PodSecurityPolicyPermissive.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**This notebook covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Permissive Policy\n",
    "\n",
    "*permissive* allows everything\n",
    "\n",
    "https://kubernetes.io/docs/concepts/policy/pod-security-policy\n",
    "\n",
    "Assume, we want to start a system service on a host port\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME          PRIV    CAPS   SELINUX    RUNASUSER   FSGROUP    SUPGROUP   READONLYROOTFS   VOLUMES\n",
      "restrictive   false   *      RunAsAny   RunAsAny    RunAsAny   RunAsAny   false            configMap,downwardAPI,emptyDir,persistentVolumeClaim,secret,projected\n"
     ]
    }
   ],
   "source": [
    "kubectl get psp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/nginx-hostnetwork-deployment created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "apiVersion: apps/v1\n",
    "kind: Deployment\n",
    "metadata:\n",
    "  name: nginx-hostnetwork-deployment\n",
    "  labels:\n",
    "    app: nginx\n",
    "spec:\n",
    "  replicas: 1\n",
    "  selector:\n",
    "    matchLabels:\n",
    "      app: nginx\n",
    "  template:\n",
    "    metadata:\n",
    "      labels:\n",
    "        app: nginx\n",
    "    spec:\n",
    "      containers:\n",
    "      - name: nginx\n",
    "        image: nginx\n",
    "      hostNetwork: true ### try to access the host network\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                              READY   STATUS    RESTARTS   AGE\n",
      "pod/nginx-hostnetwork-deployment-db7654df-88wgs   1/1     Running   0          14s\n",
      "\n",
      "NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   171m\n",
      "\n",
      "NAME                                           READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/nginx-hostnetwork-deployment   1/1     1            1           14s\n",
      "\n",
      "NAME                                                    DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/nginx-hostnetwork-deployment-db7654df   1         1         1       14s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "nginx-hostnetwork-deployment-db7654df\n"
     ]
    }
   ],
   "source": [
    "RS=$(kubectl get  rs | awk '/nginx-hostnetwork-deployment/{print $1}' | head -1)\n",
    "echo $RS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Name:           nginx-hostnetwork-deployment-db7654df\n",
      "Namespace:      default\n",
      "Selector:       app=nginx,pod-template-hash=db7654df\n",
      "Labels:         app=nginx\n",
      "                pod-template-hash=db7654df\n",
      "Annotations:    deployment.kubernetes.io/desired-replicas: 1\n",
      "                deployment.kubernetes.io/max-replicas: 2\n",
      "                deployment.kubernetes.io/revision: 1\n",
      "Controlled By:  Deployment/nginx-hostnetwork-deployment\n",
      "Replicas:       1 current / 1 desired\n",
      "Pods Status:    1 Running / 0 Waiting / 0 Succeeded / 0 Failed\n",
      "Pod Template:\n",
      "  Labels:  app=nginx\n",
      "           pod-template-hash=db7654df\n",
      "  Containers:\n",
      "   nginx:\n",
      "    Image:        nginx\n",
      "    Port:         <none>\n",
      "    \u001b[01;31m\u001b[KHost Port:    <none>\u001b[m\u001b[K\n",
      "    Environment:  <none>\n",
      "    Mounts:       <none>\n",
      "  Volumes:        <none>\n",
      "Events:\n",
      "  Type    Reason            Age   From                   Message\n",
      "  ----    ------            ----  ----                   -------\n",
      "  Normal  SuccessfulCreate  25s   replicaset-controller  Created pod: nginx-hostnetwork-deployment-db7654df-88wgs\n"
     ]
    }
   ],
   "source": [
    "kubectl describe rs $RS | grep --color=always -E   '($|FailedCreate|Host.*)'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Forbidden by default**\n",
    "\n",
    "Works as intended, let us open the box of pandora\n",
    "\n",
    "## Permissive Policy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[33;1mWarning:\u001b[0m policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+\n",
      "podsecuritypolicy.policy/permissive created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f - <<EOF\n",
    "apiVersion: policy/v1beta1\n",
    "kind: PodSecurityPolicy\n",
    "metadata:\n",
    "  name: permissive\n",
    "spec:\n",
    "  privileged: true\n",
    "  hostNetwork: true\n",
    "  hostIPC: true\n",
    "  hostPID: true\n",
    "  seLinux:\n",
    "    rule: RunAsAny\n",
    "  supplementalGroups:\n",
    "    rule: RunAsAny\n",
    "  runAsUser:\n",
    "    rule: RunAsAny\n",
    "  fsGroup:\n",
    "    rule: RunAsAny\n",
    "  hostPorts:\n",
    "  - min: 0\n",
    "    max: 65535\n",
    "  volumes:\n",
    "  - '*'\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "clusterrole.rbac.authorization.k8s.io/psp-permissive created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "kind: ClusterRole\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "metadata:\n",
    "  name: psp-permissive\n",
    "rules:\n",
    "- apiGroups:\n",
    "  - extensions\n",
    "  resources:\n",
    "  - podsecuritypolicies\n",
    "  resourceNames:\n",
    "  - permissive\n",
    "  verbs:\n",
    "  - use\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                                                   CREATED AT\n",
      "admin                                                                  2021-11-25T14:17:21Z\n",
      "cluster-admin                                                          2021-11-25T14:17:21Z\n",
      "edit                                                                   2021-11-25T14:17:21Z\n",
      "kubeadm:get-nodes                                                      2021-11-25T14:17:24Z\n",
      "psp-permissive                                                         2021-11-25T14:50:02Z\n",
      "psp-privileged                                                         2021-11-25T14:34:20Z\n",
      "psp-restrictive                                                        2021-11-25T14:24:47Z\n",
      "system:aggregate-to-admin                                              2021-11-25T14:17:21Z\n",
      "system:aggregate-to-edit                                               2021-11-25T14:17:21Z\n",
      "system:aggregate-to-view                                               2021-11-25T14:17:21Z\n",
      "system:auth-delegator                                                  2021-11-25T14:17:21Z\n",
      "system:basic-user                                                      2021-11-25T14:17:21Z\n",
      "system:certificates.k8s.io:certificatesigningrequests:nodeclient       2021-11-25T14:17:21Z\n",
      "system:certificates.k8s.io:certificatesigningrequests:selfnodeclient   2021-11-25T14:17:21Z\n",
      "system:certificates.k8s.io:kube-apiserver-client-approver              2021-11-25T14:17:21Z\n",
      "system:certificates.k8s.io:kube-apiserver-client-kubelet-approver      2021-11-25T14:17:21Z\n",
      "system:certificates.k8s.io:kubelet-serving-approver                    2021-11-25T14:17:21Z\n",
      "system:certificates.k8s.io:legacy-unknown-approver                     2021-11-25T14:17:21Z\n",
      "system:controller:attachdetach-controller                              2021-11-25T14:17:21Z\n",
      "system:controller:certificate-controller                               2021-11-25T14:17:21Z\n",
      "system:controller:clusterrole-aggregation-controller                   2021-11-25T14:17:21Z\n",
      "system:controller:cronjob-controller                                   2021-11-25T14:17:21Z\n",
      "system:controller:daemon-set-controller                                2021-11-25T14:17:21Z\n",
      "system:controller:deployment-controller                                2021-11-25T14:17:21Z\n",
      "system:controller:disruption-controller                                2021-11-25T14:17:21Z\n",
      "system:controller:endpoint-controller                                  2021-11-25T14:17:21Z\n",
      "system:controller:endpointslice-controller                             2021-11-25T14:17:21Z\n",
      "system:controller:endpointslicemirroring-controller                    2021-11-25T14:17:21Z\n",
      "system:controller:ephemeral-volume-controller                          2021-11-25T14:17:21Z\n",
      "system:controller:expand-controller                                    2021-11-25T14:17:21Z\n",
      "system:controller:generic-garbage-collector                            2021-11-25T14:17:21Z\n",
      "system:controller:horizontal-pod-autoscaler                            2021-11-25T14:17:21Z\n",
      "system:controller:job-controller                                       2021-11-25T14:17:21Z\n",
      "system:controller:namespace-controller                                 2021-11-25T14:17:21Z\n",
      "system:controller:node-controller                                      2021-11-25T14:17:21Z\n",
      "system:controller:persistent-volume-binder                             2021-11-25T14:17:21Z\n",
      "system:controller:pod-garbage-collector                                2021-11-25T14:17:21Z\n",
      "system:controller:pv-protection-controller                             2021-11-25T14:17:21Z\n",
      "system:controller:pvc-protection-controller                            2021-11-25T14:17:21Z\n",
      "system:controller:replicaset-controller                                2021-11-25T14:17:21Z\n",
      "system:controller:replication-controller                               2021-11-25T14:17:21Z\n",
      "system:controller:resourcequota-controller                             2021-11-25T14:17:21Z\n",
      "system:controller:root-ca-cert-publisher                               2021-11-25T14:17:21Z\n",
      "system:controller:route-controller                                     2021-11-25T14:17:21Z\n",
      "system:controller:service-account-controller                           2021-11-25T14:17:21Z\n",
      "system:controller:service-controller                                   2021-11-25T14:17:21Z\n",
      "system:controller:statefulset-controller                               2021-11-25T14:17:21Z\n",
      "system:controller:ttl-after-finished-controller                        2021-11-25T14:17:21Z\n",
      "system:controller:ttl-controller                                       2021-11-25T14:17:21Z\n",
      "system:coredns                                                         2021-11-25T14:17:24Z\n",
      "system:discovery                                                       2021-11-25T14:17:21Z\n",
      "system:heapster                                                        2021-11-25T14:17:21Z\n",
      "system:kube-aggregator                                                 2021-11-25T14:17:21Z\n",
      "system:kube-controller-manager                                         2021-11-25T14:17:21Z\n",
      "system:kube-dns                                                        2021-11-25T14:17:21Z\n",
      "system:kube-scheduler                                                  2021-11-25T14:17:21Z\n",
      "system:kubelet-api-admin                                               2021-11-25T14:17:21Z\n",
      "system:monitoring                                                      2021-11-25T14:17:21Z\n",
      "system:node                                                            2021-11-25T14:17:21Z\n",
      "system:node-bootstrapper                                               2021-11-25T14:17:21Z\n",
      "system:node-problem-detector                                           2021-11-25T14:17:21Z\n",
      "system:node-proxier                                                    2021-11-25T14:17:21Z\n",
      "system:persistent-volume-provisioner                                   2021-11-25T14:17:21Z\n",
      "system:public-info-viewer                                              2021-11-25T14:17:21Z\n",
      "system:service-account-issuer-discovery                                2021-11-25T14:17:21Z\n",
      "system:volume-scheduler                                                2021-11-25T14:17:21Z\n",
      "view                                                                   2021-11-25T14:17:21Z\n"
     ]
    }
   ],
   "source": [
    "kubectl get clusterrole"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "rolebinding.rbac.authorization.k8s.io/permissive created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f - <<EOF\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "kind: RoleBinding\n",
    "metadata:\n",
    "  name: permissive\n",
    "  namespace: default\n",
    "roleRef:\n",
    "  apiGroup: rbac.authorization.k8s.io\n",
    "  kind: ClusterRole\n",
    "  name: psp-permissive\n",
    "subjects:\n",
    "- kind: ServiceAccount\n",
    "  name: default\n",
    "  namespace: default\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "goto http://192.168.49.2/\n"
     ]
    }
   ],
   "source": [
    "echo goto http://$(hostname -i)/"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl delete deployment nginx-hostnetwork-deployment"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Recreate\n",
    "\n",
    "\n",
    "go back and recreate the nginx-hostnetwork-deployment\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                              READY   STATUS    RESTARTS   AGE\n",
      "pod/nginx-hostnetwork-deployment-db7654df-88wgs   1/1     Running   0          2m46s\n",
      "\n",
      "NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   173m\n",
      "\n",
      "NAME                                           READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/nginx-hostnetwork-deployment   1/1     1            1           2m46s\n",
      "\n",
      "NAME                                                    DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/nginx-hostnetwork-deployment-db7654df   1         1         1       2m46s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Which policy has been applied\n",
    "\n",
    "how can we detect, which policy is in use for a given pod "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "nginx-hostnetwork-deployment-db7654df-88wgs\n"
     ]
    }
   ],
   "source": [
    "POD=$(kubectl get  pod | awk '/nginx-hostnetwork-deployment/{print $1}' | head -1)\n",
    "echo $POD"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "permissive"
     ]
    }
   ],
   "source": [
    "kubectl get pod $POD -o jsonpath='{.metadata.annotations.kubernetes\\.io/psp}'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "permissive"
     ]
    }
   ],
   "source": [
    "kubectl get pods -o jsonpath='{.items[*].metadata.annotations.kubernetes\\.io/psp}'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Can we still create the *normal* deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/nginx-other-deployment created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "apiVersion: apps/v1\n",
    "kind: Deployment\n",
    "metadata:\n",
    "  name: nginx-other-deployment\n",
    "  namespace: default\n",
    "  labels:\n",
    "    app: nginx\n",
    "spec:\n",
    "  replicas: 1\n",
    "  selector:\n",
    "    matchLabels:\n",
    "      app: nginx\n",
    "  template:\n",
    "    metadata:\n",
    "      labels:\n",
    "        app: nginx\n",
    "    spec:\n",
    "      containers:\n",
    "      - name: nginx\n",
    "        image: nginx\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                              READY   STATUS    RESTARTS   AGE\n",
      "pod/nginx-hostnetwork-deployment-db7654df-88wgs   1/1     Running   0          10m\n",
      "pod/nginx-other-deployment-6799fc88d8-27zdq       1/1     Running   0          5s\n",
      "\n",
      "NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   3h1m\n",
      "\n",
      "NAME                                           READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/nginx-hostnetwork-deployment   1/1     1            1           10m\n",
      "deployment.apps/nginx-other-deployment         1/1     1            1           6s\n",
      "\n",
      "NAME                                                    DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/nginx-hostnetwork-deployment-db7654df   1         1         1       10m\n",
      "replicaset.apps/nginx-other-deployment-6799fc88d8       1         1         1       6s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "nginx-other-deployment-6799fc88d8-27zdq\n"
     ]
    }
   ],
   "source": [
    "POD=$(kubectl get  pod | awk '/nginx-other-deployment/{print $1}' | head -1)\n",
    "echo $POD"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "nginx-hostnetwork-deployment-db7654df-88wgs:  permissive  \n",
      "nginx-other-deployment-6799fc88d8-27zdq:  permissive  \n"
     ]
    }
   ],
   "source": [
    "kubectl get pods -o jsonpath=\"{range .items[*]}{.metadata.name}:  {.metadata.annotations.kubernetes\\.io/psp}  \n",
    "{end}\"\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Conclusion\n",
    "\n",
    "* don't mess up the psp, clusterroles and bindings\n",
    "* better one role per account\n",
    "* don't work with more than one rolebinding"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Next Stop\n",
    "\n",
    "*Kubernetes Roles*"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}