Document security restrictions (eg AppArmor) in Pods concept

[sftim]

This is a Feature Request

What would you like to be added
The Pods section doesn't mention that you can run Pods with AppArmor / seccomp / whatever to constrain the container.

Why is this needed
Although we have tutorials that explain the concepts in the manner of a walkthough, having a concept guide is important too.
It's OK if the mention within https://kubernetes.io/docs/concepts/workloads/pods/ is more like a signpost: a hyperlink to another page such as https://kubernetes.io/docs/concepts/security/container-sandboxing/ (which doesn't exist).

Comments
/sig security

Relevant to kubernetes/enhancements#24
Relevant to kubernetes/enhancements#135

[shannonxtreme]

This should be a fun time

Since we already talk about privileged mode on the Pods page I agree that it's important to talk about the security constraints that you can place on containers. I also agree that a standalone page that discusses container isolation strategies and kernel-level security measures would be a good addition to our docs.

/triage accepted
/assign

[shannonxtreme]

As a first step, I'll find out if this information exists across our current docs (it definitely does) and draft up a plan for changes.

[sftim]

The framing here should be:

• small
• simple
• soon

[sftim]

Thanks @shannonxtreme

If you're willing to focus first on the minimum viable change that can allow seccomp and AppArmor to graduate with docs in place, that'll help. It does mean more overall work if you then revisit things to make a larger improvement. Sorry about that.

[pjbgf]

Going through the current content it feels disconnected talking about Privileged mode, without not mentioning isolation levels. For someone starting their learning journey it may be hard to understand what that really means.

In my opinion, the existing Privileged mode for containers section could become a higher level section about Security Context (or a brief point on isolation levels), and within there we could talk about the ways of constraining (or enforcing isolation of) the container execution via AppArmor, Seccomp, SELinux and Privileged containers. We probably should use this opportunity to highlight the impact of privileged mode on those constraints. @sftim wdyt?

[shannonxtreme]

Agreed that it's a bit out of place there. We already have https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ so I wonder how that fits... Regardless for the mvp for this issue I'll focus on a smaller scope to meet the requirements here and then we can fiddle and improve

[shannonxtreme]

Planned here: https://docs.google.com/document/d/1QRNYpBL-gLhNKkvizu5CzCddP5K4rzs3YmfSL4z2IKE/edit?usp=sharing

@sftim @pjbgf I'd appreciate reviews on the scope so that I can do a draft and get that reviewed

[shannonxtreme]

I drafted the MVP of that page: https://docs.google.com/document/d/1QRNYpBL-gLhNKkvizu5CzCddP5K4rzs3YmfSL4z2IKE/edit#heading=h.x36r4r3h4evh

It's missing some info that I am not sure about

[sftim]

I'd be happy to see a PR anyway.

[shannonxtreme]

Still working on this, will send a PR soon

[sftim]

@shannonxtreme would you like any help here?

[shannonxtreme]

@sftim I'll open a draft PR in the coming days. One final ish question: The content in https://kubernetes.io/docs/concepts/security/security-checklist/#enabling-seccomp (the seccomp and Apparmor/SELinux sections) are a summary basically of the content in this new page. Think it's a good idea to remove that bulk from the checklist page and link to the new page to learn more?

[sftim]

@kbhawkey @onlydole @tengqm I'd really like to hear your thoughts on Shannon's question in #39601 (comment)

[tengqm]

Security has been one of the top concerns for a few years when people start evaluating k8s.
What I'd like to see is a single concept page clearly outlining all relevant topics as links
to more detailed references. In this concept page, we may want to articulate the
shared-responsibility model where security topics are organized based on users' persona.
In other words, as an application developer, what are the things I need to pay attention to?
As a cluster operator, what are the best practices I need to check.
As someone who prepares the underlying infrastructure, is there a checklist for me?

[sftim]

What I'd like to see is a single concept page clearly outlining all relevant topics as links
to more detailed references.

If #43176 merges first, we could build on that. Thoughts there?

[shannonxtreme]

I agree - we can expand that page or work it into a more use case based signposting topic. Some considerations though:

• We should think about how to organize it. There's the CNCF white paper phases, yes, but there's also the opportunity to organize by pillar, like authn/z, encryption, monitoring and logging, etc. Maybe a sensible combination of the two?

• The links we provide should be associated with specific jobs to be done. For example, in the Authorization pillar, we could have "Authorize actions in clusters" and list the learning journey (About authorization > RBAC > RBAC good practices > RBAC how-to)

Maybe we can create a follow-up issue for this and discuss the actual presentation of that information there?

[tengqm]

@shannonxtreme Maybe we can draft a toc for this on google docs for discussion?

[shannonxtreme]

@tengqm sounds good to me, we should probably also create a backlog issue for tracking purposes (I can do it later today I'm away from my computer still waking up 😂)

[sftim]

Relevant to #45471

[sftim]

We can now link from the Pod concept to https://kubernetes.io/docs/concepts/security/cloud-native-security/#protection-runtime-compute