kubernetes/kubernetes

Harden addons & system pods

Open

#38,541 opened on Dec 10, 2016

View on GitHub
 (14 comments) (5 reactions) (0 assignees)Go (43,066 forks)batch import
area/securityhelp wantedkind/cleanuplifecycle/frozenpriority/important-longtermsig/auth

Repository metrics

Stars
 (122,268 stars)
PR merge metrics
 (Avg merge 28d 17h) (343 merged PRs in 30d)

Description

Our system pods should run using security best practices, both to enhance cluster security and serve as examples of best practices to users. We should audit all our system pod Dockerfiles, and make sure all security features are enabled with custom profiles when possible.

Low hanging fruit:

  • Run as non-root (& disallow privilege escalation)
  • Run with the default seccomp profile
  • ReadOnlyRootFilesystem
  • Avoid unnecessary HostPath volumes
  • Don't mount service account token (unless required)

More advanced:

/cc @kubernetes/sig-auth @kubernetes/sig-cluster-lifecycle

Contributor guide

Research direction
Examine each system pod's Dockerfile and pod spec. For low hanging fruit, ensure the container runs as non root, has read only root filesystem, and uses default seccomp profile. For advanced items, reduce base image dependencies and create custom seccomp/AppArmor profiles.
Tech stack
go
Domain
backendinfrastructure
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
KubernetesDockerLinux security
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60