whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added shell script examples

Browse Source 
Fixed nits, broken links and numbering

Co-authored-by: Tim Bannister <tim@scalefactory.com>
Co-authored-by: Shannon Kularathna <ax3shannonkularathna@gmail.com>
Co-authored-by: Jim Angel <jimangel@users.noreply.github.com>
This commit is contained in:
Pushkar Joglekar
2021-12-07 03:42:39 +05:30
committed by Pushkar Joglekar
parent d29e93acbb
commit d1e25451d3
5 changed files with 286 additions and 184 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tutorials/_index.md
+2 -2
View File
@@ -59,8 +59,8 @@ Before walking through each tutorial, you may want to bookmark the
## Security
* [Applying Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/)
* [Applying Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/)
* [Apply Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/)
* [Apply Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/)
## {{% heading "whatsnext" %}}
content/en/docs/tutorials/security/cluster-level-pss.md
+44 -39
View File
@@ -1,5 +1,5 @@
---
title: Applying Pod Security Standards at the cluster level
title: Apply Pod Security Standards at the Cluster Level
content_type: tutorial
weight: 10
---
@@ -8,15 +8,16 @@ weight: 10
This tutorial applies only for new clusters.
{{% /alert %}}
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated
to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission
is an admission controller that applies Pod Security Standards when pods are
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it has
[graduated to beta](/blog/2021/12/09/pod-security-admission-beta/).
Pod Security
is an admission controller that carries out checks against the Kubernetes
[Pod Security Standards](docs/concepts/security/pod-security-standards/) when new pods are
created. This tutorial shows you how to enforce the `baseline` Pod Security
Standard at the cluster level which applies a standard configuration
to all namespaces in a cluster.
For applying pod security standards one namespace at a time, please [follow this
tutorial](/docs/tutorials/security/ns-level-pss).
To apply Pod Security Standards to specific namespaces, refer to [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss).
## {{% heading "prerequisites" %}}
@@ -37,12 +38,12 @@ that are most appropriate for your configuration, do the following:
1. Create a cluster with no Pod Security Standards applied:
```shell
kind create cluster --name psa-wo-cluster-pss --image kindest/node:latest
kind create cluster --name psa-wo-cluster-pss --image kindest/node:v1.23.0
```
The output is similar to this:
```
Creating cluster "psa-wo-cluster-pss" ...
✓ Ensuring node image (kindest/node:latest) 🖼
✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦
✓ Writing configuration 📜
✓ Starting control-plane 🕹️
@@ -57,7 +58,7 @@ that are most appropriate for your configuration, do the following:
```
2. Set the kubectl context to the new cluster:
1. Set the kubectl context to the new cluster:
```shell
kubectl cluster-info --context kind-psa-wo-cluster-pss
@@ -72,7 +73,7 @@ that are most appropriate for your configuration, do the following:
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
```
3. Get a list of namespaces in the cluster:
1. Get a list of namespaces in the cluster:
```shell
kubectl get ns
@@ -87,7 +88,7 @@ that are most appropriate for your configuration, do the following:
local-path-storage Active 9m26s
```
4. Use `--dry-run=server` to understand what happens when different Pod Security Standards
1. Use `--dry-run=server` to understand what happens when different Pod Security Standards
are applied:
1. Privileged
@@ -148,10 +149,10 @@ warnings, specifically in the `kube-system` namespace.
## Set modes, versions and standards
In this tutorial, you apply the following Pod Security Standards to the `latest` version:
In this section, you apply the following Pod Security Standards to the `latest` version:
* `baseline` standard in `enforce` mode.
* `restricted` standard in `warn` and `audit` mode.
* `baseline` standard in `enforce` mode.
* `restricted` standard in `warn` and `audit` mode.
The `baseline` Pod Security Standard provides a convenient
middle ground that allows keeping the exemption list short and prevents known
@@ -166,20 +167,21 @@ following:
1. Based on the risk posture applied to a cluster, a stricter Pod Security
Standard like `restricted` might be a better choice.
1. Exempting the `kube-system` namespace allows pods to run as
`privileged` in this namespace. We recommend that you apply strict RBAC
`privileged` in this namespace. For real world use, the Kubernetes project
strongly recommends that you apply strict RBAC
policies that limit access to `kube-system`, following the principle of least
privilege.
To implement the preceding standards, do the following:
1. Create a configuration file that can be consumed by the Pod Security
Admission Controller to implement these Pod Security Standards:
Admission Controller to implement these Pod Security Standards:
```
mkdir -p /tmp/pss
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
```
mkdir -p /tmp/pss
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1beta1
kind: PodSecurityConfiguration
@@ -194,9 +196,8 @@ plugins:
usernames: []
runtimeClasses: []
namespaces: [kube-system]
EOF
```
EOF
```
1. Configure the API server to consume this file during cluster creation:
@@ -235,21 +236,21 @@ EOF
```
{{<note>}}
If you use Docker Desktop with KinD, the `/tmp`
directory is added as a Shared Directory under
**Preferences > Resources > File Sharing** on Mac OS.
If you use Docker Desktop with KinD on macOS, you can
add `/tmp` as a Shared Directory under the menu item
**Preferences > Resources > File Sharing**.
{{</note>}}
2. Create a cluster that uses Pod Security Admission to apply
1. Create a cluster that uses Pod Security Admission to apply
these Pod Security Standards:
```shell
kind create cluster --name psa-with-cluster-pss --image kindest/node:latest --config /tmp/pss/cluster-config.yaml
kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml
```
The output is similar to this:
```
Creating cluster "psa-with-cluster-pss" ...
✓ Ensuring node image (kindest/node:latest) 🖼
✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦
✓ Writing configuration 📜
✓ Starting control-plane 🕹️
@@ -261,17 +262,20 @@ EOF
kubectl cluster-info --context kind-psa-with-cluster-pss
Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂
```
3. Point kubectl to the cluster
1. Point kubectl to the cluster
```shell
kubectl cluster-info --context kind-psa-with-cluster-pss
```
The output is similar to this:
```
Kubernetes control plane is running at https://127.0.0.1:63855
CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
```
4. Create a Pod with minimal configuration in the default namespace:
1. Create the following Pod specification for a minimal configuration in the default namespace:
```
cat <<EOF > /tmp/pss/nginx-pod.yaml
@@ -287,7 +291,7 @@ EOF
- containerPort: 80
EOF
```
5. Create Pod after pod security is enabled at cluster level:
1. Create the Pod in the cluster:
```shell
kubectl apply -f /tmp/pss/nginx-pod.yaml
@@ -297,6 +301,7 @@ EOF
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
pod/nginx created
```
## Clean up
Run `kind delete cluster -name psa-with-cluster-pss` and
@@ -306,7 +311,7 @@ created.
## {{% heading "whatsnext" %}}
- Run a
[gist](https://gist.github.com/PushkarJ/9f7a0045f4bec31097bdd1e9db0f2f6e)
[shell script](/examples/security/kind-with-cluster-level-baseline-pod-security.sh)
to perform all the preceding steps at once:
1. Create a Pod Security Standards based cluster level Configuration
2. Create a file to let API server consumes this configuration
@@ -316,4 +321,4 @@ created.
6. Apply this file to create a Pod in the new cluster
- [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
- [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
- [Applying Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/)
- [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/)
content/en/docs/tutorials/security/ns-level-pss.md
+38 -39
View File
@@ -1,5 +1,5 @@
---
title: Applying Pod Security Standards at Namespace level
title: Apply Pod Security Standards at the Namespace Level
content_type: tutorial
weight: 10
---
@@ -9,29 +9,32 @@ This tutorial applies only for new clusters.
{{% /alert %}}
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated
to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission
is an admission controller that applies Pod Security Standards when pods are
created. In this tutorial, we will enforce `baseline` Pod Security Standard,
to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission
is an admission controller that applies
[Pod Security Standards](docs/concepts/security/pod-security-standards/)
when pods are created. In this tutorial, you will enforce the `baseline` Pod Security Standard,
one namespace at a time.
# Pre-requisites
You can also apply Pod Security Standards to multiple namespaces at once at the cluster
level. For instructions, refer to [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss).
## {{% heading "prerequisites" %}}
Install the following on your workstation:
- [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
- [kubectl](https://kubernetes.io/docs/tasks/tools/)
# Create cluster
## Create cluster
1. Create a `KinD` cluster as follows:
```shell
kind create cluster --name psa-ns-level --image kindest/node:latest
kind create cluster --name psa-ns-level --image kindest/node:v1.23.0
```
The output is similar to this:
```
Creating cluster "psa-ns-level" ...
✓ Ensuring node image (kindest/node:latest) 🖼
✓ Ensuring node image (kindest/node:v1.23.0) 🖼
✓ Preparing nodes 📦
✓ Writing configuration 📜
✓ Starting control-plane 🕹️
@@ -45,7 +48,7 @@ Install the following on your workstation:
Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/
```
2. Set the kubectl context to the new cluster
1. Set the kubectl context to the new cluster:
```shell
kubectl cluster-info --context kind-psa-ns-level
```
@@ -57,9 +60,9 @@ Install the following on your workstation:
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
```
# Create Namespace
## Create a namespace
Create a new namespace `example` for this tutorial:
Create a new namespace called `example`:
```shell
kubectl create ns example
@@ -69,36 +72,34 @@ The output is similar to this:
namespace/example created
```
# Applying one Pod Security Standard
## Apply Pod Security Standards
Enable Pod Security Standards on this namespace using labels supported by
built-in Pod Security Admission. In this step we will warn on baseline pod
security standard as per the latest version (default value)
1. Enable Pod Security Standards on this namespace using labels supported by
built-in Pod Security Admission. In this step we will warn on baseline pod
security standard as per the latest version (default value)
```shell
kubectl label --overwrite ns example \
```shell
kubectl label --overwrite ns example \
pod-security.kubernetes.io/warn=baseline \
pod-security.kubernetes.io/warn-version=latest
```
```
# Applying multiple Pod Security Standards
2. Multiple pod security standards can be enabled on any namespace, using labels.
Following command will `enforce` the `baseline` Pod Security Standard, but
`warn` and `audit` for `restricted` Pod Security Standards as per the latest
version (default value)
Multiple pod security standards can be enabled on any namespace, using labels.
Following command will `enforce` the `baseline` Pod Security Standard, but
`warn` and `audit` for `restricted` Pod Security Standards as per the latest
version (default value)
```
kubectl label --overwrite ns example \
```
kubectl label --overwrite ns example \
pod-security.kubernetes.io/enforce=baseline \
pod-security.kubernetes.io/enforce-version=latest \
pod-security.kubernetes.io/warn=restricted \
pod-security.kubernetes.io/warn-version=latest \
pod-security.kubernetes.io/audit=restricted \
pod-security.kubernetes.io/audit-version=latest
```
```
# Create Pod
## Verify the Pod Security Standards
1. Create a minimal pod in `example` namespace:
@@ -116,7 +117,7 @@ kubectl label --overwrite ns example \
- containerPort: 80
EOF
```
2. Apply the pod spec to the cluster in `example` namespace:
1. Apply the pod spec to the cluster in `example` namespace:
```shell
kubectl apply -n example -f /tmp/pss/nginx-pod.yaml
```
@@ -126,7 +127,7 @@ kubectl label --overwrite ns example \
pod/nginx created
```
3. Apply the pod spec to the cluster in `default` namespace:
1. Apply the pod spec to the cluster in `default` namespace:
```shell
kubectl apply -n default -f /tmp/pss/nginx-pod.yaml
```
@@ -135,21 +136,19 @@ kubectl label --overwrite ns example \
pod/nginx created
```
As you can see the Pod Security Standards were applied only to `example`
namespace. For `default` namespace, pod was created without any warnings.
To apply pod security standards to multiple namespaces at once at cluster
level, please
[follow this tutorial](/docs/tutorials/security/cluster-level-pss).
The Pod Security Standards were applied only to the `example`
namespace. You could create the same Pod in the `default` namespace
with no warnings.
# Clean up
## Clean up
Run `kind delete cluster -name psa-ns-level` to delete the cluster created.
## {{% heading "whatsnext" %}}
- Run a
[gist](https://gist.github.com/PushkarJ/c694bac35c2d100f906861667474afb5)
to perform all the preceding steps all at once.
[shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh)
to perform all the preceding steps all at once.
1. Create KinD cluster
2. Create new namespace
3. Apply `baseline` Pod Security Standard in `enforce` mode while applying
@@ -157,4 +156,4 @@ to perform all the preceding steps all at once.
4. Create a new pod with the following pod security standards applied
- [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
- [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
- [Applying Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/)
- [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/)
content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh
+70
View File
@@ -0,0 +1,70 @@
#!/bin/sh
mkdir -p /tmp/pss
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1beta1
kind: PodSecurityConfiguration
defaults:
enforce: "baseline"
enforce-version: "latest"
audit: "restricted"
audit-version: "latest"
warn: "restricted"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: [kube-system]
EOF
cat <<EOF > /tmp/pss/cluster-config.yaml
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
kubeadmConfigPatches:
- |
kind: ClusterConfiguration
apiServer:
extraArgs:
admission-control-config-file: /etc/config/cluster-level-pss.yaml
extraVolumes:
- name: accf
hostPath: /etc/config
mountPath: /etc/config
readOnly: false
pathType: "DirectoryOrCreate"
extraMounts:
- hostPath: /tmp/pss
containerPath: /etc/config
# optional: if set, the mount is read-only.
# default false
readOnly: false
# optional: if set, the mount needs SELinux relabeling.
# default false
selinuxRelabel: false
# optional: set propagation mode (None, HostToContainer or Bidirectional)
# see https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
# default None
propagation: None
EOF
kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml
kubectl cluster-info --context kind-psa-with-cluster-pss
# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available
sleep 15
cat <<EOF > /tmp/pss/nginx-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
EOF
kubectl apply -f /tmp/pss/nginx-pod.yaml
content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh
+28
View File
@@ -0,0 +1,28 @@
#!/bin/sh
# Until v1.23 is released, kind node image needs to be built from k/k master branch
# Ref: https://kind.sigs.k8s.io/docs/user/quick-start/#building-images
kind create cluster --name psa-ns-level --image kindest/node:v1.23.0
kubectl cluster-info --context kind-psa-ns-level
# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available
sleep 15
kubectl create ns example
kubectl label --overwrite ns example \
pod-security.kubernetes.io/enforce=baseline \
pod-security.kubernetes.io/enforce-version=latest \
pod-security.kubernetes.io/warn=restricted \
pod-security.kubernetes.io/warn-version=latest \
pod-security.kubernetes.io/audit=restricted \
pod-security.kubernetes.io/audit-version=latest
cat <<EOF > /tmp/pss/nginx-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
EOF
kubectl apply -n example -f /tmp/pss/nginx-pod.yaml