Kubernetes kind: PodSecurityPolicy - Namespace Level

Giriş

Açıklaması şöyle

Previously, there was PodSecurityPolicy (PSP) but from Kubernetes v1.21, PodSecurityPolicy was deprecated and removed from Kubernetes in v1.25.

Yeni Yöntem

Söz dizimi şöyle

# Mandatory
pod-security.kubernetes.io/<MODE>: <LEVEL> 

# Optional        
pod-security.kubernetes.io/<MODE>-version: <VERSION>

Level Ne Demek

Açıklaması şöyle. Kısıtlamalar azdan çoğa doğru sıralı

we have to define one of the pod security standards. Currently, there are three pod security standards available.

● Privileged—Unrestricted policy, providing the widest possible level of permissions.

● Baseline — Minimally restrictive policy which prevents known privilege escalations. There is a comprehensive list of controls that should be enforced or disallowed. For instance, Privileged Pods must be disallowed if we want to create a pod in the Baseline labeled namespace.

● Restricted — Heavily restricted policy, the main purpose of this policy is to follow current pod hardening best practices. Similar to Baseline standards there is a list of controls that should be enforced or disallowed. For instance, no container can have root user permissions. Containers must be run as non-root users.

Mode Ne Demek?

Açıklaması şöyle. Enforce ise eğer bir Level ihlal edilirse Pod reddedilir. Audit veya Warn ise Pod reddedilmez ve çalışır ama uyarı verilir

● enforce — Policy violations will cause the pod to be rejected.

● audit — Policy violations will trigger the addition of an audit annotation to the event recorded in the audit log, but are otherwise allowed.

● warn — Policy violations will trigger a user-facing warning but are otherwise allowed.

Baseline Level

Pod şunu yaparsa Baseline kabul edilir

    securityContext:
       privileged: true

Restricted Level

Pod şunu yaparsa Restricted kabul edilir

    securityContext:
      runAsUser: 0

Örnek - Baseline + enforce -  Yani Privileged Pod Reject

Elimizde şöyle bir namespace ayarı olsun

apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2022-11-08T09:26:17Z"
  labels:
    kubernetes.io/metadata.name: baseline-ns-1
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: v1.25
  name: baseline-ns-1
  resourceVersion: "4779"
  uid: 2a8708f3-6f25-4cfb-84c1-ef6c825e23c5
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

Açıklaması şöyle

Since we applied labels with “enforce” mode and “baseline” pod security standards, if a pod does not respect the “baseline” standard it will be rejected. 

Şu pod başarısız olur

# pod-1.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: pod-1
  name: pod-1
  namespace: baseline-ns-1
spec:
  containers:
  - image: nginx
    name: pod-1
    securityContext:
       privileged: true

Hata şöyle

Error from server (Forbidden): error when creating "pod-1.yaml": pods "pod-1" is forbidden: violates PodSecurity "baseline:v1.25": privileged (container "pod-1" must not set securityContext.privileged=true)

Örnek - Baseline + Warn - Yani Sadece Log

Elimizde şöyle bir namespace ayarı olsun

apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2022-11-08T09:26:17Z"
  labels:
    kubernetes.io/metadata.name: baseline-ns-1
    pod-security.kubernetes.io/warn: baseline
    pod-security.kubernetes.io/warn-version: v1.25
  name: baseline-ns-1
  resourceVersion: "4779"
  uid: 2a8708f3-6f25-4cfb-84c1-ef6c825e23c5
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

Bu sefer çalışır. Çıktı şöyle

Warning: would violate PodSecurity "baseline:v1.25": privileged (container "pod-1" must not set securityContext.privileged=true) pod/pod-1 created

Örnek

Elimizde şöyle bir namespace ayarı olsun

apiVersion: v1
kind: Namespace
metadata:
  name: baseline-ns-2
  labels:
    # baseline Standard with enforce Mode 
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: v1.25
    # restricted Standard with warn Mode
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: v1.25

Şöyle yaparız

# pod-2.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-2
  namespace: baseline-ns-2
spec:
  containers:
  - name: pod-2
    image: nginx
    securityContext:
      runAsUser: 0

Pod çalışır. Çünkü root user kullansa bile restricted yani en sıkı kurallar sadece warn. Baseline root user'a izin verdiği için sıkıntı yok.

Eski Yöntem

Örnek

Şöyle yaparız. Böylece işletim sisteminin her türlü yeteneğine erişebilen privileged pod'lar yasaklanır

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: example
spec:
  privileged: false  # Don't allow privileged pods!