4 - Pod 安全策略

Pod Security Policies (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges). If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of Pod <NAME> is forbidden: unable to validate….

• You can assign PSPs at the cluster or project level.

• PSPs work through inheritance.

  • By default, PSPs assigned to a cluster are inherited by its projects, as well as any namespaces added to those projects.
  • Exception: Namespaces that are not assigned to projects do not inherit PSPs, regardless of whether the PSP is assigned to a cluster or project. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior.
  • You can override the default PSP by assigning a different PSP directly to the project.
• Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.

了解更多 about Pod Security Policies in the Kubernetes Documentation.

Best Practice: Set pod security at the cluster level.

Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file.

Default Pod Security Policies

可用版本 v2.0.7

Rancher ships with two default Pod Security Policies (PSPs): the restricted and unrestricted policies.

• restricted

This policy is based on the Kubernetes example restricted policy. It significantly restricts what types of pods can be deployed to a cluster or project. This policy:

• Prevents pods from running as a privileged user and prevents escalation of privileges.
• Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added).
  • unrestricted

This policy is equivalent to running Kubernetes with the PSP controller disabled. It has no restrictions on what pods can be deployed into a cluster or project.

Creating Pod Security Policies

• From the Global view, select Security > Pod Security Policies from the main menu. Then click Add Policy.

Step Result: The Add Policy form opens.

• Name the policy.

• Complete each section of the form. Refer to the Kubernetes documentation linked below for more information on what each policy does.

  • Basic Policies:

    • Privilege Escalation
    • Host Namespaces
    • Read Only Root Filesystems

  • Capability Policies

  • Volume Policy

  • Allowed Host Paths Policy

  • FS Group Policy

  • Host Ports Policy

  • Run As User Policy

  • SELinux Policy

  • Supplemental Groups Policy

What’s Next?

You can add a Pod Security Policy (PSPs hereafter) in the following contexts:

• When creating a cluster
• When editing an existing cluster
• When creating a project
• When editing an existing project

Note: We recommend adding PSPs during cluster and project creation instead of adding it to an existing one.