Skip to content

Commit d1e2545

Browse files
PushkarJTim Bannistershannonxtremejimangel
committed
Added shell script examples
Fixed nits, broken links and numbering Co-authored-by: Tim Bannister <[email protected]> Co-authored-by: Shannon Kularathna <[email protected]> Co-authored-by: Jim Angel <[email protected]>
1 parent d29e93a commit d1e2545

File tree

5 files changed

+285
-183
lines changed

5 files changed

+285
-183
lines changed

‎content/en/docs/tutorials/_index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ Before walking through each tutorial, you may want to bookmark the
5959

6060
## Security
6161

62-
* [Applying Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/)
63-
* [Applying Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/)
62+
* [Apply Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/)
63+
* [Apply Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/)
6464

6565
## {{% heading "whatsnext" %}}
6666

‎content/en/docs/tutorials/security/cluster-level-pss.md

Lines changed: 128 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Applying Pod Security Standards at the cluster level
2+
title: Apply Pod Security Standards at the Cluster Level
33
content_type: tutorial
44
weight: 10
55
---
@@ -8,15 +8,16 @@ weight: 10
88
This tutorial applies only for new clusters.
99
{{% /alert %}}
1010

11-
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated
12-
to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission
13-
is an admission controller that applies Pod Security Standards when pods are
14-
created. This tutorial shows you how to enforce the `baseline` Pod Security
15-
Standard at the cluster level which applies a standard configuration
11+
Pod Security admission (PSA) is enabled by default in v1.23 and later, as it has
12+
[graduated to beta](/blog/2021/12/09/pod-security-admission-beta/).
13+
Pod Security
14+
is an admission controller that carries out checks against the Kubernetes
15+
[Pod Security Standards](docs/concepts/security/pod-security-standards/) when new pods are
16+
created. This tutorial shows you how to enforce the `baseline` Pod Security
17+
Standard at the cluster level which applies a standard configuration
1618
to all namespaces in a cluster.
1719

18-
For applying pod security standards one namespace at a time, please [follow this
19-
tutorial](/docs/tutorials/security/ns-level-pss).
20+
To apply Pod Security Standards to specific namespaces, refer to [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss).
2021

2122
## {{% heading "prerequisites" %}}
2223

@@ -37,12 +38,12 @@ that are most appropriate for your configuration, do the following:
3738
1. Create a cluster with no Pod Security Standards applied:
3839

3940
```shell
40-
kind create cluster --name psa-wo-cluster-pss --image kindest/node:latest
41+
kind create cluster --name psa-wo-cluster-pss --image kindest/node:v1.23.0
4142
```
42-
The output is similar to this:
43+
The output is similar to this:
4344
```
4445
Creating cluster "psa-wo-cluster-pss" ...
45-
✓ Ensuring node image (kindest/node:latest) 🖼
46+
✓ Ensuring node image (kindest/node:v1.23.0) 🖼
4647
✓ Preparing nodes 📦
4748
✓ Writing configuration 📜
4849
✓ Starting control-plane 🕹️
@@ -57,12 +58,12 @@ that are most appropriate for your configuration, do the following:
5758

5859
```
5960

60-
2. Set the kubectl context to the new cluster:
61+
1. Set the kubectl context to the new cluster:
6162

6263
```shell
6364
kubectl cluster-info --context kind-psa-wo-cluster-pss
6465
```
65-
The output is similar to this:
66+
The output is similar to this:
6667

6768
```
6869
Kubernetes control plane is running at https://127.0.0.1:61350
@@ -72,7 +73,7 @@ that are most appropriate for your configuration, do the following:
7273
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
7374
```
7475

75-
3. Get a list of namespaces in the cluster:
76+
1. Get a list of namespaces in the cluster:
7677

7778
```shell
7879
kubectl get ns
@@ -87,71 +88,71 @@ that are most appropriate for your configuration, do the following:
8788
local-path-storage Active 9m26s
8889
```
8990

90-
4. Use `--dry-run=server` to understand what happens when different Pod Security Standards
91-
are applied:
91+
1. Use `--dry-run=server` to understand what happens when different Pod Security Standards
92+
are applied:
9293

9394
1. Privileged
94-
```shell
95-
kubectl label --dry-run=server --overwrite ns --all \
96-
pod-security.kubernetes.io/enforce=privileged
97-
```
98-
The output is similar to this:
99-
```
100-
namespace/default labeled
101-
namespace/kube-node-lease labeled
102-
namespace/kube-public labeled
103-
namespace/kube-system labeled
104-
namespace/local-path-storage labeled
105-
```
95+
```shell
96+
kubectl label --dry-run=server --overwrite ns --all \
97+
pod-security.kubernetes.io/enforce=privileged
98+
```
99+
The output is similar to this:
100+
```
101+
namespace/default labeled
102+
namespace/kube-node-lease labeled
103+
namespace/kube-public labeled
104+
namespace/kube-system labeled
105+
namespace/local-path-storage labeled
106+
```
106107
2. Baseline
107-
```shell
108-
kubectl label --dry-run=server --overwrite ns --all \
109-
pod-security.kubernetes.io/enforce=baseline
110-
```
111-
The output is similar to this:
112-
```
113-
namespace/default labeled
114-
namespace/kube-node-lease labeled
115-
namespace/kube-public labeled
116-
Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "baseline:latest"
117-
Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes
118-
Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes
119-
Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged
120-
namespace/kube-system labeled
121-
namespace/local-path-storage labeled
122-
```
108+
```shell
109+
kubectl label --dry-run=server --overwrite ns --all \
110+
pod-security.kubernetes.io/enforce=baseline
111+
```
112+
The output is similar to this:
113+
```
114+
namespace/default labeled
115+
namespace/kube-node-lease labeled
116+
namespace/kube-public labeled
117+
Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "baseline:latest"
118+
Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes
119+
Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes
120+
Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged
121+
namespace/kube-system labeled
122+
namespace/local-path-storage labeled
123+
```
123124

124125
3. Restricted
125-
```shell
126-
kubectl label --dry-run=server --overwrite ns --all \
127-
pod-security.kubernetes.io/enforce=restricted
128-
```
129-
The output is similar to this:
130-
```
131-
namespace/default labeled
132-
namespace/kube-node-lease labeled
133-
namespace/kube-public labeled
134-
Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "restricted:latest"
135-
Warning: coredns-7bb9c7b568-hsptc (and 1 other pod): unrestricted capabilities, runAsNonRoot != true, seccompProfile
136-
Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true
137-
Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile
138-
Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile
139-
namespace/kube-system labeled
140-
Warning: existing pods in namespace "local-path-storage" violate the new PodSecurity enforce level "restricted:latest"
141-
Warning: local-path-provisioner-d6d9f7ffc-lw9lh: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile
142-
namespace/local-path-storage labeled
143-
```
126+
```shell
127+
kubectl label --dry-run=server --overwrite ns --all \
128+
pod-security.kubernetes.io/enforce=restricted
129+
```
130+
The output is similar to this:
131+
```
132+
namespace/default labeled
133+
namespace/kube-node-lease labeled
134+
namespace/kube-public labeled
135+
Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "restricted:latest"
136+
Warning: coredns-7bb9c7b568-hsptc (and 1 other pod): unrestricted capabilities, runAsNonRoot != true, seccompProfile
137+
Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true
138+
Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile
139+
Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile
140+
namespace/kube-system labeled
141+
Warning: existing pods in namespace "local-path-storage" violate the new PodSecurity enforce level "restricted:latest"
142+
Warning: local-path-provisioner-d6d9f7ffc-lw9lh: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile
143+
namespace/local-path-storage labeled
144+
```
144145

145146
From the previous output, you'll notice that applying the `privileged` Pod Security Standard shows no warnings
146147
for any namespaces. However, `baseline` and `restricted` standards both have
147148
warnings, specifically in the `kube-system` namespace.
148149
149150
## Set modes, versions and standards
150151
151-
In this tutorial, you apply the following Pod Security Standards to the `latest` version:
152+
In this section, you apply the following Pod Security Standards to the `latest` version:
152153
153-
* `baseline` standard in `enforce` mode.
154-
* `restricted` standard in `warn` and `audit` mode.
154+
* `baseline` standard in `enforce` mode.
155+
* `restricted` standard in `warn` and `audit` mode.
155156
156157
The `baseline` Pod Security Standard provides a convenient
157158
middle ground that allows keeping the exemption list short and prevents known
@@ -166,37 +167,37 @@ following:
166167
1. Based on the risk posture applied to a cluster, a stricter Pod Security
167168
Standard like `restricted` might be a better choice.
168169
1. Exempting the `kube-system` namespace allows pods to run as
169-
`privileged` in this namespace. We recommend that you apply strict RBAC
170+
`privileged` in this namespace. For real world use, the Kubernetes project
171+
strongly recommends that you apply strict RBAC
170172
policies that limit access to `kube-system`, following the principle of least
171173
privilege.
172-
174+
To implement the preceding standards, do the following:
173175
1. Create a configuration file that can be consumed by the Pod Security
174-
Admission Controller to implement these Pod Security Standards:
175-
176-
```
177-
mkdir -p /tmp/pss
178-
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
179-
apiVersion: apiserver.config.k8s.io/v1
180-
kind: AdmissionConfiguration
181-
plugins:
182-
- name: PodSecurity
183-
configuration:
184-
apiVersion: pod-security.admission.config.k8s.io/v1beta1
185-
kind: PodSecurityConfiguration
186-
defaults:
187-
enforce: "baseline"
188-
enforce-version: "latest"
189-
audit: "restricted"
190-
audit-version: "latest"
191-
warn: "restricted"
192-
warn-version: "latest"
193-
exemptions:
194-
usernames: []
195-
runtimeClasses: []
196-
namespaces: [kube-system]
197-
EOF
198-
```
176+
Admission Controller to implement these Pod Security Standards:
199177

178+
```
179+
mkdir -p /tmp/pss
180+
cat <<EOF > /tmp/pss/cluster-level-pss.yaml
181+
apiVersion: apiserver.config.k8s.io/v1
182+
kind: AdmissionConfiguration
183+
plugins:
184+
- name: PodSecurity
185+
configuration:
186+
apiVersion: pod-security.admission.config.k8s.io/v1beta1
187+
kind: PodSecurityConfiguration
188+
defaults:
189+
enforce: "baseline"
190+
enforce-version: "latest"
191+
audit: "restricted"
192+
audit-version: "latest"
193+
warn: "restricted"
194+
warn-version: "latest"
195+
exemptions:
196+
usernames: []
197+
runtimeClasses: []
198+
namespaces: [kube-system]
199+
EOF
200+
```
200201
201202
1. Configure the API server to consume this file during cluster creation:
202203
@@ -234,22 +235,22 @@ EOF
234235
EOF
235236
```
236237
237-
{{<note>}}
238-
If you use Docker Desktop with KinD, the `/tmp`
239-
directory is added as a Shared Directory under
240-
**Preferences > Resources > File Sharing** on Mac OS.
241-
{{</note>}}
238+
{{<note>}}
239+
If you use Docker Desktop with KinD on macOS, you can
240+
add `/tmp` as a Shared Directory under the menu item
241+
**Preferences > Resources > File Sharing**.
242+
{{</note>}}
242243
243-
2. Create a cluster that uses Pod Security Admission to apply
244+
1. Create a cluster that uses Pod Security Admission to apply
244245
these Pod Security Standards:
245246
246247
```shell
247-
kind create cluster --name psa-with-cluster-pss --image kindest/node:latest --config /tmp/pss/cluster-config.yaml
248+
kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml
248249
```
249250
The output is similar to this:
250251
```
251252
Creating cluster "psa-with-cluster-pss" ...
252-
✓ Ensuring node image (kindest/node:latest) 🖼
253+
✓ Ensuring node image (kindest/node:v1.23.0) 🖼
253254
✓ Preparing nodes 📦
254255
✓ Writing configuration 📜
255256
✓ Starting control-plane 🕹️
@@ -261,17 +262,20 @@ EOF
261262
kubectl cluster-info --context kind-psa-with-cluster-pss
262263
263264
Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂
264-
265-
3. Point kubectl to the cluster
265+
```
266+
267+
1. Point kubectl to the cluster
266268
```shell
267269
kubectl cluster-info --context kind-psa-with-cluster-pss
268-
Kubernetes control plane is running at https://127.0.0.1:63855
269-
CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
270-
271-
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
272270
```
273-
274-
4. Create a Pod with minimal configuration in the default namespace:
271+
The output is similar to this:
272+
```
273+
Kubernetes control plane is running at https://127.0.0.1:63855
274+
CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
275+
276+
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
277+
```
278+
1. Create the following Pod specification for a minimal configuration in the default namespace:
275279
276280
```
277281
cat <<EOF > /tmp/pss/nginx-pod.yaml
@@ -287,33 +291,34 @@ EOF
287291
- containerPort: 80
288292
EOF
289293
```
290-
5. Create Pod after pod security is enabled at cluster level:
291-
294+
1. Create the Pod in the cluster:
295+
292296
```shell
293297
kubectl apply -f /tmp/pss/nginx-pod.yaml
294298
```
295299
The output is similar to this:
296300
```
297301
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
298302
pod/nginx created
299-
```
303+
```
304+
300305
## Clean up
301306
302-
Run `kind delete cluster -name psa-with-cluster-pss` and
303-
`kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you
307+
Run `kind delete cluster -name psa-with-cluster-pss` and
308+
`kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you
304309
created.
305310
306311
## {{% heading "whatsnext" %}}
307312
308-
- Run a
309-
[gist](https://gist.github.com/PushkarJ/9f7a0045f4bec31097bdd1e9db0f2f6e)
313+
- Run a
314+
[shell script](/examples/security/kind-with-cluster-level-baseline-pod-security.sh)
310315
to perform all the preceding steps at once:
311-
1. Create a Pod Security Standards based cluster level Configuration
312-
2. Create a file to let API server consumes this configuration
313-
3. Create a cluster that creates an API server with this configuration
314-
4. Set kubectl context to this new cluster
315-
5. Create a minimal pod yaml file
316-
6. Apply this file to create a Pod in the new cluster
316+
1. Create a Pod Security Standards based cluster level Configuration
317+
2. Create a file to let API server consumes this configuration
318+
3. Create a cluster that creates an API server with this configuration
319+
4. Set kubectl context to this new cluster
320+
5. Create a minimal pod yaml file
321+
6. Apply this file to create a Pod in the new cluster
317322
- [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
318323
- [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
319-
- [Applying Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/)
324+
- [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/)

0 commit comments

Comments
 (0)