Merge "Support for Pod Security Admission Controller - Tech Preview"
This commit is contained in:
Zuul
Gerrit Code Review
commit
245d5bc62d
@ -49,6 +49,7 @@ Manage Non-Admin Type Users
|
|||||||
disable-pod-security-policy-checking
|
disable-pod-security-policy-checking
|
||||||
assign-pod-security-policies
|
assign-pod-security-policies
|
||||||
resource-management
|
resource-management
|
||||||
|
pod-security-admission-controller-8e9e6994100f
|
||||||
|
|
||||||
.. _user-authentication-using-windows-active-directory-security-index:
|
.. _user-authentication-using-windows-active-directory-security-index:
|
||||||
|
|
||||||
|
|||||||
@ -0,0 +1,289 @@
|
|||||||
|
.. _pod-security-admission-controller-8e9e6994100f:
|
||||||
|
|
||||||
|
======================================================
|
||||||
|
Technology Preview - Pod Security Admission Controller
|
||||||
|
======================================================
|
||||||
|
|
||||||
|
Pod Security Admission (PSA) Controller is the |PSP| replacement, and this
|
||||||
|
document describes the technical preview of |PSA| functionality which is 'beta'
|
||||||
|
quality in K8S v1.23 .
|
||||||
|
|
||||||
|
The |PSA| admission controller acts on creation and modification of the pod and
|
||||||
|
determines if it should be admitted based on the requested security context and
|
||||||
|
the policies defined by Pod Security Standards.
|
||||||
|
|
||||||
|
-------------------
|
||||||
|
Pod Security levels
|
||||||
|
-------------------
|
||||||
|
|
||||||
|
Pod Security Admission levels refer to the 3 policies defined by the Pod
|
||||||
|
Security Standards: privileged, baseline, and restricted.
|
||||||
|
|
||||||
|
Privileged
|
||||||
|
Unrestricted policy, providing the widest possible level of permissions.
|
||||||
|
This policy allows for known privilege escalations. It aims at system- and
|
||||||
|
infrastructure-level workloads managed by privileged, trusted users.
|
||||||
|
|
||||||
|
Baseline
|
||||||
|
Minimally restrictive policy which prevents known privilege escalations. It
|
||||||
|
aims at ease of adoption for common containerized workloads for
|
||||||
|
non-critical applications.
|
||||||
|
|
||||||
|
Restricted
|
||||||
|
Heavily restricted policy, following current Pod hardening best practices.
|
||||||
|
It is targeted at operators and developers of security-critical
|
||||||
|
applications, as well as lower-trust users.
|
||||||
|
|
||||||
|
--------------------------------------------
|
||||||
|
Pod Security Admission labels for namespaces
|
||||||
|
--------------------------------------------
|
||||||
|
|
||||||
|
Pod security restrictions are applied at the namespace level.
|
||||||
|
|
||||||
|
With |PSA| feature enabled, namespaces can be configured to define the
|
||||||
|
admission control mode to be used for pod security in each namespace.
|
||||||
|
Kubernetes defines a set of labels to set predefined Pod Security levels for a
|
||||||
|
namespace. The label will define what action the controller control plane takes
|
||||||
|
if a potential violation is detected.
|
||||||
|
|
||||||
|
A namespace can configure any or all modes, or set different levels for
|
||||||
|
different modes. The modes are:
|
||||||
|
|
||||||
|
enforce
|
||||||
|
Policy violations will cause the pod to be rejected.
|
||||||
|
|
||||||
|
audit
|
||||||
|
Policy violations will trigger the addition of an audit annotation to the
|
||||||
|
event recorded in the K8S audit log but are otherwise allowed.
|
||||||
|
|
||||||
|
warn
|
||||||
|
Policy violations will trigger a user-facing warning but are otherwise
|
||||||
|
allowed.
|
||||||
|
|
||||||
|
For each mode, there are two labels that determine the policy used.
|
||||||
|
|
||||||
|
This is a generic namespace configuration using labels.
|
||||||
|
|
||||||
|
.. code-block:: none
|
||||||
|
|
||||||
|
# label indicates which policy level to apply for the mode.
|
||||||
|
#
|
||||||
|
# MODE must be one of `enforce`, `audit`, or `warn`.
|
||||||
|
# LEVEL must be one of `privileged`, `baseline`, or `restricted`.
|
||||||
|
pod-security.kubernetes.io/<MODE>: <LEVEL>
|
||||||
|
|
||||||
|
# Optional: per-mode version label can be used to pin the policy to the
|
||||||
|
# version that shipped with a given Kubernetes minor version (e.g. v1.23).
|
||||||
|
#
|
||||||
|
# MODE must be one of `enforce`, `audit`, or `warn`.
|
||||||
|
# VERSION must be a valid Kubernetes minor version, or `latest`.
|
||||||
|
pod-security.kubernetes.io/<MODE>-version: <VERSION>
|
||||||
|
|
||||||
|
For more information refer to
|
||||||
|
`https://kubernetes.io/docs/concepts/security/pod-security-admission/
|
||||||
|
<https://kubernetes.io/docs/concepts/security/pod-security-admission/>`__.
|
||||||
|
|
||||||
|
-----------------------------
|
||||||
|
Enable Pod Security Admission
|
||||||
|
-----------------------------
|
||||||
|
|
||||||
|
To enable |PSA|, PodSecurity feature gate must be enabled.
|
||||||
|
|
||||||
|
Starting with Kubernetes 1.23 version, PodSecurity feature gate is enabled by
|
||||||
|
default.
|
||||||
|
|
||||||
|
For Kubernetes version 1.22, PodSecurity feature gate can be enabled using
|
||||||
|
option ``feature-gates`` in bootstrap overrides file, ``localhost.yml``. As the
|
||||||
|
example shown below:
|
||||||
|
|
||||||
|
.. code-block:: none
|
||||||
|
|
||||||
|
apiserver_extra_args:
|
||||||
|
feature-gates: "TTLAfterFinished=true,HugePageStorageMediumSize=true,RemoveSelfLink=false,MemoryManager=true,PodSecurity=true"
|
||||||
|
|
||||||
|
See :ref:`Kubernetes Custom Configuration
|
||||||
|
<kubernetes-custom-configuration-31c1fd41857d>` for more details on kubernetes
|
||||||
|
configuration, ``apiserver_extra_args`` and ``apiserver_extra_volumes``.
|
||||||
|
|
||||||
|
.. _configure-defaults-for-the-pod-security-admission-controller-525590d11815:
|
||||||
|
|
||||||
|
------------------------------------------------------------
|
||||||
|
Configure defaults for the Pod Security Admission Controller
|
||||||
|
------------------------------------------------------------
|
||||||
|
|
||||||
|
For the technology preview of the |PSA| controller, the |PSA| controller can be
|
||||||
|
configured with default security polices and exemptions at bootstrap time.
|
||||||
|
|
||||||
|
The Default |PSA| controller configuration will apply to namespaces that are
|
||||||
|
not configured with the ``pod-security.kubernetes.io`` labels to specify a
|
||||||
|
security level and mode. For example if you display the namespace description
|
||||||
|
using ``kubectl describe namespace <namespace>`` and the
|
||||||
|
``pod-security.kubernetes.io`` labels are not displayed, then the behavior of
|
||||||
|
the namespace will follow the default |PSA| labels' level, mode and version
|
||||||
|
configuration set with PodSecurity plugin of the AdmissionConfiguration
|
||||||
|
resource.
|
||||||
|
|
||||||
|
To configure ``cluster-wide`` default policies and/or exemptions, the
|
||||||
|
PodSecurity plugin of the AdmissionConfiguration resource can be used. The
|
||||||
|
AdmissionConfiguration resource is configurable at bootstrap time with the
|
||||||
|
``api-server_extra_args`` and ``apiserver_extra_volumes`` overrides in the
|
||||||
|
``localhost.yml`` file.
|
||||||
|
|
||||||
|
Any policy that is applied via namespace labels will take precedence.
|
||||||
|
|
||||||
|
Example of configuration added to ``localhost.yml``:
|
||||||
|
|
||||||
|
.. code-block:: none
|
||||||
|
|
||||||
|
apiserver_extra_args:
|
||||||
|
admission-control-config-file: "/etc/kubernetes/admission-control-config-file.yaml"
|
||||||
|
|
||||||
|
apiserver_extra_volumes:
|
||||||
|
- name: admission-control-config-file
|
||||||
|
mountPath: "/etc/kubernetes/admission-control-config-file.yaml"
|
||||||
|
pathType: "File"
|
||||||
|
readOnly: true
|
||||||
|
content: |
|
||||||
|
apiVersion: apiserver.config.k8s.io/v1
|
||||||
|
kind: AdmissionConfiguration
|
||||||
|
plugins:
|
||||||
|
- name: PodSecurity
|
||||||
|
configuration:
|
||||||
|
apiVersion: pod-security.admission.config.k8s.io/v1beta1
|
||||||
|
kind: PodSecurityConfiguration
|
||||||
|
defaults:
|
||||||
|
enforce: "privileged"
|
||||||
|
enforce-version: "latest"
|
||||||
|
audit: "privileged"
|
||||||
|
audit-version: "latest"
|
||||||
|
warn: "privileged"
|
||||||
|
warn-version: "latest"
|
||||||
|
|
||||||
|
See :ref:`Kubernetes Custom Configuration
|
||||||
|
<kubernetes-custom-configuration-31c1fd41857d>` for more details on kubernetes
|
||||||
|
configuration, ``apiserver_extra_args`` and ``apiserver_extra_volumes``.
|
||||||
|
|
||||||
|
The generic definition of the ``AdmissionConfiguration`` resource can be found
|
||||||
|
at
|
||||||
|
`https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/
|
||||||
|
<https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/>`__.
|
||||||
|
|
||||||
|
|
||||||
|
---------------------------------
|
||||||
|
Platform namespaces configuration
|
||||||
|
---------------------------------
|
||||||
|
|
||||||
|
In preparation for |PSA| controller full support, namespace labels have been
|
||||||
|
added to all the namespaces used by the platform. System namespaces, such as
|
||||||
|
``kube-system``, ``deployment``, as well as application namespaces such as,
|
||||||
|
``cert-manager`` have been created by default with privileged label levels.
|
||||||
|
|
||||||
|
The following labels configuration is applied by default to Platform
|
||||||
|
namespaces:
|
||||||
|
|
||||||
|
.. code-block:: none
|
||||||
|
|
||||||
|
controller-0:~$ kubectl describe namespace kube-system
|
||||||
|
Name: kube-system
|
||||||
|
Labels: kubernetes.io/metadata.name=kube-system
|
||||||
|
pod-security.kubernetes.io/audit=privileged
|
||||||
|
pod-security.kubernetes.io/audit-version=latest
|
||||||
|
pod-security.kubernetes.io/enforce=privileged
|
||||||
|
pod-security.kubernetes.io/enforce-version=latest
|
||||||
|
pod-security.kubernetes.io/warn=privileged
|
||||||
|
pod-security.kubernetes.io/warn-version=latest
|
||||||
|
|
||||||
|
Annotations: <none>
|
||||||
|
Status: Active
|
||||||
|
|
||||||
|
No resource quota.
|
||||||
|
|
||||||
|
No LimitRange resource
|
||||||
|
|
||||||
|
-------------------------------------------------
|
||||||
|
Pod Security Admission Controller - Usage Example
|
||||||
|
-------------------------------------------------
|
||||||
|
|
||||||
|
This page walks thru a usage example of |PSA| where you will:
|
||||||
|
|
||||||
|
- Create a namespace for each of the 3 security policies levels: privileged,
|
||||||
|
baseline and restricted.
|
||||||
|
|
||||||
|
- Create a yaml file with a privileged pod configuration.
|
||||||
|
|
||||||
|
- Create a privileged pod in all 3 namespaces.
|
||||||
|
|
||||||
|
- The pod creation will only be successful in the privileged namespace.
|
||||||
|
|
||||||
|
.. code-block:: none
|
||||||
|
|
||||||
|
controller-0:~$ vi baseline-ns.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: baseline-ns
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: baseline
|
||||||
|
pod-security.kubernetes.io/enforce-version: v1.23
|
||||||
|
pod-security.kubernetes.io/warn: baseline
|
||||||
|
pod-security.kubernetes.io/warn-version: v1.23
|
||||||
|
pod-security.kubernetes.io/audit: baseline
|
||||||
|
pod-security.kubernetes.io/audit-version: v1.23
|
||||||
|
|
||||||
|
controller-0:~$ kubectl apply -f baseline-ns.yaml
|
||||||
|
|
||||||
|
controller-0:~$ vi privileged-ns.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: privileged-ns
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
pod-security.kubernetes.io/enforce-version: v1.23
|
||||||
|
pod-security.kubernetes.io/warn: privileged
|
||||||
|
pod-security.kubernetes.io/warn-version: v1.23
|
||||||
|
pod-security.kubernetes.io/audit: privileged
|
||||||
|
pod-security.kubernetes.io/audit-version: v1.23
|
||||||
|
|
||||||
|
controller-0:~$ kubectl apply -f privileged-ns.yaml
|
||||||
|
|
||||||
|
controller-0:~$ vi restricted-ns.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: restricted-ns
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: restricted
|
||||||
|
pod-security.kubernetes.io/enforce-version: v1.23
|
||||||
|
pod-security.kubernetes.io/warn: restricted
|
||||||
|
pod-security.kubernetes.io/warn-version: v1.23
|
||||||
|
pod-security.kubernetes.io/audit: restricted
|
||||||
|
pod-security.kubernetes.io/audit-version: v1.23
|
||||||
|
|
||||||
|
controller-0:~$ kubectl apply -f restricted-ns.yaml
|
||||||
|
|
||||||
|
controller-0:~$ vi privileged-pod.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: privileged
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: pause
|
||||||
|
image: k8s.gcr.io/pause
|
||||||
|
securityContext:
|
||||||
|
privileged: true
|
||||||
|
|
||||||
|
controller-0:~$ kubectl -n privileged-ns apply -f privileged-pod.yaml
|
||||||
|
pod/privileged created
|
||||||
|
|
||||||
|
controller-0:~$ kubectl -n baseline-ns apply -f privileged-pod.yaml
|
||||||
|
Error from server (Failure): error when creating "privileged-pod.yaml": privileged (container "pause" must not set securityContext.privileged=true)
|
||||||
|
|
||||||
|
controller-0:~$ kubectl -n restricted-ns apply -f privileged-pod.yaml
|
||||||
|
Error from server (Failure): error when creating "privileged-pod.yaml": privileged (container "pause" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "pause" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "pause" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "pause" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "pause" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
|
||||||
|
controller-0:~$
|
||||||
|
|
||||||
|
For more information refer to
|
||||||
|
`https://kubernetes.io/docs/concepts/security/pod-security-admission/
|
||||||
|
<https://kubernetes.io/docs/concepts/security/pod-security-admission/>`__.
|
||||||
@ -48,3 +48,17 @@ policy checking. Setting this parameter also creates:
|
|||||||
kube-system, such that at least restricted Deployments/ReplicaSets/etc. can
|
kube-system, such that at least restricted Deployments/ReplicaSets/etc. can
|
||||||
be created by any authenticated user in any namespaces that user has access
|
be created by any authenticated user in any namespaces that user has access
|
||||||
to based on other [Cluster]RoleBindings.
|
to based on other [Cluster]RoleBindings.
|
||||||
|
|
||||||
|
PodSecurityPolicy (PSP) is deprecated as of Kubernetes v1.21 and will be
|
||||||
|
removed in v1.25. PSP will continue to be fully functional until being removed
|
||||||
|
in v1.25.
|
||||||
|
|
||||||
|
Since first introduced PSP has shown some serious usability problems.
|
||||||
|
|
||||||
|
The way PSPs are applied to Pods has proven confusing especially when trying to
|
||||||
|
use them. It is easy to accidentally grant broader permissions than intended,
|
||||||
|
and difficult to inspect which PSPs apply in a certain situation.
|
||||||
|
|
||||||
|
As a beta feature, Kubernetes offers a built-in Pod Security Admission (PSA)
|
||||||
|
controller, the successor to PSP. See :ref:`Technology Preview - Pod Security
|
||||||
|
Admission Controller <pod-security-admission-controller-8e9e6994100f>`.
|
||||||
|
|||||||
@ -101,6 +101,7 @@
|
|||||||
.. |PMD| replace:: :abbr:`PMD (Pole Mode Driver)`
|
.. |PMD| replace:: :abbr:`PMD (Pole Mode Driver)`
|
||||||
.. |PQDN| replace:: :abbr:`PDQN (Partially Qualified Domain Name)`
|
.. |PQDN| replace:: :abbr:`PDQN (Partially Qualified Domain Name)`
|
||||||
.. |PQDNs| replace:: :abbr:`PQDNs (Partially Qualified Domain Names)`
|
.. |PQDNs| replace:: :abbr:`PQDNs (Partially Qualified Domain Names)`
|
||||||
|
.. |PSA| replace:: :abbr:`PSA (Pod Security Admission)`
|
||||||
.. |PSP| replace:: :abbr:`PSP (Pod Security Policy)`
|
.. |PSP| replace:: :abbr:`PSP (Pod Security Policy)`
|
||||||
.. |PSPs| replace:: :abbr:`PSPs (Pod Security Policies)`
|
.. |PSPs| replace:: :abbr:`PSPs (Pod Security Policies)`
|
||||||
.. |PTP| replace:: :abbr:`PTP (Precision Time Protocol)`
|
.. |PTP| replace:: :abbr:`PTP (Precision Time Protocol)`
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user