How to apply kubernetes PSP for a namespace

4/16/2019

How can I apply a PSP (PodSecurityPolicy) only for the kube-system namespace and another PSP for all the other containers?

-- Panos Georgiadis
kubernetes

2 Answers

4/17/2019

Pod security policies are a cluster level resource so there is no current way to do what you need in vanilla Kubernetes.

However Rancher adds a concept of Projects to the cluster and you can apply Pod Security policies to Projects.

NOTE - They still recommend using Pod Security Polices at a cluster level.

Alternatively @Crou's answer is also a good choice to implement it via RBAC and RoleBindings

-- Colwin
Source: StackOverflow

4/16/2019

As we can read in the Kubernetes documentation about Pod Security Policies.

A Pod Security Policy is a cluster-level resource that controls security sensitive aspects of the pod specification. The PodSecurityPolicy objects define a set of conditions that a pod must run with in order to be accepted into the system, as well as defaults for the related fields.

You should use RBAC and setup Role which will use desired PSP.

If a RoleBinding (not a ClusterRoleBinding) is used, it will only grant usage for pods being run in the same namespace as the binding. This can be paired with system groups to grant access to all pods run in the namespace:

# Authorize all service accounts in a namespace:
- kind: Group
  apiGroup: rbac.authorization.k8s.io
  name: system:serviceaccounts
# Or equivalently, all authenticated users in a namespace:
- kind: Group
  apiGroup: rbac.authorization.k8s.io
  name: system:authenticated

You should also check out Using PodSecurityPolicies and Kubernetes: Assigning Pod Security Policies with RBAC.

Hope this helps.

-- Crou
Source: StackOverflow