Pod Security Policy (PSP)
Security is critical for organizations of all sizes. The platform provides a number of security capabilities (both native and turnkey integrations with 3rd party products) that users can incorporate into their core architecture and design.
The platform provides support for the following as part of the core offering: secrets, certificates, registry pull secrets, RBAC, SSO integration etc. Pod Security Policies (PSP) is a key building block for k8s security as well.
PSPs are cluster-wide resources that control security sensitive aspects of pod specification. PSP objects define a set of conditions that a pod must run with in order to be "allowed" into the cluster.
It is strongly recommended that users use PSPs with care and understanding. If used improperly, it is possible to make a cluster "unusable".
Pod Security Policies allow you to control:
- The running of privileged containers
- Usage of host namespaces
- Usage of host networking and ports
- Usage of volume types
- Usage of the host filesystem
- A white list of Flexvolume drivers
- The allocation of an FSGroup that owns the pod’s volumes
- Requirements for use of a read only root file system
- The user and group IDs of the container
- Escalations of root privileges
- Linux capabilities, SELinux context, AppArmor, seccomp, sysctl profile
Official Kubernetes documentation on PSPs
For capabilities beyond what PSPs support, users can use OPA Gatekeeper using the provided, curated recipe.
Out of Box PSPs¶
Every Org and Project comes pre-populated with "two" PSPs that can be considered two extreme book ends.
- Restricted (highly restrictive and locked down)
- Privileged (open and permissive)
The default PSP is always the "Privileged" PSP. If required, admins can change the default for their Organization by updating the default.
Admins can create and manage the lifecycle of custom PSPs per project. They can then leverage the PSPs in cluster blueprints.
As an Admin - Click on "New PSP" - Follow the instructions in the PSP Wizard which is organized in logical sections
Volumes and File Systems¶
Users & Groups¶
SE Linux and Capabilities¶
Using PSPs in Blueprint¶
PSPs can be used as part of a cluster blueprint.
- Select the list of PSPs that need to be used
- Select "cluster scoped" for Policy Type
- The PSP will be applied as part of the blueprint update on the cluster
In an upcoming update, the policy type will be expanded to support "namespace-scoped" PSPs as well.