github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: awareness of possible netpol overwrite set by tenant owners

Browse Source 
Co-authored-by: Dario Tranchitella <dario@tranchitella.eu>
Co-authored-by: jandres - moscardo <titansmc@gmail.com>
This commit is contained in:
jandres - moscardo
2023-08-01 09:05:56 +02:00
committed by GitHub
co-authored by Dario Tranchitella
parent ebc249591e
commit af29cebea7
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/content/general/tutorial.md
+6
View File
@@ -1308,6 +1308,12 @@ Kubernetes network policies control network traffic between namespaces and betwe
To meet this requirement, Bill needs to define network policies that deny pods belonging to Alice's namespaces to access pods in namespaces belonging to other tenants, e.g. Bob's tenant `water`, or in system namespaces, e.g. `kube-system`.
> Keep in mind, that because of how the NetworkPolicies API works, the users can still add a policy which contradicts what the Tenant has set, resulting in users being able to circumvent the initial limitation set by the tenant admin.
>
> Two options can be put in place to mitigate this potential privilege escalation:
> 1. providing a restricted role rather than the default `admin` one
> 2. using Calico's `GlobalNetworkPolicy`, or Cilium's `CiliumClusterwideNetworkPolicy` which are defined at the cluster-level, thus creating an order of packet filtering.
Also, Bill can make sure pods belonging to a tenant namespace cannot access other network infrastructures like cluster nodes, load balancers, and virtual machines running other services.
Bill can set network policies in the tenant manifest, according to the requirements: