Skip to content

Commit 548d110

Browse files
tossmilestonetossmilestone
authored
docs: improve security policies document structure (#284)
- Adjust heading levels for better hierarchy - Fix code block indentation in lists - Improve overall document organization
1 parent b72b2dc commit 548d110

File tree

1 file changed

+71
-5
lines changed

1 file changed

+71
-5
lines changed

‎docs/en/developer/building_application/namespace/security_policies.mdx‎

Lines changed: 71 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,17 @@
22
weight: 50
33
---
44

5-
# Pod Security Admission
5+
# Pod Security Policies
6+
7+
ACP supports Kubernetes Pod Security Admission (PSA) and Kyverno Policy to help enforce security standards for Pods running in your clusters.
8+
9+
## Pod Security Admission
610

711
Refer to the official Kubernetes documentation: [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/)
812

913
Pod Security Admission (PSA) is a Kubernetes admission controller that enforces security policies at the namespace level by validating Pod specifications against predefined standards.
1014

11-
## Security Modes
15+
### Security Modes
1216

1317
PSA defines three modes to control how policy violations are handled:
1418

@@ -23,7 +27,7 @@ PSA defines three modes to control how policy violations are handled:
2327
- **Enforce** acts on Pods only (e.g., rejects Pods but allows non-Pod resources like Deployments).
2428
- **Audit** and **Warn** apply to both Pods and their controllers (e.g., Deployments).
2529

26-
## Security Standards
30+
### Security Standards
2731

2832
PSA defines three security standards to restrict Pod privileges:
2933

@@ -33,9 +37,9 @@ PSA defines three security standards to restrict Pod privileges:
3337
| **Baseline** | Minimal restrictions to prevent known privilege escalations. | Blocks `hostNetwork`, `hostPID`, privileged containers, and unrestricted `hostPath` volumes. |
3438
| **Restricted** | Strictest policy enforcing security best practices. | Requires: <br/>- `runAsNonRoot: true` <br/>- `seccompProfile.type: RuntimeDefault` <br/>- Dropped Linux capabilities. |
3539

36-
## Configuration
40+
### Configuration
3741

38-
### Namespace Labels
42+
#### Namespace Labels
3943

4044
Apply labels to namespaces to define PSA policies.
4145

@@ -79,3 +83,65 @@ exemptions:
7983
runtimeClasses: ['nvidia']
8084
namespaces: ['kube-system']
8185
```
86+
87+
## Kyverno Policy
88+
89+
ACP provides several samples to create the Kyverno policies for Pod security. The samples includes:
90+
- **Restricted**: Restricted denies access to all host features and requires pods to be run with a UID, and SELinux context that are allocated to the namespace.
91+
- **Restricted-v2**: Restricted-v2 denies access to all host features and requires pods to be run with a UID, and SELinux context that are allocated to the namespace. This is the most restrictive policy and it is used by default for authenticated users. On top of the legacy 'restricted', it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required.
92+
- **Anyuid**: Anyuid provides all features of the restricted policy but allows users to run with any UID and any GID.
93+
- **Hostaccess**: Hostaccess allows access to all host namespaces but still requires pods to be run with a UID and SELinux context that are allocated to the namespace. WARNING: this policy allows host access to namespaces, file systems, and PIDS. It should only be used by trusted pods. Grant with caution.
94+
- **Hostmount-anyuid**: Hostmount-anyuid provides all the features of the restricted policy but allows host mounts and any UID by a pod. This is primarily used by the persistent volume recycler. WARNING: this policy allows host file system access as any UID, including UID 0. Grant with caution.
95+
- **Hostnetwork**: Hostnetwork allows using host networking and host ports but still requires pods to be run with a UID and SELinux context that are allocated to the namespace.
96+
- **Hostnetwork-v2**: Hostnetwork-v2 allows using host networking and host ports but still requires pods to be run with a UID and SELinux context that are allocated to the namespace. On top of the legacy 'hostnetwork' policy, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required.
97+
- **Node-exporter**: Node-exporter policy is used for the Prometheus node exporter.
98+
- **Nonroot**: Nonroot provides all features of the restricted policy but allows users to run with any non-root UID. The user must specify the UID or it must be specified on the by the manifest of the container runtime.
99+
- **Nonroot-v2**: Nonroot-v2 provides all features of the restricted policy but allows users to run with any non-root UID. The user must specify the UID or it must be specified on the by the manifest of the container runtime. On top of the legacy 'nonroot' policy, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required.
100+
- **Privileged**: Privileged allows access to all privileged and host features and the ability to run as any user, any group, any fsGroup, and with any SELinux context. WARNING: this is the most relaxed and should be used only for cluster administration. Grant with caution.
101+
102+
<Directive type="note" title="NOTICE">
103+
The **Restricted** policy is not equal to the Kubernetes Pod Security Admission 'restricted' standard.
104+
You may need to change your pod security configuration if you want to use the kyverno **Restricted** policy instead of Kubernetes Pod Security Admission 'restricted' standard.
105+
</Directive>
106+
107+
### Prerequisites
108+
109+
- Install Alauda Container Platform Compliance for Kyverno, refer to the [document](../../../security/security_and_compliance/compliance/install.mdx).
110+
- Enable feature gate `namespace-resource-manage` in ACP featuregate settings.
111+
112+
### Apply Kyverno Policies
113+
114+
### Web Console
115+
116+
1. In the ACP console, navigate to **Container Platform**, choose the namespace where you want to apply the security policy.
117+
2. Go to **Advanced** > **Resources**.
118+
3. Search the resource type with name **Policy** for resource **Policy** of group **kyverno.io**.
119+
4. Select the version "v2beta1", Click **Create** to create a new Kyverno Policy.
120+
5. In the **Create Resource** dialog, select the **Samples** tab.
121+
6. Choose the desired Pod security policy sample (e.g., `Restricted`), then click **Try**.
122+
7. Review and modify the policy YAML as needed, then click **Update** to apply the policy.
123+
124+
### CLI
125+
126+
1. Log in to the kubernetes cluster where you want to apply the security policy.
127+
2. Run the following command to create a Kyverno Policy from a sample resource:
128+
129+
```shell
130+
$ kubectl get consoleyamlsamples.console.alauda.io restricted-policy -otemplate --template={{.spec.yaml}}|kubectl apply -f -
131+
$ kubectl get policies.kyverno.io
132+
NAME ADMISSION BACKGROUND READY AGE MESSAGE
133+
restricted true true True 1m Ready
134+
```
135+
136+
The sample resources available are:
137+
- restricted-policy
138+
- restrictedv2-policy
139+
- anyuid-policy
140+
- hostaccess-policy
141+
- hostmount-anyuid-policy
142+
- hostnetwork-policy
143+
- hostnetwork-v2-policy
144+
- node-exporter-policy
145+
- nonroot-policy
146+
- nonroot-v2-policy
147+
- privileged-policy

0 commit comments

Comments
 (0)