Enable a security policy for forced Sidecar injection in a cluster - Alibaba Cloud Service Mesh

Background information

Policy governance

As of Kubernetes v1.21, PodSecurityPolicy (PSP) is deprecated. In response, ACK has upgraded its original PSP-based policy management feature. Built on the Gatekeeper admission controller that uses Open Policy Agent (OPA) policies, ACK enhances the feature with capabilities such as policy governance status statistics, log reporting, and log search. ACK also includes a rich policy library with rules tailored for a wide range of Kubernetes application scenarios. You can configure these policies through a user-friendly interface in the ACK console, simplifying the use of policy governance.

Policy types are categorized as follows:

infra: policies related to infrastructure-layer resources.
compliance: policies customized based on Kubernetes compliance standards, such as Alibaba Cloud Kubernetes Security Hardening.
psp: policies that replace the capabilities of Pod Security Policy (PSP).
k8s-general: general policies that enforce security constraints on Kubernetes resource configurations based on security best practices.

Sidecar injection

You can abstract functionality from an application's container into a sidecar proxy. This proxy runs as a separate container in the same pod. To take full advantage of these features, each service in an application must run a sidecar proxy in its pod. The sidecar proxy intercepts all inbound and outbound TCP traffic for the service and communicates with the Service Mesh control plane.

Prerequisites

The cluster runs Kubernetes 1.16 or later. To upgrade your cluster, see Manually upgrade an ACK cluster.
If you use a RAM user to manage policies, ensure the RAM user has the following permissions:
- cs:DescribePolicies: lists the policies in the policy library.
- cs:DescribePolicyDetails: obtains the details of a policy template.
- cs:DescribePolicyGovernanceInCluster: obtains the policy governance details of a cluster.
- cs:DescribePolicyInstances: lists the policy instances deployed in a cluster.
- cs:DescribePolicyInstancesStatus: obtains the deployment status of policy instances for different policy types in a cluster.
- cs:DeployPolicyInstance: deploys a policy instance in a specified cluster.
- cs:DeletePolicyInstance: deletes a policy instance in a specified cluster.
- cs:ModifyPolicyInstance: modifies a policy instance in a specified cluster.
For more information about how to create a custom RAM policy, see Grant access permissions on clusters and cloud resources by using RAM.

Procedure

When this policy is enabled, attempts to create pods in the specified namespaces will either fail or generate high-risk security warnings and violation audit logs.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Security > Policy Governance.

On the Policy Governance page, install or upgrade the component if prompted. Then, enable the policy by using one of the following methods.

Enable the enforced injection policy from the security policy list.

Click the My Policies tab to view all deployable policies for the cluster.
In the policy list, find the ASMSidecarInjectionEnforced policy and click Enable in the Actions column.

Configure the policy as described in the following table and click Create.

Parameter	Description
Action	Select an action: Block: Blocks the deployment of specified resources that violate the policy rule. Alert: Allows the deployment of specified resources that violate the policy rule, but generates a corresponding violation audit alert log.
Applicable Scope	Specify the namespaces in the cluster where the policy instance applies. You can also apply the policy to all namespaces, but this is not recommended.
Parameters	Leave this field empty.

Create a policy instance directly.

Click the My Policies tab and click Create Policy Instance. In the Create Policy Instance dialog box, configure the parameters.

Parameter	Description
Policy Type	Select the infra policy type. For more information, see Predefined security policies for ACK.
Policy Name	From the Policy Name drop-down list, select the ASMSidecarInjectionEnforced policy template.
Action	Select an action: Block: Blocks the deployment of specified resources that violate the policy rule. Alert: Allows the deployment of specified resources that violate the policy rule, but generates a corresponding violation audit alert log.
Applicable Scope	Specify the namespaces in the cluster where the policy instance applies. You can also apply the policy to all namespaces, but this is not recommended.
Parameters	Leave this field empty.

Verify the policy.
1. This test assumes that automatic injection is not enabled for the default namespace and that the enforced injection policy is enabled with the Action set to Block.
  1. Deploy the httpbin application.
  2. Check the workload.
    
    The pod fails to create.
    
    The httpbin Deployment shows a replica status of 0/1, and the following error message is displayed: admission webhook "validation.gatekeeper.sh" denied the request: Pod must contain at least one container or initContainer named 'istio-proxy'.
  3. Click the Overview tab. A block record appears in the Actions within Last 7 Days list.
    
    The record shows that the policy type is infra, the policy name is ASMSidecarInjectionEnforced, and the policy description is "Requires ASM sidecar injection for pods". The details show the message Pod must contain at least one container or initContainer named 'istio-proxy'.
2. Edit the policy and change the Action to Warning.
  1. Redeploy the httpbin application.
  2. Check the workload.
    
    The application is deployed successfully.
    
    On the Stateless page, the pod status for the httpbin application is 1/1, and the application is running as expected.
  3. Click the Overview tab. An alert record appears in the Actions within Last 7 Days list.
    
    The alert record shows that the policy type is infra, the policy name is ASMSidecarInjectionEnforced, the policy description is "Requires ASM sidecar injection for pods", the action is Alert, and the details show the message Pod must contain at least one sidecar.