Kubernetes security context, security policy, and network policy – Kubernetes security guide part 2

Kubernetes admission controllers

An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the object, but after the request is authenticated and authorized. Admission controllers pre-process the requests and can provide utility functions (such as filling out empty parameters with default values), but can also be used to enforce security policies and other checks.

一个接纳控制器是一段代码之前拦截请求到Kubernetes API服务器到持久性的对象，但该请求被认证和授权之后。准入控制器对请求进行预处理并可以提供实用功能（例如使用默认值填充空参数），但也可用于强制执行安全策略和其他检查。

Admission controllers are found on the kube-apiserver conf file:

--admission-control=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota

 Here are the admission controllers that can help you strengthen security:

DenyEscalatingExec: Forbids executing commands on an “escalated” container. This includes pods that run as privileged, have access to the host IPC namespace, and have access to the host PID namespace. Without this admission controller, a regular user can escalate privileges over the Kubernetes node just spawning a terminal on these containers.

NodeRestriction: Limits the node and pod objects a kubelet can modify. Using this controller, a Kubernetes node will only be able to modify the API representation of itself and the pods bound to this node.

限制 kubelet 可以修改的节点和 pod 对象。使用此控制器，Kubernetes 节点将只能修改其自身和绑定到此节点的 Pod 的 API 表示。

PodSecurityPolicy: This admission controller acts on creation and modification of the pod and determines if it should be admitted based on the requested Security Context and the available Pod Security Policies. The PodSecurityPolicy objects define a set of conditions and security context that a pod must declare in order to be accepted into the cluster, we will cover PSP in more detail below.

此准入控制器作用于 Pod 的创建和修改，并根据请求的安全上下文和可用的 Pod 安全策略确定是否应准入。PodSecurityPolicy 对象定义了一组条件和安全上下文，pod 必须声明这些条件和安全上下文才能被集群接受 

ValidatingAdmissionWebhooks: Calls any external service that is implementing your custom security policies to decide if a pod should be accepted in your cluster. For example, you can pre-validate container images using Grafeas, a container-oriented auditing and compliance engine, or validate Anchore scanned images.

Kubernetes Security Context

---

When you declare a pod/deployment, you can group several security-related parameters, like SELinux profile, Linux capabilities, etc, in a Security context block:

...
spec:
  securityContext:
    runAsUser: 1000
    fsGroup: 2000
...

You can configure the following parameters as part of your security context:

Privileged: Processes inside of a privileged container get almost the same privileges as those outside of a container, such as being able to directly configure the host kernel or host network stack.

特权：特权容器内的进程获得与容器外的进程几乎相同的特权，例如能够直接配置主机内核或主机网络堆栈。

Other context parameters that you can enforce include:

User and Group ID for the processes, containers and volumes: When you run a container without any security context, the ‘entrypoint’ command will run as root, this is easy to verify:

进程、容器和卷的用户和组 ID：当您在没有任何安全上下文的情况下运行容器时，'entrypoint' 命令将以 root 身份运行，这很容易验证：

$ kubectl run -i --tty busybox --image=busybox --restart=Never -- sh
/ # ps aux
PID   USER     TIME  COMMAND
    1 root      0:00 sh

 Using the runAsUser parameter you can modify the user ID of the processes inside a container. For example:

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: gcr.io/google-samples/node-hello:1.0
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

If you spawn a container using this definition you can check that the initial process is using UID 1000.

如果使用此定义生成容器，则可以检查初始进程是否使用UID 1000。

And any file you create inside the /data/demo volume will use GID 2000 (due to the fsGroup parameter).

您在/data/demo卷内创建的任何文件都将使用 GID 2000（由于fsGroup参数）。

Security Enhanced Linux (SELinux): You can assign SELinuxOptions objects using the seLinuxOptions field. Note that SELinux module needs to be loaded on the underlying Linux nodes for this policies to take effect.

Capabilities: Linux capabilities break down root full unrestricted access into a set of separate permissions. This way, you can grant some privileges to your software, like binding to a port < 1024, without granting full root access.

There is a default set of capabilities granted to any container if you don’t modify the security context. For example, using chown to set file permissions or net_raw to craft raw network packages.

Using the pod security context, you can drop default Linux capabilities and/or add non-default Linux capabilities. Again, applying the principle of least-privilege you can greatly reduce the damage of any malicious attack taking over the pod.

使用 pod 安全上下文，您可以删除默认 Linux 功能和/或添加非默认 Linux 功能。同样，应用最小权限原则，您可以大大减少接管 Pod 的任何恶意攻击的损害。

As a quick example, you can spawn the flask-cap pod:

$ kubectl create -f flask-cap.yaml

apiVersion: v1
kind: Pod
metadata:
  name: flask-cap
  namespace: default
spec:
  containers:
  - image: mateobur/flask
    name: flask-cap
    securityContext:
      capabilities:
        drop:
          - NET_RAW
          - CHOWN

 Note that some securityContext should be applied at the pod level, while other labels are applied at container level.

If you spawn a shell, you can verify that these capabilities have been dropped:

 请注意，一些securityContext应在 pod 级别应用，而其他标签应在容器级别应用。

如果您生成一个 shell，您可以验证这些功能是否已被删除：

$ kubectl exec -it flask-cap bash
root@flask-cap:/# ping 8.8.8.8
ping: Lacking privilege for raw socket.
root@flask-cap:/# chown daemon /tmp
chown: changing ownership of '/tmp': Operation not permitted