{{- end }}
EOF
sed -i -e 's/ name: flux-addon/ name: {{ $clusterName }}-flux-addon/' ${SCRIPTDIR}/templates/flux-addon.yaml
+
+ # PodSecurityPolicy is being replaced in future versions of K8s.
+ # The recommended practice is described by K8s at
+ # - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#recommended-practice
+ # - https://kubernetes.io/docs/concepts/security/pod-security-standards/
+ # and provides three levels: privileged, baseline, and restricted.
+ #
+ # The question to answer here is how to reconcile the K8s levels
+ # against the Akraino security requirements.
+ #
+ # For the time being, the below populates the cluster with the K8s
+ # recommended levels and provides an additional policy (icn) bound
+ # to the system:authenticated group to meet the Akraino
+ # requirements.
+ cat <<EOF >${SCRIPTDIR}/addons/podsecurity.yaml
+---
+$(curl -sL https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/policy/privileged-psp.yaml)
+---
+$(curl -sL https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/policy/baseline-psp.yaml)
+---
+$(curl -sL https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/policy/restricted-psp.yaml)
+---
+$(curl -sL https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/policy/privileged-psp.yaml |
+ sed -e 's/ name: privileged/ name: icn/' |
+ sed -e '/^ allowedCapabilities:/,/^ [!-]/d')
+ allowedCapabilities:
+ - 'NET_ADMIN'
+ - 'SYS_ADMIN'
+ - 'SYS_NICE'
+ - 'SYS_PTRACE'
+ requiredDropCapabilities:
+ - 'NET_RAW'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: psp:privileged
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+ - policy
+ resourceNames:
+ - privileged
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: psp:baseline
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+ - policy
+ resourceNames:
+ - baseline
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: psp:icn
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+ - policy
+ resourceNames:
+ - icn
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: psp:restricted
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+ - policy
+ resourceNames:
+ - restricted
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: psp:privileged:nodes
+ namespace: kube-system
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: psp:privileged
+subjects:
+- kind: Group
+ name: system:nodes
+ apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: psp:privileged:kube-system
+ namespace: kube-system
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: psp:privileged
+subjects:
+- kind: Group
+ name: system:serviceaccounts:kube-system
+ apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: psp:icn:any
+roleRef:
+ kind: ClusterRole
+ name: psp:icn
+ apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: Group
+ name: system:authenticated
+ apiGroup: rbac.authorization.k8s.io
+EOF
+ cat <<EOF >${SCRIPTDIR}/templates/podsecurity-addon.yaml
+{{- range \$clusterName, \$cluster := .Values.clusters }}
+---
+$(kubectl create configmap podsecurity-addon --from-file=${SCRIPTDIR}/addons/podsecurity.yaml -o yaml --dry-run=client)
+{{- end }}
+EOF
+ sed -i -e 's/ name: podsecurity-addon/ name: {{ $clusterName }}-podsecurity-addon/' ${SCRIPTDIR}/templates/podsecurity-addon.yaml
+
}
case $1 in
- name: {{ $clusterName }}-flux-addon
kind: ConfigMap
{{- end }}
+ - name: {{ $clusterName }}-podsecurity-addon
+ kind: ConfigMap
{{- end }}
name: {{ $clusterName }}
spec:
kubeadmConfigSpec:
+ clusterConfiguration:
+ apiServer:
+ extraArgs:
+ enable-admission-plugins: NodeRestriction,PodSecurityPolicy
initConfiguration:
nodeRegistration:
kubeletExtraArgs:
--- /dev/null
+{{- range $clusterName, $cluster := .Values.clusters }}
+---
+apiVersion: v1
+data:
+ podsecurity.yaml: |
+ ---
+ apiVersion: policy/v1beta1
+ kind: PodSecurityPolicy
+ metadata:
+ name: privileged
+ annotations:
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+ spec:
+ privileged: true
+ allowPrivilegeEscalation: true
+ allowedCapabilities:
+ - '*'
+ volumes:
+ - '*'
+ hostNetwork: true
+ hostPorts:
+ - min: 0
+ max: 65535
+ hostIPC: true
+ hostPID: true
+ runAsUser:
+ rule: 'RunAsAny'
+ seLinux:
+ rule: 'RunAsAny'
+ supplementalGroups:
+ rule: 'RunAsAny'
+ fsGroup:
+ rule: 'RunAsAny'
+ ---
+ apiVersion: policy/v1beta1
+ kind: PodSecurityPolicy
+ metadata:
+ name: baseline
+ annotations:
+ # Optional: Allow the default AppArmor profile, requires setting the default.
+ apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+ apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+ spec:
+ privileged: false
+ # The moby default capability set, minus NET_RAW
+ allowedCapabilities:
+ - 'CHOWN'
+ - 'DAC_OVERRIDE'
+ - 'FSETID'
+ - 'FOWNER'
+ - 'MKNOD'
+ - 'SETGID'
+ - 'SETUID'
+ - 'SETFCAP'
+ - 'SETPCAP'
+ - 'NET_BIND_SERVICE'
+ - 'SYS_CHROOT'
+ - 'KILL'
+ - 'AUDIT_WRITE'
+ # Allow all volume types except hostpath
+ volumes:
+ # 'core' volume types
+ - 'configMap'
+ - 'emptyDir'
+ - 'projected'
+ - 'secret'
+ - 'downwardAPI'
+ # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use.
+ - 'csi'
+ - 'persistentVolumeClaim'
+ - 'ephemeral'
+ # Allow all other non-hostpath volume types.
+ - 'awsElasticBlockStore'
+ - 'azureDisk'
+ - 'azureFile'
+ - 'cephFS'
+ - 'cinder'
+ - 'fc'
+ - 'flexVolume'
+ - 'flocker'
+ - 'gcePersistentDisk'
+ - 'gitRepo'
+ - 'glusterfs'
+ - 'iscsi'
+ - 'nfs'
+ - 'photonPersistentDisk'
+ - 'portworxVolume'
+ - 'quobyte'
+ - 'rbd'
+ - 'scaleIO'
+ - 'storageos'
+ - 'vsphereVolume'
+ hostNetwork: false
+ hostIPC: false
+ hostPID: false
+ readOnlyRootFilesystem: false
+ runAsUser:
+ rule: 'RunAsAny'
+ seLinux:
+ # This policy assumes the nodes are using AppArmor rather than SELinux.
+ # The PSP SELinux API cannot express the SELinux Pod Security Standards,
+ # so if using SELinux, you must choose a more restrictive default.
+ rule: 'RunAsAny'
+ supplementalGroups:
+ rule: 'RunAsAny'
+ fsGroup:
+ rule: 'RunAsAny'
+ ---
+ apiVersion: policy/v1beta1
+ kind: PodSecurityPolicy
+ metadata:
+ name: restricted
+ annotations:
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
+ apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+ apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+ spec:
+ privileged: false
+ # Required to prevent escalations to root.
+ allowPrivilegeEscalation: false
+ requiredDropCapabilities:
+ - ALL
+ # Allow core volume types.
+ volumes:
+ - 'configMap'
+ - 'emptyDir'
+ - 'projected'
+ - 'secret'
+ - 'downwardAPI'
+ # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use.
+ - 'csi'
+ - 'persistentVolumeClaim'
+ - 'ephemeral'
+ hostNetwork: false
+ hostIPC: false
+ hostPID: false
+ runAsUser:
+ # Require the container to run without root privileges.
+ rule: 'MustRunAsNonRoot'
+ seLinux:
+ # This policy assumes the nodes are using AppArmor rather than SELinux.
+ rule: 'RunAsAny'
+ supplementalGroups:
+ rule: 'MustRunAs'
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ fsGroup:
+ rule: 'MustRunAs'
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ readOnlyRootFilesystem: false
+ ---
+ apiVersion: policy/v1beta1
+ kind: PodSecurityPolicy
+ metadata:
+ name: icn
+ annotations:
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+ spec:
+ privileged: true
+ allowPrivilegeEscalation: true
+ volumes:
+ - '*'
+ hostNetwork: true
+ hostPorts:
+ - min: 0
+ max: 65535
+ hostIPC: true
+ hostPID: true
+ runAsUser:
+ rule: 'RunAsAny'
+ seLinux:
+ rule: 'RunAsAny'
+ supplementalGroups:
+ rule: 'RunAsAny'
+ fsGroup:
+ rule: 'RunAsAny'
+ allowedCapabilities:
+ - 'NET_ADMIN'
+ - 'SYS_ADMIN'
+ - 'SYS_NICE'
+ - 'SYS_PTRACE'
+ requiredDropCapabilities:
+ - 'NET_RAW'
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: psp:privileged
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ rules:
+ - apiGroups:
+ - policy
+ resourceNames:
+ - privileged
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: psp:baseline
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ rules:
+ - apiGroups:
+ - policy
+ resourceNames:
+ - baseline
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: psp:icn
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ rules:
+ - apiGroups:
+ - policy
+ resourceNames:
+ - icn
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: psp:restricted
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ rules:
+ - apiGroups:
+ - policy
+ resourceNames:
+ - restricted
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: RoleBinding
+ metadata:
+ name: psp:privileged:nodes
+ namespace: kube-system
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: psp:privileged
+ subjects:
+ - kind: Group
+ name: system:nodes
+ apiGroup: rbac.authorization.k8s.io
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: RoleBinding
+ metadata:
+ name: psp:privileged:kube-system
+ namespace: kube-system
+ roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: psp:privileged
+ subjects:
+ - kind: Group
+ name: system:serviceaccounts:kube-system
+ apiGroup: rbac.authorization.k8s.io
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRoleBinding
+ metadata:
+ name: psp:icn:any
+ roleRef:
+ kind: ClusterRole
+ name: psp:icn
+ apiGroup: rbac.authorization.k8s.io
+ subjects:
+ - kind: Group
+ name: system:authenticated
+ apiGroup: rbac.authorization.k8s.io
+kind: ConfigMap
+metadata:
+ creationTimestamp: null
+ name: {{ $clusterName }}-podsecurity-addon
+{{- end }}
--- /dev/null
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
--- /dev/null
+# A simple chart to create a RoleBinding of a Namespace to a
+# PodSecurityPolicy. This can be used with the Flux "dependsOn"
+# feature to install the binding before deploying additional
+# HelmReleases into the Namespace.
+apiVersion: v2
+name: podsecurity
+type: application
+version: 0.1.0
--- /dev/null
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ .Values.roleRef }}-{{ .Release.Namespace }}
+ namespace: {{ .Release.Namespace }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: {{ .Values.roleRef }}
+subjects:
+- kind: Group
+ name: system:serviceaccounts:{{ .Release.Namespace }}
+ apiGroup: rbac.authorization.k8s.io
--- /dev/null
+# Under ICN, roleRef may be psp:restricted, psp:baseline, or
+# psp:privileged
+roleRef: psp:baseline
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
targetNamespace: emco
install:
createNamespace: true
+ dependsOn:
+ - name: emco-podsecurity
values:
global:
repository: integratedcloudnative/
--- /dev/null
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: emco-podsecurity
+ namespace: flux-system
+spec:
+ interval: 5m
+ chart:
+ spec:
+ chart: deploy/podsecurity
+ sourceRef:
+ kind: GitRepository
+ name: icn
+ namespace: flux-system
+ interval: 1m
+ releaseName: emco-podsecurity
+ targetNamespace: emco
+ install:
+ createNamespace: true
+ values:
+ roleRef: psp:privileged
targetNamespace: emco
install:
createNamespace: true
+ dependsOn:
+ - name: emco-podsecurity
values:
global:
repository: integratedcloudnative/
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
--- /dev/null
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: kud-podsecurity
+ namespace: flux-system
+spec:
+ interval: 5m
+ chart:
+ spec:
+ chart: deploy/podsecurity
+ sourceRef:
+ kind: GitRepository
+ name: icn
+ namespace: flux-system
+ interval: 1m
+ releaseName: kud-podsecurity
+ targetNamespace: kud
+ install:
+ createNamespace: true
+ values:
+ roleRef: psp:privileged
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
targetNamespace: kud
install:
createNamespace: true
+ dependsOn:
+ - name: kud-podsecurity
Code Review / icn.git / commitdiff