Kubernetes Pod Security Policy Migration

PodSecurityPolicy is dead, long live ???

Please see our blog post PodSecurityPolicy is Dead, Long Live...?!

---

🚨 🚧 UNDER ACTIVE DEVELOPMENT (pull requests welcome) 🚧 🚨

This project is striving to recreate common Pod Security Policy configuration in other common kubernetes policy engines, to better inform the consumer how to migrate before it is removed in Kubernetes 1.25

Installation

Download the right binary for your OS and Arch from the latest release

Or you can try it now in your browser!

Usage

The app takes PodSecurityPolicy on stdIn and output your policy engine of choice on stdOut, you select the policy engine with the --engine=<engine>:

$ cat psp.yaml | ./psp-migration --engine=gatekeeper > output.yaml
# or if you're feeling brave you can pipe it back and forth to the kubernetes api
$ kubectl get -o yaml mypodsecuritypolicy | ./psp-migration -e kubewarden | kubectl apply -f -

Known limitations

• Generated policy will probably be pretty verbose
• Generated policy will probably have some unintended side effects, please create an issue when this happens
• Only takes one PodSecurityPolicy at a time
• Generated policy may conflict with other policies

Features

⚠️ This table is manually updated, see the automated test suites results ⚠️

Note: ❌ Doesn't mean it doesn't work, it just means the test is currently failing, in most cases the test needs to be updated

PSP field	Pod Security Policy	Pod Security Standard (baseline)	Gatekeeper	Kyverno	Kubewarden	k-rail
privileged	✔️	✔️	✔️	✔️	✔️	✔️
hostPID	✔️	✔️	✔️	✔️	✔️	✔️
hostIPC	✔️	✔️	✔️	✔️	✔️	❌
hostNetwork	✔️	✔️	✔️	✔️	✔️	✔️
hostPorts	✔️	❌	✔️	✔️	✔️	❌
volumes	✔️	✔️	✔️	✔️	✔️	❌
allowedHostPaths	✔️	❌	✔️	✔️	✔️	❌
allowedFlexVolumes	✔️	❌	✔️	✔️	✔️	❌
readOnlyRootFilesystem	✔️	❌	✔️	✔️	✔️	❌
runAsUser	✔️	❌	✔️	✔️	✔️	❌
runAsGroup	✔️	❌	✔️	✔️	✔️	❌
supplementalGroups	✔️	❌	✔️	✔️	✔️	❌
fsgroup	✔️	❌	✔️	✔️	✔️	❌
allowPrivilegeEscalation	✔️	❌	✔️	✔️	✔️	❌
defaultAllowPrivilegeEscalation	✔️	❌	✔️	✔️	✔️	❌
allowedCapabilities	✔️	❌	✔️	✔️	✔️	❌
defaultAddCapabilities	✔️	❌	✔️	✔️	✔️	❌
requiredDropCapabilities	✔️	❌	✔️	✔️	✔️	❌
seLinux	✔️	❌	✔️	✔️	✔️	❌
allowedProcMountTypes	✔️	❌	✔️	✔️	✔️	❌
apparmor	✔️	✔️	✔️	✔️	✔️	✔️
seccomp	✔️	✔️	✔️	✔️	✔️	❌
forbiddenSysctls	✔️	❌	✔️	✔️	✔️	❌
allowedUnsafeSysctls	✔️	❌	✔️	✔️	✔️	❌

References

• https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/
• https://github.com/open-policy-agent/gatekeeper-library
• https://kubernetes.io/docs/concepts/security/pod-security-standards/
• https://github.com/open-policy-agent/gatekeeper
• https://github.com/kyverno/kyverno
• https://github.com/kyverno/policies
• https://github.com/kubewarden/kubewarden-controller
• https://hub.kubewarden.io/
• https://github.com/cruise-automation/k-rail/blob/master/charts/k-rail/values.yaml
• https://github.com/cruise-automation/k-rail