Chapter 6. Pod security authentication and authorization
6.1. Understanding and managing pod security admission
Pod security admission is an implementation of the Kubernetes pod security standards. Use pod security admission to restrict the behavior of pods.
6.2. Security context constraint synchronization with pod security standards
MicroShift includes Kubernetes pod security admission.
In addition to the global pod security admission control configuration, a controller exists that applies pod security admission control warn and audit labels to namespaces according to the security context constraint (SCC) permissions of the service accounts that are in a given namespace.
Namespaces that are defined as part of the cluster payload have pod security admission synchronization disabled permanently. You can enable pod security admission synchronization on other namespaces as necessary. If an Operator is installed in a user-created openshift-* namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace.
The controller examines ServiceAccount object permissions to use security context constraints in each namespace. Security context constraints (SCCs) are mapped to pod security profiles based on their field values; the controller uses these translated profiles. Pod security admission warn and audit labels are set to the most privileged pod security profile found in the namespace to prevent warnings and audit logging as pods are created.
Namespace labeling is based on consideration of namespace-local service account privileges.
Applying pods directly might use the SCC privileges of the user who runs the pod. However, user privileges are not considered during automatic labeling.
6.2.1. Viewing security context constraints in a namespace
You can view the security context constraints (SCC) permissions in a given namespace.
Prerequisites
-
You have installed the OpenShift CLI (
oc).
Procedure
To view the security context constraints in your namespace, run the following command:
oc get --show-labels namespace <namespace>
6.3. Controlling pod security admission synchronization
You can enable automatic pod security admission synchronization for most namespaces.
System defaults are not enforced when the security.openshift.io/scc.podSecurityLabelSync field is empty or set to false. You must set the label to true for synchronization to occur.
Namespaces that are defined as part of the cluster payload have pod security admission synchronization disabled permanently. These namespaces include:
-
default -
kube-node-lease -
kube-system -
kube-public -
openshift -
All system-created namespaces that are prefixed with
openshift-, except foropenshift-operatorsBy default, all namespaces that have anopenshift-prefix are not synchronized. You can enable synchronization for any user-createdopenshift-*namespaces. You cannot enable synchronization for any system-createdopenshift-*namespaces, except foropenshift-operators.
If an Operator is installed in a user-created openshift-* namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace. The synchronized label inherits the permissions of the service accounts in the namespace.
Procedure
To enable pod security admission label synchronization in a namespace, set the value of the
security.openshift.io/scc.podSecurityLabelSynclabel totrue.Run the following command:
$ oc label namespace <namespace> security.openshift.io/scc.podSecurityLabelSync=true
You can use the --overwrite flag to reverse the effects of the pod security label synchronization in a namespace.
