Open collivier opened 6 months ago
A simple way to setup an hardened cluster as described in https://kubernetes.io/docs/tutorials/security/cluster-level-pss/
$ cat kind.v1.29.yaml
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
image: kindest/node:v1.29.0
kubeadmConfigPatches:
- |
kind: ClusterConfiguration
apiServer:
extraArgs:
admission-control-config-file: /etc/config/cluster-level-pss.yaml
extraVolumes:
- name: accf
hostPath: /etc/config
mountPath: /etc/config
readOnly: false
pathType: "DirectoryOrCreate"
extraMounts:
- hostPath: /home/opnfv/K8S
containerPath: /etc/config
# optional: if set, the mount is read-only.
# default false
readOnly: false
# optional: if set, the mount needs SELinux relabeling.
# default false
selinuxRelabel: false
# optional: set propagation mode (None, HostToContainer or Bidirectional)
# see https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
# default None
propagation: None
- role: worker
image: kindest/node:v1.29.0
- role: worker
image: kindest/node:v1.29.0
$ cat /home/opnfv/K8S/cluster-level-pss.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1
kind: PodSecurityConfiguration
defaults:
enforce: "restricted"
enforce-version: "latest"
audit: "restricted"
audit-version: "latest"
warn: "restricted"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces:
- kube-system
- local-path-storage
Is your feature request related to a problem? Please describe.
CNF Test Suite cannot run today vs Clusters where Pod Security Standard restricted is enforced. To work vs hardened clusters in production, Functest Kubernetes has to patch all 3 namespaces before running CNF Test Suite. https://github.com/opnfv/functest-kubernetes/blob/master/functest_kubernetes/cnf_conformance/conformance.py#L67-L86
Describe the solution you'd like
I would like to see github actions verifying CNF TestSuite under the following configuration: https://kubernetes.io/docs/tutorials/security/cluster-level-pss/
How will this be tested? aka Acceptance Criteria (optional)
The gate job would work and any new issue in CNF Test Suite would be detected premerge