kubernetes 无法在Minikube上启用Pod安全准入控制器

ldfqzlk8  于 2023-01-25  发布在  Kubernetes
关注(0)|答案(1)|浏览(220)

我试图启用新的PSA控制器与Minikube,但没有运气(无论是与类)。
下面是我用来启动minikube的命令:minikube start --kubernetes-version=v1.25.3 --feature-gates=PodSecurity=true --extra-config=apiserver.enable-admission-plugins=PodSecurity
这并没有被正确地记录下来,但是我发现PSA和准入控制器插件都有一个功能门,即使同时启用这两个功能门也没有效果。
为了确保我没有漏掉什么,我尝试用以下方法来测试:命名空间配置:

kind: Namespace
metadata:
  labels:
    pod-security.kubernetes.io/enforce: restricted
  name: psa```

Super unsecure Deployment:
```apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-unsecure
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      securityContext:
        runAsUser: 0
        runAsGroup: 0
        fsGroup: 0
      volumes:
        - name: etcvol
          hostPath:
            path: "/etc"
            type: Directory
      containers:
        - name: nginx
          image: nginx:1.14.2
          ports:
            - containerPort: 80
          securityContext:
            allowPrivilegeEscalation: true
            privileged: true
            capabilities:
              add: ["NET_ADMIN", "SYS_TIME"]```

When I try to create this deployment in the `psa` namespace it goes through without a hitch.
g2ieeal7

g2ieeal71#

好吧,我意识到这是我对PSA工作方式的误解。PSA控制器似乎不检查部署等更高级别的资源。因此,部署创建得很好,但它无法创建Pod,因为这些将违反策略。
如果运行Kubernetes 1.25,minikube(或Kind)完全不需要配置(没有功能门或准入插件配置)。

kubectl run --image=nginx nginx
Error from server (Forbidden): pods "nginx" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

相关问题