Using Pod Security Policies with Container Engine for Kubernetes

To create a pod security policy for application pods, create a role to access the pod security policy, and create a rolebinding to enable the application pods to use the pod security policy:

1. Create the pod security policy for application pods:

   1. Define and save the pod security policy in a file. For example, in acme-app-psp.yaml).

      For example, this policy (taken from the Kubernetes documentation) simply prevents the creation of privileged pods:

      
      apiVersion: policy/v1beta1
      kind: PodSecurityPolicy
      metadata:
        name: acme-app-psp
      spec:
        privileged: false  # Don't allow privileged pods!
        # The rest fills in some required fields.
        seLinux:
          rule: RunAsAny
        supplementalGroups:
          rule: RunAsAny
        runAsUser:
          rule: RunAsAny
        fsGroup:
          rule: RunAsAny
        volumes:
        - '*'

   2. Enter the following command to create the pod security policy:

      kubectl create -f <filename>.yaml

      For example:

      kubectl create -f acme-app-psp.yaml

2. Create the role (or clusterrole) to access the pod security policy:

   1. Define and save a role (or clusterrole) in a file. For example, in acme-app-psp-crole.yaml.

      For example:

      # Cluster role which grants access to the app pod security policy
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        name: acme-app-psp-crole
      rules:
      - apiGroups:
        - policy
        resourceNames:
        - acme-app-psp
        resources:
        - podsecuritypolicies
        verbs:
        - use
      

   2. Enter the following command to create the role (or clusterrole):

      kubectl create -f <filename>.yaml

      For example:

      kubectl create -f acme-app-psp-crole.yaml

3. Create the rolebinding (or clusterrolebinding) to authorize the application pods to use the pod security policy:

   1. Define and save the rolebinding (or clusterrolebinding) in a file. For example, in acme-app-psp-crole-bind.yaml.

      For example:

      
      # Role binding which grants access to the app pod security policy
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        name: acme-app-psp-binding
        namespace: acme-namespace
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: acme-app-psp-crole
      subjects:
      # For all service accounts in acme-namespace
      - apiGroup: rbac.authorization.k8s.io
        kind: Group
        name: system:serviceaccounts:acme-namespace

   2. Enter the following command to create the rolebinding (or clusterrolebinding):

      kubectl create -f <filename>.yaml

      For example:

      kubectl create -f acme-app-psp-crole-bind.yaml

Having defined a pod security policy and authorized application pods to use it by creating a role and rolebinding (or a clusterrole and clusterrolebinding), enable the cluster's PodSecurityPolicy admission controller to enforce the pod security policy (if it's not enabled already).

To enable the PodSecurityPolicy admission controller when creating new clusters using the Console:

1. Log in to the Console.

2. Follow the instructions to create a new cluster in Using the Console to create a Cluster with Explicitly Defined Settings in the 'Custom Create' workflow, click Show Advanced Options, and select the Pod Security Policies - Enforced option. This option enables the PodSecurityPolicy admission controller.

   No application pods will be accepted into the new cluster unless suitable pod security policies exist, along with roles (or clusterroles) and rolebindings (or clusterrolebindings) to associate pods with policies.

3. Follow the instructions to set the remaining cluster details, and click Create Cluster to create the new cluster.

4. Follow the instructions in Creating a Pod Security Policy for Application Pods to create pod security policies for the PodSecurityPolicy admission controller to enforce when accepting pods into the new cluster.

To enable the PodSecurityPolicy admission controller in existing clusters using the Console:

1. Follow the instructions in Creating a Pod Security Policy for Application Pods to create pod security policies for the PodSecurityPolicy admission controller to enforce when accepting pods into the existing cluster.

   We strongly recommend you first verify the pod security policies in a development or test environment. That way, you can be sure the pod security policies work as you expect and correctly allow (or refuse) pods to start on the cluster.

2. Open the navigation menu and click Developer Services. Under Containers & Artifacts, click Kubernetes Clusters (OKE).
3. Choose a Compartment you have permission to work in.
4. On the Cluster List page, click the name of the cluster you want to modify.
5. On the Cluster Details tab, click Not Enforced beside Pod Security Policies.

6. In the Pod Security Policies window, select Enforced.

   From now on, no new application pods will be accepted into the cluster unless suitable pod security policies exist, along with roles (or clusterroles) and rolebindings (or clusterrolebindings) to associate pods with policies. Note that any currently running pods will continue to run regardless.

7. Click Save Changes.

To disable the PodSecurityPolicy admission controller in clusters where it was previously enabled:

1. Open the navigation menu and click Developer Services. Under Containers & Artifacts, click Kubernetes Clusters (OKE).
2. Choose a Compartment you have permission to work in.
3. On the Cluster List page, click the name of the cluster you want to modify.
4. On the Cluster Details tab, click Enforced beside Pod Security Policies.

5. In the Pod Security Policies window, select Not Enforced.

   From now on, new application pods will be accepted into the cluster without pod security policies, roles (or clusterroles) and rolebindings (or clusterrolebindings) being required. Note that any currently running pods will continue to run regardless.

6. Click Save Changes.

For information about using the API and signing requests, see REST API documentation and Security Credentials. For information about SDKs, see SDKs and the CLI.

To enable the PodSecurityPolicy admission controller, use the:

• CreateCluster operation when creating new clusters
• Update Cluster operation when modifying existing clusters

The pod security policy, and the associated clusterrole and clusterrolebinding, for Kubernetes system privileged pods are automatically created when you enable a cluster's PodSecurityPolicy admission controller. These allow any pod in the kube-system namespace to run. They are created from definitions in the kube-system.yaml shown below:

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  annotations:
    # See https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
  name: oke-privileged
spec:
  allowedCapabilities:
  - '*'
  allowPrivilegeEscalation: true
  fsGroup:
    rule: 'RunAsAny'
  hostIPC: true
  hostNetwork: true
  hostPID: true
  hostPorts:
  - min: 0
    max: 65535
  privileged: true
  readOnlyRootFilesystem: false
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  volumes:
  - '*'
  
---
  
# Cluster role which grants access to the privileged pod security policy
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: oke-privileged-psp
rules:
- apiGroups:
  - policy
  resourceNames:
  - oke-privileged
  resources:
  - podsecuritypolicies
  verbs:
  - use
  
---
  
# Role binding for kube-system - allow kube-system service accounts - should take care of CNI i.e. flannel running in the kube-system namespace
# Assumes access to the kube-system is restricted
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kube-system-psp
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: oke-privileged-psp
subjects:
# For all service accounts in the kube-system namespace
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts:kube-system