public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 21:18:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

[2.7.2] #462 Add instructions for how to use PSACT (#489)

Browse Source 
* #462 Add Add instructions for how to use PSACT

* started adding instructions for adding/editing a cluster

* started adding instructions for add/editing a psa template

* instructions for rke2/k3s, note about cis

* updated to include RKE1 instructions

* wording

* nipicky word choice: applied > described

* Apply suggestions from code review

Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com>

* tabs, added suggestion on RKe2 link from thread

* sidebars, correcting language in hardening guide

* link, switching where list of exempt namespaces is placed, corrections - users edit the PSA config, not PSS, to establish restrictions on pods

* update link

* added final save/create instructions

* Apply suggestions from code review

Co-authored-by: Billy Tat <btat@suse.com>

* updated file names

* missing metadata key

* corrected links

* Delete psa-config-template.md

File shouldn't still be in the tree, as it was renamed

* Apply suggestions from code review

Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com>

* syncing RKE1 and 2 hardening guides, title update

* moved sample config file, added -  to list of required exempt namespaces

* added moved config file to sidebars.js

---------

Co-authored-by: Jiaqi Luo <6218999+jiaqiluo@users.noreply.github.com>
Co-authored-by: Billy Tat <btat@suse.com>
This commit is contained in:
Marty Hernandez Avedon
2023-03-24 15:04:15 -04:00
committed by GitHub
co-authored by Jiaqi Luo Billy Tat
parent 73334f6d62
commit 40936468b4
7 changed files with 166 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pages-for-subheaders/k3s-hardening-guide.md
+3 -3
View File
@@ -71,16 +71,16 @@ By default, K3s does not include any pod security or network policies. However,
<Tabs groupId="k3s-version">
<TabItem value="v1.25 and Newer" default>
K3s v1.25 and newer support [Pod Security Admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) for controlling pod security.
K3s v1.25 and newer support [Pod Security admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) for controlling pod security.
You can specify the Pod Security Admission configuration by setting the `defaultPodSecurityAdmissionConfigurationTemplateName` field in the cluster configuration in Rancher:
You can specify the PSA configuration by setting the `defaultPodSecurityAdmissionConfigurationTemplateName` field in the cluster configuration in Rancher:
```yaml
spec:
defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted
```
The `rancher-restricted` template is a Rancher provided PSS (Pod Security Standards) policy that enforces the highly-restrictive Kubernetes upstream [`Restricted`](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) profile with best practices for pod hardening.
The `rancher-restricted` template is provided by Rancher to enforce the highly-restrictive Kubernetes upstream [`Restricted`](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) profile with best practices for pod hardening.
</TabItem>
<TabItem value="v1.24 and Older">
docs/pages-for-subheaders/rke1-hardening-guide.md
+1 -1
View File
@@ -154,7 +154,7 @@ The reference `cluster.yml` is used by the RKE CLI that provides the configurati
<TabItem value="v1.25 and Newer" default>
:::note
If you intend to import an RKE cluster into Rancher, please consult the [documentation](../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md) for how to configure the Pod Security Standards to add Rancher's namespaces to the exemption list.
If you intend to import an RKE cluster into Rancher, please consult the [documentation](../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for how to configure the PSA to exempt Rancher system namespaces.
:::
```yaml
docs/pages-for-subheaders/rke2-hardening-guide.md
+6 -2
View File
@@ -87,7 +87,7 @@ RKE2 always runs with some amount of pod security.
<Tabs groupId="rke2-version">
<TabItem value="v1.25 and Newer" default>
On v1.25 and newer, [Pod Security Admission (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) are used for pod security.
On v1.25 and newer, [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) are used for pod security.
Below is the minimum necessary configuration needed for hardening RKE2 to pass CIS v1.23 hardened profile `rke2-cis-1.23-hardened` available in Rancher.
@@ -104,9 +104,13 @@ When both the `defaultPodSecurityAdmissionConfigurationTemplateName` and `profil
1. Checks that host-level requirements have been met. If they haven't, RKE2 will exit with a fatal error describing the unmet requirements.
2. Applies network policies that allow the cluster to pass associated controls.
3. Configures the Pod Security Admission Controller with the Pod Security Admission Configuration Template (PSACT) `rancher-restricted`, to enforce restricted mode in all namespaces, except the ones in the PSACT's exemption list.
3. Configures the Pod Security Admission Controller with the PSA configuration template `rancher-restricted`, to enforce restricted mode in all namespaces, except the ones in the template's exemption list.
These namespaces are exempted to allow system pods to run without restrictions, which is required for proper operation of the cluster.
:::note
If you intend to import an RKE cluster into Rancher, please consult the [documentation](../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for how to configure the PSA to exempt Rancher system namespaces.
:::
</TabItem>
<TabItem value="v1.24 and Older">