The output is similar to this: The output is similar to this:
``` ```
namespace/default labeled namespace/default labeled
namespace/kube-node-lease labeled namespace/kube-node-lease labeled
namespace/kube-public labeled namespace/kube-public labeled
namespace/kube-system labeled namespace/kube-system labeled
namespace/local-path-storage labeled namespace/local-path-storage labeled
``` ```
2. Baseline 2. Baseline
```shell ```shell
kubectl label --dry-run=server --overwrite ns --all \ kubectl label --dry-run=server --overwrite ns --all \
pod-security.kubernetes.io/enforce=baseline pod-security.kubernetes.io/enforce=baseline
``` ```
The output is similar to this: The output is similar to this:
``` ```
namespace/default labeled namespace/default labeled
namespace/kube-node-lease labeled namespace/kube-node-lease labeled
namespace/kube-public labeled namespace/kube-public labeled
Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "baseline:latest" Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "baseline:latest"
Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes
Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes
Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged
namespace/kube-system labeled namespace/kube-system labeled
namespace/local-path-storage labeled namespace/local-path-storage labeled
``` ```
3. Restricted 3. Restricted
```shell ```shell
kubectl label --dry-run=server --overwrite ns --all \ kubectl label --dry-run=server --overwrite ns --all \
pod-security.kubernetes.io/enforce=restricted pod-security.kubernetes.io/enforce=restricted
``` ```
The output is similar to this: The output is similar to this:
``` ```
namespace/default labeled namespace/default labeled
namespace/kube-node-lease labeled namespace/kube-node-lease labeled
namespace/kube-public labeled namespace/kube-public labeled
Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "restricted:latest" Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "restricted:latest"
Warning: coredns-7bb9c7b568-hsptc (and 1 other pod): unrestricted capabilities, runAsNonRoot != true, seccompProfile Warning: coredns-7bb9c7b568-hsptc (and 1 other pod): unrestricted capabilities, runAsNonRoot != true, seccompProfile
Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true
Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile
Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile
namespace/kube-system labeled namespace/kube-system labeled
Warning: existing pods in namespace "local-path-storage" violate the new PodSecurity enforce level "restricted:latest" Warning: existing pods in namespace "local-path-storage" violate the new PodSecurity enforce level "restricted:latest"
Warning: local-path-provisioner-d6d9f7ffc-lw9lh: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile Warning: local-path-provisioner-d6d9f7ffc-lw9lh: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile
namespace/local-path-storage labeled namespace/local-path-storage labeled
``` ```
From the previous output, you'll notice that applying the `privileged` Pod Security Standard shows no warnings From the previous output, you'll notice that applying the `privileged` Pod Security Standard shows no warnings
for any namespaces. However, `baseline` and `restricted` standards both have for any namespaces. However, `baseline` and `restricted` standards both have
@@ -148,10 +149,10 @@ warnings, specifically in the `kube-system` namespace.
## Set modes, versions and standards ## Set modes, versions and standards
In this tutorial, you apply the following Pod Security Standards to the `latest` version: In this section, you apply the following Pod Security Standards to the `latest` version:
* `baseline` standard in `enforce` mode. * `baseline` standard in `enforce` mode.
* `restricted` standard in `warn` and `audit` mode. * `restricted` standard in `warn` and `audit` mode.
The `baseline` Pod Security Standard provides a convenient The `baseline` Pod Security Standard provides a convenient
middle ground that allows keeping the exemption list short and prevents known middle ground that allows keeping the exemption list short and prevents known
@@ -166,37 +167,37 @@ following:
1. Based on the risk posture applied to a cluster, a stricter Pod Security 1. Based on the risk posture applied to a cluster, a stricter Pod Security
Standard like `restricted` might be a better choice. Standard like `restricted` might be a better choice.
1. Exempting the `kube-system` namespace allows pods to run as 1. Exempting the `kube-system` namespace allows pods to run as
`privileged` in this namespace. We recommend that you apply strict RBAC `privileged` in this namespace. For real world use, the Kubernetes project
strongly recommends that you apply strict RBAC
policies that limit access to `kube-system`, following the principle of least policies that limit access to `kube-system`, following the principle of least
privilege. privilege.
To implement the preceding standards, do the following:
1. Create a configuration file that can be consumed by the Pod Security 1. Create a configuration file that can be consumed by the Pod Security
Admission Controller to implement these Pod Security Standards: Admission Controller to implement these Pod Security Standards:
```
mkdir -p /tmp/pss
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1beta1
kind: PodSecurityConfiguration
defaults:
enforce: "baseline"
enforce-version: "latest"
audit: "restricted"
audit-version: "latest"
warn: "restricted"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: [kube-system]
EOF
```
```
mkdir -p /tmp/pss
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1beta1
kind: PodSecurityConfiguration
defaults:
enforce: "baseline"
enforce-version: "latest"
audit: "restricted"
audit-version: "latest"
warn: "restricted"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: [kube-system]
EOF
```
1. Configure the API server to consume this file during cluster creation: 1. Configure the API server to consume this file during cluster creation:
@@ -234,22 +235,22 @@ EOF
EOF EOF
``` ```
{{<note>}} {{<note>}}
If you use Docker Desktop with KinD, the `/tmp` If you use Docker Desktop with KinD on macOS, you can
directory is added as a Shared Directory under add `/tmp` as a Shared Directory under the menu item
**Preferences > Resources > File Sharing** on Mac OS. **Preferences > Resources > File Sharing**.
{{</note>}} {{</note>}}
2. Create a cluster that uses Pod Security Admission to apply 1. Create a cluster that uses Pod Security Admission to apply
these Pod Security Standards: these Pod Security Standards:
```shell ```shell
kind create cluster --name psa-with-cluster-pss --image kindest/node:latest --config /tmp/pss/cluster-config.yaml kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml
``` ```
The output is similar to this: The output is similar to this:
``` ```
Creating cluster "psa-with-cluster-pss" ... Creating cluster "psa-with-cluster-pss" ...
✓ Ensuring node image (kindest/node:latest) 🖼 ✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦 ✓ Preparing nodes 📦
✓ Writing configuration 📜 ✓ Writing configuration 📜
✓ Starting control-plane 🕹️ ✓ Starting control-plane 🕹️
@@ -261,17 +262,20 @@ EOF
kubectl cluster-info --context kind-psa-with-cluster-pss kubectl cluster-info --context kind-psa-with-cluster-pss
Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂 Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂
3. Point kubectl to the cluster
```shell
kubectl cluster-info --context kind-psa-with-cluster-pss
Kubernetes control plane is running at https://127.0.0.1:63855
CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
``` ```
4. Create a Pod with minimal configuration in the default namespace: 1. Point kubectl to the cluster
```shell
kubectl cluster-info --context kind-psa-with-cluster-pss
```
The output is similar to this:
```
Kubernetes control plane is running at https://127.0.0.1:63855
CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
```
1. Create the following Pod specification for a minimal configuration in the default namespace:
``` ```
cat <<EOF > /tmp/pss/nginx-pod.yaml cat <<EOF > /tmp/pss/nginx-pod.yaml
@@ -287,8 +291,8 @@ EOF
- containerPort: 80 - containerPort: 80
EOF EOF
``` ```
5. Create Pod after pod security is enabled at cluster level: 1. Create the Pod in the cluster:
```shell ```shell
kubectl apply -f /tmp/pss/nginx-pod.yaml kubectl apply -f /tmp/pss/nginx-pod.yaml
``` ```
@@ -296,24 +300,25 @@ EOF
``` ```
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
pod/nginx created pod/nginx created
``` ```
## Clean up ## Clean up
Run `kind delete cluster -name psa-with-cluster-pss` and Run `kind delete cluster -name psa-with-cluster-pss` and
`kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you `kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you
created. created.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
- Run a - Run a
[gist](https://gist.github.com/PushkarJ/9f7a0045f4bec31097bdd1e9db0f2f6e) [shell script](/examples/security/kind-with-cluster-level-baseline-pod-security.sh)
to perform all the preceding steps at once: to perform all the preceding steps at once:
1. Create a Pod Security Standards based cluster level Configuration 1. Create a Pod Security Standards based cluster level Configuration
2. Create a file to let API server consumes this configuration 2. Create a file to let API server consumes this configuration
3. Create a cluster that creates an API server with this configuration 3. Create a cluster that creates an API server with this configuration
4. Set kubectl context to this new cluster 4. Set kubectl context to this new cluster
5. Create a minimal pod yaml file 5. Create a minimal pod yaml file
6. Apply this file to create a Pod in the new cluster 6. Apply this file to create a Pod in the new cluster
- [Pod Security Admission](/docs/concepts/security/pod-security-admission/) - [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
- [Pod Security Standards](/docs/concepts/security/pod-security-standards/) - [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
- [Applying Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/) - [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/)
content/en/docs/tutorials/security/ns-level-pss.md
+57 -58
View File
@@ -1,37 +1,40 @@
--- ---
title: Applying Pod Security Standards at Namespace level title: Apply Pod Security Standards at the Namespace Level
content_type: tutorial content_type: tutorial
weight: 10 weight: 10
--- ---
{{% alert title="Note" %}} {{% alert title="Note" %}}
This tutorial applies only for new clusters. This tutorial applies only for new clusters.
{{% /alert %}} {{% /alert %}}
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated
to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission
is an admission controller that applies Pod Security Standards when pods are is an admission controller that applies
created. In this tutorial, we will enforce `baseline` Pod Security Standard, [Pod Security Standards](docs/concepts/security/pod-security-standards/)
when pods are created. In this tutorial, you will enforce the `baseline` Pod Security Standard,
one namespace at a time. one namespace at a time.
# Pre-requisites You can also apply Pod Security Standards to multiple namespaces at once at the cluster
level. For instructions, refer to [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss).
## {{% heading "prerequisites" %}}
Install the following on your workstation: Install the following on your workstation:
- [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) - [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
- [kubectl](https://kubernetes.io/docs/tasks/tools/) - [kubectl](https://kubernetes.io/docs/tasks/tools/)
# Create cluster ## Create cluster
1. Create a `KinD` cluster as follows: 1. Create a `KinD` cluster as follows:
```shell ```shell
kind create cluster --name psa-ns-level --image kindest/node:latest kind create cluster --name psa-ns-level --image kindest/node:v1.23.0
``` ```
The output is similar to this: The output is similar to this:
``` ```
Creating cluster "psa-ns-level" ... Creating cluster "psa-ns-level" ...
✓ Ensuring node image (kindest/node:latest) 🖼 ✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦 ✓ Preparing nodes 📦
✓ Writing configuration 📜 ✓ Writing configuration 📜
✓ Starting control-plane 🕹️ ✓ Starting control-plane 🕹️
@@ -45,11 +48,11 @@ Install the following on your workstation:
Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/ Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/
``` ```
2. Set the kubectl context to the new cluster 1. Set the kubectl context to the new cluster:
```shell ```shell
kubectl cluster-info --context kind-psa-ns-level kubectl cluster-info --context kind-psa-ns-level
``` ```
The output is similar to this: The output is similar to this:
``` ```
Kubernetes control plane is running at https://127.0.0.1:50996 Kubernetes control plane is running at https://127.0.0.1:50996
CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
@@ -57,9 +60,9 @@ Install the following on your workstation:
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
``` ```
# Create Namespace ## Create a namespace
Create a new namespace `example` for this tutorial: Create a new namespace called `example`:
```shell ```shell
kubectl create ns example kubectl create ns example
@@ -69,36 +72,34 @@ The output is similar to this:
namespace/example created namespace/example created
``` ```
# Applying one Pod Security Standard ## Apply Pod Security Standards
Enable Pod Security Standards on this namespace using labels supported by 1. Enable Pod Security Standards on this namespace using labels supported by
built-in Pod Security Admission. In this step we will warn on baseline pod built-in Pod Security Admission. In this step we will warn on baseline pod
security standard as per the latest version (default value) security standard as per the latest version (default value)
```shell ```shell
kubectl label --overwrite ns example \ kubectl label --overwrite ns example \
pod-security.kubernetes.io/warn=baseline \ pod-security.kubernetes.io/warn=baseline \
pod-security.kubernetes.io/warn-version=latest pod-security.kubernetes.io/warn-version=latest
``` ```
# Applying multiple Pod Security Standards 2. Multiple pod security standards can be enabled on any namespace, using labels.
Following command will `enforce` the `baseline` Pod Security Standard, but
`warn` and `audit` for `restricted` Pod Security Standards as per the latest
version (default value)
Multiple pod security standards can be enabled on any namespace, using labels. ```
Following command will `enforce` the `baseline` Pod Security Standard, but kubectl label --overwrite ns example \
`warn` and `audit` for `restricted` Pod Security Standards as per the latest pod-security.kubernetes.io/enforce=baseline \
version (default value) pod-security.kubernetes.io/enforce-version=latest \
pod-security.kubernetes.io/warn=restricted \
pod-security.kubernetes.io/warn-version=latest \
pod-security.kubernetes.io/audit=restricted \
pod-security.kubernetes.io/audit-version=latest
```
``` ## Verify the Pod Security Standards
kubectl label --overwrite ns example \
pod-security.kubernetes.io/enforce=baseline \
pod-security.kubernetes.io/enforce-version=latest \
pod-security.kubernetes.io/warn=restricted \
pod-security.kubernetes.io/warn-version=latest \
pod-security.kubernetes.io/audit=restricted \
pod-security.kubernetes.io/audit-version=latest
```
# Create Pod
1. Create a minimal pod in `example` namespace: 1. Create a minimal pod in `example` namespace:
@@ -116,45 +117,43 @@ kubectl label --overwrite ns example \
- containerPort: 80 - containerPort: 80
EOF EOF
``` ```
2. Apply the pod spec to the cluster in `example` namespace: 1. Apply the pod spec to the cluster in `example` namespace:
```shell ```shell
kubectl apply -n example -f /tmp/pss/nginx-pod.yaml kubectl apply -n example -f /tmp/pss/nginx-pod.yaml
``` ```
The output is similar to this: The output is similar to this:
``` ```
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
pod/nginx created pod/nginx created
``` ```
3. Apply the pod spec to the cluster in `default` namespace: 1. Apply the pod spec to the cluster in `default` namespace:
```shell ```shell
kubectl apply -n default -f /tmp/pss/nginx-pod.yaml kubectl apply -n default -f /tmp/pss/nginx-pod.yaml
``` ```
Output is similar to this: Output is similar to this:
``` ```
pod/nginx created pod/nginx created
``` ```
As you can see the Pod Security Standards were applied only to `example` The Pod Security Standards were applied only to the `example`
namespace. For `default` namespace, pod was created without any warnings. namespace. You could create the same Pod in the `default` namespace
To apply pod security standards to multiple namespaces at once at cluster with no warnings.
level, please
[follow this tutorial](/docs/tutorials/security/cluster-level-pss).
# Clean up ## Clean up
Run `kind delete cluster -name psa-ns-level` to delete the cluster created. Run `kind delete cluster -name psa-ns-level` to delete the cluster created.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
- Run a - Run a
[gist](https://gist.github.com/PushkarJ/c694bac35c2d100f906861667474afb5) [shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh)
to perform all the preceding steps all at once. to perform all the preceding steps all at once.
1. Create KinD cluster 1. Create KinD cluster
2. Create new namespace 2. Create new namespace
3. Apply `baseline` Pod Security Standard in `enforce` mode while applying 3. Apply `baseline` Pod Security Standard in `enforce` mode while applying
`restricted` Pod Security Standard also in `warn` and `audit` mode. `restricted` Pod Security Standard also in `warn` and `audit` mode.
4. Create a new pod with the following pod security standards applied 4. Create a new pod with the following pod security standards applied
- [Pod Security Admission](/docs/concepts/security/pod-security-admission/) - [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
- [Pod Security Standards](/docs/concepts/security/pod-security-standards/) - [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
- [Applying Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) - [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/)
content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh
+70
View File
@@ -0,0 +1,70 @@
#!/bin/sh
mkdir -p /tmp/pss
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1beta1
kind: PodSecurityConfiguration
defaults:
enforce: "baseline"
enforce-version: "latest"
audit: "restricted"
audit-version: "latest"
warn: "restricted"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: [kube-system]
EOF
cat <<EOF > /tmp/pss/cluster-config.yaml
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
kubeadmConfigPatches:
- |
kind: ClusterConfiguration
apiServer:
extraArgs:
admission-control-config-file: /etc/config/cluster-level-pss.yaml
extraVolumes:
- name: accf
hostPath: /etc/config
mountPath: /etc/config
readOnly: false
pathType: "DirectoryOrCreate"
extraMounts:
- hostPath: /tmp/pss
containerPath: /etc/config
# optional: if set, the mount is read-only.
# default false
readOnly: false
# optional: if set, the mount needs SELinux relabeling.
# default false
selinuxRelabel: false
# optional: set propagation mode (None, HostToContainer or Bidirectional)
# see https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
# default None
propagation: None
EOF
kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml
kubectl cluster-info --context kind-psa-with-cluster-pss
# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available
sleep 15
cat <<EOF > /tmp/pss/nginx-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
EOF
kubectl apply -f /tmp/pss/nginx-pod.yaml
content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh
+28
View File
@@ -0,0 +1,28 @@
#!/bin/sh
# Until v1.23 is released, kind node image needs to be built from k/k master branch
# Ref: https://kind.sigs.k8s.io/docs/user/quick-start/#building-images
kind create cluster --name psa-ns-level --image kindest/node:v1.23.0
kubectl cluster-info --context kind-psa-ns-level
# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available
sleep 15
kubectl create ns example
kubectl label --overwrite ns example \
pod-security.kubernetes.io/enforce=baseline \
pod-security.kubernetes.io/enforce-version=latest \
pod-security.kubernetes.io/warn=restricted \
pod-security.kubernetes.io/warn-version=latest \
pod-security.kubernetes.io/audit=restricted \
pod-security.kubernetes.io/audit-version=latest
cat <<EOF > /tmp/pss/nginx-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
EOF
kubectl apply -n example -f /tmp/pss/nginx-pod.yaml