Enable PodSecurityPolicy in our test environment

[mattmoor]

In what area(s)?

/area test-and-release

Describe the feature

To catch things like: #3237 (comment)

cc @yu2003w

[knative-housekeeping-robot]

Issues go stale after 90 days of inactivity.
Mark the issue as fresh by adding the comment /remove-lifecycle stale.
Stale issues rot after an additional 30 days of inactivity and eventually close.
If this issue is safe to close now please do so by adding the comment /close.

Send feedback to Knative Productivity Slack channel or file an issue in knative/test-infra.

/lifecycle stale

[knative-housekeeping-robot]

Stale issues rot after 30 days of inactivity.
Mark the issue as fresh by adding the comment /remove-lifecycle rotten.
Rotten issues close after an additional 30 days of inactivity.
If this issue is safe to close now please do so by adding the comment /close.

Send feedback to Knative Productivity Slack channel or file an issue in knative/test-infra.

/lifecycle rotten

[knative-housekeeping-robot]

Rotten issues close after 30 days of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh by adding the comment /remove-lifecycle rotten.

Send feedback to Knative Productivity Slack channel or file an issue in knative/test-infra.

/close

[knative-prow-robot]

@knative-housekeeping-robot: Closing this issue.

In response to this:

Rotten issues close after 30 days of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh by adding the comment /remove-lifecycle rotten.

Send feedback to Knative Productivity Slack channel or file an issue in knative/test-infra.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Cynocracy]

/reopen

/remove-lifecycle rotten

[knative-prow-robot]

@Cynocracy: Reopened this issue.

In response to this:

/reopen

/remove-lifecycle rotten

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Cynocracy]

Reopening this, is this something we want to support?

At least from our end, we'd like to maintain a policy, and this repo feels like the appropriate place to do so.

[Cynocracy]

More info about the last attempt can be found at #4500

[mattmoor]

I think that we should be shipping a default PSP. It should be harmless for environments that aren't enforcing it, and very useful for installing into environments that require one.

Here are the docs on enabling this for GKE: https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies#enabling_podsecuritypolicy_controller

I'm happy to put together PSPs for the components we ship, we can probably start with a derivative of the Tekton PSP (the main change below is MustRunAsNonRoot):

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: knative-components
spec:
  privileged: false
  allowPrivilegeEscalation: false
  hostNetwork: false
  hostIPC: false
  hostPID: false

  volumes:
  - 'emptyDir'
  - 'configMap'
  - 'secret'

  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
    - min: 1
      max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
    - min: 1
      max: 65535

[mattmoor]

cc @chaodaiG @chizhg How hard would it be to enable this in our e2e test environments?

[chizhg]

cc @chaodaiG @chizhg How hard would it be to enable this in our e2e test environments?

With the current infra it would be pretty easy, just changing https://github.com/knative/serving/blob/master/test/e2e-tests.sh#L39 to initialize $@ --skip-istio-addon --cluster-creation-flag "--enable-pod-security-policy" would create a PSP enabled cluster.

[mattmoor]

Awesome 😍

[mattmoor]

I'm attempting to make the e2e legs here use this to test it out: knative-extensions/net-contour#107

[mattmoor]

Sounds like PSPs are out and OPA/Gatekeeper is the new hotness: https://www.youtube.com/watch?v=SFtHRmPuhEw&feature=youtu.be&t=920

[dprotaso]

Going to close this issue since PSP won't be supported in the future

From: kubernetes/kubernetes#90603

The clock is set for deprecation in 1.22 and removal of beta levels in 1.25.