Skip to content

Latest commit

 

History

History
65 lines (46 loc) · 1.04 KB

tipps-hardening.md

File metadata and controls

65 lines (46 loc) · 1.04 KB
Raw

Kubernetes Tipps Hardening

PSA (Pod Security Admission)

Policies defined by namespace.
e.g. not allowed to run container as root.

Will complain/deny when creating such a pod with that container type

Möglichkeiten in Pods und Containern

# für die Pods
kubectl explain pod.spec.securityContext 
kubectl explain pod.spec.containers.securityContext

Example (seccomp / security context)

A. seccomp - profile
https://github.com/docker/docker/blob/master/profiles/seccomp/default.json


apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  labels:
    app: audit-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/audit.json

  containers:

  - name: test-container
    image: hashicorp/http-echo:0.2.3
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

SecurityContext (auf Pod Ebene)

kubectl explain pod.spec.containers.securityContext

NetworkPolicy

# Firewall Kubernetes