PodSecurityPolicy FEATURE STATE: Kubernetes v1.21 [deprecated] about k3s-on-prem-production

[89luca89]

Hey @lorenzo95 glad you liked the post 😄

So yea, 1.21+ Deprecates the PSPs, which means it still works but we need to start finding a replacement

As stated in this blog article from the kubernetes.io blog
The immediate solution is to use PodSecurityContext which is an evolution of the SecurityContextDeny.

This works for generic not-do-complicated hardenization and works when you write them pod-per-pod, but not as a generic policy for the cluster (eg when used by multiple users)

personally (emphasis 😄 ) I would just go full with 2 tools:

Falco by Sysdig, implements a great engine to detect stuff and make rule easily (as shown in the blogpost)
Using its ability to support directly the PSPs: https://falco.org/docs/psp-support/

And OPA Gatekeeper, which can enforce PSPs like explained here: https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies-with-gatekeeper

[devopstales]

Hey @89luca89

With the release of Kubernetes v1.23, Pod Security admission has now entered beta. This will be the replacement for PSP. I will less configurable the PSP so a tool like OPA Gatekeeper or Kyverno could be a better solution. I prefer to use Kyverno, because it is easier to use and has more functionality then OPA Gatekeeper.

[89luca89]

Hey @devopstales

Yea was looking in to the new PSA will have to play with them a bit more
What I was thinking with Falco and OPA is that they can drop-in use the old PSP, so that in the meantime that PSA becomes stable it is still possible to use the PSP already written