PSP 是否仅适用于通过部署/副本集创建的 Pod？

Question

我正在尝试在集群中设置安全策略。我启用了 pod 安全性并创建了一个受限制的 psp

1.第 1 步 - 创建 PSP 2.第2步-创建集群角色 3.步骤 3 - 创建 ClusterRoleBinding

PSP

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  annotations:
    serviceaccount.cluster.cattle.io/pod-security: restricted
    serviceaccount.cluster.cattle.io/pod-security-version: "2315292"
  creationTimestamp: "2022-02-28T20:48:12Z"
  labels:
    cattle.io/creator: norman
  name: restricted-psp
spec:
  allowPrivilegeEscalation: false
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes:
  - configMap
  - emptyDir
  - projected
  - secret
  - downwardAPI
  - persistentVolumeClaim

集群角色 -

apiVersion: rbac.authorization.k8s.io/v1
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    serviceaccount.cluster.cattle.io/pod-security: restricted
  labels:
    cattle.io/creator: norman
  name: restricted-clusterrole
rules:
- apiGroups:
  - extensions
  resourceNames:
  - restricted-psp
  resources:
  - podsecuritypolicies
  verbs:
  - use

ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: restricted-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: restricted-clusterrole
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts:security
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:authenticated

创建一对 yam，一个用于部署，另一个用于 pod

kubectl create ns security

$ cat previleged-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: privileged-deploy
  name: privileged-pod
spec:
      containers:
        - image: alpine
          name: alpine
          stdin: true
          tty: true
          securityContext:
            privileged: true
      hostPID: true
      hostNetwork: true

$ cat previleged-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: privileged-deploy
  name: privileged-deploy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: privileged-deploy
  template:
    metadata:
      labels:
        app: privileged-deploy
    spec:
      containers:
        - image: alpine
          name: alpine
          stdin: true
          tty: true
          securityContext:
            privileged: true
      hostPID: true
      hostNetwork: true

预期是要阻止 pod 和部署。但是 pod 已创建且部署失败

$ kg all -n security
NAME                 READY   STATUS    RESTARTS   AGE
**pod/privileged-pod   1/1     Running   0          13m**

NAME                                READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/privileged-deploy   0/1     0            0           13m

NAME                                           DESIRED   CURRENT   READY   AGE
replicaset.apps/privileged-deploy-77d7c75dd8   1         0         0       13m

部署的预期错误如下所示

Events:
  Type     Reason        Age                   From                   Message
  ----     ------        ----                  ----                   -------
  Warning  FailedCreate  3m10s (x18 over 14m)  replicaset-controller  Error creating: pods "privileged-deploy-77d7c75dd8-" is forbidden: PodSecurityPolicy: unable to admit pod: [spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used spec.securityContext.hostPID: Invalid value: true: Host PID is not allowed to be used spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used spec.securityContext.hostPID: Invalid value: true: Host PID is not allowed to be used spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used spec.securityContext.hostPID: Invalid value: true: Host PID is not allowed to be used spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed]

但 pod 是直接创建的，尽管 yaml 有效。 PSP 是否仅适用于通过 deplyment/rs 创建的 Pod？请帮忙，我们如何防止用户创建特权和危险的 Pod

Answer 1

但是通过yaml直接创建的pod可以工作。 PSP只适用于Pod吗
通过deplyment/rs 创建？

这是因为当您创建一个裸 Pod（直接创建 Pod）时，它将由名为 kubernetes-admin 的用户（默认情况下）创建，该用户是 system 组的成员： masters，它映射到名为 cluster-admin 的集群角色，该角色可以访问在集群上创建的所有 PSP。这样裸pod的创建就会成功了。

而通过部署创建的 pod、rs、sts、ds（所有托管 pod）将使用其定义中提到的服务帐户创建。仅当这些服务帐户能够通过集群角色或角色访问 PSP 时，这些 pod 的创建才会成功。

我们如何防止用户创建特权且危险的 Pod

我们需要确定将创建这些 Pod 的用户和组是什么（通过检查 ~/kube/config 或其证书），然后确保它无法通过任何集群角色或角色访问 PSP。