Skip to main content

Pod Security Policy Should Be Enabled

More Info:​

Ensures pod security policy is enabled for all Kubernetes clusters. Kubernetes pod security policy is a resource that controls security sensitive aspects of the pod configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • NIST CSF

Triage and Remediation​

Remediation​

Using Console

To remediate the Pod Security Policy misconfiguration in GCP using the GCP console, follow these steps:

  1. Open the Google Kubernetes Engine (GKE) console.

  2. Select the GKE cluster for which you want to enable Pod Security Policy.

  3. Click on the "Edit" button.

  4. Under the "Security" section, click on "Enable Pod Security Policy".

  5. Click on the "Save" button to apply the changes.

  6. Once the changes are applied, Pod Security Policy will be enabled for the selected GKE cluster.

Note: Enabling Pod Security Policy may cause some of your existing workloads to fail if they do not meet the policy requirements. Therefore, it is recommended to test the policy with a small set of workloads before enabling it for all workloads in the cluster.

Using CLI

To remediate the "Pod Security Policy Should Be Enabled" misconfiguration in GCP, you can follow these step-by-step instructions using GCP CLI:

  1. First, ensure that you have the necessary permissions to create and modify Pod Security Policies in your GCP project.

  2. Open the Google Cloud Console and navigate to the Kubernetes Engine section.

  3. Select the cluster where you want to enable Pod Security Policy.

  4. Click the "Edit" button to edit the cluster configuration.

  5. Scroll down to the "Security" section and click "Enable Pod Security Policy".

  6. Click "Save" to apply the changes.

  7. Alternatively, you can use the GCP CLI to enable Pod Security Policy for your GCP cluster. Open your terminal or command prompt and run the following command:

gcloud beta container clusters update CLUSTER_NAME --enable-pod-security-policy

Make sure to replace CLUSTER_NAME with the name of your GCP cluster.

  1. Verify that Pod Security Policy has been enabled by running the following command:
gcloud beta container clusters describe CLUSTER_NAME --zone ZONE | grep podSecurityPolicyConfig

Make sure to replace CLUSTER_NAME with the name of your GCP cluster and ZONE with the zone where your cluster is located.

If the output shows "podSecurityPolicyConfig": {"enabled": true}, then Pod Security Policy has been successfully enabled for your GCP cluster.

Using Python

To remediate the misconfiguration of Pod Security Policy not being enabled in GCP using Python, follow the below steps:

  1. Install the required Python libraries:

    pip install google-auth google-auth-oauthlib google-auth-httplib2 google-cloud-container google-cloud-logging

  2. Authenticate to the GCP project using a service account:

    from google.oauth2 import service_account

    credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_file>')

  3. Connect to the Kubernetes cluster using the Kubernetes Python client:

    from kubernetes import client, config

    config.load_kube_config()
    v1 = client.CoreV1Api()

  4. Create a Pod Security Policy object:

    psp = {
       "apiVersion": "policy/v1beta1",
       "kind": "PodSecurityPolicy",
       "metadata": {
          "name": "restricted-psp"
       },
       "spec": {
          "privileged": False,
          "allowPrivilegeEscalation": False,
          "requiredDropCapabilities": [
             "ALL"
          ],
          "fsGroup": {
             "rule": "RunAsAny"
          },
          "runAsUser": {
             "rule": "MustRunAsNonRoot"
          },
          "seLinux": {
             "rule": "RunAsAny"
          },
          "supplementalGroups": {
             "rule": "RunAsAny"
          },
          "volumes": [
             "configMap",
             "downwardAPI",
             "emptyDir",
             "persistentVolumeClaim",
             "secret"
          ]
       }
    }

  5. Create the Pod Security Policy object in the Kubernetes cluster:

    api_instance = client.PolicyV1beta1Api()
    api_instance.create_pod_security_policy(psp)

  6. Verify that the Pod Security Policy object was created successfully:

    api_response = api_instance.list_pod_security_policy()
    for item in api_response.items:
       print(item.metadata.name)

Once the above steps are completed, the Pod Security Policy will be enabled in the GCP Kubernetes cluster, and all pods will be required to adhere to the policy.

Using Terraform
resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
  project  = "GOOGLE_PROJECT_ID"         # replace with your GCP project ID
  location = "GCP_REGION_OR_ZONE"        # replace with your region or zone

  # ...other existing cluster arguments...

  pod_security_policy_config {
    enabled = true
  }
}

Enabling pod_security_policy_config is an in-place control-plane update for supported GKE/Kubernetes versions (no Terraform-forced replacement of the cluster itself).

To verify, terraform plan should show an update to the google_container_cluster resource with pod_security_policy_config.enabled changing from false (or null) to true.

Additional Reading:​