Skip to content

Latest commit

 

History

History
89 lines (69 loc) · 17.4 KB

README.md

File metadata and controls

89 lines (69 loc) · 17.4 KB

Kubernetes Pod Security Policy Migration

PodSecurityPolicy is dead, long live ???

CI GitHub issues GitHub forks GitHub stars GitHub contributors GitHub last commit Appvia Community Slack GitHub license


🚨 🚧 UNDER ACTIVE DEVELOPMENT (pull requests welcome) 🚧 🚨

This project is striving to recreate common Pod Security Policy configuration in other common kubernetes policy engines, to better inform the consumer how to migrate before it is removed in Kubernetes 1.25

Installation

Download the right binary for your OS and Arch from the latest release

Or you can try it now in your browser!

Usage

The app takes PodSecurityPolicy on stdIn and output your policy engine of choice on stdOut, you select the policy engine with the --engine=<engine>:

$ cat psp.yaml | ./psp-migration --engine=gatekeeper > output.yaml
# or if you're feeling brave you can pipe it back and forth to the kubernetes api
$ kubectl get -o yaml mypodsecuritypolicy | ./psp-migration -e kubewarden | kubectl apply -f -

Known limitations

  • Generated policy will probably be pretty verbose
  • Generated policy will probably have some unintended side effects, please create an issue when this happens
  • Only takes one PodSecurityPolicy at a time
  • Generated policy may conflict with other policies

Features

⚠️ This table is manually updated, see the automated test suites results ⚠️

Note: ❌ Doesn't mean it doesn't work, it just means the test is currently failing, in most cases the test needs to be updated

PSP field Pod Security Policy Pod Security Standard (baseline) Gatekeeper Kyverno Kubewarden k-rail
privileged ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
hostPID ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
hostIPC ✔️ ✔️ ✔️ ✔️ ✔️
hostNetwork ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
hostPorts ✔️ ✔️ ✔️ ✔️
volumes ✔️ ✔️ ✔️ ✔️ ✔️
allowedHostPaths ✔️ ✔️ ✔️ ✔️
allowedFlexVolumes ✔️ ✔️ ✔️ ✔️
readOnlyRootFilesystem ✔️ ✔️ ✔️ ✔️
runAsUser ✔️ ✔️ ✔️ ✔️
runAsGroup ✔️ ✔️ ✔️ ✔️
supplementalGroups ✔️ ✔️ ✔️ ✔️
fsgroup ✔️ ✔️ ✔️ ✔️
allowPrivilegeEscalation ✔️ ✔️ ✔️ ✔️
defaultAllowPrivilegeEscalation ✔️ ✔️ ✔️ ✔️
allowedCapabilities ✔️ ✔️ ✔️ ✔️
defaultAddCapabilities ✔️ ✔️ ✔️ ✔️
requiredDropCapabilities ✔️ ✔️ ✔️ ✔️
seLinux ✔️ ✔️ ✔️ ✔️
allowedProcMountTypes ✔️ ✔️ ✔️ ✔️
apparmor ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
seccomp ✔️ ✔️ ✔️ ✔️ ✔️
forbiddenSysctls ✔️ ✔️ ✔️ ✔️
allowedUnsafeSysctls ✔️ ✔️ ✔️ ✔️

References