Enforce Pod Security Standards

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

المهارات في هذا الفصل

معايير Pod Security وسياقات الأمان

Know the three levels

Choose the strictest level each namespace can live with.

Level	Allows	For
privileged	Everything	System namespaces (CNI, storage drivers)
baseline	Blocks known escalations: host namespaces, privileged, hostPath, extra capabilities	Most legacy apps
restricted	Also: non-root, no privilege escalation, drop ALL capabilities, seccomp RuntimeDefault	New apps — the target

4.2

Label a namespace

Three modes per namespace: enforce (reject), audit (log), warn (warning to the user).

$kubectl label namespace shop pod-security.kubernetes.io/enforce=restricted pod-security.kubernetes.io/enforce-version=latest
$kubectl label namespace shop pod-security.kubernetes.io/warn=restricted pod-security.kubernetes.io/audit=restricted --overwrite
$kubectl label --dry-run=server --overwrite namespace legacy pod-security.kubernetes.io/enforce=restricted
$kubectl get ns shop --show-labels

في العمل

The --dry-run=server line lists which running pods would break the level before you enforce it.

4.3

Write a restricted pod

This pod passes the restricted level.

restricted-pod.yaml

apiVersion: v1
kind: Pod
metadata: { name: api, namespace: shop }
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    fsGroup: 1001
    seccompProfile: { type: RuntimeDefault }
  containers:
    - name: api
      image: ghcr.io/s0sta/api:2.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities: { drop: ["ALL"] }
      volumeMounts:
        - { name: tmp, mountPath: /tmp }
  volumes:
    - name: tmp
      emptyDir: {}

$kubectl apply -f restricted-pod.yaml
$kubectl run bad --image=nginx -n shop
Error from server (Forbidden): pods "bad" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...

4.4

Fix a rejected workload

The error message lists every broken rule. Fix them one by one in the pod template (Deployments are not rejected — their pods are; check the ReplicaSet events).

$kubectl get events -n shop --field-selector reason=FailedCreate
$kubectl describe rs -n shop -l app=web | grep -A3 Warning

Message part	Fix
`runAsNonRoot != true`	`securityContext.runAsNonRoot: true` (+ a non-root image or `runAsUser`)
`allowPrivilegeEscalation != false`	Set it to `false` per container
`unrestricted capabilities`	`capabilities.drop: ["ALL"]`
`seccompProfile`	`seccompProfile.type: RuntimeDefault`
`hostPath volumes`	Use PVCs or emptyDir

تذكّر

Pod Security Admission checks only new pods. Existing pods keep running until they are recreated.

كل الأوامر في هذا الفصل