Security Settings

# SecurityContext can be set at Pod level as well as container level
kubectl explain pod.spec.securityContext

kubectl explain pod.spec.containers.securityContext

# Settings applied at the container level will overwrite settings applied at the Pod level
kubectl apply -f security-context.yaml
kubectl get pods
kubectl exec -it secrity-context-demo -- sh
ps
id
exit

# pods/security/security-context.yaml
apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    supplementalGroups: [4000]
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox:1.28
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

# Roles are used on Namespaces and use Verbs to specify access to specific resources in that Namespace
kubectl create role

# RoleBindings connect users or ServiceAccount to Roles
kubectl create rolebinding

# A ServiceAccount is used to authorize Pods to get information from the API
# All Pods have a default ServiceAccount which provides minimal access
# If more access is needed, specific ServiceAccounts can be created
# ServiceAccounts don't have specific configuration, they are used in RoleBingings to get access to specific Roles

kubectl create ns students
kubectl create ns staff
kubectl config get-contexts

# Step 2: create a local Linux user 'anna' with home dir, add to 'sudo' group, shell bash
sudo useradd -m -G sudo -s /bin/bash anna
# set the login password for user 'anna'
sudo passwd anna
# switch into the 'anna' user session
su - anna
# create anna's 2048-bit RSA private key
openssl genrsa -out anna.key 2048
# list files to confirm anna.key was created
ls -l
# generate a CSR; CN=username, O=group, both used by k8s RBAC
openssl req -new -key anna.key -out anna.csr -subj "/CN=anna/O=k8s"
# sign the CSR with the cluster CA to issue anna's client cert, valid 1800 days
sudo openssl x509 -req -in anna.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out anna.crt -days 1800

# Step 3: update the kubeconfig credentials files for the new user
# create the .kube directory in anna's home
mkdir /home/anna/.kube
# copy the admin kubeconfig as anna's config (-i prompts before overwrite)
sudo cp -i /etc/kubernetes/admin.conf /home/anna/.kube/config
# give anna ownership of the whole .kube directory
sudo chown -R anna:anna /home/anna/.kube
# register anna's credentials (client cert + key) into the kubeconfig
kubectl config set-credentials anna \
  --client-certificate=/home/anna/anna.crt \
  --client-key=/home/anna/anna.key

# Step 4: create a default context for the new user
# define context 'anna-context' binding cluster/namespace/user together
kubectl config set-context anna-context --cluster=kubernetes \
  --namespace=staff --user=anna
# switch to anna-context and persist it as the current context
kubectl config use-context anna-context # will set context permanently
# try listing pods; fails for now because no RBAC has been granted yet
kubectl get pods # will fail as no RBAC has been configured yet
# list all contexts to confirm anna-context exists and is active
kubectl config get-contexts

# Step 5: configure RBAC to define a staff role
# switch to the student user (admin-capable) to create RBAC objects
su - student
# create a Role 'staff' in the 'staff' namespace with these verbs on these resources
kubectl create role staff -n staff \
  --verb=get,list,watch,create,update,patch,delete \
  --resource=deployments,replicasets,pods

# Step 6: bind the user to the new role
# grant user anna the 'staff' role within the 'staff' namespace
kubectl create rolebinding -n staff staff-role-binding --user=anna \
  --role=staff

# Step 7: test it
# switch back to anna and view her kubeconfig
su - anna; kubectl config view
# create a deployment; now allowed by the staff role
kubectl create deployment nginx --image=nginx
# list pods; now succeeds within the staff namespace
kubectl get pods

# Step 8: create a view-only Role
# switch to anna and try listing resources in 'default' ns (fails, no access there)
su - anna
kubectl get all -n default
# switch to student (admin) to create the read-only role
su - student
# create Role 'viewers' in 'default' ns with read-only verbs
kubectl create role viewers -n default --verb=list,get,watch \
  --resource=deployments,replicasets,pods
# bind anna to the 'viewers' role (defaults to current/default namespace)
kubectl create rolebinding viewers --user=anna --role=viewers
# switch back to anna and verify she can now view resources in 'default'
su - anna
kubectl get all -n default