pspmigrator

README

pspmigrator: Migrate from PSP to PSA

pspmigrator is a tool to make it easier for K8s users to migrate from PodSecurityPolicy (PSP) to PodSecurity Standards/Admission (PSA). The tool has the following features:

• CLI tool to interactively migrate you from PSP to PSA by looking at the running pods in a namespace and suggesting a Pod Security Standard
• Detect if PSP object is potentially mutating Pods
• Detect if a Pod is being mutated by a PSP object

Disclaimer: Migrating to PSA might cause new pods to no longer be allowed to run. So make sure you do test this out before applying PodSecurity Standards on your namespaces.

Status: Work in progress, usable for testing purposes

Installation

go install github.com/kubernetes-sigs/pspmigrator/cmd/pspmigrator

Alternatively, you can download a release from here

Usage

Start the migration from PSP to PSA

pspmigrator migrate
# example output
Checking if any pods are being mutated by a PSP object
Suggest using baseline in namespace default
✔ enforce
Applied pod security level baseline on namespace default in enforce control mode
Review the labels by running `kubectl get ns default -o yaml`
There are no pods running in namespace empty. Skipping and going to the next one.
Done with migrating namespaces with pods to PSA

Full help docs available by running:

pspmigrator -h
pspmigrator is a tool to help migrate from PSP to PSA

Usage:
  pspmigrator [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  migrate     Interactive command to migrate from PSP to PSA
  mutating    Check if pods or PSP objects are mutating

Flags:
  -h, --help                help for pspmigrator
  -k, --kubeconfig string   (optional) absolute path to the kubeconfig file (default "/Users/stoelinga/.kube/config")

Use "pspmigrator [command] --help" for more information about a command.

Check if any pods are being mutated by a Pod Security Policy in your K8s cluster:

pspmigrator mutating pods
# example output
+----------------------------------------------------+-------------+---------+------------------------+
|                        NAME                        |  NAMESPACE  | MUTATED |          PSP           |
+----------------------------------------------------+-------------+---------+------------------------+
| nginx-nonpriv-66b6c48dd5-rl6jt                     | default     | true    | my-psp                 |
| event-exporter-gke-5479fd58c8-k8f5k                | kube-system | true    | gce.event-exporter     |
| fluentbit-gke-4hcg8                                | kube-system | true    | gce.fluentbit-gke      |
| gke-metadata-server-8bbrf                          | kube-system | false   | gce.privileged         |
+----------------------------------------------------+-------------+---------+------------------------+

Check if a specific pod called my-pod in namespace my-namespace is being mutated by a Pod Security Policy:

pspmigrator mutating pod my-pod -n my-namespace
# example output
Pod nginx-nonpriv-66b6c48dd5-rl6jt is mutated by PSP my-psp: true, diff: [slice[0]: <nil pointer> != v1.SecurityContext]
PSP profile my-psp has the following mutating fields: [DefaultAddCapabilities] and annotations: []

Demo

Watch the video demo:

Community, discussion, contribution, and support

Learn how to engage with the Kubernetes community on the community page.

You can reach the maintainers of this project at:

• Slack
• Mailing List

Code of conduct

Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.

Documentation

Index

• func FetchControllerObj(kind, name, namespace string, clientset *kubernetes.Clientset) (runtime.Object, error)
• func FetchControllerPod(kind, name, namespace string, clientset *kubernetes.Clientset) (*metav1.ObjectMeta, *v1.PodSpec, error)
• func GetContainerSecurityContexts(podSpec *v1.PodSpec) []*v1.SecurityContext
• func GetPSPAnnotations(annotations map[string]string) map[string]string
• func IsPSPMutating(pspObj *v1beta1.PodSecurityPolicy) (mutating bool, fields, annotations []string)
• func IsPodBeingMutatedByPSP(pod *v1.Pod, clientset *kubernetes.Clientset) (mutating bool, diff []string, err error)
• func SuggestedPodSecurityStandard(pod *v1.Pod) (psaapi.Level, error)

Functions

func FetchControllerObj

func FetchControllerObj(kind, name, namespace string, clientset *kubernetes.Clientset) (runtime.Object, error)

func FetchControllerPod

func FetchControllerPod(kind, name, namespace string, clientset *kubernetes.Clientset) (*metav1.ObjectMeta, *v1.PodSpec, error)

func GetContainerSecurityContexts

func GetContainerSecurityContexts(podSpec *v1.PodSpec) []*v1.SecurityContext

func GetPSPAnnotations

func GetPSPAnnotations(annotations map[string]string) map[string]string

func IsPSPMutating

func IsPSPMutating(pspObj *v1beta1.PodSecurityPolicy) (mutating bool, fields, annotations []string)

IsPSPMutating checks wheter a PodSecurityPolicy is potentially mutating pods. It returns true if one of the fields or annotations used in the PodSecurityPolicy is suspected to be mutating pods. The field or annotations that are suspected to be mutating are returned as well.

func IsPodBeingMutatedByPSP

func IsPodBeingMutatedByPSP(pod *v1.Pod, clientset *kubernetes.Clientset) (mutating bool, diff []string, err error)

IsPodBeingMutatedByPSP returns whether a pod is likely mutated by a PSP object. It also returns the difference of the securityContext attribute between the parent controller (e.g. Deployment) and the running pod.

func SuggestedPodSecurityStandard

func SuggestedPodSecurityStandard(pod *v1.Pod) (psaapi.Level, error)