当 kubernetes 中存在 pod 安全策略时，如何部署 statefulset

Question

I am trying to play around with PodSecurityPolicies in kubernetes so pods can't be created if they are using the root user. This is my psp definition:

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: eks.restrictive
spec:
  hostNetwork: false
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: MustRunAsNonRoot
  fsGroup:
    rule: RunAsAny
  volumes:
  - '*'

and this is my statefulset definition

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx # has to match .spec.template.metadata.labels
  serviceName: "nginx"
  replicas: 3 # by default is 1
  template:
    metadata:
      labels:
        app: nginx # has to match .spec.selector.matchLabels
    spec:
      securityContext:
        #only takes integers. 
        runAsUser: 1000
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: k8s.gcr.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "my-storage-class"
      resources:
        requests:
          storage: 1Gi

When trying to create this statefulset I get

create Pod web-0 in StatefulSet web failed error: pods "web-0" is forbidden: unable to validate against any pod security policy:

It doesn't specify what policy am I violating, and since I am specifying I want to run this on user 1000, I am not running this as root (Hence my understanding is that this statefulset pod definition is not violating any rules defined in the PSP). There is no USER specified in the Dockerfile used for this image.

The other weird part, is that this works fine for standard pods (kind: Pod, instead of kind:Statefulset), for example, this works just fine, when the same PSP exists:

apiVersion: v1
kind: Pod
metadata:
  name: my-nodejs
spec:
  securityContext:
    runAsUser: 1000
  containers:
    - name: my-node
      image: node
      ports:
        - name: web
          containerPort: 80
          protocol: TCP
      command:
      - /bin/sh
      - -c
      - |
          npm install http-server-g
          npx http-server

What am I missing / doing wrong?

Answer 1

You seems to have forgotten about binding this psp to a service account.

You need to apply the following:

cat << EOF | kubectl apply -f-
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: psp-role
rules:
- apiGroups: ['policy']
  resources: ['podsecuritypolicies']
  verbs:     ['use']
  resourceNames:
  - eks.restrictive
EOF

cat << EOF | kubectl apply -f-
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: psp-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: psp-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
EOF

If you dont want to use the default account you can create a separate service account and bind the role to it.

Read more about it k8s documentation - pod-security-policy .