[Pod Security Standards] Add ruleset documentation#755
[Pod Security Standards] Add ruleset documentation#755AleksandarSavchev wants to merge 2 commits into
Conversation
|
Skipping CI for Draft Pull Request. |
gardener-prow
Bot
added
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
gardener-prow
Bot
added
size/L
| severity: "HIGH" | ||
| - id: PSS-B004 | ||
| name: "Capabilities (Baseline)" | ||
| description: "Adding additional capabilities beyond those listed below must be disallowed." |
There was a problem hiding this comment.
we should probably list the capabilities?
There was a problem hiding this comment.
Yes, I have now added the list
The description field were taken directly from the k8s PSP documentation from the policy field, but specific one cannot be left without the list.
| description: "Adding additional capabilities beyond those listed below must be disallowed." | ||
| severity: "HIGH" | ||
| - id: PSS-B005 | ||
| name: "HostPath Volumes" |
There was a problem hiding this comment.
Either that or we should adapt other similar names to be consistent across naming. Or was this taken from the k8s documentation?
| name: "HostPath Volumes" | |
| name: "Host Path Volumes" |
There was a problem hiding this comment.
These names were take directly from the k8s PSS documentation, as the name of the policy. I agree that there is an inconsistency, but should we fix it or stick to the way they are written in k8s?
| - id: PSS-R001 | ||
| name: "Volume Types" | ||
| description: "The Restricted policy only permits the following volume types: configMap, csi, downwardAPI, emptyDir, ephemeral, persistentVolumeClaim, projected, secret." | ||
| severity: "MEDIUM" | ||
| - id: PSS-R002 | ||
| name: "Privilege Escalation" | ||
| description: "Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed. This is Linux only policy in v1.25+." | ||
| severity: "MEDIUM" | ||
| - id: PSS-R003 | ||
| name: "Running as Non-root" | ||
| description: "Containers must be required to run as non-root users." | ||
| severity: "MEDIUM" | ||
| - id: PSS-R004 | ||
| name: "Running as Non-root user" | ||
| description: "Containers must not set runAsUser to 0." | ||
| severity: "MEDIUM" | ||
| - id: PSS-R005 | ||
| name: "Seccomp (Restricted)" | ||
| description: "Seccomp profile must be explicitly set to RuntimeDefault or Localhost. Unconfined profiles and the absence of a profile are prohibited." | ||
| severity: "MEDIUM" | ||
| - id: PSS-R006 | ||
| name: "Capabilities (Restricted)" | ||
| description: "Containers must drop ALL capabilities, and are only permitted to add back NET_BIND_SERVICE." | ||
| severity: "MEDIUM" |
There was a problem hiding this comment.
I cannot decide if those should be MEDIUM or HIGH. Privilege escalation and runnning as non-root seem like a HIGH requirements to me. How can we decide what to change? The other options is to set everything to high?
There was a problem hiding this comment.
Some of these rules have more restrictive versions in the baseline policies. Such are: PSS-R001 < PSS-B005; PSS-R005 < PSS-B011; PSS-R006 < PSS-B004.
We can also say that PSS-R004 < PSS-R003.
I agree that we can set PSS-R002 & PSS-R003 to HIGH
2 participants
How to categorize this PR?
/kind enhancement
What this PR does / why we need it:
Adds documentation for the new Pod Security Standards ruleset. This ruleset will check pods running in a managed Kubernetes cluster against the official Kubernetes Pod Security Standards, covering both the Baseline (PSS-B001 to PSS-B012) and Restricted (PSS-R001 to PSS-R006) profiles.
Which issue(s) this PR fixes:
Part of #754
Special notes for your reviewer:
Release note: