Tutorials for Pod Security Admission #30422

PushkarJ · 2021-11-09T18:31:12Z

Creates a two part tutorial for Pod Security Admission with KinD:

Applying Pod Security Standards at Cluster level
Applying Pod Security Standards at Namespace level

/kind documentation

Notes for reviewers:

kind node image for v1.23 is not yet available here: https://hub.docker.com/r/kindest/node/tags
So the steps here are documented by building a kind Node image from source
We could hold this PR until v1.23 tag lands for kind or I can add a step / link on how to build Node image from source
Once v1.23 lands, can update the tutorial to reflect the correct version instead of latest tag

(open to feedback on other ways to tackle this of course :) )

Initial slack discussion: https://kubernetes.slack.com/archives/C1J0BPD2M/p1636152420159200

PushkarJ · 2021-11-09T18:31:48Z

/cc @reylejano @shannonxtreme @savitharaghunathan

PushkarJ · 2021-11-09T18:31:59Z

/sig security

netlify · 2021-11-09T18:44:19Z

✔️ Deploy Preview for kubernetes-io-main-staging ready!

🔨 Explore the source changes: d1e2545

🔍 Inspect the deploy log: https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/61b03ec9cc4dd20008ce01fe

😎 Browse the preview: https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app

reylejano · 2021-11-13T00:21:24Z

Previews of updated pages:
https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/
https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/pod-security/
https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/pod-security/cluster-level-pss/
https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/pod-security/ns-level-pss/

linux-foundation-easycla · 2021-11-15T19:34:43Z

The committers are authorized under a signed CLA.

✅ Pushkar Joglekar (53da735, 36a49f5)

shannonxtreme

Structural review. I'll do a content review after we have hashed out some of the structural changes :)

Thank you for this PJ!!

content/en/docs/tutorials/_index.md

content/en/docs/tutorials/pod-security/cluster-level-pss.md

content/en/docs/tutorials/pod-security/ns-level-pss.md

content/en/docs/tutorials/pod-security/_index.md

PushkarJ · 2021-11-19T01:52:15Z

/hold

Until merge timelines are aligned as per this comment: #30502 (comment)

content/en/docs/tutorials/security/cluster-level-pss.md

content/en/docs/tutorials/security/ns-level-pss.md

Fixed nits, broken links and numbering Co-authored-by: Tim Bannister <tim@scalefactory.com> Co-authored-by: Shannon Kularathna <ax3shannonkularathna@gmail.com> Co-authored-by: Jim Angel <jimangel@users.noreply.github.com>

PushkarJ · 2021-12-08T05:16:22Z

Alright, just pushed the final changes that takes care of all the pending actionable feedback.

Now that blog post PR is merged, just need someone to /hold remove and /lgtm on or before publish date for the blog (Dec 09)

Deploy previews:

https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/#security
https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/security/
https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/security/cluster-level-pss/
https://deploy-preview-30422--kubernetes-io-main-staging.netlify.app/docs/tutorials/security/ns-level-pss/

@PushkarJ

All addressed I think - thanks @PushkarJ

sftim · 2021-12-08T12:20:58Z

/check-cla
/easycla

sftim · 2021-12-08T12:38:36Z

Hold from #30422 (comment) should stand until the blog article publishes.

Any time after 16:05 Pacific time on the 8th of December should be good to go, as the related blog article goes live at UTC midnight on the 9th.
It's also OK to PR an update to the publication time of that article if that makes the sync easier.

sftim · 2021-12-08T12:42:57Z

This is ready for a technical signoff from SIG Auth. It's already been through quite a few checks, including by me, so what I'm looking for is a final read-through and a formal /lgtm providing no concerns spotted.
In other words, there is no need to go through each step to verify.

Page previews:

LGTM for SIG Docs, and #30422 (review) implies it also looks good to @shannonxtreme

sftim · 2021-12-08T12:43:39Z

/remove-label tide/merge-method-squash

Commits are already squashed

sftim · 2021-12-08T12:44:56Z

content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh

+# Until v1.23 is released, kind node image needs to be built from k/k master branch
+# Ref: https://kind.sigs.k8s.io/docs/user/quick-start/#building-images


femtonit: the release has happened (very happy to fix this in a follow-up PR, though)

liggitt · 2021-12-08T13:59:46Z

content/en/docs/tutorials/security/cluster-level-pss.md

+1. Configure the API server to consume this file during cluster creation:
+
+    ```
+    cat <<EOF > /tmp/pss/cluster-config.yaml 


is /tmp a good location for cluster confit files? I'm not sure what the typical permissions there are (or if files in /tmp are subject to automated cleanup/removal)

liggitt · 2021-12-08T14:00:52Z

content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh

@@ -0,0 +1,70 @@
+#!/bin/sh
+mkdir -p /tmp/pss
+cat <<EOF > /tmp/pss/cluster-level-pss.yaml


same question about using /tmp

liggitt · 2021-12-08T14:02:25Z

content/en/docs/tutorials/security/ns-level-pss.md

+      pod-security.kubernetes.io/warn-version=latest
+    ```
+
+2. Multiple pod security standards can be enabled on any namespace, using labels.


it might be worth noting that if this is an existing namespace that already contains workloads, using --dry-run=server is recommended first to determine if the new policy levels will disrupt existing workloads

liggitt · 2021-12-08T14:03:19Z

Technical content lgtm, had a non-blocking question about use of tmp and suggestion about calling out use of dry-run

sftim · 2021-12-08T14:08:52Z

Thanks @liggitt

Taking #30422 (comment) as
/lgtm

We can do a follow-up PR. I agree about taking care about using /tmp. There might be a way to improve on this.

k8s-ci-robot · 2021-12-08T14:09:14Z

LGTM label has been added.

Git tree hash: 377841f45aca39355245243a3391e41bda229ba5

shannonxtreme · 2021-12-08T15:09:08Z

LGTM too PJ, wonderful work here ❤️

…

On Wed., Dec. 8, 2021, 18:09 Kubernetes Prow Robot, < ***@***.***> wrote: LGTM label has been added. Git tree hash: 377841f45aca39355245243a3391e41bda229ba5 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#30422 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHH4EFXXTM47JCWCLNJRBZDUP5RJLANCNFSM5HV7LZTQ> .

PushkarJ · 2021-12-09T00:28:12Z

Blog is now published https://kubernetes.io/blog/2021/12/09/pod-security-admission-beta/

/hold remove

PushkarJ · 2021-12-09T00:28:48Z

/hold cancel

k8s-ci-robot added kind/documentation Categorizes issue or PR as related to documentation. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 9, 2021

k8s-ci-robot requested review from divya-mohan0209 and jimangel November 9, 2021 18:31

k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label Nov 9, 2021

k8s-ci-robot requested review from reylejano, savitharaghunathan and shannonxtreme November 9, 2021 18:31

k8s-ci-robot added the sig/security Categorizes an issue or PR as relevant to SIG Security. label Nov 9, 2021

PushkarJ changed the title ~~Draft: Tutorial for pod security admission~~ WIP: Tutorial for pod security admission Nov 9, 2021

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 9, 2021

PushkarJ force-pushed the psa-tutorial branch 3 times, most recently from a81b779 to 53da735 Compare November 9, 2021 19:27

shannonxtreme suggested changes Nov 15, 2021

View reviewed changes

PushkarJ changed the title ~~WIP: Tutorial for pod security admission~~ Tutorials for Pod Security Admission Nov 18, 2021

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 18, 2021

PushkarJ mentioned this pull request Nov 18, 2021

v1.23 blog post: Pod Security Admission Graduates to Beta #30502

Merged

5 tasks

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 19, 2021

PushkarJ force-pushed the psa-tutorial branch from 886a373 to 42eecf0 Compare November 19, 2021 01:55

PushkarJ commented Nov 19, 2021

View reviewed changes

content/en/docs/tutorials/security/cluster-level-pss.md Outdated Show resolved Hide resolved

PushkarJ commented Nov 19, 2021

View reviewed changes

content/en/docs/tutorials/security/ns-level-pss.md Outdated Show resolved Hide resolved

Added shell script examples

d1e2545

Fixed nits, broken links and numbering Co-authored-by: Tim Bannister <tim@scalefactory.com> Co-authored-by: Shannon Kularathna <ax3shannonkularathna@gmail.com> Co-authored-by: Jim Angel <jimangel@users.noreply.github.com>

PushkarJ force-pushed the psa-tutorial branch from 79822c3 to d1e2545 Compare December 8, 2021 05:12

k8s-ci-robot removed the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Dec 8, 2021

sftim reviewed Dec 8, 2021

View reviewed changes

liggitt reviewed Dec 8, 2021

View reviewed changes

k8s-ci-robot assigned sftim Dec 8, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 8, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 9, 2021

k8s-ci-robot merged commit aa848ab into kubernetes:main Dec 9, 2021

Babapool mentioned this pull request Dec 17, 2021

Merge the tutorials under tutorials->clusters into tutorials->security #31014

Merged

tallclair mentioned this pull request May 5, 2022

PodSecurity admission (PodSecurityPolicy replacement) kubernetes/enhancements#2579

Closed

12 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tutorials for Pod Security Admission #30422

Tutorials for Pod Security Admission #30422

PushkarJ commented Nov 9, 2021 •

edited

Loading

PushkarJ commented Nov 9, 2021

PushkarJ commented Nov 9, 2021

netlify bot commented Nov 9, 2021 •

edited

Loading

reylejano commented Nov 13, 2021

linux-foundation-easycla bot commented Nov 15, 2021 •

edited

Loading

shannonxtreme left a comment

PushkarJ commented Nov 19, 2021

PushkarJ commented Dec 8, 2021 •

edited

Loading

sftim commented Dec 8, 2021

sftim commented Dec 8, 2021

sftim commented Dec 8, 2021

sftim commented Dec 8, 2021

sftim Dec 8, 2021

liggitt Dec 8, 2021

liggitt Dec 8, 2021

liggitt Dec 8, 2021

liggitt commented Dec 8, 2021

sftim commented Dec 8, 2021

k8s-ci-robot commented Dec 8, 2021

shannonxtreme commented Dec 8, 2021 via email

PushkarJ commented Dec 9, 2021

PushkarJ commented Dec 9, 2021

		# Until v1.23 is released, kind node image needs to be built from k/k master branch
		# Ref: https://kind.sigs.k8s.io/docs/user/quick-start/#building-images

Tutorials for Pod Security Admission #30422

Tutorials for Pod Security Admission #30422

Conversation

PushkarJ commented Nov 9, 2021 • edited Loading

Notes for reviewers:

PushkarJ commented Nov 9, 2021

PushkarJ commented Nov 9, 2021

netlify bot commented Nov 9, 2021 • edited Loading

reylejano commented Nov 13, 2021

linux-foundation-easycla bot commented Nov 15, 2021 • edited Loading

shannonxtreme left a comment

Choose a reason for hiding this comment

PushkarJ commented Nov 19, 2021

PushkarJ commented Dec 8, 2021 • edited Loading

sftim commented Dec 8, 2021

sftim commented Dec 8, 2021

sftim commented Dec 8, 2021

sftim commented Dec 8, 2021

sftim Dec 8, 2021

Choose a reason for hiding this comment

liggitt Dec 8, 2021

Choose a reason for hiding this comment

liggitt Dec 8, 2021

Choose a reason for hiding this comment

liggitt Dec 8, 2021

Choose a reason for hiding this comment

liggitt commented Dec 8, 2021

sftim commented Dec 8, 2021

k8s-ci-robot commented Dec 8, 2021

shannonxtreme commented Dec 8, 2021 via email

PushkarJ commented Dec 9, 2021

PushkarJ commented Dec 9, 2021

PushkarJ commented Nov 9, 2021 •

edited

Loading

netlify bot commented Nov 9, 2021 •

edited

Loading

linux-foundation-easycla bot commented Nov 15, 2021 •

edited

Loading

PushkarJ commented Dec 8, 2021 •

edited

Loading