Kh add examples (#18)

* kh: add examples

* policy examples

Author: Kaizhe

examples/clean.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -eu
+
+kubectl delete -f ns.yaml || true
+
+kubectl delete psp psp-privileged psp-restricted || true

examples/deploy.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+export PATH=$PATH:../
+
+set -eu
+
+# create namespaces
+kubectl apply -f ns.yaml || true
+
+# create service accounts
+kubectl apply -f sa.yaml || true
+
+# create roles and rolebindings for service accounts to use pod security policies
+kubectl apply -f roles.yaml || true
+
+# create pods
+kubectl apply -f pods.yaml || true
+
+# generate psp and update the pod security policy name
+kube-psp-advisor --namespace privileged | sed -e 's/pod-security.*/psp-privileged/g' | kubectl apply -f -
+
+kube-psp-advisor --namespace restricted | sed -e 's/pod-security.*/psp-restricted/g' | kubectl apply -f -
+
+# test creating pods that pass the pod security policies
+kubectl apply -f pods-allow.yaml || true
+
+kubectl get pods -n privileged
+
+kubectl get pods -n restricted
+
+# test creating pod that violate pod security policies
+kubectl apply -f pods-deny.yaml || true
+
+kubectl get pods -n privileged
+
+kubectl get pods -n restricted
+

examples/ns.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: restricted
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: privileged

examples/pods-allow.yaml

@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: privileged-busybox-0
+  namespace: privileged 
+spec:
+  serviceAccountName: privileged-sa
+  containers:
+  - name: my-busybox-container
+    image: busybox
+    args: ["sleep", "3000"]
+    securityContext:
+      privileged: false
+      runAsNonRoot: false 
+      readOnlyRootFilesystem: false
+      allowPrivilegeEscalation: true
+  hostPID: true
+  hostIPC: false
+  hostNetwork: true
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: restricted-busybox-0
+  namespace: restricted
+spec:
+  serviceAccountName: restricted-sa
+  containers:
+  - name: my-busybox-container
+    image: busybox
+    args: ["sleep", "3000"]
+    securityContext:
+      privileged: false
+      runAsNonRoot: false 
+      readOnlyRootFilesystem: false
+      allowPrivilegeEscalation: false
+  hostPID: false
+  hostIPC: false
+  hostNetwork: false

examples/pods-deny.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: restricted-busybox-1
+  namespace: restricted
+spec:
+  serviceAccountName: restricted-sa
+  containers:
+  - name: busybox-container-1
+    image: busybox
+    args: ["sleep", "3000"]
+    securityContext:
+      privileged: true # try to launch a privileged pod in restricted namespace
+      runAsNonRoot: false 
+      readOnlyRootFilesystem: false
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - SYS_CHROOT
+  hostPID: false
+  hostIPC: false
+  hostNetwork: false
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: privileged-busybox-1
+  namespace: privileged 
+spec:
+  serviceAccountName: restricted-sa # restricted-sa is trying to launch a privileged pod in privileged namespace
+  containers:
+  - name: busybox-container-1
+    image: busybox
+    args: ["sleep", "3000"]
+    securityContext:
+      privileged: true # try to launch a privileged pod in privileged namespace
+      runAsNonRoot: false 
+      readOnlyRootFilesystem: false
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - SYS_CHROOT
+  hostPID: false
+  hostIPC: false
+  hostNetwork: false

examples/pods.yaml

@@ -0,0 +1,47 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: privileged-busybox-base
+  namespace: privileged 
+spec:
+  serviceAccountName: privileged-sa
+  containers:
+  - name: my-busybox-container
+    image: busybox
+    args: ["sleep", "3000"]
+    securityContext:
+      capabilities:
+        add:
+        - SYS_ADMIN
+        drop:
+        - SYS_CHROOT
+      privileged: true
+      runAsNonRoot: false 
+      readOnlyRootFilesystem: false
+      allowPrivilegeEscalation: true
+  hostPID: true
+  hostIPC: true
+  hostNetwork: true
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: restricted-busybox-base
+  namespace: restricted
+spec:
+  serviceAccountName: restricted-sa
+  containers:
+  - name: my-busybox-container
+    image: busybox
+    args: ["sleep", "3000"]
+    securityContext:
+      capabilities:
+        drop:
+        - SYS_CHROOT
+      privileged: false
+      runAsNonRoot: false 
+      readOnlyRootFilesystem: false
+      allowPrivilegeEscalation: false
+  hostPID: false
+  hostIPC: false
+  hostNetwork: false

examples/roles.yaml

@@ -0,0 +1,49 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: psp-restricted-role
+  namespace: restricted
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  resourceNames: ['psp-restricted']
+  verbs: ['use']
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: psp-privileged-role
+  namespace: privileged 
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  resourceNames: ['psp-privileged']
+  verbs: ['use']
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: psp-restricted-rolebinding
+  namespace: restricted
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: psp-restricted-role
+subjects:
+- kind: ServiceAccount
+  name: restricted-sa
+  namespace: restricted
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: psp-privileged-rolebinding
+  namespace: privileged
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: psp-privileged-role
+subjects:
+- kind: ServiceAccount
+  name: privileged-sa
+  namespace: privileged

examples/sa.yaml

@@ -0,0 +1,11 @@
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: restricted-sa
+  namespace: restricted
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: privileged-sa
+  namespace: privileged 

test-yaml/busy-box.yaml

@@ -4,6 +4,7 @@ metadata:
   name: my-busybox
   namespace: psp-test 
 spec:
+  serviceAccountName: psp-test-sa
   containers:
   - name: my-busybox-container
     image: busybox