Skip to content

Commit 198ae37

Browse files
tallclairtallclair
authored
Rewrite PodSecurityPolicy migration guide (#31782)
1 parent 25358e1 commit 198ae37

File tree

5 files changed

+603
-29
lines changed

5 files changed

+603
-29
lines changed

‎assets/scss/_custom.scss

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,11 @@ main {
329329
.td-content>table td {
330330
word-break: break-word;
331331
}
332+
333+
table.no-word-break td,
334+
table.no-word-break code {
335+
word-break: normal;
336+
}
332337
}
333338

334339

‎content/en/docs/concepts/policy/pod-security-policy.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,13 @@ weight: 30
1111

1212
{{< feature-state for_k8s_version="v1.21" state="deprecated" >}}
1313

14-
PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25. It has been replaced by
15-
[Pod Security Admission](/docs/concepts/security/pod-security-admission/). For more information on the deprecation,
14+
{{< caution >}}
15+
PodSecurityPolicy is deprecated as of Kubernetes v1.21, and **will be removed in v1.25**. We recommend migrating to
16+
[Pod Security Admission](/docs/concepts/security/pod-security-admission/), or a 3rd party admission plugin.
17+
For a migration guide, see [Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](/docs/tasks/configure-pod-container/migrate-from-psp/).
18+
For more information on the deprecation,
1619
see [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/).
20+
{{< /caution >}}
1721

1822
Pod Security Policies enable fine-grained authorization of pod creation and
1923
updates.

‎content/en/docs/concepts/security/pod-security-standards.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ fail validation.
5252
<caption style="display:none">Baseline policy specification</caption>
5353
<tbody>
5454
<tr>
55-
<td><strong>Control</strong></td>
56-
<td><strong>Policy</strong></td>
55+
<th>Control</th>
56+
<th>Policy</th>
5757
</tr>
5858
<tr>
5959
<td style="white-space: nowrap">HostProcess</td>

‎content/en/docs/reference/access-authn-authz/psp-to-pod-security-standards.md

Lines changed: 272 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,272 @@
1+
---
2+
reviewers:
3+
- tallclair
4+
- liggitt
5+
title: Mapping PodSecurityPolicies to Pod Security Standards
6+
content_type: concept
7+
weight: 95
8+
---
9+
10+
<!-- overview -->
11+
The tables below enumerate the configuration parameters on
12+
[PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/) objects, whether the field mutates
13+
and/or validates pods, and how the configuration values map to the
14+
[Pod Security Standards](/docs/concepts/security/pod-security-standards/).
15+
16+
For each applicable parameter, the allowed values for the
17+
[Baseline](/docs/concepts/security/pod-security-standards/#baseline) and
18+
[Restricted](/docs/concepts/security/pod-security-standards/#restricted) profiles are listed.
19+
Anything outside the allowed values for those profiles would fall under the
20+
[Privileged](/docs/concepts/security/pod-security-standards/#priveleged) profile. "No opinion"
21+
means all values are allowed under all Pod Security Standards.
22+
23+
<!-- body -->
24+
25+
## PodSecurityPolicy Spec
26+
27+
The fields enumerated in this table are part of the `PodSecurityPolicySpec`, which is specified
28+
under the `.spec` field path.
29+
30+
<table class="no-word-break">
31+
<caption style="display:none">Mapping PodSecurityPolicySpec fields to Pod Security Standards</caption>
32+
<tbody>
33+
<tr>
34+
<th><code>PodSecurityPolicySpec</code></th>
35+
<th>Type</th>
36+
<th>Pod Security Standards Equivalent</th>
37+
</tr>
38+
<tr>
39+
<td><code>privileged</code></td>
40+
<td>Validating</td>
41+
<td><b>Baseline & Restricted</b>: <code>false</code> / undefined / nil</td>
42+
</tr>
43+
<tr>
44+
<td><code>defaultAddCapabilities</code></td>
45+
<td>Mutating & Validating</td>
46+
<td>Requirements match <code>allowedCapabilities</code> below.</td>
47+
</tr>
48+
<tr>
49+
<td><code>allowedCapabilities</code></td>
50+
<td>Validating</td>
51+
<td>
52+
<p><b>Baseline</b>: subset of</p>
53+
<ul>
54+
<li><code>AUDIT_WRITE</code></li>
55+
<li><code>CHOWN</code></li>
56+
<li><code>DAC_OVERRIDE</code></li>
57+
<li><code>FOWNER</code></li>
58+
<li><code>FSETID</code></li>
59+
<li><code>KILL</code></li>
60+
<li><code>MKNOD</code></li>
61+
<li><code>NET_BIND_SERVICE</code></li>
62+
<li><code>SETFCAP</code></li>
63+
<li><code>SETGID</code></li>
64+
<li><code>SETPCAP</code></li>
65+
<li><code>SETUID</code></li>
66+
<li><code>SYS_CHROOT</code></li>
67+
</ul>
68+
<p><b>Restricted</b>: empty / undefined / nil OR a list containing <i>only</i> <code>NET_BIND_SERVICE</code>
69+
</td>
70+
</tr>
71+
<tr>
72+
<td><code>requiredDropCapabilities</code></td>
73+
<td>Mutating & Validating</td>
74+
<td>
75+
<p><b>Baseline</b>: no opinion</p>
76+
<p><b>Restricted</b>: must include <code>ALL</code></p>
77+
</td>
78+
</tr>
79+
<tr>
80+
<td><code>volumes</code></td>
81+
<td>Validating</td>
82+
<td>
83+
<p><b>Baseline</b>: anything except</p>
84+
<ul>
85+
<li><code>hostPath</code></li>
86+
<li><code>*</code></li>
87+
</ul>
88+
<p><b>Restricted</b>: subset of</p>
89+
<ul>
90+
<li><code>configMap</code></li>
91+
<li><code>csi</code></li>
92+
<li><code>downwardAPI</code></li>
93+
<li><code>emptyDir</code></li>
94+
<li><code>ephemeral</code></li>
95+
<li><code>persistentVolumeClaim</code></li>
96+
<li><code>projected</code></li>
97+
<li><code>secret</code></li>
98+
</ul>
99+
</td>
100+
</tr>
101+
<tr>
102+
<td><code>hostNetwork</code></td>
103+
<td>Validating</td>
104+
<td><b>Baseline & Restricted</b>: <code>false</code> / undefined / nil</td>
105+
</tr>
106+
<tr>
107+
<td><code>hostPorts</code></td>
108+
<td>Validating</td>
109+
<td><b>Baseline & Restricted</b>: undefined / nil / empty</td>
110+
</tr>
111+
<tr>
112+
<td><code>hostPID</code></td>
113+
<td>Validating</td>
114+
<td><b>Baseline & Restricted</b>: <code>false</code> / undefined / nil</td>
115+
</tr>
116+
<tr>
117+
<td><code>hostIPC</code></td>
118+
<td>Validating</td>
119+
<td><b>Baseline & Restricted</b>: <code>false</code> / undefined / nil</td>
120+
</tr>
121+
<tr>
122+
<td><code>seLinux</code></td>
123+
<td>Mutating & Validating</td>
124+
<td>
125+
<p><b>Baseline & Restricted</b>:
126+
<code>seLinux.rule</code> is <code>MustRunAs</code>, with the following <code>options</code></p>
127+
<ul>
128+
<li><code>user</code> is unset (<code>""</code> / undefined / nil)</li>
129+
<li><code>role</code> is unset (<code>""</code> / undefined / nil)</li>
130+
<li><code>type</code> is unset or one of: <code>container_t, container_init_t, container_kvm_t</code></li>
131+
<li><code>level</code> is anything</li>
132+
</ul>
133+
</td>
134+
</tr>
135+
<tr>
136+
<td><code>runAsUser</code></td>
137+
<td>Mutating & Validating</td>
138+
<td>
139+
<p><b>Baseline</b>: Anything</p>
140+
<p><b>Restricted</b>: <code>rule</code> is <code>MustRunAsNonRoot</code></p>
141+
</td>
142+
</tr>
143+
<tr>
144+
<td><code>runAsGroup</code></td>
145+
<td>Mutating (MustRunAs) & Validating</td>
146+
<td>
147+
<i>No opinion</i>
148+
</td>
149+
</tr>
150+
<tr>
151+
<td><code>supplementalGroups</code></td>
152+
<td>Mutating & Validating</td>
153+
<td>
154+
<i>No opinion</i>
155+
</td>
156+
</tr>
157+
<tr>
158+
<td><code>fsGroup</code></td>
159+
<td>Mutating & Validating</td>
160+
<td>
161+
<i>No opinion</i>
162+
</td>
163+
</tr>
164+
<tr>
165+
<td><code>readOnlyRootFilesystem</code></td>
166+
<td>Mutating & Validating</td>
167+
<td>
168+
<i>No opinion</i>
169+
</td>
170+
</tr>
171+
<tr>
172+
<td><code>defaultAllowPrivilegeEscalation</code></td>
173+
<td>Mutating</td>
174+
<td>
175+
<i>No opinion (non-validating)</i>
176+
</td>
177+
</tr>
178+
<tr>
179+
<td><code>allowPrivilegeEscalation</code></td>
180+
<td>Mutating & Validating</td>
181+
<td>
182+
<p><i>Only mutating if set to <code>false</code></i></p>
183+
<p><b>Baseline</b>: No opinion</p>
184+
<p><b>Restricted</b>: <code>false</code></p>
185+
</td>
186+
</tr>
187+
<tr>
188+
<td><code>allowedHostPaths</code></td>
189+
<td>Validating</td>
190+
<td><i>No opinion (volumes takes precedence)</i></td>
191+
</tr>
192+
<tr>
193+
<td><code>allowedFlexVolumes</code></td>
194+
<td>Validating</td>
195+
<td><i>No opinion (volumes takes precedence)</i></td>
196+
</tr>
197+
<tr>
198+
<td><code>allowedCSIDrivers</code></td>
199+
<td>Validating</td>
200+
<td><i>No opinion (volumes takes precedence)</i></td>
201+
</tr>
202+
<tr>
203+
<td><code>allowedUnsafeSysctls</code></td>
204+
<td>Validating</td>
205+
<td><b>Baseline & Restricted</b>: undefined / nil / empty</td>
206+
</tr>
207+
<tr>
208+
<td><code>forbiddenSysctls</code></td>
209+
<td>Validating</td>
210+
<td><i>No opinion</i></td>
211+
</tr>
212+
<tr>
213+
<td><code>allowedProcMountTypes</code><br><i>(alpha feature)</i></td>
214+
<td>Validating</td>
215+
<td><b>Baseline & Restricted</b>: <code>["Default"]</code> OR undefined / nil / empty</td>
216+
</tr>
217+
<tr>
218+
<td><code>runtimeClass</code><br><code>&nbsp;.defaultRuntimeClassName</code></td>
219+
<td>Mutating</td>
220+
<td><i>No opinion</i></td>
221+
</tr>
222+
<tr>
223+
<td><code>runtimeClass</code><br><code>&nbsp;.allowedRuntimeClassNames</code></td>
224+
<td>Validating</td>
225+
<td><i>No opinion</i></td>
226+
</tr>
227+
</tbody>
228+
</table>
229+
230+
## PodSecurityPolicy annotations
231+
232+
The [annotations](/docs/concepts/overview/working-with-objects/annotations/) enumerated in this
233+
table can be specified under `.metadata.annotations` on the PodSecurityPolicy object.
234+
235+
<table class="no-word-break">
236+
<caption style="display:none">Mapping PodSecurityPolicy annotations to Pod Security Standards</caption>
237+
<tbody>
238+
<tr>
239+
<th><code>PSP Annotation</code></th>
240+
<th>Type</th>
241+
<th>Pod Security Standards Equivalent</th>
242+
</tr>
243+
<tr>
244+
<td><code>seccomp.security.alpha.kubernetes.io</code><br><code>/defaultProfileName</code></td>
245+
<td>Mutating</td>
246+
<td><i>No opinion</i></td>
247+
</tr>
248+
<tr>
249+
<td><code>seccomp.security.alpha.kubernetes.io</code><br><code>/allowedProfileNames</code></td>
250+
<td>Validating</td>
251+
<td>
252+
<p><b>Baseline</b>: <code>"runtime/default,"</code> <i>(Trailing comma to allow unset)</i></p>
253+
<p><b>Restricted</b>: <code>"runtime/default"</code> <i>(No trailing comma)</i></p>
254+
<p><i><code>localhost/*</code> values are also permitted for both Baseline & Restricted.</i></p>
255+
</td>
256+
</tr>
257+
<tr>
258+
<td><code>apparmor.security.beta.kubernetes.io</code><br><code>/defaultProfileName</code></td>
259+
<td>Mutating</td>
260+
<td><i>No opinion</i></td>
261+
</tr>
262+
<tr>
263+
<td><code>apparmor.security.beta.kubernetes.io</code><br><code>/allowedProfileNames</code></td>
264+
<td>Validating</td>
265+
<td>
266+
<p><b>Baseline</b>: <code>"runtime/default,"</code> <i>(Trailing comma to allow unset)</i></p>
267+
<p><b>Restricted</b>: <code>"runtime/default"</code> <i>(No trailing comma)</i></p>
268+
<p><i><code>localhost/*</code> values are also permitted for both Baseline & Restricted.</i></p>
269+
</td>
270+
</tr>
271+
</tbody>
272+
</table>

0 commit comments

Comments
 (0)