Enforce Pod Security Standards

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Pod Security Standards en security contexts

Know the three levels

Choose the strictest level each namespace can live with.

Level	Allows	For
privileged	Everything	System namespaces (CNI, storage drivers)
baseline	Blocks known escalations: host namespaces, privileged, hostPath, extra capabilities	Most legacy apps
restricted	Also: non-root, no privilege escalation, drop ALL capabilities, seccomp RuntimeDefault	New apps — the target

4.2

Label a namespace

Three modes per namespace: enforce (reject), audit (log), warn (warning to the user).

$kubectl label namespace shop pod-security.kubernetes.io/enforce=restricted pod-security.kubernetes.io/enforce-version=latest
$kubectl label namespace shop pod-security.kubernetes.io/warn=restricted pod-security.kubernetes.io/audit=restricted --overwrite
$kubectl label --dry-run=server --overwrite namespace legacy pod-security.kubernetes.io/enforce=restricted
$kubectl get ns shop --show-labels

Op het werk

The --dry-run=server line lists which running pods would break the level before you enforce it.

4.3

Write a restricted pod

This pod passes the restricted level.

restricted-pod.yaml

apiVersion: v1
kind: Pod
metadata: { name: api, namespace: shop }
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    fsGroup: 1001
    seccompProfile: { type: RuntimeDefault }
  containers:
    - name: api
      image: ghcr.io/s0sta/api:2.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities: { drop: ["ALL"] }
      volumeMounts:
        - { name: tmp, mountPath: /tmp }
  volumes:
    - name: tmp
      emptyDir: {}

$kubectl apply -f restricted-pod.yaml
$kubectl run bad --image=nginx -n shop
Error from server (Forbidden): pods "bad" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...

4.4

Fix a rejected workload

The error message lists every broken rule. Fix them one by one in the pod template (Deployments are not rejected — their pods are; check the ReplicaSet events).

$kubectl get events -n shop --field-selector reason=FailedCreate
$kubectl describe rs -n shop -l app=web | grep -A3 Warning

Message part	Fix
`runAsNonRoot != true`	`securityContext.runAsNonRoot: true` (+ a non-root image or `runAsUser`)
`allowPrivilegeEscalation != false`	Set it to `false` per container
`unrestricted capabilities`	`capabilities.drop: ["ALL"]`
`seccompProfile`	`seccompProfile.type: RuntimeDefault`
`hostPath volumes`	Use PVCs or emptyDir

Onthoud

Pod Security Admission checks only new pods. Existing pods keep running until they are recreated.

Alle commando's in dit hoofdstuk