From dcb8b784d55cdbe5b43f50ba48a543f2d7721757 Mon Sep 17 00:00:00 2001 From: bsctl Date: Fri, 16 Jul 2021 20:22:23 +0200 Subject: [PATCH] docs: additional test cases --- docs/operator/mtb/block-add-capabilities.md | 3 + .../block-modification-of-resource-quotas.md | 69 +++++++++ .../mtb/block-privilege-escalation.md | 115 +++++++++++++++ .../mtb/block-privileged-containers.md | 116 +++++++++++++++ .../block-use-of-host-networking-and-ports.md | 134 ++++++++++++++++++ .../mtb/block-use-of-host-path-volumes.md | 127 +++++++++++++++++ .../mtb/configure-namespace-object-limits.md | 66 +++++++++ .../configure-namespace-resource-quotas.md | 65 +++++++++ .../mtb/require-run-as-non-root-user.md | 119 ++++++++++++++++ docs/operator/mtb/sig-multitenancy-bench.md | 18 +-- 10 files changed, 823 insertions(+), 9 deletions(-) create mode 100644 docs/operator/mtb/block-modification-of-resource-quotas.md create mode 100644 docs/operator/mtb/block-privilege-escalation.md create mode 100644 docs/operator/mtb/block-privileged-containers.md create mode 100644 docs/operator/mtb/block-use-of-host-networking-and-ports.md create mode 100644 docs/operator/mtb/block-use-of-host-path-volumes.md create mode 100644 docs/operator/mtb/configure-namespace-object-limits.md create mode 100644 docs/operator/mtb/configure-namespace-resource-quotas.md create mode 100644 docs/operator/mtb/require-run-as-non-root-user.md diff --git a/docs/operator/mtb/block-add-capabilities.md b/docs/operator/mtb/block-add-capabilities.md index cfb85293..3259bbed 100644 --- a/docs/operator/mtb/block-add-capabilities.md +++ b/docs/operator/mtb/block-add-capabilities.md @@ -64,6 +64,7 @@ apiVersion: capsule.clastix.io/v1beta1 kind: Tenant metadata: name: oil + namespace: oil-production spec: owners: - kind: User @@ -115,4 +116,6 @@ As cluster admin, delete all the created resources ```bash kubectl --kubeconfig cluster-admin delete tenant oil +kubectl --kubeconfig cluster-admin delete PodSecurityPolicy tenant +kubectl --kubeconfig cluster-admin delete ClusterRole tenant:psp ``` \ No newline at end of file diff --git a/docs/operator/mtb/block-modification-of-resource-quotas.md b/docs/operator/mtb/block-modification-of-resource-quotas.md new file mode 100644 index 00000000..3875ba7d --- /dev/null +++ b/docs/operator/mtb/block-modification-of-resource-quotas.md @@ -0,0 +1,69 @@ +# Block modification of resource quotas + +**Profile Applicability:** L1 + +**Type:** Behavioral Check + +**Category:** Tenant Isolation + +**Description:** Tenants should not be able to modify the resource quotas defined in their namespaces + +**Rationale:** Resource quotas must be configured for isolation and fairness between tenants. Tenants should not be able to modify existing resource quotas as they may exhaust cluster resources and impact other tenants. + +**Audit:** + +As cluster admin, create a tenant + +```yaml +kubectl create -f - < Note: make sure `PodSecurityPolicy` Admission Control is enabled on the APIs server: `--enable-admission-plugins=PodSecurityPolicy` + +Then create a ClusterRole using or granting the said item + +```yaml +kubectl create -f - << EOF +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tenant:psp +rules: +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + resourceNames: ['tenant'] + verbs: ['use'] +EOF +``` + +And assign it to the tenant + +```yaml +kubectl apply -f - << EOF +apiVersion: capsule.clastix.io/v1beta1 +kind: Tenant +metadata: + name: oil +spec: + owners: + - kind: User + name: alice + additionalRoleBindings: + - clusterRoleName: tenant:psp + subjects: + - kind: "Group" + apiGroup: "rbac.authorization.k8s.io" + name: "system:authenticated" +EOF + +./create-user.sh alice oil +``` + +As tenant owner, run the following command to create a namespace in the given tenant + +```bash +kubectl --kubeconfig alice create ns oil-production +kubectl --kubeconfig alice config set-context --current --namespace oil-production +``` + +As tenant owner, create a pod or container that sets `allowPrivilegeEscalation=true` in its `securityContext`. + +```yaml +kubectl --kubeconfig alice apply -f - << EOF +apiVersion: v1 +kind: Pod +metadata: + name: pod-priviliged-mode + namespace: oil-production + labels: +spec: + containers: + - name: busybox + image: busybox:latest + command: ["/bin/sleep", "3600"] + securityContext: + allowPrivilegeEscalation: true +EOF +``` + +You should have the pod blocked by `PodSecurityPolicy`. + +**Cleanup:** +As cluster admin, delete all the created resources + +```bash +kubectl --kubeconfig cluster-admin delete tenant oil +kubectl --kubeconfig cluster-admin delete PodSecurityPolicy tenant +kubectl --kubeconfig cluster-admin delete ClusterRole tenant:psp +``` diff --git a/docs/operator/mtb/block-privileged-containers.md b/docs/operator/mtb/block-privileged-containers.md new file mode 100644 index 00000000..a698c39a --- /dev/null +++ b/docs/operator/mtb/block-privileged-containers.md @@ -0,0 +1,116 @@ +# Block privileged containers + +**Profile Applicability:** L1 + +**Type:** Behavioral Check + +**Category:** Control Plane Isolation + +**Description:** Control container permissions. + +**Rationale:** By default a container is not allowed to access any devices on the host, but a “privileged” container can access all devices on the host. A process within a privileged container can also get unrestricted host access. Hence, tenants should not be allowed to run privileged containers. + +**Audit:** + +As cluster admin, define a `PodSecurityPolicy` that sets `privileged=false` and map the policy to a tenant: + +```yaml +kubectl create -f - << EOF +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tenant +spec: + privileged: false + # Required to prevent escalations to root. + allowPrivilegeEscalation: false + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + fsGroup: + rule: RunAsAny +EOF +``` + +> Note: make sure `PodSecurityPolicy` Admission Control is enabled on the APIs server: `--enable-admission-plugins=PodSecurityPolicy` + +Then create a ClusterRole using or granting the said item + +```yaml +kubectl create -f - << EOF +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tenant:psp +rules: +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + resourceNames: ['tenant'] + verbs: ['use'] +EOF +``` + +And assign it to the tenant + +```yaml +kubectl apply -f - << EOF +apiVersion: capsule.clastix.io/v1beta1 +kind: Tenant +metadata: + name: oil + namespace: oil-production +spec: + owners: + - kind: User + name: alice + additionalRoleBindings: + - clusterRoleName: tenant:psp + subjects: + - kind: "Group" + apiGroup: "rbac.authorization.k8s.io" + name: "system:authenticated" +EOF + +./create-user.sh alice oil +``` + +As tenant owner, run the following command to create a namespace in the given tenant + +```bash +kubectl --kubeconfig alice create ns oil-production +kubectl --kubeconfig alice config set-context --current --namespace oil-production +``` + +As tenant owner, create a pod or container that sets privileges in its `securityContext`. + +```yaml +kubectl --kubeconfig alice apply -f - << EOF +apiVersion: v1 +kind: Pod +metadata: + name: pod-priviliged-mode + namespace: + labels: +spec: + containers: + - name: busybox + image: busybox:latest + command: ["/bin/sleep", "3600"] + securityContext: + privileged: true +EOF +``` + +You should have the pod blocked by `PodSecurityPolicy`. + +**Cleanup:** +As cluster admin, delete all the created resources + +```bash +kubectl --kubeconfig cluster-admin delete tenant oil +kubectl --kubeconfig cluster-admin delete PodSecurityPolicy tenant +kubectl --kubeconfig cluster-admin delete ClusterRole tenant:psp +``` diff --git a/docs/operator/mtb/block-use-of-host-networking-and-ports.md b/docs/operator/mtb/block-use-of-host-networking-and-ports.md new file mode 100644 index 00000000..301dda33 --- /dev/null +++ b/docs/operator/mtb/block-use-of-host-networking-and-ports.md @@ -0,0 +1,134 @@ +# Block use of host networking and ports + +**Profile Applicability:** L1 + +**Type:** Behavioral Check + +**Category:** Host Isolation + +**Description:** Tenants should not be allowed to use host networking and host ports for their workloads. + +**Rationale:** Using `hostPort` and `hostNetwork` allows tenants workloads to share the host networking stack allowing potential snooping of network traffic across application pods. + +**Audit:** + +As cluster admin, define a `PodSecurityPolicy` that restricts `hostPort` and `hostNetwork` and map the policy to a tenant: + +```yaml +kubectl create -f - << EOF +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tenant +spec: + privileged: false + hostNetwork: false + hostPorts: [] # empty means no allowed host ports + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + fsGroup: + rule: RunAsAny +EOF +``` + +> Note: make sure `PodSecurityPolicy` Admission Control is enabled on the APIs server: `--enable-admission-plugins=PodSecurityPolicy` + +Then create a ClusterRole using or granting the said item + +```yaml +kubectl create -f - << EOF +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tenant:psp +rules: +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + resourceNames: ['tenant'] + verbs: ['use'] +EOF +``` + +And assign it to the tenant + +```yaml +kubectl apply -f - << EOF +apiVersion: capsule.clastix.io/v1beta1 +kind: Tenant +metadata: + name: oil + namespace: oil-production +spec: + owners: + - kind: User + name: alice + additionalRoleBindings: + - clusterRoleName: tenant:psp + subjects: + - kind: "Group" + apiGroup: "rbac.authorization.k8s.io" + name: "system:authenticated" +EOF + +./create-user.sh alice oil +``` + +As tenant owner, run the following command to create a namespace in the given tenant + +```bash +kubectl --kubeconfig alice create ns oil-production +kubectl --kubeconfig alice config set-context --current --namespace oil-production +``` + +As tenant owner, create a pod using `hostNetwork` + +```yaml +kubectl --kubeconfig alice apply -f - << EOF +apiVersion: v1 +kind: Pod +metadata: + name: pod-with-hostnetwork + namespace: oil-production +spec: + hostNetwork: true + containers: + - name: nginx + image: nginx:latest + ports: + - containerPort: 80 +EOF +``` + +As tenant owner, create a pod defining a container using `hostPort` + +```yaml +kubectl --kubeconfig alice apply -f - << EOF +apiVersion: v1 +kind: Pod +metadata: + name: pod-with-hostport + namespace: oil-production +spec: + containers: + - name: nginx + image: nginx:latest + ports: + - containerPort: 80 + hostPort: 9090 +EOF +``` + +In both the cases, you should have the pod blocked by `PodSecurityPolicy`. + +**Cleanup:** +As cluster admin, delete all the created resources + +```bash +kubectl --kubeconfig cluster-admin delete tenant oil +kubectl --kubeconfig cluster-admin delete PodSecurityPolicy tenant +kubectl --kubeconfig cluster-admin delete ClusterRole tenant:psp +``` diff --git a/docs/operator/mtb/block-use-of-host-path-volumes.md b/docs/operator/mtb/block-use-of-host-path-volumes.md new file mode 100644 index 00000000..0622cc2d --- /dev/null +++ b/docs/operator/mtb/block-use-of-host-path-volumes.md @@ -0,0 +1,127 @@ +# Block use of host path volumes + +**Profile Applicability:** L1 + +**Type:** Behavioral Check + +**Category:** Host Protection + +**Description:** Tenants should not be able to mount host volumes and directories. + +**Rationale:** The use of host volumes and directories can be used to access shared data or escalate priviliges and also creates a tight coupling between a tenant workload and a host. + +**Audit:** + +As cluster admin, define a `PodSecurityPolicy` that restricts `hostPath` volumes and map the policy to a tenant: + +```yaml +kubectl create -f - << EOF +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: tenant +spec: + privileged: false + volumes: # hostPath is not permitted + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + - 'persistentVolumeClaim' + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + fsGroup: + rule: RunAsAny +EOF +``` + +> Note: make sure `PodSecurityPolicy` Admission Control is enabled on the APIs server: `--enable-admission-plugins=PodSecurityPolicy` + +Then create a ClusterRole using or granting the said item + +```yaml +kubectl create -f - << EOF +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tenant:psp +rules: +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + resourceNames: ['tenant'] + verbs: ['use'] +EOF +``` + +And assign it to the tenant + +```yaml +kubectl apply -f - << EOF +apiVersion: capsule.clastix.io/v1beta1 +kind: Tenant +metadata: + name: oil + namespace: oil-production +spec: + owners: + - kind: User + name: alice + additionalRoleBindings: + - clusterRoleName: tenant:psp + subjects: + - kind: "Group" + apiGroup: "rbac.authorization.k8s.io" + name: "system:authenticated" +EOF + +./create-user.sh alice oil +``` + +As tenant owner, run the following command to create a namespace in the given tenant + +```bash +kubectl --kubeconfig alice create ns oil-production +kubectl --kubeconfig alice config set-context --current --namespace oil-production +``` + +As tenant owner, create a pod defining a volume of type `hostpath`. + +```yaml +kubectl --kubeconfig alice apply -f - << EOF +apiVersion: v1 +kind: Pod +metadata: + name: pod-with-hostpath-volume + namespace: oil-production +spec: + containers: + - name: busybox + image: busybox:latest + command: ["/bin/sleep", "3600"] + volumeMounts: + - mountPath: /tmp + name: volume + volumes: + - name: volume + hostPath: + # directory location on host + path: /data + type: Directory +EOF +``` + +You should have the pod blocked by `PodSecurityPolicy`. + +**Cleanup:** +As cluster admin, delete all the created resources + +```bash +kubectl --kubeconfig cluster-admin delete tenant oil +kubectl --kubeconfig cluster-admin delete PodSecurityPolicy tenant +kubectl --kubeconfig cluster-admin delete ClusterRole tenant:psp +``` diff --git a/docs/operator/mtb/configure-namespace-object-limits.md b/docs/operator/mtb/configure-namespace-object-limits.md new file mode 100644 index 00000000..0c851b58 --- /dev/null +++ b/docs/operator/mtb/configure-namespace-object-limits.md @@ -0,0 +1,66 @@ +# Configure namespace object limits + +**Profile Applicability:** L1 + +**Type:** Configuration + +**Category:** Fairness + +**Description:** Namespace resource quotas should be used to allocate, track and limit the number of objects, of a particular type, that can be created within a namespace. + +**Rationale:** Resource quotas must be configured for each tenant namespace, to guarantee isolation and fairness across tenants. + +**Audit:** + +As cluster admin, create a tenant + +```yaml +kubectl create -f - < Note: make sure `PodSecurityPolicy` Admission Control is enabled on the APIs server: `--enable-admission-plugins=PodSecurityPolicy` + +Then create a ClusterRole using or granting the said item + +```yaml +kubectl create -f - << EOF +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tenant:psp +rules: +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + resourceNames: ['tenant'] + verbs: ['use'] +EOF +``` + +And assign it to the tenant + +```yaml +kubectl apply -f - << EOF +apiVersion: capsule.clastix.io/v1beta1 +kind: Tenant +metadata: + name: oil +spec: + owners: + - kind: User + name: alice + additionalRoleBindings: + - clusterRoleName: tenant:psp + subjects: + - kind: "Group" + apiGroup: "rbac.authorization.k8s.io" + name: "system:authenticated" +EOF + +./create-user.sh alice oil +``` + +As tenant owner, run the following command to create a namespace in the given tenant + +```bash +kubectl --kubeconfig alice create ns oil-production +kubectl --kubeconfig alice config set-context --current --namespace oil-production +``` + +As tenant owner, create a pod or container that does not set `runAsNonRoot` to `true` in its `securityContext`, and `runAsUser` must not be set to 0. + +```yaml +kubectl --kubeconfig alice apply -f - << EOF +apiVersion: v1 +kind: Pod +metadata: + name: pod-run-as-root + namespace: oil-production +spec: + containers: + - name: busybox + image: busybox:latest + command: ["/bin/sleep", "3600"] +EOF +``` + +You should have the pod blocked by `PodSecurityPolicy`. + +**Cleanup:** +As cluster admin, delete all the created resources + +```bash +kubectl --kubeconfig cluster-admin delete tenant oil +kubectl --kubeconfig cluster-admin delete PodSecurityPolicy tenant +kubectl --kubeconfig cluster-admin delete ClusterRole tenant:psp +``` diff --git a/docs/operator/mtb/sig-multitenancy-bench.md b/docs/operator/mtb/sig-multitenancy-bench.md index 28331a30..44ddc09d 100644 --- a/docs/operator/mtb/sig-multitenancy-bench.md +++ b/docs/operator/mtb/sig-multitenancy-bench.md @@ -10,17 +10,17 @@ Actually, there's no yet a real standard for the multi-tenancy model in Kubernet |[Block access to other tenant resources](block-access-to-other-tenant-resources.md)|L1|v0.1.0|✓|MTB draft| |[Block add capabilities](block-add-capabilities.md)|L1|v0.1.0|✓|---| |[Require always imagePullPolicy](require-always-imagepullpolicy.md)|L1|v0.1.0|✓|---| -|Require run as non-root user|L1|v0.1.0|✓|---| -|Block privileged containers|L1|v0.1.0|✓|---| -|Block privilege escalation|L1|v0.1.0|✓|---| -|Configure namespace resource quotas|L1|v0.1.0|✓|---| -|Configure namespace object limits|L1|v0.1.0|✓|---| -|Block use of host path volumes|L1|v0.1.0|✓|---| -|Block use of NodePort services|L1|v0.1.0|✓|---| -|Block use of host networking and ports|L1|v0.1.0|✓|---| +|[Require run as non-root user](require-run-as-non-root-user.md)|L1|v0.1.0|✓|---| +|[Block privileged containers](block-privileged-containers.md)|L1|v0.1.0|✓|---| +|[Block privilege escalation](block-privilege-escalation.md)|L1|v0.1.0|✓|---| +|[Configure namespace resource quotas](configure-namespace-resource-quotas.md)|L1|v0.1.0|✓|---| +|[Block modification of resource quotas](block-modification-of-resource-quotas.md)|L1|v0.1.0|✓|---| +|[Configure namespace object limits](configure-namespace-object-limits.md)|L1|v0.1.0|✓|---| +|[Block use of host path volumes](block-use-of-host-path-volumes.md)|L1|v0.1.0|✓|---| +|[Block use of host networking and ports](block-use-of-host-networking-and-ports.md)|L1|v0.1.0|✓|---| |Block use of host PID|L1|v0.1.0|✓|---| |Block use of host IPC|L1|v0.1.0|✓|---| -|Block modification of resource quotas|L1|v0.1.0|✓|---| +|Block use of NodePort services|L1|v0.1.0|✓|---| |Require PersistentVolumeClaim for storage|L1|v0.1.0|✓|MTB draft| |Require PV reclaim policy of delete|L1|v0.1.0|✓|MTB draft| |Block use of existing PVs|L1|v0.1.0|✓|MTB draft|