mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 12:38:05 +00:00
[2.7.2] Update PSS docs (#479)
* Update PSS docs Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com> * Update namespace exemption list Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com> * Apply suggestions from code review Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com> * typo fix for docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md * Removing rancher-operator-system * Removing rancher-operator-system * Update docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com> * Update docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/pod-security-standards.md Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com> --------- Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com> Co-authored-by: Marty Hernandez Avedon <martyavedon@gmail.com> Co-authored-by: Caleb Bron <cbron@users.noreply.github.com>
This commit is contained in:
Guilherme Macedo
co-authored by
Marty Hernandez Avedon
Caleb Bron
Marty Hernandez Avedon
Caleb Bron
parent
9ff1727619
commit
d5b67bb7ec
+6
-2
@@ -2,9 +2,13 @@
|
||||
title: Pod Security Policies
|
||||
---
|
||||
|
||||
_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges).
|
||||
:::caution
|
||||
Pod Security Policy is only available in Kubernetes until v1.24. [Pod Security Standards](pod-security-standards.md) are the built-in alternative.
|
||||
:::
|
||||
|
||||
If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of `Pod <NAME> is forbidden: unable to validate...`.
|
||||
[Pod Security Policies (PSPs)](https://kubernetes.io/docs/concepts/security/pod-security-policy/) are objects that control security-sensitive aspects of the pod specification (such as root privileges).
|
||||
|
||||
If a pod doesn't meet the conditions specified in the PSP, Kubernetes won't allow it to start, and Rancher will display the following error message: `Pod <NAME> is forbidden: unable to validate...`.
|
||||
|
||||
|
||||
## How PSPs Work
|
||||
|
||||
+47
-40
@@ -1,68 +1,75 @@
|
||||
---
|
||||
title: Pod Security Standards
|
||||
title: Pod Security Standards (PSS) & Pod Security Admissions (PSA)
|
||||
---
|
||||
|
||||
[Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) define security restrictions for a broad set of workloads. They replace [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/), which are now deprecated.
|
||||
[Pod Security Standards (PSS)](https://kubernetes.io/docs/concepts/security/pod-security-standards/) and [Pod Security admissions (PSA)](https://kubernetes.io/docs/concepts/security/pod-security-admission/) define security restrictions for a broad set of workloads. They replace [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) in Kubernetes v1.25 and above.
|
||||
|
||||
PSS define security levels for workloads. PSAs describe requirements for pod security contexts and related fields. PSAs reference PSS levels to define security restrictions.
|
||||
|
||||
## Upgrade to Pod Security Standards
|
||||
|
||||
Make sure that all Pod Security Policies have been migrated, which should result in equivalent security controls still being enforced (e.g. Pod Security Admission, Gatekeeper, Kyverno) and all PodSecurityPolicy objects removed from the cluster.
|
||||
Make sure that you migrate all Pod Security Policies. This should grant equivalent security controls through [Pod Security Admissions](https://kubernetes.io/docs/concepts/security/pod-security-admission/), or through solutions such as [Gatekeeper](https://github.com/open-policy-agent/gatekeeper), [Kubewarden](https://www.kubewarden.io/), [Kyverno](https://kyverno.io/), and [NeuVector](https://neuvector.com/). Remove all PodSecurityPolicy objects from the cluster.
|
||||
|
||||
:::info important
|
||||
The new policy enforcement must be added before the PodSecurityPolicy objects are removed, or you risk creating a window of opportunity for privilege escalation within the cluster.
|
||||
|
||||
You must add your new policy enforcement mechanisms _before_ you remove the PodSecurityPolicy objects. If you don't, you may create an opportunity for privilege escalation attacks within the cluster.
|
||||
:::
|
||||
|
||||
## Pod Security Admission Configuration Templates
|
||||
|
||||
Rancher comes with two Pod Security Admission Configuration (PSAC) templates that you can assign to a cluster:
|
||||
- `rancher-privileged`: This is the most permissive configuration and doesn't restrict the behavior of any pod.
|
||||
- `rancher-restricted`: This policy follows current pod-hardening best practices.
|
||||
Rancher comes with two Pod Security Admission (PSA) configuration templates that you can assign to a cluster:
|
||||
|
||||
- `rancher-privileged`: This is the most permissive configuration and doesn't restrict the behavior of the pod, allowing for known privilege escalations. This policy has no exemptions.
|
||||
- `rancher-restricted`: This configuration is heavily restricted and follows current best practices for hardening pods. There are namespace-level exemptions for Rancher components, as described below.
|
||||
|
||||
If you are a Rancher administrator or have restricted administrator privileges, you can customize restrictions and permissions by creating additional PSAC templates, or by editing existing templates.
|
||||
If you are a Rancher administrator or have restricted administrator privileges, you can customize restrictions and permissions by creating additional templates, or by editing existing templates.
|
||||
|
||||
:::caution
|
||||
|
||||
If you edit an existing PSAC template while it is still in use, it *will* affect all clusters that have been assigned that template.
|
||||
|
||||
If you edit an existing template while it is still in use, it *will* affect all clusters that have been assigned that template.
|
||||
:::
|
||||
|
||||
If you want to allow users other than the Rancher administrator to manage PSAC templates, you can bind the user to a role that grants the user all verbs ("*") on `management.cattle.io/podsecurityadmissionconfigurationtemplates`.
|
||||
If you want to allow users other than the Rancher administrator to manage templates, you can bind the user to a role that grants the user all verbs (`"*"`) on `management.cattle.io/podsecurityadmissionconfigurationtemplates`.
|
||||
|
||||
:::warning
|
||||
|
||||
Any user that is bound to the above permission will be able to change the restriction levels on all managed clusters which use this template, including ones they have no permissions on.
|
||||
|
||||
:::
|
||||
|
||||
### Rancher on PSA-restricted Clusters
|
||||
|
||||
### Rancher On PSA-restricted Clusters
|
||||
When you run Rancher on a Kubernetes cluster that enforces a restrictive security policy by default, you will need to exempt the following namespaces, otherwise the policy might prevent Rancher system pods from properly running.
|
||||
|
||||
When you run Rancher on a Kubernetes cluster that enforces the `rancher-restricted` PSS policy by default, you'll need to exempt the following namespaces. This prevents the policy from blocking Rancher system pods:
|
||||
|
||||
Here is the list of the namespaces that require an exemption:
|
||||
- `kube-system`
|
||||
- `kube-public`
|
||||
- `cattle-system`
|
||||
- `cattle-alerting`
|
||||
- `cattle-logging`
|
||||
- `cattle-prometheus`
|
||||
- `ingress-nginx`
|
||||
- `cattle-global-data`
|
||||
- `cattle-istio`
|
||||
- `kube-node-lease`
|
||||
- `cert-manager`
|
||||
- `cattle-global-nt`
|
||||
- `security-scan`
|
||||
- `cattle-fleet-system`
|
||||
- `cattle-fleet-local-system`
|
||||
- `calico-system`
|
||||
- `tigera-operator`
|
||||
- `cattle-impersonation-system`
|
||||
- `rancher-operator-system`
|
||||
- `cattle-csp-adapter-system`
|
||||
- `calico-apiserver`
|
||||
- `calico-system`
|
||||
- `cattle-alerting`
|
||||
- `cattle-csp-adapter-system`
|
||||
- `cattle-epinio-system`
|
||||
- `cattle-externalip-system`
|
||||
- `cattle-fleet-local-system`
|
||||
- `cattle-fleet-system`
|
||||
- `cattle-gatekeeper-system`
|
||||
- `cattle-global-data`
|
||||
- `cattle-global-nt`
|
||||
- `cattle-impersonation-system`
|
||||
- `cattle-istio`
|
||||
- `cattle-istio-system`
|
||||
- `cattle-logging`
|
||||
- `cattle-logging-system`
|
||||
- `cattle-monitoring-system`
|
||||
- `cattle-neuvector-system`
|
||||
- `cattle-prometheus`
|
||||
- `cattle-sriov-system`
|
||||
- `cattle-system`
|
||||
- `cattle-ui-plugin-system`
|
||||
- `cattle-windows-gmsa-system`
|
||||
- `cert-manager`
|
||||
- `cis-operator-system`
|
||||
- `ingress-nginx`
|
||||
- `istio-system`
|
||||
- `kube-node-lease`
|
||||
- `kube-public`
|
||||
- `kube-system`
|
||||
- `longhorn-system`
|
||||
- `rancher-alerting-drivers`
|
||||
- `security-scan`
|
||||
- `tigera-operator`
|
||||
|
||||
A sample AdmissionConfiguration with all the required exemptions to run Rancher can be found [here](psa-restricted-exemptions.yaml).
|
||||
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](psa-restricted-exemptions.yaml).
|
||||
|
||||
+33
-20
@@ -3,7 +3,7 @@ kind: AdmissionConfiguration
|
||||
plugins:
|
||||
- name: PodSecurity
|
||||
configuration:
|
||||
apiVersion: pod-security.admission.config.k8s.io/v1beta1
|
||||
apiVersion: pod-security.admission.config.k8s.io/v1
|
||||
kind: PodSecurityConfiguration
|
||||
defaults:
|
||||
enforce: "restricted"
|
||||
@@ -15,24 +15,37 @@ plugins:
|
||||
exemptions:
|
||||
usernames: []
|
||||
runtimeClasses: []
|
||||
namespaces: [kube-system,
|
||||
kube-public,
|
||||
cattle-system,
|
||||
cattle-alerting,
|
||||
cattle-logging,
|
||||
cattle-prometheus,
|
||||
ingress-nginx,
|
||||
cattle-global-data,
|
||||
cattle-istio,
|
||||
kube-node-lease,
|
||||
cert-manager,
|
||||
cattle-global-nt,
|
||||
security-scan,
|
||||
cattle-fleet-system,
|
||||
cattle-fleet-local-system,
|
||||
namespaces: [calico-apiserver,
|
||||
calico-system,
|
||||
tigera-operator,
|
||||
cattle-impersonation-system,
|
||||
rancher-operator-system,
|
||||
cattle-alerting,
|
||||
cattle-csp-adapter-system,
|
||||
calico-apiserver]
|
||||
cattle-epinio-system,
|
||||
cattle-externalip-system,
|
||||
cattle-fleet-local-system,
|
||||
cattle-fleet-system,
|
||||
cattle-gatekeeper-system,
|
||||
cattle-global-data,
|
||||
cattle-global-nt,
|
||||
cattle-impersonation-system,
|
||||
cattle-istio,
|
||||
cattle-istio-system,
|
||||
cattle-logging,
|
||||
cattle-logging-system,
|
||||
cattle-monitoring-system,
|
||||
cattle-neuvector-system,
|
||||
cattle-prometheus,
|
||||
cattle-sriov-system,
|
||||
cattle-system,
|
||||
cattle-ui-plugin-system,
|
||||
cattle-windows-gmsa-system,
|
||||
cert-manager,
|
||||
cis-operator-system,
|
||||
ingress-nginx,
|
||||
istio-system,
|
||||
kube-node-lease,
|
||||
kube-public,
|
||||
kube-system,
|
||||
longhorn-system,
|
||||
rancher-alerting-drivers,
|
||||
security-scan,
|
||||
tigera-operator]
|
||||
|
||||
Reference in New Issue
Block a user