Gankrin

GK2 - Apply Pod Security Standards to the Kubernetes Cluster

In this post, we will explore - How To Apply Pod Security Standards to the Kubernetes Cluster. Pod Security is an admission controller that checks new pods against the Kubernetes Pod Security Standards. Pod Security admission (PSA) is enabled by default in Kubernetes v1.23 and later, and has graduated to beta status. Follow the below step by step process to do this.  

1. Choose Pod Security Standard :

Pod Security Admission (PSA) allows you to apply built-in Pod Security Standards using three different modes: "enforce", "audit", and "warn" This will create a new cluster named "psa-wo-cluster-pss" using the specified node image. The output of the command will show the progress of the cluster creation process and will inform you when the cluster is ready to use. 
kind create cluster --name psa-wo-cluster-pss --image kindest/node:v1.24.0
  
kubectl cluster-info --context kind-psa-wo-cluster-pss
  
kubectl get ns
This will list all the namespaces in the cluster, along with their status and age.    

2. Pre-Checks Prior To Applying the Security Standards :

To understand what will happen when different Pod Security Standards are applied, you can use the kubectl label command with the --dry-run=server option and the pod-security.kubernetes.io/enforce label. 
kubectl label --dry-run=server --overwrite ns --all \
pod-security.kubernetes.io/enforce=privileged
  The output of these commands will show you what would happen if these Pod Security Standards were applied, and whether any existing pods in the cluster would violate the new standards.   
kubectl label --dry-run=server --overwrite ns --all \
pod-security.kubernetes.io/enforce=baseline
  The pod-security.kubernetes.io/enforce=restricted label shows what would happen if the "restricted" Pod Security Standard were applied to all namespaces in the cluster. The output will show how the "restricted" standard would be applied to the default, kube-node-lease, and kube-public namespaces, but would generate warnings for the kube-system and local-path-storage namespaces. 
kubectl label --dry-run=server --overwrite ns --all \
pod-security.kubernetes.io/enforce=restricted
   

3. Apply the Security Standards :

To apply the "baseline" Pod Security Standard in "enforce" mode and the "restricted" standard in "warn" and "audit" mode to the latest version, you can use the kubectl label command to set the appropriate labels on the namespaces you want to apply these standards to.     
kubectl label --overwrite ns --all \
pod-security.kubernetes.io/enforce=baseline:latest
    
kubectl label --overwrite ns --all \
pod-security.kubernetes.io/warn=restricted:latest
    
kubectl label --overwrite ns --all \
pod-security.kubernetes.io/audit=restricted:latest
  e.g. To remove the "enforce" label from the kube-system namespace  use below. This will remove the "enforce" label from the kube-system namespace, exempting it from the Pod Security Standard you applied. You can use similar commands to remove the "warn" and "audit" labels as well. 
kubectl label ns kube-system pod-security.kubernetes.io/enforce-
  
mkdir -p /tmp/pss
cat <<EOF > /tmp/pss/cluster-level-pss.yaml 
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1
    kind: PodSecurityConfiguration
    defaults:
      enforce: "baseline"
      enforce-version: "latest"
      audit: "restricted"
      audit-version: "latest"
      warn: "restricted"
      warn-version: "latest"
    exemptions:
      usernames: []
      runtimeClasses: []
      namespaces: [kube-system]
EOF
    
cat <<EOF > /tmp/pss/cluster-config.yaml 
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: ClusterConfiguration
    apiServer:
        extraArgs:
          admission-control-config-file: /etc/config/cluster-level-pss.yaml
        extraVolumes:
          - name: accf
            hostPath: /etc/config
            mountPath: /etc/config
            readOnly: false
            pathType: "DirectoryOrCreate"
  extraMounts:
  - hostPath: /tmp/pss
    containerPath: /etc/config
    # optional: if set, the mount is read-only.
    # default false
    readOnly: false
    # optional: if set, the mount needs SELinux relabeling.
    # default false
    selinuxRelabel: false
    # optional: set propagation mode (None, HostToContainer or Bidirectional)
    # see https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
    # default None
    propagation: None
EOF
    
 kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.24.0 --config /tmp/pss/cluster-config.yaml
  
 kubectl cluster-info --context kind-psa-with-cluster-pss
  
cat <<EOF > /tmp/pss/nginx-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
    - image: nginx
      name: nginx
      ports:
        - containerPort: 80
EOF
  
 kubectl apply -f /tmp/pss/nginx-pod.yaml
   

4. Delete the Cluster :

If you require to delete the cluster, you just created, do the following - 
kind delete cluster --name psa-with-cluster-pss
kind delete cluster --name psa-wo-cluster-pss
  Hope this helps.  

Additional Posts you might want to read from this Blog -

    
kubectl get pod security policy ,readonlyrootfilesystem kubernetes ,kubernetes pod security policy ,kubernetes pod security policy best practices ,kubernetes allowprivilegeescalation ,pod security policy deprecated ,pod security kubernetes io enforce privileged ,kubernetes pod security context ,kubernetes pod security best practices ,pod security policy in kubernetes ,pod security kubernetes ,kubernetes pod security standards ,kubectl get pod security policy ,pod security policy deprecated ,pod security kubernetes io enforce privileged ,kubernetes pod security policy best practices ,pod security standards example ,pod security admission controller ,kubernetes security ,How do I apply for a pod security policy ,How do you secure pods in Kubernetes ,How do I check my pod security standards ,How do you manage security in Kubernetes cluster ,apply pod security standards kubernetes cluster ,pod security admission controller ,pod security configuration ,kubernetes pod security standards ,kubernetes cluster pod security ,enforce pod security standards kubernetes ,audit pod security standards kubernetes ,warn pod security standards kubernetes ,pod security exemptions kubernetes ,kubernetes pod security admission control