polaris/docs/assets/js/13.8b1bb030.js

(window.webpackJsonp=window.webpackJsonp||[]).push([[13],{369:function(e,t,r){"use strict";r.r(t);var o=r(42),i=Object(o.a)({},(function(){var e=this,t=e.$createElement,r=e._self._c||t;return r("ContentSlotsDistributor",{attrs:{"slot-key":e.$parent.slotKey}},[r("h1",{attrs:{id:"security"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#security"}},[e._v("#")]),e._v(" Security")]),e._v(" "),r("p",[e._v("These checks are related to security concerns. Workloads that fail these\nchecks may make your cluster more vulnerable, often by introducing a path\nfor privilege escalation.")]),e._v(" "),r("table",[r("thead",[r("tr",[r("th",[e._v("key")]),e._v(" "),r("th",[e._v("default")]),e._v(" "),r("th",[e._v("description")])])]),e._v(" "),r("tbody",[r("tr",[r("td",[r("code",[e._v("security.hostIPCSet")])]),e._v(" "),r("td",[r("code",[e._v("danger")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("hostIPC")]),e._v(" attribute is configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.hostPIDSet")])]),e._v(" "),r("td",[r("code",[e._v("danger")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("hostPID")]),e._v(" attribute is configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.notReadOnlyRootFilesystem")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("securityContext.readOnlyRootFilesystem")]),e._v(" is not true.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.privilegeEscalationAllowed")])]),e._v(" "),r("td",[r("code",[e._v("danger")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("securityContext.allowPrivilegeEscalation")]),e._v(" is true.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.runAsRootAllowed")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("securityContext.runAsNonRoot")]),e._v(" is not true.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.runAsPrivileged")])]),e._v(" "),r("td",[r("code",[e._v("danger")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("securityContext.privileged")]),e._v(" is true.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.insecureCapabilities")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("securityContext.capabilities")]),e._v(" includes one of the capabilities "),r("a",{attrs:{href:"https://github.com/FairwindsOps/polaris/tree/master/checks/insecureCapabilities.yaml",target:"_blank",rel:"noopener noreferrer"}},[e._v("listed here"),r("OutboundLink")],1)])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.dangerousCapabilities")])]),e._v(" "),r("td",[r("code",[e._v("danger")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("securityContext.capabilities")]),e._v(" includes one of the capabilities "),r("a",{attrs:{href:"https://github.com/FairwindsOps/polaris/tree/master/checks/dangerousCapabilities.yaml",target:"_blank",rel:"noopener noreferrer"}},[e._v("listed here"),r("OutboundLink")],1)])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.hostNetworkSet")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("hostNetwork")]),e._v(" attribute is configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("security.hostPortSet")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("hostPort")]),e._v(" attribute is configured.")])])])]),e._v(" "),r("h2",{attrs:{id:"background"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#background"}},[e._v("#")]),e._v(" Background")]),e._v(" "),r("p",[e._v("Securing workloads in Kubernetes is an important part of overall cluster security. The overall goal should be to ensure that containers are running with as minimal privileges as possible. This includes avoiding privilege escalation, not running containers with a root user, not giving excessive access to the host network, and using read only file systems wherever possible.")]),e._v(" "),r("p",[e._v("A pod running with the "),r("code",[e._v("hostNetwork")]),e._v(" attribute enabled will have access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. There are certain examples where setting "),r("code",[e._v("hostNetwork")]),e._v(" to true is required, such as deploying a networking plugin like Flannel.")]),e._v(" "),r("p",[e._v("Setting the "),r("code",[e._v("hostPort")]),e._v(" attribute on a container will ensure that it is accessible on that specific port on each node it is deployed to. Unfortunately when this is specified, it limits where a pod can actually be scheduled in a cluster.")]),e._v(" "),r("p",[e._v("Much of this configuration can be found in the "),r("code",[e._v("securityContext")]),e._v(" attribute for both Kubernetes pods and containers. Where configuration is available at both a pod and container level, Polaris validates both.")]),e._v(" "),r("h2",{attrs:{id:"further-reading"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#further-reading"}},[e._v("#")]),e._v(" Further Reading")]),e._v(" "),r("ul",[r("li",[r("a",{attrs:{href:"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes Docs: Configure a Security Context for a Pod or Container"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://www.youtube.com/watch?v=ltrV-Qmh3oY",target:"_blank",rel:"noopener noreferrer"}},[e._v("KubeCon 2018 Keynote: Running with Scissors"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://kubernetes-security.info/",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes Security Book"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes Docs: Set capabilities for a Container"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"http://man7.org/linux/man-pages/man7/capabilities.7.html",target:"_blank",rel:"noopener noreferrer"}},[e._v("Linux Programmer's Manual: Capabilities"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://kubernetes.io/docs/concepts/configuration/overview/#services",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes Docs: Configuration Best Practices"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"http://alesnosek.com/blog/2017/02/14/accessing-kubernetes-pods-from-outside-of-the-cluster/",target:"_blank",rel:"noopener noreferrer"}},[e._v("Accessing Kubernetes Pods from Outside of the Cluster"),r("OutboundLink")],1)])])])}),[],!1,null,null,null);t.default=i.exports}}]);