Add documentation for Seccomp GA #21278

hasheddan · 2020-05-28T21:34:02Z

Signed-off-by: hasheddan [email protected]

This is adds documentation for the Seccomp GA KEP: kubernetes/enhancements#135

Tasks still to be completed:

Update /content/en/docs/concepts/security/pod-security-standards.md
Update /content/en/docs/tasks/configure-pod-container/security-context.md with a short section on setting seccompProfile fields
Update various examples through documentation that use seccomp annotations
Add full guide in /content/en/docs/tutorials/clusters/seccomp.md

/cc @saschagrunert @pjbgf @evrardjp

k8s-ci-robot · 2020-05-28T21:34:05Z

@hasheddan: GitHub didn't allow me to request PR reviews from the following users: evrardjp.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

Signed-off-by: hasheddan [email protected]

This is a WIP for adding documentation for the Seccomp GA KEP: kubernetes/enhancements#135

Tasks still to be completed:

Update /content/en/docs/concepts/security/pod-security-standards.md

Update /content/en/docs/tasks/configure-pod-container/security-context.md with a short section on setting seccompProfile fields

Update various examples through documentation that use seccomp annotations

Add full guide in /content/en/docs/tutorials/clusters/seccomp.md

/cc @saschagrunert @pjbgf @evrardjp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

content/en/docs/tutorials/clusters/seccomp.md

netlify · 2020-05-28T21:45:04Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit 3582c8d

https://deploy-preview-21278--kubernetes-io-master-staging.netlify.app

pjbgf

@hasheddan thanks for pushing ahead with the seccomp documentation. 👍

content/en/docs/concepts/policy/pod-security-policy.md

saschagrunert

Thank you for starting with this @hasheddan 🙏 !

content/en/docs/concepts/policy/pod-security-policy.md

savitharaghunathan · 2020-05-30T20:11:10Z

Hi @hasheddan, Thank you for the PR. If this is a part of release 1.19, which I assume it is, can you open this PR against dev-1.19 branch, please? Thanks!

hasheddan · 2020-06-01T13:10:28Z

@savitharaghunathan sure thing! Thanks for letting me know!

k8sio-netlify-preview-bot · 2020-06-01T13:18:11Z

Deploy preview for kubernetes-io-vnext-staging processing.

Building with commit 3ad7ea7

https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/5f15e80f1dd204000701b67b

sftim · 2020-06-02T05:08:36Z

/milestone 1.19
AIUI

sftim · 2020-06-28T00:20:37Z

/sig node

sftim

Here's some early feedback.

As well as the suggested rewording, I have a question.

What happens to the --seccomp-profile-root command line setting to the kubelet? What if I set this to, eg, /run/foo in 1.19 - does that error out? Does the kubelet silently ignore the command line setting?

content/en/docs/concepts/policy/pod-security-policy.md

sftim · 2020-07-14T21:26:22Z

content/en/docs/concepts/policy/pod-security-policy.md

+  `--seccomp-profile-root` flag on the Kubelet. (Note: this flag has been
+  deprecated in v1.19 and will be removed in v1.23. The seccomp root path will
+  then be derived from the kubelet root path, which is defined by `--root-dir`.
+  The current default value is `<root-dir>/seccomp`.)


Suggested change

`--seccomp-profile-root` flag on the Kubelet. (Note: this flag has been

deprecated in v1.19 and will be removed in v1.23. The seccomp root path will

then be derived from the kubelet root path, which is defined by `--root-dir`.

The current default value is `<root-dir>/seccomp`.)

`--seccomp-profile-root` flag on the kubelet.

{{< note >}}

Kubernetes v1.19 deprecated the `--seccomp-profile-root` flag, which will be removed in

Kubernetes v1.23. The seccomp root path will then be derived from the kubelet root path,

which is defined by `--root-dir`. The current default value is `<root-dir>/seccomp`.

{{< /note >}}

or, with avoid statements about the future in mind:

Suggested change

`--seccomp-profile-root` flag on the Kubelet. (Note: this flag has been

deprecated in v1.19 and will be removed in v1.23. The seccomp root path will

then be derived from the kubelet root path, which is defined by `--root-dir`.

The current default value is `<root-dir>/seccomp`.)

the seccomp root path for that node. The default seccomp root path is a directory

named `seccomp` directly beneath the kubelet's root directory (specified via the

`--root-dir` command line flag to the kubelet).

{{< note >}}

The `--seccomp-profile-root` flag (deprecated since Kubernetes v1.19) allowed you to configure

the seccomp root path for a node. To use the defined behavior, leave that flag unset so that the

kubelet uses its default.

{{< /note >}}

@hasheddan , avoid statements/promises/predictions about the future.

sftim · 2020-07-14T21:27:09Z

content/en/docs/tutorials/clusters/apparmor.md

 ---
 reviewers:
 - stclair
 title: AppArmor


Consider revising this title in the PR that introduces a Seccomp tutorial.

hasheddan · 2020-07-14T21:28:19Z

@sftim how would opening a separate PR work with docs freeze? This PR was marked ready for review before the deadline but a new one would not have been.

kbhawkey · 2020-07-14T22:09:47Z

Page previews:
https://deploy-preview-21278--kubernetes-io-vnext-staging.netlify.app/docs/tutorials/clusters/seccomp/
https://deploy-preview-21278--kubernetes-io-vnext-staging.netlify.app/docs/tutorials/clusters/apparmor/
https://deploy-preview-21278--kubernetes-io-vnext-staging.netlify.app/docs/concepts/security/pod-security-standards/
https://deploy-preview-21278--kubernetes-io-vnext-staging.netlify.app/docs/concepts/policy/pod-security-policy/#seccomp
https://deploy-preview-21278--kubernetes-io-vnext-staging.netlify.app/docs/tasks/configure-pod-container/security-context/

sftim · 2020-07-14T22:24:11Z

@sftim how would opening a separate PR work with docs freeze?

@hasheddan the website itself uses a continuous deployment pipeline. To get your change into a release (v1.19) you must document it, and this documentation has an impending deadline for when your feature documentation must be ready. But, you can split this PR into a minimum-viable amount of documentation and a separate PR with the tutorial in it, both targeting dev-1.19.

Once #21278 (this PR) merges, and a putative separate PR for adding the seccomp tutorial has /lgtm, then that separate tutorial PR is good to merge into dev-1.19, ahead of the release. If the separate tutorial misses the opportunity to merge into the dev-1.19 branch you can change its merge target to master, after v1.19 is released, and it'll still be ready for approval, automated merge, and publishing.

Essentially: whilst it's nice to add that tutorial for using Seccomp, not adding that tutorial doesn't block or delay the v1.19 release.

@savitharaghunathan & @kubernetes/sig-docs-leads does that sound right? If I've got a detail wrong there please jump in.

Discussed in comment history

kbhawkey · 2020-07-14T22:59:49Z

content/en/docs/tutorials/clusters/seccomp.md

+## {{% heading "prerequisites" %}}
+
+In order to complete all steps in this tutorial, you must install
+[kind](https://kind.sigs.k8s.io/docs/user/quick-start/) and


Is it straightforward to port the tutorial to use minikube?

kbhawkey · 2020-07-14T23:02:56Z

content/en/docs/tutorials/clusters/seccomp.md

+
+## Create Pod with Seccomp Profile for Syscall Auditing
+
+Next we want to apply our `audit.json` profile, which will log all syscalls of


Next , apply the audit.json profile. The audit.json profile logs all syscalls of the process to a new Pod.

sftim · 2020-07-14T23:05:47Z

content/en/docs/tutorials/clusters/seccomp.md

+If you are using a pre-v1.19 Kubernetes version, download this manifest as
+`audit-pod.yaml`. 
+
+{{< codenew file="pods/security/seccomp/alpha/audit-pod.yaml" >}}
+
+If using Kubernetes v1.19 or later, download this manifest as `audit-pod.yaml`.
+
+{{< codenew file="pods/security/seccomp/ga/audit-pod.yaml" >}}


Consider using tabs here.

A viable alternative: get a version of this tutorial for v1.18 merged into master, and then revise it for v1.19

In the v1.19 and later versions, tell the reader to look at the v1.18 version if they're using an older cluster.

kbhawkey · 2020-07-14T23:06:54Z

content/en/docs/tutorials/clusters/seccomp.md

+audit-pod   1/1     Running   0          30s
+```
+
+We want to be able to interact with this endpoint exposed by this container, so


nit, clean up we and let's:
To interact with this endpoint exposed by this container, create a NodePort service that allows access
to the endpoint from inside your kind control plane container.

kbhawkey · 2020-07-14T23:07:40Z

content/en/docs/tutorials/clusters/seccomp.md

+```
+
+Now we will be able to `curl` the endpoint from inside the kind control plane
+container at the port exposed by this Service.


Clean up: Now we will be able ...

kbhawkey · 2020-07-14T23:08:17Z

content/en/docs/tutorials/clusters/seccomp.md

+```
+docker exec -it 6a96207fed4b curl localhost:32373
+```
+


Is this the output?
If so, could add text before the code block to explain.

This is a command, added some text to indicate so 👍

kbhawkey · 2020-07-14T23:09:51Z

content/en/docs/tutorials/clusters/seccomp.md

+
+{{< codenew file="pods/security/seccomp/alpha/default-pod.yaml" >}}
+
+If using Kubernetes v1.19 or later, set the field.


nit: Set the field?

kbhawkey · 2020-07-16T01:01:22Z

Looking at this again.

kbhawkey · 2020-07-16T02:00:43Z

Hello @hasheddan . Thanks for this PR.
I looked through the changes again. If you have time, you could fix the style and other small issues.
I don't have a strong opinion about which cluster setup tool to feature with the examples.
I'd be in favor of showing both kind and minikube paths. I am okay with showing kind now and updating later.
For me, the biggest challenge with this tutorial is displaying the alpha and GA manifests together.
How difficult would it be to split the tutorial, creating two versions (alpha, GA) of the tutorial?
I imagine this would not be too difficult.

kbhawkey · 2020-07-16T02:08:53Z

@savitharaghunathan , What is the absolute last day/time for accepting 1.19 docs changes?

savitharaghunathan · 2020-07-16T10:50:46Z

@savitharaghunathan , What is the absolute last day/time for accepting 1.19 docs changes?

@kbhawkey It is EOD PST time today :) However, this particular PR has obtained approvals to be merged after the deadline.

hasheddan · 2020-07-19T22:46:01Z

@sftim @kbhawkey thank you for your thoughtful reviews and your patience! I believe I have now addressed all comments, and have made the explanation of using both GA and alpha seccomp cleaner by using tabs. I have not yet moved the tutorial from kind to minikube, and would advocate for keeping kind and adding minikube because I think the kind setup is useful information. Seccomp should work on any Kubernetes cluster where it is enabled, so it does not make a huge difference what tool or service is used. I am starting work on adding minikube support here, but please let me know if you think it is not necessary. Thanks again for your work!

Signed-off-by: hasheddan <[email protected]>

hasheddan · 2020-07-20T18:54:10Z

@zacharysarah commits squashed 👍

zacharysarah · 2020-07-20T19:13:27Z

/lgtm
/approve

k8s-ci-robot · 2020-07-20T19:13:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: zacharysarah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [zacharysarah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 28, 2020

k8s-ci-robot requested review from pjbgf and saschagrunert May 28, 2020 21:34

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels May 28, 2020

sftim reviewed May 28, 2020

View reviewed changes

content/en/docs/tutorials/clusters/seccomp.md Outdated Show resolved Hide resolved

pjbgf reviewed May 28, 2020

View reviewed changes

saschagrunert reviewed May 29, 2020

View reviewed changes

content/en/docs/concepts/policy/pod-security-policy.md Outdated Show resolved Hide resolved

hasheddan changed the base branch from master to dev-1.19 June 1, 2020 13:10

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 1, 2020

hasheddan force-pushed the seccomp branch from 3582c8d to d46f9b4 Compare June 1, 2020 13:18

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jun 1, 2020

pjbgf mentioned this pull request Jun 1, 2020

Graduate Seccomp to GA kubernetes/kubernetes#91286

Closed

9 tasks

k8s-ci-robot added this to the 1.19 milestone Jun 2, 2020

k8s-ci-robot added the sig/node Categorizes an issue or PR as relevant to SIG Node. label Jun 28, 2020

sftim reviewed Jun 28, 2020

View reviewed changes

content/en/docs/concepts/policy/pod-security-policy.md Outdated Show resolved Hide resolved

hasheddan force-pushed the seccomp branch from d46f9b4 to 17147b4 Compare July 1, 2020 14:30

k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 1, 2020

sftim reviewed Jul 14, 2020

View reviewed changes

kbhawkey reviewed Jul 14, 2020

View reviewed changes

sftim reviewed Jul 14, 2020

View reviewed changes

kbhawkey reviewed Jul 14, 2020

View reviewed changes

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 19, 2020

Add documentation for generally available seccomp functionality

3ad7ea7

Signed-off-by: hasheddan <[email protected]>

hasheddan force-pushed the seccomp branch from 69113e3 to 3ad7ea7 Compare July 20, 2020 18:53

zacharysarah force-pushed the dev-1.19 branch from e8364ee to 54949b5 Compare July 20, 2020 19:03

k8s-ci-robot assigned zacharysarah Jul 20, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 20, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 20, 2020

k8s-ci-robot merged commit 3841d72 into kubernetes:dev-1.19 Jul 20, 2020

hasheddan mentioned this pull request Aug 5, 2020

Document Kubernetes seccomp support kubernetes/kubernetes#58211

Closed

-  `--seccomp-profile-root` flag on the Kubelet. (Note: this flag has been
-  deprecated in v1.19 and will be removed in v1.23. The seccomp root path will
-  then be derived from the kubelet root path, which is defined by `--root-dir`.
-  The current default value is `<root-dir>/seccomp`.)
+  `--seccomp-profile-root` flag on the kubelet.
+   {{< note >}}
+   Kubernetes v1.19 deprecated the `--seccomp-profile-root` flag, which will be removed in
+   Kubernetes v1.23. The seccomp root path will   then be derived from the kubelet root path,
+   which is defined by `--root-dir`. The current default value is `<root-dir>/seccomp`.
+   {{< /note >}}


		## Create Pod with Seccomp Profile for Syscall Auditing

		Next we want to apply our `audit.json` profile, which will log all syscalls of


		{{< codenew file="pods/security/seccomp/alpha/default-pod.yaml" >}}

		If using Kubernetes v1.19 or later, set the field.

Add documentation for Seccomp GA #21278

Add documentation for Seccomp GA #21278

Uh oh!

Conversation

hasheddan commented May 28, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented May 28, 2020

Uh oh!

Uh oh!

netlify bot commented May 28, 2020

Uh oh!

pjbgf left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

savitharaghunathan commented May 30, 2020

Uh oh!

hasheddan commented Jun 1, 2020

Uh oh!

k8sio-netlify-preview-bot commented Jun 1, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sftim commented Jun 2, 2020

Uh oh!

sftim commented Jun 28, 2020

Uh oh!

sftim left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hasheddan commented Jul 14, 2020

Uh oh!

kbhawkey commented Jul 14, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sftim commented Jul 14, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kbhawkey commented Jul 16, 2020

Uh oh!

kbhawkey commented Jul 16, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kbhawkey commented Jul 16, 2020

Uh oh!

savitharaghunathan commented Jul 16, 2020

Uh oh!

hasheddan commented Jul 19, 2020

Uh oh!

hasheddan commented May 28, 2020 •

edited

Loading

k8sio-netlify-preview-bot commented Jun 1, 2020 •

edited

Loading

kbhawkey commented Jul 14, 2020 •

edited

Loading

kbhawkey commented Jul 16, 2020 •

edited

Loading