search

digitalis-io / k3s-on-prem-production

Playbooks needed to set up an on-premises K3s cluster and securize it
Apache License 2.0
158 stars 45 forks source link

PodSecurityPolicy FEATURE STATE: Kubernetes v1.21 [deprecated] #3

Open lorenzo95 opened 2 years ago

lorenzo95 commented 2 years ago

Hello!

I would first like to say that I am amazed by the content of your blog post/repository. I am learning a lot and it gives me great ideas. Therefore, thank you for sharing!!!

I do want to ask what your opinion is on the PodSecurityPolicy Admission Controller since it is deprecated now (https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy)

Do you think for example that the SecurityContextDeny Controller would be a good replacement? Rancher is referring to it regarding the cis benchmark requirements here: https://rancher.com/docs/k3s/latest/en/security/self_assessment/#1-2-13

Thank you, Gera

89luca89 commented 2 years ago

Hey @lorenzo95 glad you liked the post :smile:

So yea, 1.21+ Deprecates the PSPs, which means it still works but we need to start finding a replacement

As stated in this blog article from the kubernetes.io blog The immediate solution is to use PodSecurityContext which is an evolution of the SecurityContextDeny.

This works for generic not-do-complicated hardenization and works when you write them pod-per-pod, but not as a generic policy for the cluster (eg when used by multiple users)

personally (emphasis :smile: ) I would just go full with 2 tools:

Falco by Sysdig, implements a great engine to detect stuff and make rule easily (as shown in the blogpost) Using its ability to support directly the PSPs: https://falco.org/docs/psp-support/

And OPA Gatekeeper, which can enforce PSPs like explained here: https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies-with-gatekeeper

devopstales commented 2 years ago

Hey @89luca89

With the release of Kubernetes v1.23, Pod Security admission has now entered beta. This will be the replacement for PSP. I will less configurable the PSP so a tool like OPA Gatekeeper or Kyverno could be a better solution. I prefer to use Kyverno, because it is easier to use and has more functionality then OPA Gatekeeper.

89luca89 commented 2 years ago

Hey @devopstales

Yea was looking in to the new PSA will have to play with them a bit more What I was thinking with Falco and OPA is that they can drop-in use the old PSP, so that in the meantime that PSA becomes stable it is still possible to use the PSP already written