mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 12:38:05 +00:00
* #462 Add Add instructions for how to use PSACT * started adding instructions for adding/editing a cluster * started adding instructions for add/editing a psa template * instructions for rke2/k3s, note about cis * updated to include RKE1 instructions * wording * nipicky word choice: applied > described * Apply suggestions from code review Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com> * tabs, added suggestion on RKe2 link from thread * sidebars, correcting language in hardening guide * link, switching where list of exempt namespaces is placed, corrections - users edit the PSA config, not PSS, to establish restrictions on pods * update link * added final save/create instructions * Apply suggestions from code review Co-authored-by: Billy Tat <btat@suse.com> * updated file names * missing metadata key * corrected links * Delete psa-config-template.md File shouldn't still be in the tree, as it was renamed * Apply suggestions from code review Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com> * syncing RKE1 and 2 hardening guides, title update * moved sample config file, added - to list of required exempt namespaces * added moved config file to sidebars.js --------- Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com> Co-authored-by: Billy Tat <btat@suse.com>
This commit is contained in:
Marty Hernandez Avedon
co-authored by
Jiaqi Luo
Billy Tat
Jiaqi Luo
Billy Tat
parent
73334f6d62
commit
40936468b4
+7
-58
@@ -4,73 +4,22 @@ title: Pod Security Standards (PSS) & Pod Security Admissions (PSA)
|
||||
|
||||
[Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) and [Pod Security admissions (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) define security restrictions for a broad set of workloads. They replace [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) in Kubernetes v1.25 and above.
|
||||
|
||||
PSS define security levels for workloads. PSAs describe requirements for pod security contexts and related fields. PSAs reference PSS levels to define security restrictions.
|
||||
PSS define security levels for workloads. PSAs describe requirements for pod security contexts and related fields. PSAs reference PSS levels to define security restrictions on pods.
|
||||
|
||||
## Upgrade to Pod Security Standards
|
||||
## Upgrade to Pod Security Standards (PSS)
|
||||
|
||||
Make sure that you migrate all Pod Security Policies. This should grant equivalent security controls through [Pod Security Admissions](https://kubernetes.io/docs/concepts/security/pod-security-admission/), or through solutions such as [Gatekeeper](https://github.com/open-policy-agent/gatekeeper), [Kubewarden](https://www.kubewarden.io/), [Kyverno](https://kyverno.io/), and [NeuVector](https://neuvector.com/). Remove all PodSecurityPolicy objects from the cluster.
|
||||
Make sure that you migrate all Pod Security Policies (PSPs). This should grant equivalent security controls through [Pod Security Admissions](https://kubernetes.io/docs/concepts/security/pod-security-admission/), or through solutions such as [Gatekeeper](https://github.com/open-policy-agent/gatekeeper), [Kubewarden](https://www.kubewarden.io/), [Kyverno](https://kyverno.io/), and [NeuVector](https://neuvector.com/). Remove all `PodSecurityPolicy` objects from the cluster.
|
||||
|
||||
:::info important
|
||||
You must add your new policy enforcement mechanisms _before_ you remove the PodSecurityPolicy objects. If you don't, you may create an opportunity for privilege escalation attacks within the cluster.
|
||||
:::
|
||||
|
||||
## Pod Security Admission Configuration Templates
|
||||
## Pod Security Admission (PSA) Configuration Templates
|
||||
|
||||
Rancher comes with two Pod Security Admission (PSA) configuration templates that you can assign to a cluster:
|
||||
|
||||
- `rancher-privileged`: This is the most permissive configuration and doesn't restrict the behavior of the pod, allowing for known privilege escalations. This policy has no exemptions.
|
||||
- `rancher-restricted`: This configuration is heavily restricted and follows current best practices for hardening pods. There are namespace-level exemptions for Rancher components, as described below.
|
||||
|
||||
If you are a Rancher administrator or have restricted administrator privileges, you can customize restrictions and permissions by creating additional templates, or by editing existing templates.
|
||||
|
||||
:::caution
|
||||
If you edit an existing template while it is still in use, it *will* affect all clusters that have been assigned that template.
|
||||
:::
|
||||
|
||||
If you want to allow users other than the Rancher administrator to manage templates, you can bind the user to a role that grants the user all verbs (`"*"`) on `management.cattle.io/podsecurityadmissionconfigurationtemplates`.
|
||||
|
||||
:::warning
|
||||
Any user that is bound to the above permission will be able to change the restriction levels on all managed clusters which use this template, including ones they have no permissions on.
|
||||
:::
|
||||
Rancher offers PSA configuration templates. These are pre-defined security configurations that you can apply to a cluster. Rancher admins (or those with the right permissions) can [create, manage, and edit](./psa-config-templates.md) PSA templates.
|
||||
|
||||
### Rancher on PSA-restricted Clusters
|
||||
|
||||
When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you will need to exempt the following namespaces, otherwise the policy might prevent Rancher system pods from properly running.
|
||||
Rancher system namespaces are also affected by the restrictive security policies described by PSA templates. You need to exempt Rancher's system namespaces after you assign the template, or else the cluster won't operate correctly. See [Pod Security Admission (PSA) Configuration Templates](./psa-config-templates.md#exempting-required-rancher-namespaces) for more details.
|
||||
|
||||
- `calico-apiserver`
|
||||
- `calico-system`
|
||||
- `cattle-alerting`
|
||||
- `cattle-csp-adapter-system`
|
||||
- `cattle-epinio-system`
|
||||
- `cattle-externalip-system`
|
||||
- `cattle-fleet-local-system`
|
||||
- `cattle-fleet-system`
|
||||
- `cattle-gatekeeper-system`
|
||||
- `cattle-global-data`
|
||||
- `cattle-global-nt`
|
||||
- `cattle-impersonation-system`
|
||||
- `cattle-istio`
|
||||
- `cattle-istio-system`
|
||||
- `cattle-logging`
|
||||
- `cattle-logging-system`
|
||||
- `cattle-monitoring-system`
|
||||
- `cattle-neuvector-system`
|
||||
- `cattle-prometheus`
|
||||
- `cattle-sriov-system`
|
||||
- `cattle-system`
|
||||
- `cattle-ui-plugin-system`
|
||||
- `cattle-windows-gmsa-system`
|
||||
- `cert-manager`
|
||||
- `cis-operator-system`
|
||||
- `fleet-default`
|
||||
- `ingress-nginx`
|
||||
- `istio-system`
|
||||
- `kube-node-lease`
|
||||
- `kube-public`
|
||||
- `kube-system`
|
||||
- `longhorn-system`
|
||||
- `rancher-alerting-drivers`
|
||||
- `security-scan`
|
||||
- `tigera-operator`
|
||||
|
||||
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](psa-restricted-exemptions.yaml).
|
||||
For a complete file which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](psa-restricted-exemptions.md).
|
||||
|
||||
+138
@@ -0,0 +1,138 @@
|
||||
---
|
||||
title: Pod Security Admission (PSA) Configuration Templates
|
||||
---
|
||||
|
||||
[Pod Security admission (PSA)](./pod-security-standards.md) configuration templates are a Rancher custom-defined resource (CRD), available in Rancher v2.7.2 and above. The templates provide pre-defined security configurations that you can apply to a cluster:
|
||||
|
||||
- `rancher-privileged`: The most permissive configuration. It doesn't restrict the behavior of any pods. This allows for known privilege escalations. This policy has no exemptions.
|
||||
- `rancher-restricted`: A heavily restricted configuration that follows current best practices for hardening pods. You must make [namespace-level exemptions](./pod-security-standards.md#rancher-on-psa-restricted-clusters) for Rancher components.
|
||||
|
||||
## Assign a Pod Security Admissions (PSA) Configuration Template
|
||||
|
||||
You can assign a PSA template at the same time that you create a downstream cluster. You can also add a template by configuring an existing cluster.
|
||||
|
||||
### Assign a Template During Cluster Creation
|
||||
<Tabs>
|
||||
<TabItem value="RKE2 and K3s">
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. On the **Clusters** page, click the **Create** button.
|
||||
1. Select a provider.
|
||||
1. On the **Cluster: Create** page, go to **Basics > Security**.
|
||||
1. In the **Default Pod Security Admission** dropdown menu, select the template you want to assign.
|
||||
1. Click **Create**.
|
||||
|
||||
### Assign a Template to an Existing Cluster
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**.
|
||||
1. Select **Edit Config** .
|
||||
1. In the **Default Pod Security Admission** dropdown menu, select the template you want to assign.
|
||||
1. Click **Save**.
|
||||
|
||||
### Hardening the Cluster
|
||||
|
||||
If you select the **rancher-restricted** template but don't select a **CIS Profile**, you won't meet required CIS benchmarks. See the [RKE2 hardening guide](../../../pages-for-subheaders/rke2-hardening-guide.md) for more details.
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="RKE1">
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. On the **Clusters** page, click the **Create** button.
|
||||
1. Select a provider.
|
||||
1. On the **Add Cluster** page, under **Cluster Options**, click **Advanced Options**.
|
||||
1. In the **Pod Security Admission Configuration Template** dropdown menu, select the template you want to assign.
|
||||
1. Click **Create**.
|
||||
|
||||
### Assign a Template to an Existing Cluster
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**.
|
||||
1. Select **Edit Config**.
|
||||
1. On the **Edit Cluster** page, go to **Cluster Options > Advanced Options**.
|
||||
1. In the **Pod Security Admission Configuration Template**, select the template you want to assign.
|
||||
1. Click **Save**.
|
||||
|
||||
</TabItem>
|
||||
</Tabs>
|
||||
|
||||
## Add or Edit a Pod Security Admissions (PSA) Configuration Template
|
||||
|
||||
If you have administrator privileges, you can customize security restrictions and permissions by creating additional PSA templates, or by editing existing templates.
|
||||
|
||||
:::caution
|
||||
If you edit an existing PSA template while it is still in use, changes will be applied to all clusters that have been assigned to that template.
|
||||
:::
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. Click **Advanced** to open the dropdown menu.
|
||||
1. Select **Pod Security Admissions**.
|
||||
1. Find the template you want to modify, and click the **⋮**.
|
||||
1. Select **Edit Config** to edit the template.
|
||||
1. When you're done editing the configuration, click **Save**.
|
||||
|
||||
### Allow Non-Admin Users to Manage PSA Templates
|
||||
|
||||
If you want to allow other users to manage templates, you can bind that user to a role that grants all verbs (`"*"`) on `management.cattle.io/podsecurityadmissionconfigurationtemplates`.
|
||||
|
||||
:::caution
|
||||
Any user that is bound to the above permission will be able to change the restriction levels on _all_ managed clusters which use a given PSA template, including ones that they have no permissions on.
|
||||
:::
|
||||
|
||||
## Exempting Namespaces
|
||||
|
||||
If you assign the `rancher-restricted` template to a cluster, by default the restrictions are applied across the entire cluster at the namespace level. To exempt certain namespaces from this highly restricted policy, do the following:
|
||||
|
||||
1. In the upper left corner, click **☰ > Cluster Management**.
|
||||
1. Click **Advanced** to open the dropdown menu.
|
||||
1. Select **Pod Security Admissions**.
|
||||
1. Find the template you want to modify, and click the **⋮**.
|
||||
1. Select **Edit Config**.
|
||||
1. Click the **Namespaces** checkbox under **Exemptions** to edit the **Namespaces** field.
|
||||
1. When you're done exempting namespaces, click **Save**.
|
||||
|
||||
:::note
|
||||
You need to update the target cluster to make the new template take effect in that cluster. An update can be triggered by editing and saving the cluster without changing values.
|
||||
:::
|
||||
|
||||
### Exempting Required Rancher Namespaces
|
||||
|
||||
When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you will need to [exempt the following namespaces](./psa-config-templates.md#exempting-namespaces), otherwise the policy might prevent Rancher system pods from properly running.
|
||||
|
||||
- `calico-apiserver`
|
||||
- `calico-system`
|
||||
- `cattle-alerting`
|
||||
- `cattle-csp-adapter-system`
|
||||
- `cattle-epinio-system`
|
||||
- `cattle-externalip-system`
|
||||
- `cattle-fleet-local-system`
|
||||
- `cattle-fleet-system`
|
||||
- `cattle-gatekeeper-system`
|
||||
- `cattle-global-data`
|
||||
- `cattle-global-nt`
|
||||
- `cattle-impersonation-system`
|
||||
- `cattle-istio`
|
||||
- `cattle-istio-system`
|
||||
- `cattle-logging`
|
||||
- `cattle-logging-system`
|
||||
- `cattle-monitoring-system`
|
||||
- `cattle-neuvector-system`
|
||||
- `cattle-prometheus`
|
||||
- `cattle-sriov-system`
|
||||
- `cattle-system`
|
||||
- `cattle-ui-plugin-system`
|
||||
- `cattle-windows-gmsa-system`
|
||||
- `cert-manager`
|
||||
- `cis-operator-system`
|
||||
- `fleet-default`
|
||||
- `ingress-nginx`
|
||||
- `istio-system`
|
||||
- `kube-node-lease`
|
||||
- `kube-public`
|
||||
- `kube-system`
|
||||
- `longhorn-system`
|
||||
- `rancher-alerting-drivers`
|
||||
- `security-scan`
|
||||
- `tigera-operator`
|
||||
|
||||
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](psa-restricted-exemptions.md).
|
||||
@@ -71,16 +71,16 @@ By default, K3s does not include any pod security or network policies. However,
|
||||
<Tabs groupId="k3s-version">
|
||||
<TabItem value="v1.25 and Newer" default>
|
||||
|
||||
K3s v1.25 and newer support [Pod Security Admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) for controlling pod security.
|
||||
K3s v1.25 and newer support [Pod Security admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) for controlling pod security.
|
||||
|
||||
You can specify the Pod Security Admission configuration by setting the `defaultPodSecurityAdmissionConfigurationTemplateName` field in the cluster configuration in Rancher:
|
||||
You can specify the PSA configuration by setting the `defaultPodSecurityAdmissionConfigurationTemplateName` field in the cluster configuration in Rancher:
|
||||
|
||||
```yaml
|
||||
spec:
|
||||
defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted
|
||||
```
|
||||
|
||||
The `rancher-restricted` template is a Rancher provided PSS (Pod Security Standards) policy that enforces the highly-restrictive Kubernetes upstream [`Restricted`](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) profile with best practices for pod hardening.
|
||||
The `rancher-restricted` template is provided by Rancher to enforce the highly-restrictive Kubernetes upstream [`Restricted`](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) profile with best practices for pod hardening.
|
||||
|
||||
</TabItem>
|
||||
<TabItem value="v1.24 and Older">
|
||||
|
||||
@@ -154,7 +154,7 @@ The reference `cluster.yml` is used by the RKE CLI that provides the configurati
|
||||
<TabItem value="v1.25 and Newer" default>
|
||||
|
||||
:::note
|
||||
If you intend to import an RKE cluster into Rancher, please consult the [documentation](../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md) for how to configure the Pod Security Standards to add Rancher's namespaces to the exemption list.
|
||||
If you intend to import an RKE cluster into Rancher, please consult the [documentation](../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for how to configure the PSA to exempt Rancher system namespaces.
|
||||
:::
|
||||
|
||||
```yaml
|
||||
|
||||
@@ -87,7 +87,7 @@ RKE2 always runs with some amount of pod security.
|
||||
<Tabs groupId="rke2-version">
|
||||
<TabItem value="v1.25 and Newer" default>
|
||||
|
||||
On v1.25 and newer, [Pod Security Admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) are used for pod security.
|
||||
On v1.25 and newer, [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) are used for pod security.
|
||||
|
||||
Below is the minimum necessary configuration needed for hardening RKE2 to pass CIS v1.23 hardened profile `rke2-cis-1.23-hardened` available in Rancher.
|
||||
|
||||
@@ -104,9 +104,13 @@ When both the `defaultPodSecurityAdmissionConfigurationTemplateName` and `profil
|
||||
|
||||
1. Checks that host-level requirements have been met. If they haven't, RKE2 will exit with a fatal error describing the unmet requirements.
|
||||
2. Applies network policies that allow the cluster to pass associated controls.
|
||||
3. Configures the Pod Security Admission Controller with the Pod Security Admission Configuration Template (PSACT) `rancher-restricted`, to enforce restricted mode in all namespaces, except the ones in the PSACT's exemption list.
|
||||
3. Configures the Pod Security Admission Controller with the PSA configuration template `rancher-restricted`, to enforce restricted mode in all namespaces, except the ones in the template's exemption list.
|
||||
These namespaces are exempted to allow system pods to run without restrictions, which is required for proper operation of the cluster.
|
||||
|
||||
:::note
|
||||
If you intend to import an RKE cluster into Rancher, please consult the [documentation](../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for how to configure the PSA to exempt Rancher system namespaces.
|
||||
:::
|
||||
|
||||
</TabItem>
|
||||
|
||||
<TabItem value="v1.24 and Older">
|
||||
|
||||
+9
@@ -1,3 +1,10 @@
|
||||
---
|
||||
title: Sample PodSecurityConfiguration
|
||||
---
|
||||
|
||||
The following PodSecurityConfiguration contains the required Rancher namespace exemptions for a `rancher-restricted` cluster to run properly.
|
||||
|
||||
```yaml
|
||||
apiVersion: apiserver.config.k8s.io/v1
|
||||
kind: AdmissionConfiguration
|
||||
plugins:
|
||||
@@ -40,6 +47,7 @@ plugins:
|
||||
cattle-windows-gmsa-system,
|
||||
cert-manager,
|
||||
cis-operator-system,
|
||||
fleet-default,
|
||||
ingress-nginx,
|
||||
istio-system,
|
||||
kube-node-lease,
|
||||
@@ -49,3 +57,4 @@ plugins:
|
||||
rancher-alerting-drivers,
|
||||
security-scan,
|
||||
tigera-operator]
|
||||
```
|
||||
+2
-1
@@ -316,7 +316,7 @@ const sidebars = {
|
||||
},
|
||||
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies",
|
||||
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards",
|
||||
|
||||
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates",
|
||||
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry",
|
||||
|
||||
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/custom-branding",
|
||||
@@ -1110,6 +1110,7 @@ const sidebars = {
|
||||
},
|
||||
"reference-guides/rancher-security/kubernetes-security-best-practices",
|
||||
"reference-guides/rancher-security/security-advisories-and-cves",
|
||||
"reference-guides/rancher-security/psa-restricted-exemptions",
|
||||
],
|
||||
}
|
||||
]
|
||||
|
||||
Reference in New Issue
Block a user