Feature+Docs: PodSecurityPolicy for Windows

[PatrickLang]

Most of the fields in PodSecurityPolicy today cannot be implemented in Windows since they're based on Linux namespace and UID/GID assumptions.

We need a feature proposal to add or modify what can be implemented on Windows to achieve use cases such as:

• Restricting host path mounts (allowedFlexVolumes, allowedHostPaths)
• Restricting runAsUser based on username[string] or group membership rather than uid/gid
• Using group managed service accounts (related to Feature: Add Group Managed Service Account support to Windows #62038)

Areas that need to be documented as does not apply to Windows:

• hostPID, hostIPC, hostNetwork, hostPorts - these are not possible today without changes to Windows itself, could be considered for future
• fsGroup
• *Capabilities, seLinux, AppArmor, sysctl - these are all Linux specific

Is this a BUG REPORT or FEATURE REQUEST?:

/kind feature

Environment:

• Kubernetes version (use kubectl version): v1.9, v1.10, v1.11
• Cloud provider or hardware configuration: not specific
• OS (e.g. from /etc/os-release): Windows Server 2016, Windows Server version 1709, Windows Server version 1803

[PatrickLang]

/sig windows

[PatrickLang]

/assign

[tallclair]

I'd like to redo PodSecurityPolicy at some point, and don't necessarily see it progressing to GA in its current form. Given that, I think it will be useful to understand the windows requirements for PodSecurityPolicy to inform the design of the successor, but I don't think it's worth investing in retrofitting the current PSP for windows.

[feiskyer]

I'd like to redo PodSecurityPolicy at some point, and don't necessarily see it progressing to GA in its current form.

Any timeline for this?

[tallclair]

No. Discussions are underway (wg-policy) about what should be a native policy vs. a policy DSL (e.g. OPA/rego). Any progress on PodSecurityPolicy is blocked on that guidance.

[derekwaynecarr]

@PatrickLang we need to clarify the pod spec for windows before making updates around the policy discussion.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[PatrickLang]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[PatrickLang]

/remove-lifecycle stale

[krmayankk]

/sig auth

[enj]

/priority awaiting-more-evidence

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[jsturtevant]

This has come up quite a bit and starting to find more scenarios where although it should be ignore not affect windows pods they are either blocked or don't get scheduled. I will start to look into more as well as the how it might work in regards to Gatekeeper.

/assign

[tallclair]

A good starting point might be to document that pod features that should be restricted on windows, as part of the "Pod Security Standards"

[jsturtevant]

I went through the Pod Security Standards doc and mapped each to what can/should apply to windows and things that don't make sense. If folks want to have a look and leave comments we can discuss at a sig-windows meeting: https://docs.google.com/spreadsheets/d/1Snhqtnu38I2Sqa7UQQbD3ZwYTkXMo7L81lUHSmh7buU/edit?usp=sharing

For areas where the security context was causing issues with PSP these PR's should take care of them: #93475 and #91482

In summary the following should be available in windows and need to map to a particular "standard".

• Usage of volume types
• Usage of the host filesystem
• Running as Non-root

There are on windows specific one that should be added:

• GMSA

[jsturtevant]

With the proposal for the Privileged Containers KEP, there was an analysis done for what would be potentially impacted in regards to Pod Security Standards and policies. Please see the KEP for details.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[jsturtevant]

/remove-lifecycle stale

[jglick]

Can this be closed given #97171?

[liggitt]

for PodSecurityPolicy specifically, I don't expect to see any windows-related changes, so this issue could probably be closed, but the points raised here (how OS-specific implications shape policy) would be good for the group working on a proposal for a PSP replacement to consider/incorporate if possible

cc @IanColdwater @tabbysable @tallclair

[jsturtevant]

agree for PSP but would like to get update guidance for general Windows Pod Security Standards doc: https://kubernetes.io/docs/concepts/security/pod-security-standards/

[tabbysable]

@jsturtevant It sounds like y'all in SIG Windows know what the hardening guidelines you have in mind are (at least somewhat, with the mappings you've done already), but would like some additional eyes on it and assistance with writing a PR to the Pod Security Standards doc? I'd recommend asking about that in the sig-security-docs channel on kubernetes slack to see if anybody has bandwidth to help.

[jsturtevant]

Before writing the docs I wanted to ensure we had these working in some form (most likely via Gatekeeper) so if we publish guidance it is something that can be followed and implemented. I had to step away from this shortly after doing the initial analysis for other work. Hoping I can get back to it soon.

[tabbysable]

Awesome! I assume you'll be PRing an example policy into https://github.com/open-policy-agent/gatekeeper-library/. Feel free to drop into #sig-security on k8s slack to ask if anyone wants to review it!

[jsturtevant]

We got the first gate-keeper policy PR open for anyone following along: open-policy-agent/gatekeeper-library#70

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[k8s-triage-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[tallclair]

I think we can close this, since PSP is marked as deprecated and targeting removal in v1.25