ghost
commented
2 years ago Hi johndohoneyjr, AKS bot here :wave: Thank you for posting on the AKS Repo, I'll do my best to get a kind human from the AKS team to assist you.
I might be just a bot, but I'm told my suggestions are normally quite good, as such: 1) If this case is urgent, please open a Support Request so that our 24/7 support team may help you faster. 2) Please abide by the AKS repo Guidelines and Code of Conduct. 3) If you're having an issue, could it be described on the AKS Troubleshooting guides or AKS Diagnostics? 4) Make sure your subscribed to the AKS Release Notes to keep up to date with all that's new on AKS. 5) Make sure there isn't a duplicate of this issue already reported. If there is, feel free to close this one and '+1' the existing issue. 6) If you have a question, do take a look at our AKS FAQ. We place the most common ones there!
miwithro
fseldow
What happened:
I tried this with both "Standard" and "Hardened" SKUs. I activated the Policy agent and verified the Azure Policy Agent and Gatekeeper were active in my cluster
john@DESKTOP-5CAD0JG:/mnt/c/Users/johndohoney$ k get po -n kube-system NAME READY STATUS RESTARTS AGE azure-ip-masq-agent-fhmd2 1/1 Running 0 66m azure-ip-masq-agent-pg8kq 1/1 Running 0 66m azure-policy-59bbf5454f-rgjb8 1/1 Running 2 67m azure-policy-webhook-84884d989b-jntsv 1/1 Running 0 50m coredns-845757d86-5fscs 1/1 Running 0 50m coredns-845757d86-l4756 1/1 Running 0 66m coredns-autoscaler-5f85dc856b-whpj8 1/1 Running 0 50m csi-azuredisk-node-542pn 3/3 Running 0 66m csi-azuredisk-node-wwrwb 3/3 Running 0 66m csi-azurefile-node-678tf 3/3 Running 0 66m csi-azurefile-node-xdtn7 3/3 Running 0 66m konnectivity-agent-664d9bff8b-2jz7k 1/1 Running 0 35m konnectivity-agent-664d9bff8b-7jm89 1/1 Running 0 35m kube-proxy-br5rg 1/1 Running 0 66m kube-proxy-kgvbx 1/1 Running 0 66m metrics-server-6bc97b47f7-zpxpz 1/1 Running 1 67m omsagent-4gm9r 2/2 Running 0 66m omsagent-cbztw 2/2 Running 0 66m omsagent-rs-7df76848-cggsk 1/1 Running 0 50m john@DESKTOP-5CAD0JG:/mnt/c/Users/johndohoney$ k get pods -n gatekeeper-system NAME READY STATUS RESTARTS AGE gatekeeper-audit-7b87566755-m55kw 1/1 Running 0 52m gatekeeper-controller-6844c5c896-2kkpj 1/1 Running 0 52m gatekeeper-controller-6844c5c896-dkzq9 1/1 Running 2 68m
I then verified the "Disallowed Cacpabilities": k get k8sazuredisallowedcapabilities -o yaml
apiVersion: v1 items:
***** Notice the following excerpts from above **** disallowedCapabilities:
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ ### $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
What you expected to happen: The following manifest should be blocked from running:
apiVersion: v1 kind: Pod metadata: name: security-context-demo-4 spec: containers:
I tried a variation to make sure I got it right -- this too should have errored on the kubectl create
apiVersion: v1 kind: Pod metadata: name: nginx-privileged spec: containers:
How to reproduce it (as minimally and precisely as possible):
apiVersion: v1 kind: Pod metadata: name: security-context-demo-4 spec: containers:
Environment:
Kubernetes version (use
kubectl version): 1.21.7Size of cluster (how many worker nodes are in the cluster?)
john@DESKTOP-5CAD0JG:/mnt/c/Users/johndohoney$ k get nodes NAME STATUS ROLES AGE VERSION aks-agentpool-34591016-vmss000001 Ready agent 3d1h v1.21.7 aks-userpool-34591016-vmss000001 Ready agent 3d1h v1.21.7
General description of workloads in the cluster (e.g. HTTP microservices, Java app, Ruby on Rails, machine learning, etc.)
Simple test application using busy box
Others: