Prevent Kubernetes users from being able to create privileged containers

user_4070477 0
Viewed 183

I'm currently attempting to look into whether it's possible to prevent a Kubernetes user from creating privileged containers via RBAC. I'm aware that as of Kubernetes 1.1, privileged containers are enabled by default to support underlying Docker requirements. This is fine, I'm not looking to block everybody from being able to run privileged containers.

I would, however, like to work on a principle of least privilege. For example, I'd like to prevent users being able to use something such as kubectl node-shell from being able to gain root access to a worker node, preferably through RBAC.

Is this possible?

kubernetes
2 Answers

There are several ways to achieve this and I'd like to start with the first, official one: Pod Security Policy.

The policy you want to implement is the following: Privileged

determines if any container in a pod can enable privileged mode. By default a container is not allowed to access any devices on the host, but a "privileged" container is given access to all devices on the host. This allows the container nearly all the same access as processes running on the host. This is useful for containers that want to use linux capabilities like manipulating the network stack and accessing devices.

The Kubernetes documentation provides few examples on how to interact with PSP, although a big disclaimer must be stated: the PodSecurityPolicy admission controlled must be activated on the API Server.

Besides the official admission controller, there are other projects that allow performing the denial of containers matching criteria, as well as running as privileged: Gatekeeper, Kyverno.

There are other projects that can address your use-case but wanted to share these last two since they seem the most promising ones.

Examples

user_101044720

Once PodSecurityPolicies have been enabled on you cluster, the standard recommends creating 3 levels of policies:

  • privileged
  • baseline
  • restricted then you have to use RBAC to map these policies with your users. Here is a minimalist example for all of these: https://github.com/k8s-school/kind-travis-ci/tree/master/psp. It will at least allow to boostrap the control plane once PodSecurityPolicies are enabled, indeed kube-proxy and CNI daemonset, and coredns deployment service accounts require some rights on PodSecurityPolicies in order to be able to create their related pod.
user_27840390
Related