Skip to content

Commit bec9d0d

Browse files
iholder101iholder101
committed
Add a tutorial to provision and configure swap on a node
Signed-off-by: Itamar Holder <[email protected]>
1 parent ccfb648 commit bec9d0d

File tree

2 files changed

+193
-0
lines changed

2 files changed

+193
-0
lines changed

‎content/en/docs/concepts/security/linux-security.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
reviewers:
3+
- jayunit100
4+
- jsturtevant
5+
- marosset
6+
- perithompson
7+
title: Security For Windows Nodes
8+
content_type: concept
9+
weight: 40
10+
---
11+
12+
<!-- overview -->
13+
14+
This page describes security considerations and best practices specific to the Linux operating system.
15+
16+
<!-- body -->
17+
18+
## Protection for Secret data on nodes
19+
20+
On Windows, data from Secrets are written out in clear text onto the node's local
21+
storage (as compared to using tmpfs / in-memory filesystems on Linux). As a cluster
22+
operator, you should take both of the following additional measures:
23+
24+
1. Use file ACLs to secure the Secrets' file location.
25+
1. Apply volume-level encryption using
26+
[BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server).
27+
28+
## Container users
29+
30+
[RunAsUsername](/docs/tasks/configure-pod-container/configure-runasusername)
31+
can be specified for Windows Pods or containers to execute the container
32+
processes as specific user. This is roughly equivalent to
33+
[RunAsUser](/docs/concepts/security/pod-security-policy/#users-and-groups).
34+
35+
Windows containers offer two default user accounts, ContainerUser and ContainerAdministrator.
36+
The differences between these two user accounts are covered in
37+
[When to use ContainerAdmin and ContainerUser user accounts](https://docs.microsoft.com/virtualization/windowscontainers/manage-containers/container-security#when-to-use-containeradmin-and-containeruser-user-accounts)
38+
within Microsoft's _Secure Windows containers_ documentation.
39+
40+
Local users can be added to container images during the container build process.
41+
42+
{{< note >}}
43+
44+
* [Nano Server](https://hub.docker.com/_/microsoft-windows-nanoserver) based images run as
45+
`ContainerUser` by default
46+
* [Server Core](https://hub.docker.com/_/microsoft-windows-servercore) based images run as
47+
`ContainerAdministrator` by default
48+
49+
{{< /note >}}
50+
51+
Windows containers can also run as Active Directory identities by utilizing
52+
[Group Managed Service Accounts](/docs/tasks/configure-pod-container/configure-gmsa/)
53+
54+
## Pod-level security isolation
55+
56+
Linux-specific pod security context mechanisms (such as SELinux, AppArmor, Seccomp, or custom
57+
POSIX capabilities) are not supported on Windows nodes.
58+
59+
Privileged containers are [not supported](/docs/concepts/windows/intro/#compatibility-v1-pod-spec-containers-securitycontext)
60+
on Windows.
61+
Instead [HostProcess containers](/docs/tasks/configure-pod-container/create-hostprocess-pod)
62+
can be used on Windows to perform many of the tasks performed by privileged containers on Linux.

‎content/en/docs/tutorials/configuration/provision-swap-memory.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
---
2+
reviewers:
3+
- lmktfy
4+
title: Configuring swap memory on Kubernetes nodes
5+
content_type: tutorial
6+
weight: 35
7+
min-kubernetes-server-version: "1.33"
8+
---
9+
10+
<!-- overview -->
11+
12+
This page provides an example of how to provision and configure swap memory on a Kubernetes node using kubeadm.
13+
14+
<!-- lessoncontent -->
15+
16+
## {{% heading "objectives" %}}
17+
18+
* Provision swap memory on a Kubernetes node using kubeadm.
19+
* Learn to configure both encrypted and unencrypted swap.
20+
* Learn to enable swap on boot.
21+
22+
## {{% heading "prerequisites" %}}
23+
24+
25+
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
26+
27+
You need at least one worker node in your cluster which needs to run a Linux operating system.
28+
It is required for this demo that the kubeadm tool be installed, following the steps outlined in the
29+
[kubeadm installation guide](/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm).
30+
31+
On each worker node where you will configure swap use, you need:
32+
* `fallocate`
33+
* `mkswap`
34+
* `swapon`
35+
36+
* For encrypted swap space (recommended), you also need:
37+
* `cryptsetup`
38+
39+
<!-- lessoncontent -->
40+
41+
42+
## Install a swap-enabled cluster with kubeadm
43+
44+
### Create a swap file and turn swap on
45+
46+
If swap is not enabled, there's a need to provision swap on the node.
47+
The following sections demonstrate creating 4GiB of swap, both in the encrypted and unencrypted case.
48+
49+
{{< tabs name="Create a swap file and turn swap on" >}}
50+
51+
{{% tab name="Setting up encrypted swap" %}}
52+
An encrypted swap file can be set up as follows.
53+
Bear in mind that this example uses the `cryptsetup` binary (which is available
54+
on most Linux distributions).
55+
56+
```bash
57+
# Allocate storage and restrict access
58+
fallocate --length 4GiB /swapfile
59+
chmod 600 /swapfile
60+
61+
# Create an encrypted device backed by the allocated storage
62+
cryptsetup --type plain --cipher aes-xts-plain64 --key-size 256 -d /dev/urandom open /swapfile cryptswap
63+
64+
# Format the swap space
65+
mkswap /dev/mapper/cryptswap
66+
67+
# Activate the swap space for paging
68+
swapon /dev/mapper/cryptswap
69+
```
70+
71+
{{% /tab %}}
72+
73+
{{% tab name="Setting up unencrypted swap" %}}
74+
An unencrypted swap file can be set up as follows.
75+
76+
```bash
77+
# Allocate storage and restrict access
78+
fallocate --length 4GiB /swapfile
79+
chmod 600 /swapfile
80+
81+
# Format the swap space
82+
mkswap /swapfile
83+
84+
# Activate the swap space for paging
85+
swapon /swapfile
86+
```
87+
88+
{{% /tab %}}
89+
90+
{{< /tabs >}}
91+
92+
#### Verify that swap is enabled
93+
94+
Swap can be verified to be enabled with both `swapon -s` command or the `free` command.
95+
96+
Using `swapon -s`:
97+
```
98+
Filename Type Size Used Priority
99+
/dev/dm-0 partition 4194300 0 -2
100+
```
101+
102+
Using `free -h`:
103+
```
104+
total used free shared buff/cache available
105+
Mem: 3.8Gi 1.3Gi 249Mi 25Mi 2.5Gi 2.5Gi
106+
Swap: 4.0Gi 0B 4.0Gi
107+
```
108+
109+
#### Enable swap on boot
110+
111+
After setting up swap, to start the swap file at boot time,
112+
you typically either set up a systemd unit to activate (encrypted) swap, or you
113+
add a line similar to `/swapfile swap swap defaults 0 0` into `/etc/fstab`.
114+
115+
Using systemd for swap activation allows the system to delay kubelet start until swap is available,
116+
if that is something you want to ensure.
117+
In a similar way, using systemd allows your server to leave swap active until kubelet
118+
(and, typically, your container runtime) have shut down.
119+
120+
### Set up kubelet configuration
121+
122+
After enabling swap on the node, kubelet needs to be configured in the following way:
123+
124+
```yaml
125+
# this fragment goes into the kubelet's configuration file
126+
failSwapOn: false
127+
memorySwap:
128+
swapBehavior: LimitedSwap
129+
```
130+
131+
In order for these configurations to take effect, kubelet needs to be restarted.

0 commit comments

Comments
 (0)