@pmorie @smarterclayton @erictune

With SELinux we made the assumption that your policy across the cluster was either homogenous, or that you were responsible for defining a pattern and applying it and controlling access to nodes. Does the indirection from pod to profile have any particular benefit or disadvantages? For selinux it's been a fairly mechanical range / enforcement usage, although we're starting to ask how to propagate assigned labels from pod to PVC to PV.

We have this. It is called PodSecurityPolicy.

The type is checked in. Enforcement code is not in yet.
@pweil- what is timeline for upstreaming more of this?

@pweil- any plans to add seccomp support?

@erictune I'll be able to focus more on this when we close out 1.2 (which mostly corresponds to our 3.2) so likely in after the next sprint.

I'd like to add the seccomp support somewhere in the PSP. I haven't thought through where the actual profile lives and how it makes its way to the node if we're not expecting it to be there already.

Awesome. Since I clearly can't read every PR (sad face), I'll pick a
couple nits here:

The yaml is going to be pretty mouthy for SELinux:

kind: PodSecurityPolicy
spec:
    seLinuxContext:
        type: MustRunAs
        seLinuxOptions:
            user: foo

Could we reduce it to:

kind: PodSecurityPolicy
spec:
    seLinux:
        rule: MustRunAs
        options:
            user: foo

In the next cycle we'll need to add apparmor here, and we can discuss the
details at that time.

Tim

On Mon, Feb 29, 2016 at 10:19 AM, Paul Weil notifications@github.com
wrote:

@erictune https://github.com/erictune I'll be able to focus more on
this when we close out 1.2 (which mostly corresponds to our 3.2) so likely
in after the next sprint.

I'd like to add the seccomp support somewhere in the PSP. I haven't
thought through where the actual profile lives and how it makes its way to
the node if we're not expecting it to be there already.

—
Reply to this email directly or view it on GitHub
#22159 (comment)
.

👍

And seccomp modes and filters?

On Wed, Mar 2, 2016 at 5:52 AM, Paul Weil notifications@github.com wrote:

[image: 👍]

—
Reply to this email directly or view it on GitHub
#22159 (comment)
.

something like #22419 ?

On Wed, Mar 2, 2016 at 5:52 AM, Paul Weil notifications@github.com wrote:

[image: 👍]

—
Reply to this email directly or view it on GitHub
#22159 (comment)
.

Retitled to better reflect current needs :)

Lemme compare that to
#22402

On Thu, Mar 3, 2016 at 12:01 AM, Tim Hockin notifications@github.com
wrote:

something like #22419 ?

On Wed, Mar 2, 2016 at 5:52 AM, Paul Weil notifications@github.com
wrote:

[image: 👍]

—
Reply to this email directly or view it on GitHub
<
#22159 (comment)

.

—
Reply to this email directly or view it on GitHub
#22159 (comment)
.

Seccomp PSP support is on its way: #28300

How does this play with the CRI? https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/container-runtime-interface-v1.md

cc @yujuhong ?

We will have to extend CRI to support this as well. There are a few things in the pipeline that we will need to add later, and this is one of them. Let me file an issue.