Container Service for Kubernetes:Configure Pod security policies

Install and configure ack-policy-external-provider

1. On the ACK Clusters page, click the name of your cluster. In the left navigation pane, click Add-ons.

2. Search for ack-policy-external-provider and follow the on-screen instructions to complete the configuration.

   • ProviderPodNumber: the number of component instances.

   • ProtectedKinds: Add the resource types corresponding to the CRDs that you want to protect.

     CRD deletion protection requires checking whether instances of the resource type exist in the cluster. Following the principle of least privilege, ack-policy-external-provider does not have the required query permissions by default and must be manually configured.

     Set ProviderPodNumber (number of replicas, default: 1). In the ProtectedKinds section, enter the resource type names (such as pods, policies, or customresources). Click Add to add multiple entries, or click Delete to remove an entry. Click OK.

API definition and parameters

ack-policy-external-provider implements a standard Gatekeeper external data Provider. In a Rego policy template, you can send a resource query request to this component by calling the external_data function and specifying provider: ack-policy-external-data-provider.

The request parameters are defined in JSON format. The following shows some examples.

// Example 1
{
  "action": "ListK8sResource",
  "namespaced": false,
  "group": "",
  "version": "v1",
  "resource": "persistentvolumeclaims"
  "requestID": review.uid,
  "userInfo": review.userInfo,
  "requestFrom": "PVCProtector",
  "labelSelector": "protected",
  "limit": 1
}
// Example 2
{
  "action": "GetK8sResource",
  "namespaced": true,
  "namespace": "default",
  "group": "apps",
  "version": "v1",
  "resource": "deployments",
  "requestID": review.uid,
  "userInfo": review.userInfo,
  "requestFrom": "FinOpsPolicy",
  "labelSelector": "protected",
  "limit": 1
}

The following table describes the core parameters.

Example: Prevent CRD deletion

This example shows how to use ack-policy-external-provider to implement a common advanced policy: prohibit the deletion of a CustomResourceDefinition (CRD) if associated custom resource (CR) instances still exist.

This policy is a built-in rule and does not require manual deployment. This section is for demonstration purposes only.

• Policy logic

  • Trigger: Gatekeeper detects a DELETE CRD operation.

  • Query: Rego policies use external_data to call ack-policy-external-provider.

  • Check: Based on the request parameters, the ack-policy-external-provider component queries the cluster to check whether corresponding CR instances exist.

  • Decision: If the query result returns at least one CR instance, ack-policy-external-provider will return the result to the Rego policy, and the policy will ultimately deny (reject) this deletion operation.

• Policy template (ConstraintTemplate)

  Defines the policy logic.

  apiVersion: templates.gatekeeper.sh/v1beta1
  kind: ConstraintTemplate
  metadata:
    name: blockcrddeletion
    annotations:
      meta.helm.sh/release-name: gatekeeper
      meta.helm.sh/release-namespace: kube-system
      metadata.gatekeeper.sh/version: 1.0.0
    labels:
      app.kubernetes.io/managed-by: Helm
  spec:
    crd:
      spec:
        names:
          kind: BlockCrdDeletion
        validation:
          legacySchema: true
    targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package block_crd_deletion
        violation[{"msg": msg}] {
          before(input.review.operation)
          response := handle(input.review)
          msg := after(response)
        }
  
        before(operation) {
          operation == "DELETE"
        }
  
        handle(review) = response {
          customrequest := {
            "action": "ListK8sResource",
            "namespaced": false,
            "group": review.object.spec.group,
            "version": "",
            "resource": review.object.spec.names.plural,
            "requestID": review.uid,
            "userInfo": review.userInfo,
            "requestFrom": "BlockCrdDeletion",
            "labelSelector": "protected",
            "limit": 1
          }
          request_keys := [json.marshal(customrequest)]
          response := external_data({
            "provider": "ack-policy-external-data-provider",
            "keys": request_keys
          })
        }
  
        after(response) = msg {
          count(response.responses[0]) > 0
          msg := sprintf(
            "The CRD %v is not allowed to be deleted. Reason: It is not allowed to delete a CRD object when it contains a collection of custom resources. Current existing custom resources: %v, etc.",
            [input.review.name, response.responses[0][0]]
          )
        }

• Policy instance (Constraint)

  Applies the template to specific resources. This example applies the policy to all CRDs.

  apiVersion: constraints.gatekeeper.sh/v1beta1
  kind: BlockCrdDeletion
  metadata:
    name: block-crd-deletion-rule
  spec:
    enforcementAction: deny
    match:
      kinds:
      - apiGroups:
        - '*'
        kinds:
        - CustomResourceDefinition

• Verify the result

  1. Create a test CRD and a corresponding CR instance.

     # Create a CRD
     apiVersion: apiextensions.k8s.io/v1
     kind: CustomResourceDefinition
     metadata:
       name: simplestthings.example.com
     spec:
       group: example.com
       scope: Namespaced
       names:
         plural: simplestthings
         singular: simplestthing
         kind: SimplestThing
       versions:
         - name: v1
           served: true
           storage: true
           schema:
             openAPIV3Schema:
               type: object
               properties:
                 spec:
                   type: object
                   properties:
                     message:
                       type: string
     ---
     # Create a CR instance
     apiVersion: example.com/v1
     kind: SimplestThing
     metadata:
       name: my-simple-thing
       namespace: default
       labels:
         protected: "false"
     spec:
       message: "Hello"

  2. Attempt to delete the CRD.

     kubectl delete crd simplestthings.example.com

  3. Verify that the policy blocks the deletion and returns a clear error message.

     Expected output:

     Error from server (Forbidden): admission webhook "delete.validation.gatekeeper.sh" denied the request: [block-crd-deletion-rule] The CRD simplestthings.example.com is not allowed to be deleted. Reason: It is not allowed to delete a CRD object when it contains a collection of custom resources. Current existing custom resources: my-simple-thing, etc.