search

kubernetes-sigs / metrics-server

Scalable and efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines.
https://kubernetes.io/docs/tasks/debug-application-cluster/resource-metrics-pipeline/
Apache License 2.0
5.82k stars 1.87k forks source link

Migrate from Pod Security Policy to SecurityContext #1063

Open pierluigilenoci opened 2 years ago

pierluigilenoci commented 2 years ago

What would you like to be added:

Pod Security Policies are deprecated and will be removed in Kubernetes v1.25.

Migration to another alternative is necessary. To date there are some alternative solutions:

A solution that is ecumenical and covers all the aforementioned alternatives is the use of Security Context directly in the manifest of the chart.

A possible solution would be to implement all the major alternatives within the chart but it is certainly a more onerous job.

Why is this needed:

For the reasons already explained above.

/kind feature

pierluigilenoci commented 2 years ago

@stevehipwell could you please take a look?

stevehipwell commented 2 years ago

@pierluigilenoci are you suggesting that the security context for the pod and primary container need updating or are you asking for something else? AFAIK the security admission control is namespace based so out of the scope of a chart, but the chart should be following best practices and potentially offer a non-mutating PSP version to use as a pre-migration step.

pierluigilenoci commented 2 years ago

@stevehipwell I suggest adding the securityContext as default in the chart so that the software runs as restrictively as possible and limiting the use of the PSP only if the K8s version is < 1.25.

For example, this is completely missing:

capabilities:
  drop:
    - ALL
stevehipwell commented 2 years ago

@pierluigilenoci I think the security context needs to come form the Metrics Server maintainers, the Helm chart copies what's in the manifest and also provides the ability to set the pod security policy in addition. AFAIK this change isn't required to enable pod admission, it just means that it needs to be configured correctly (as it will need to be for multiple other pods running in kube-system). I do agree that the PSP resources should be gated on the K8s version, I'll open a PR to do this.

@serathius do you have any plans to change the manifest security policy configuration?

pierluigilenoci commented 2 years ago

@stevehipwell obviously, the request must be evaluated by the maintainers and implemented in the chart only after it is approved.

I would also like to have the opinion of @serathius about it.

stevehipwell commented 2 years ago

@pierluigilenoci the chart usually tracks the installation manifest, so changes would be expected there first which would then be implemented as the defaults in the chart. This issue is currently labelled for the chart but I think it's really about Metrics Server in general.

pierluigilenoci commented 2 years ago

@stevehipwell do you think it might make sense to create a new issue for this more general aspect?

stevehipwell commented 2 years ago

@stevehipwell do you think it might make sense to create a new issue for this more general aspect?

@pierluigilenoci that might be a good idea, maybe pitched more about reducing default permissions ready for pod security admission? This issue could then be renamed to track getting any changes into Helm?

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

pierluigilenoci commented 1 year ago

/remove-lifecycle stale

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

pierluigilenoci commented 1 year ago

/remove-lifecycle stale

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

pierluigilenoci commented 1 year ago

/remove-lifecycle stale

pierluigilenoci commented 1 year ago

@stevehipwell, I lost track of this issue and never created the follow-up one; sorry.

k8s-triage-robot commented 9 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

pierluigilenoci commented 9 months ago

/remove-lifecycle stale

treksler commented 6 months ago

https://github.com/kubernetes-sigs/metrics-server/pull/1471

at the very least we should avoid making psps in 1.25 and above

k8s-triage-robot commented 3 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

pierluigilenoci commented 3 months ago

/remove-lifecycle stale

stevehipwell commented 3 months ago

@pierluigilenoci PSP is disabled for K8s versions where it's no longer supported. For the Helm chart the pod and container security contexts are both configurable. Could you expand on the actual changes you'd like to see?

pierluigilenoci commented 3 months ago

We talked about it almost two years ago: https://github.com/kubernetes-sigs/metrics-server/issues/1063#issuecomment-1209504970

stevehipwell commented 3 months ago

@pierluigilenoci I read that comment again but your most recent comment was that you hadn't followed up on this.

As the replacement for PSPs are Pod Security Standards you might be best off documenting how the Metrics Server defaults don't work with them and what you think the defaults should be changed to.

k8s-triage-robot commented 3 weeks ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

pierluigilenoci commented 3 weeks ago

/remove-lifecycle stale