Pod Security Policies

[gambol99]

The current implementation doesn't work with PodSecurityPolicies admission controller enabled due to no psp policies. This PR adds a default psp policy for the kubelet users and and the kube-system namespace.

• added a default pod security policy covering the kube-system namespace
• this also covers the kubelet user as without this static pod are not longer visible, which effects the ability of the dns-controller to add the internal api dns records and thus no nodes can come up.

I still need to test this with 1.8.0; thus far only 1.7.2 / 1.7.7 has been tested

[gambol99]

/assign @gambol99
/assign @justinsb
/assign @chrislovecnm

[gambol99]

i'm gonna leave this one as WIP for now and perhaps offline chat on it. The experience of PSP hasn't been great and at present there a number of outstanding PR's targeted for a 1.8.x release to make this admission controller more user friendly.

• one issue if a you can see more than one policy, the admission controller will randomly choose one; this effects the deployments in kube-system as they deployed via kops with an user in the system:master group which is tied to cluster-admin clusterrole. This a known issue and two PRs, one adding a weighting factory and ordering have been raised.

[chrislovecnm]

@gambol99 is this something that you are working on? Just grooming old PRs

[gambol99]

apologizes for the delay @chrislovecnm ... currently away for xmas in italy so trying to stay away from a laptop :-) .. The PR was functional, the issue was due to problem with the admission controller itself. Effectively if you had a user or service account which via rbac can see all policies (i.e. pretty much most things deployed in kube-system as it was deployed via an cluster wide admin) the controller will randomly pick a policy. So there's a percentage of pods restarted which will end up with a policy which might conflict. In our case a few restarts of kube-dns would fail due to the RunAsNonRoot requirement. Their we two PR's which fix this behavior, one which orders the policy via name and the other which add's a priority field to the policies. Both are scheduled for a 1.9 release ..

[k8s-github-robot]

@gambol99 PR needs rebase

[gambol99]

@justinsb @chrislovecnm ... since >= 1.9.0 this one is good to go as the issue effecting pods who's rbac permits seeing multiple policies has been fixed

[gambol99]

can i just change this to >=1.9.0 @justinsb

[KashifSaadat]

Yeah probably best to lock down to k8s 1.9+, also update the template name to match (and the references to it on L119 - L120)

[KashifSaadat]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gambol99, KashifSaadat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [KashifSaadat,gambol99]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[KashifSaadat]

/test pull-kops-bazel-build