[Deprecated] Pod Security Policy #5

erictune · 2016-05-09T16:58:22Z

Feature Description

Define policy objects that limit what security-related features pods and containers can use
Primary contact (assignee): @tallclair
Responsible SIGs: @kubernetes/sig-auth-feature-requests @kubernetes/sig-node-feature-requests
Design proposal link (community repo): https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/pod-security-policy.md
Link to e2e and/or unit tests: https://github.com/kubernetes/kubernetes/blob/master/test/e2e/auth/pod_security_policy.go
Reviewer(s) - (for LGTM): @liggitt @tallclair
Approver: @liggitt @tallclair
Feature target (which target equals to which milestone):
- Beta release target (extensions/v1beta1) - 1.8
- Beta release target (policy/v1beta1) - 1.10
- Stable release target - TBD

Related issues

stop serving extensions/v1beta1 and networking.k8s.io/v1beta1 in 1.22 kubernetes#43214 - Move out of extensions/v1beta1 API group:
- 1.10
  - additionally allow authorizing via use verb in policy API group (will need to allow via either group for some time period)
  - update e2e tests (test both for some time period)
- 1.11
  - move internal types to policy package (cleanup)
  - move registry to policy package (cleanup)
  - update addon manifests to use policy/v1beta1, grant permissions in policy API group
  - switch admission plugin to use policy group informer
  - switch preferred storage version to policy group
[PodSecurityPolicy] API changes kubernetes#56174
PodSecurityPolicy should work with managed sidecars kubernetes#55435
[PodSecurityPolicy] "MayRunAs" strategies kubernetes#56173

The text was updated successfully, but these errors were encountered:

erictune · 2016-05-09T17:58:07Z

Admission controller code is under review in: kubernetes/kubernetes#24600

erictune · 2016-05-09T17:58:36Z

This feature is skipping straight to Beta since it has had initial exposure in OpenShift.

erictune · 2016-05-09T17:59:57Z

It will be default disabled in kubernetes/kubernetes#24600. After that goes in, we need changes in the admission controller to link PSPs to users.

pweil- · 2016-05-11T13:57:17Z

Noting kubernetes/kubernetes#20573 as a dependency for the next step on PSP (subject level access)

bryk · 2016-07-12T13:07:30Z

Whats the status of this? Is the description in first comment up to date?

pweil- · 2016-07-12T13:23:06Z

Is the description in first comment up to date

no (I don't have permissions to update). I believe all of the alpha requirements have been met. The initial types, api, and tests have been merged. The admission controller is not enabled by default.

IMO the remaining work for beta/1.4 is auth integration for permissions, updating for new fields we want to constraint (seccomp - in progress, sysctl), and any required docs/tutorials.

erictune · 2016-07-12T15:42:54Z

And an e2e test.

On Tue, Jul 12, 2016 at 6:23 AM, Paul Weil notifications@github.com wrote:

Is the description in first comment up to date

no (I don't have permissions to update). I believe all of the alpha
requirements have been met. The initial types, api, and tests have been
merged. The admission controller is not enabled by default.

IMO the remaining work for beta/1.4 is auth integration for permissions,
updating for new fields we want to constraint (seccomp - in progress,
sysctl), and any required docs/tutorials.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#5 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AHuudqFwephlYk0Y1PS77y0xxA5QW0_-ks5qU5U7gaJpZM4IaU8n
.

therc · 2016-07-15T23:26:57Z

How about interactions with cloud providers? It would be nice to easily assign each pod different IAM roles so they can access only the subset of cloud services that they actually need. Would it be in scope or is it considered a SecurityContext detail?

erictune · 2016-07-16T14:06:57Z

@therc that should be done via ServiceAccount.

pweil- · 2016-08-22T21:38:22Z

@goltermann I noticed this was marked with alpha but I believe it probably needs the beta tag based on #5 (comment)

goltermann · 2016-08-22T21:41:15Z

@erictune does beta sound right based on the @pweil- comment?

pweil- · 2016-08-22T21:48:51Z

@goltermann I think technically this would've been beta in 1.3, it is not new to 1.4 though development is ongoing.

erictune · 2016-08-22T23:09:02Z

Yes, beta is correct. I was incorrect when I said alpha earlier today.

goltermann · 2016-08-22T23:36:31Z

great, fixed it up

janetkuo · 2016-09-02T17:34:49Z

@pweil- Are the docs ready? Please update the docs to https://github.com/kubernetes/kubernetes.github.io, and then add PR numbers and have the docs box checked in the issue description

pweil- · 2016-09-02T18:44:31Z

@janetkuo docs PR kubernetes/website#1150

edit: kubernetes/website#1206 is the correct 1.4 PR

cc @kubernetes/feature-reviewers

idvoretskyi · 2016-09-21T22:10:08Z

@pweil- I suppose, this PR is actual - kubernetes/website#1206?

pweil- · 2016-09-22T06:46:29Z

correct

sftim · 2021-07-20T18:13:33Z

For more information on the deprecation, see PodSecurityPolicy Deprecation: Past, Present, and Future.

Remove security review.

Fix nits and table of contents

k8s-triage-robot · 2021-10-18T18:34:57Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

tallclair · 2021-10-19T18:19:08Z

/remove-lifecycle stale

tallclair · 2021-10-19T18:19:17Z

/lifecycle frozen

Priyankasaggu11929 · 2022-06-06T13:31:55Z

Hello @tallclair 👋, 1.25 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PST on Thursday June 16, 2022.

For note, This enhancement is targeting for Removal in 1.25 (followed by the Deprecation in 1.21) (correct me, if otherwise)

As discussed with the Release team in this K8s slack thread, the team agreed that we don't require to migrate the old archived design proposal to a KEP template, to just track the deprecation & removal stages for this enhancement.

Since, the new KEP-2579: Pod Security Admission Control KEP is there to explicitly replace PSP, we will align the deprecation & removal stages of this enhancement with that KEP & track both!

For note, the status of this enhancement is marked as tracked. Thank you for keeping the issue description up-to-date!

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Priyankasaggu11929 · 2022-07-21T11:11:58Z

Hi @tallclair 👋

Checking in once more as we approach 1.25 code freeze at 01:00 UTC on Wednesday, 3rd August 2022.

Please ensure the following items are completed:

All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
All PRs are fully merged by the code freeze deadline.
- Remove PodSecurityPolicy admission plugin kubernetes#109798

Please verify, if there are any additional k/k PRs besides the ones listed above.

Since all the listed k/k PRs are fully merged, the status of this enhancement is marked as tracked.

Please update the issue description with the relevant links for tracking purposes. Thank you so much!

tallclair · 2022-07-21T18:50:03Z

All the k/k work for v1.25 is done.

liggitt · 2022-09-01T12:25:08Z

marked complete in #3487

Not an alternative rejected any more, given applyset.k8s.io/inventory

…ategy (#3661) * Initial KEP for improving pruning in kubectl apply * Add design details Co-authored-by: Katrina Verey <katrina.verey@shopify.com> * Add another open question * Links, clarifications, ownerRef and GKNN explanations * Follow-on to initial feedback, address some unresolved blocks * Fix lint errors * Add more detail about reference implementation (#2) * Apply prune jan25 (#3) * More clearly delineate specification vs kubectl details * Move design details of spec to Design Details section * Updates from synchronous conversation * Remove leftover paragraph (#5) Not an alternative rejected any more, given applyset.k8s.io/inventory * Justin has always been coauthor * KEP-3659: production readiness etc (#4) Fill in the testing/ PRR sections. * Fix test failures * Prune: document confused deputy attack and mitigations Likely pushes us to GKNN-derived IDs. * Constrain applyset id We just choose the constrained applyset id to prevent "applyset ID impersonation". * Update KEP and PRR metadata * Enhance testing description * ID vs name fixes * Fixes from soltysh's review --------- Co-authored-by: Justin Santa Barbara <justinsb@google.com>

Another pass at the goals

* Add draft of CSI CBT KEP Signed-off-by: Ivan Sim <ivan.sim@dell.com> * Update KEP status Signed-off-by: Ivan Sim <ivan.sim@dell.com> * Initial structure. Filled in the Proposal, Caveats and Risks. Put in the CSI spec in the Details section. * Removed distracting links to common K8s definitions. Clarified the proposal. * More caveats. Better grammar. * Use "snapshot access session". * addressed most of the feedback in the PR. * Updated role figure. * More refinements. * Session figure. Renamed figure files. * Fix background of session figure. * Updated figures and roles. * Propose a new role for session data. * GRPC spec * Don't propose roles. * Add user stories in the proposal (#2) * Add user stories in the proposal Signed-off-by: Prasad Ghangal <prasad.ghangal@gmail.com> * Remove acceptance criteria for the user stories * Make changes suggested by Carl --------- Signed-off-by: Prasad Ghangal <prasad.ghangal@gmail.com> * Added details to the manager, sidecar and SP service sections. Fixed session figure errors and rewrote the client gRPC description in the risks section. * Called out UNRESOLVED issues. More on the SP service and sidecar. * Resolved issues with expiry and advertising. * Updated TOC * Fixed typo and svg space rendering. * Fixed typo in perms figure. * Typo in session figure. More detail in user stories. * Add SnapshotSession CRDs (#5) * Add SnapshotSession CRDs * Add CR descriptions * Address review comments * Address review comments * Remove typo * Remove unnecessary new line * Added image of the flow when the TokenRequest and TokenReview APIs are used. * Fixed figure spacing * Updated permissions svg; removed session. * Updated figures. Removed session figure. * Added explanation of permissions. * Updated overview and risks. * Updated RPC and components. * Completed remaining rewrite. * Updated to CSI spec to reflect container-storage-interface/spec#551 * Removed the security_token and namespace from the gRPC spec. Pass the security token via the metadata authorization key. Pass the namespace as part of the K8s snapshot id string. * Update sections on test plan, PRR and graduation criteria Signed-off-by: Ivan Sim <ihcsim@gmail.com> * More neutral language on passing the auth token. * Updated to reflect changes in the CSI spec PR. * Use a separate gRPC API for the sidecar. * Replaced authorization gRPC metadata with a security_token field in request messages. * Fixed typo. * Updated CSI spec; downplayed similarity between the K8s and CSI gRPC services. * Add beta and GA graduation criteria Signed-off-by: Ivan Sim <ihcsim@gmail.com> * Updated CSI spec again - no unsigned numbers used. * Update KEP milestone to v1.30 Signed-off-by: Ivan Sim <ihcsim@gmail.com> * Update 'Scalability' section Signed-off-by: Ivan Sim <ihcsim@gmail.com> * Add sig-auth as participating sigs Signed-off-by: Ivan Sim <ihcsim@gmail.com> * Require that the CR be named for the driver. * Removed the label requirement for the CR. * Replaced johnbelamaric with soltysh for PRR approver. * Bump up milestone to v1.31 * Change KEP status to implementable --------- Signed-off-by: Ivan Sim <ivan.sim@dell.com> Signed-off-by: Prasad Ghangal <prasad.ghangal@gmail.com> Signed-off-by: Ivan Sim <ihcsim@gmail.com> Co-authored-by: Carl Braganza <carl@kasten.io> Co-authored-by: Prasad Ghangal <prasad.ghangal@gmail.com>

erictune assigned pweil- May 9, 2016

idvoretskyi modified the milestone: v1.4 Jul 18, 2016

idvoretskyi added the sig/node Categorizes an issue or PR as relevant to SIG Node. label Aug 4, 2016

goltermann added the alpha-in-1.4 label Aug 22, 2016

goltermann added beta-in-1.4 and removed alpha-in-1.4 labels Aug 22, 2016

pweil- mentioned this issue Sep 2, 2016

Create a ref doc for pod security policy kubernetes/website#1150

Closed

liggitt added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Apr 4, 2017

liggitt modified the milestones: next-milestone, v1.4 Jun 14, 2017

liggitt removed the (deprecated label - do not use) beta-in-1.4 label Jun 14, 2017

cici37 pushed a commit to cici37/enhancements that referenced this issue Sep 2, 2021

Merge pull request kubernetes#5 from cici37/crd-expression-lang-kep

6e83a78

Remove security review.

astoycos pushed a commit to astoycos/enhancements-1 that referenced this issue Sep 27, 2021

Merge pull request kubernetes#5 from abhiraut/cleanup

5ea023c

Fix nits and table of contents

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 18, 2021

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 19, 2021

k8s-ci-robot added the lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. label Oct 19, 2021

tallclair added the kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. label Apr 20, 2022

tallclair changed the title ~~Pod Security Policy~~ [Deprecated] Pod Security Policy Apr 20, 2022

liggitt mentioned this issue May 4, 2022

Remove PodSecurityPolicy admission plugin kubernetes/kubernetes#109798

Merged

tallclair assigned liggitt May 5, 2022

Priyankasaggu11929 added tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team and removed tracked/no Denotes an enhancement issue is NOT actively being tracked by the Release Team labels May 30, 2022

k8s-ci-robot pushed a commit that referenced this issue Jun 17, 2022

add comments for encrypted object (#5)

6f80e8e

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

palnabarun mentioned this issue Jul 26, 2022

KEP Manifest Generator palnabarun/enhancements#2

Closed

sftim mentioned this issue Aug 1, 2022

Update PodSecurityPolicy annotation details for v1.25 kubernetes/website#35610

Merged

liggitt closed this as completed Sep 1, 2022

rhockenbury removed the tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team label Sep 20, 2022

pacoxu mentioned this issue Oct 31, 2022

Remove PodSecurityPolicy related code except client-go & API type kubernetes/kubernetes#113467

Merged

3 tasks

justinsb added a commit to justinsb/features that referenced this issue Jan 30, 2023

Remove leftover paragraph (kubernetes#5)

a88ff93

Not an alternative rejected any more, given applyset.k8s.io/inventory

dougbtv pushed a commit to dougbtv/enhancements that referenced this issue Feb 9, 2024

Merge pull request kubernetes#5 from shaneutt/shaneutt/kni-goals-2

855d5e7

Another pass at the goals

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Deprecated] Pod Security Policy #5

[Deprecated] Pod Security Policy #5

erictune commented May 9, 2016 •

edited by tallclair

Loading

erictune commented May 9, 2016

erictune commented May 9, 2016

erictune commented May 9, 2016

pweil- commented May 11, 2016

bryk commented Jul 12, 2016

pweil- commented Jul 12, 2016

erictune commented Jul 12, 2016

therc commented Jul 15, 2016

erictune commented Jul 16, 2016

pweil- commented Aug 22, 2016

goltermann commented Aug 22, 2016

pweil- commented Aug 22, 2016

erictune commented Aug 22, 2016

goltermann commented Aug 22, 2016

janetkuo commented Sep 2, 2016

pweil- commented Sep 2, 2016 •

edited

Loading

idvoretskyi commented Sep 21, 2016

pweil- commented Sep 22, 2016

sftim commented Jul 20, 2021

k8s-triage-robot commented Oct 18, 2021

tallclair commented Oct 19, 2021

tallclair commented Oct 19, 2021

Priyankasaggu11929 commented Jun 6, 2022

Priyankasaggu11929 commented Jul 21, 2022

tallclair commented Jul 21, 2022

liggitt commented Sep 1, 2022

[Deprecated] Pod Security Policy #5

[Deprecated] Pod Security Policy #5

Comments

erictune commented May 9, 2016 • edited by tallclair Loading

Feature Description

Related issues

erictune commented May 9, 2016

erictune commented May 9, 2016

erictune commented May 9, 2016

pweil- commented May 11, 2016

bryk commented Jul 12, 2016

pweil- commented Jul 12, 2016

erictune commented Jul 12, 2016

therc commented Jul 15, 2016

erictune commented Jul 16, 2016

pweil- commented Aug 22, 2016

goltermann commented Aug 22, 2016

pweil- commented Aug 22, 2016

erictune commented Aug 22, 2016

goltermann commented Aug 22, 2016

janetkuo commented Sep 2, 2016

pweil- commented Sep 2, 2016 • edited Loading

idvoretskyi commented Sep 21, 2016

pweil- commented Sep 22, 2016

sftim commented Jul 20, 2021

k8s-triage-robot commented Oct 18, 2021

tallclair commented Oct 19, 2021

tallclair commented Oct 19, 2021

Priyankasaggu11929 commented Jun 6, 2022

Priyankasaggu11929 commented Jul 21, 2022

tallclair commented Jul 21, 2022

liggitt commented Sep 1, 2022

erictune commented May 9, 2016 •

edited by tallclair

Loading

pweil- commented Sep 2, 2016 •

edited

Loading