Open smira opened 3 years ago
I would like to avoid any third party solutions if we can. That would be ideal IMHO.
I would like to avoid any third party solutions if we can. That would be ideal IMHO.
we should probably discuss it more, but I wonder if we do PSP which forbids hostPath volumes as a baseline policy, should it be enough?
I would like to avoid any third party solutions if we can. That would be ideal IMHO.
we should probably discuss it more, but I wonder if we do PSP which forbids hostPath volumes as a baseline policy, should it be enough?
I feel like so. Our whole goal with Talos is to make the host irrelevant, so it makes sense to me.
@smira Given the current status on https://www.talos.dev/v1.6/kubernetes-guides/configuration/pod-security/, can this issue be closed?
@andrewrynhard @smira I think the main value that speaks from this issue, and that remains to be created, is a comprehensive documentation of Talos Linux's security model, applicable frameworks and the required parameters such as specific permissions. For example, document Talos Linux design wrt. Linux namespaces, networking, boot/disks and other dimensions. This would result in docs that list which filesystem paths are sensitive. When users then decide to reconfigure from the applied standards, they can be expected to take into account these paths and take appropriate measures themselves, with or without third party extensions to Kubernetes or Talos Linux.
This is more of a research ticket to collect some data.
There are two problems we need to solve:
/system
, because/system/state
contains Talos config,/system/secrets
contains PKI, and/system/run
might contain unprotected file socketsThere might a single solution to both problems, or different solutions.
Today Talos deploys PSP which enables everything for every user in the system, so it's effectively no-op.
Potential solutions:
Please also note that enabling write access to
hostPath
volumes means that eventually any path on the host filesystem can be mounted, so probably proper solution is simply to forbidhostPath
volumes as baseline and allow it only for privileged users.