Skip to content

Room 29

POD SECURITY

The Security Checkpoint

  • Pod Security Standards (PSS) define three profiles: Privileged, Baseline, Restricted.
  • A namespace enforces the Restricted policy - deploy a compliant pod to pass.

📜 Mission Briefing

  1. Create a namespace with the restricted Pod Security Standard: 
    kubectl label namespace secure-ns \
  pod-security.kubernetes.io/enforce=restricted
  2. Try deploying a privileged pod - it will be REJECTED.
  3. Deploy a compliant pod using compliant-pod.yaml.
  4. The compliant pod has the password as an env variable: podsec99.
Key Commands
Command Purpose
kubectl label ns NS pod-security.kubernetes.io/enforce=LEVEL Enforce PSS
kubectl label ns NS pod-security.kubernetes.io/warn=LEVEL Warn on violations
kubectl label ns NS pod-security.kubernetes.io/audit=LEVEL Audit violations
Pod Security Standards
# Three levels:
# privileged:  No restrictions (default)
# baseline:    Prevents known privilege escalations
# restricted:  Heavily restricted (best practices)

# Three modes:
# enforce: Violations reject the pod
# warn:    Violations produce warnings
# audit:   Violations logged in audit log

# Apply to namespace
kubectl create namespace secure-ns
kubectl label namespace secure-ns \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

# Restricted-compliant pod
apiVersion: v1
kind: Pod
metadata:
  name: compliant-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: busybox
      command: ['sh', '-c', 'echo $PASSWORD && sleep 3600']
      env:
        - name: PASSWORD
          value: "podsec99"
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true

# What restricted profile requires:
# - runAsNonRoot: true
# - allowPrivilegeEscalation: false
# - drop ALL capabilities
# - seccompProfile: RuntimeDefault or Localhost
# - No hostNetwork, hostPID, hostIPC
# - No privileged containers
# - No hostPath volumes
Hints

Hint 1

Try the privileged pod first to see the rejection: 

kubectl run priv-test --image=busybox -n secure-ns --privileged

Hint 2

Apply the compliant pod: 

kubectl apply -f compliant-pod.yaml -n secure-ns

Hint 3

The password is podsec99.

🔓 Unlock Room 30

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_30/README             \
        -out ../room_30/README.txt        \
        -pass pass:PASSWORD
cat ../room_30/README.txt