From bd1cfccef3781360019c8d5b5e02424631b06924 Mon Sep 17 00:00:00 2001 From: martyav Date: Fri, 17 Mar 2023 16:49:13 -0400 Subject: [PATCH] #487 Instructions for Preparing Hardened Imported/Custom RKE2/K3s Cluster for Upgrade from 1.24 to 1.25 --- ...upgrade-a-hardened-cluster-to-k8s-v1-25.md | 48 +++++++++++++++++++ .../rancher-psact.yaml | 37 ++++++++++++++ 2 files changed, 85 insertions(+) create mode 100644 docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/prepare-to-upgrade-a-hardened-cluster-to-k8s-v1-25.md create mode 100644 docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/prepare-to-upgrade-a-hardened-cluster-to-k8s-v1-25.md b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/prepare-to-upgrade-a-hardened-cluster-to-k8s-v1-25.md new file mode 100644 index 00000000000..21cdb0f38ea --- /dev/null +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/prepare-to-upgrade-a-hardened-cluster-to-k8s-v1-25.md @@ -0,0 +1,48 @@ +--- +title: Preparing to Upgrade a Hardened Custom/Imported Cluster to Kubernetes v1.25 +--- + +Kubernetes v1.25 changes how clusters describe and implement security policies. From this version forward, [Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are no longer available. Kubernetes v1.25 replaces them with new security objects: [Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/), and [Pod Security Admissions (PSAs)](https://kubernetes.io/docs/concepts/security/pod-security-admission/). + +If you have custom or imported hardened clusters, you must make special preparations to ensure that the upgrade from an earlier version of Kubernetes to ≥v1.25 goes smoothly. + +## Upgrading Imported Hardened Clusters to Kubernetes ≥v1.25 + + + +1. Save [`rancher-psact.yaml`](./rancher-psact.yaml) in `/etc/rancher/rke2` on each node in the cluster. +1. Edit the RKE2 configuration file: + 1. Update the `profile` field to `cis-1.23`. + 1. Specify the path for the configuration file that you just added: `pod-security-admission-config-file: /etc/rancher/rke2/rancher-psact.yaml`. + +After you perform these steps, you can upgrade the cluster's Kubernetes version through the Rancher UI. + + +Follow the [official K3s instructions](https://docs.k3s.io/known-issues#:~:text=Upgrading%20Hardened%20Clusters%20from%20v1.24.x%20to%20v1.25.x), but use a [custom](./rancher-psact.yaml) Rancher PSA configuration template, instead of the configuration provided on the official K3s site. + +After you perform these steps, you can upgrade the cluster's Kubernetes version through the Rancher UI. + + + +## Upgrading Custom Hardened Clusters to Kubernetes ≥v1.25 + + + +1. In the upper left corner, click **☰ > Cluster Management**. +1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. +1. Select **Edit Config**. +1. Under **Basics > Security**, in the **CIS Profile** dropdown menu, select `cis-1.23`. +1. In the **Default Pod Security Admission** dropdown menu, select `rancher-restricted`. +1. Click **Save**. +1. Upgrade the cluster's Kubernetes version through the Rancher UI. + + +1. In the upper left corner, click **☰ > Cluster Management**. +1. Find the cluster you want to update in the **Clusters** table, and click the **⋮**. +1. Select **Edit YAML**. +1. Delete `PodSecurityPolicy` from `kube-apiserver-arg.enable-admission-plugins` +1. Add this line to the `spec` field: `defaultPodSecurityAdmissionConfigurationTemplateName: rancher-restricted` +1. Update `kubernetesVersion` to your chosen version (v1.25 or later). +1. Click **Save**. + + \ No newline at end of file diff --git a/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml new file mode 100644 index 00000000000..ae248cc9b7c --- /dev/null +++ b/docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml @@ -0,0 +1,37 @@ +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- configuration: + apiVersion: pod-security.admission.config.k8s.io/v1 + defaults: + audit: restricted + audit-version: latest + enforce: restricted + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - ingress-nginx + - kube-system + - cattle-system + - cattle-epinio-system + - cattle-fleet-system + - longhorn-system + - cattle-neuvector-system + - cattle-monitoring-system + - rancher-alerting-drivers + - cis-operator-system + - cattle-csp-adapter-system + - cattle-externalip-system + - cattle-gatekeeper-system + - istio-system + - cattle-istio-system + - cattle-logging-system + - cattle-windows-gmsa-system + - cattle-sriov-system + - cattle-ui-plugin-system + - tigera-operator + kind: PodSecurityConfiguration + name: PodSecurity + path: "" \ No newline at end of file