Skip to content

Commit

Permalink
✨ Mise en place des PodSecurityAdmission sur les namespaces clients
Browse files Browse the repository at this point in the history 
Dans l'objectif de remplacer les podSecurityPolicy en prévision du passage en Kubernetes 1.26, il est nécessaire de mettre en place les nouvelles règles de sécurité.

Nous mettons en place par défaut un enforce sur la policy "restricted", avec un warning emis dès lors que l'applicatif ne respecte pas la policy "restricted" et réalisons par défaut l'émission d'un event d'audit lorsque la policy ne respecte pas le niveau "restricted".

Le choix restricted a été fait dans l'objectif d'avoir une politique sécurisée par défaut.

En raison de projets clients devant être en privileged, nous rendons possible l'ajout d'une liste de namespaces devant être valorisés à privileged. Nous émettons un log de type Warn pour souligner à un administrateur la particularité de configuration d'un namespace en particulier dans les logs de l'opérateur.
Sans cette modification tous les namespaces clients sont considérés comme héritant de la politique par défaut.
  • Loading branch information
Kévin PEREZ committed Jan 11, 2024
1 parent dcaeff1 commit a2bbe82
Show file tree
Hide file tree
Showing 7 changed files with 178 additions and 431 deletions.
5 changes: 4 additions & 1 deletion Readme.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,10 @@ For specific exceptions, add another network policy.
| **CUSTOM_LABELS** | *Add custom labels to namespaces* | `quota=managed,monitoring=true` | `no ` | - |
| **DEFAULT_PERMISSION** | *ClusterRole associated with default service account* | `view` | `no ` | - |
| **BLACKLIST** | *Ignore Project* | `my-project-dev` | `no ` | - |

| **PODSECURITYADMISSION_ENFORCEMENT** | *PodSecurityAdmission Enforcement* | `restricted` | `no ` | `restricted ` |
| **PODSECURITYADMISSION_WARNING** | *PodSecurityAdmission Warning* | `restricted` | `no ` | `restricted ` |
| **PODSECURITYADMISSION_AUDIT** | *PodSecurityAdmission Audit* | `restricted` | `no ` | `restricted ` |
| **PRIVILEGED_NAMESPACES** | *Namespaces allowed to use privileged annotation* | `native-development` | `no ` | - |
## Versioning

Since version v1.24.0, we have decided to modify the naming of versions for ease of reading and understanding.
Expand Down
51 changes: 27 additions & 24 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,65 +7,68 @@ require (
github.com/go-ozzo/ozzo-validation v3.6.0+incompatible
github.com/gorilla/mux v1.8.0
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.11.1
github.com/prometheus/client_golang v1.16.0
github.com/rs/zerolog v1.18.0
github.com/stretchr/testify v1.8.1
github.com/stretchr/testify v1.8.4
gopkg.in/ldap.v2 v2.5.1
gopkg.in/yaml.v2 v2.4.0
k8s.io/api v0.24.13
k8s.io/apimachinery v0.24.13
k8s.io/client-go v0.24.13
k8s.io/code-generator v0.24.13
k8s.io/pod-security-admission v0.24.13
)

require k8s.io/component-base v0.24.13 // indirect

require (
github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.1.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/emicklei/go-restful v2.16.0+incompatible // indirect
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
github.com/go-logr/logr v1.2.4 // indirect
github.com/go-logr/logr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.19.6 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.22.4 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/nxadm/tail v1.4.11 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/prometheus/client_model v0.2.0 // indirect
github.com/prometheus/common v0.26.0 // indirect
github.com/prometheus/procfs v0.6.0 // indirect
github.com/prometheus/client_model v0.4.0 // indirect
github.com/prometheus/common v0.44.0 // indirect
github.com/prometheus/procfs v0.10.1 // indirect
github.com/spf13/pflag v1.0.5 // indirect
golang.org/x/mod v0.11.0 // indirect
golang.org/x/net v0.11.0 // indirect
golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
golang.org/x/sys v0.9.0 // indirect
golang.org/x/term v0.9.0 // indirect
golang.org/x/text v0.10.0 // indirect
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
golang.org/x/tools v0.10.0 // indirect
golang.org/x/mod v0.12.0 // indirect
golang.org/x/net v0.17.0 // indirect
golang.org/x/oauth2 v0.10.0 // indirect
golang.org/x/sys v0.13.0 // indirect
golang.org/x/term v0.13.0 // indirect
golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.30.0 // indirect
google.golang.org/protobuf v1.31.0 // indirect
gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/gengo v0.0.0-20230306165830-ab3349d207d4 // indirect
k8s.io/klog/v2 v2.100.1 // indirect
k8s.io/kube-openapi v0.0.0-20230614213217-ba0abe644833 // indirect
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
k8s.io/klog/v2 v2.110.1 // indirect
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
sigs.k8s.io/yaml v1.3.0 // indirect
)

Expand Down
Loading

0 comments on commit a2bbe82

Please sign in to comment.