PodSecurityPolicyBasic.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**This notebook covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Check the params of the kube-apiserver\n",
    "\n",
    "Add `PodSecurityPolicy` if necessary. \n",
    "The server will automatically restart on saving the file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "kind: Pod\n",
      "metadata:\n",
      "  annotations:\n",
      "    kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 192.168.49.2:8443\n",
      "  creationTimestamp: null\n",
      "  labels:\n",
      "    component: kube-apiserver\n",
      "    tier: control-plane\n",
      "  name: kube-apiserver\n",
      "  namespace: kube-system\n",
      "spec:\n",
      "  containers:\n",
      "  - command:\n",
      "    - kube-apiserver\n",
      "    - --advertise-address=192.168.49.2\n",
      "    - --allow-privileged=true\n",
      "    - --authorization-mode=Node,\u001b[01;31m\u001b[KRBAC\u001b[m\u001b[K\n",
      "    - --client-ca-file=/var/lib/minikube/certs/ca.crt\n",
      "    - --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota\n",
      "    - --enable-bootstrap-token-auth=true\n",
      "    - --etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt\n",
      "    - --etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt\n",
      "    - --etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key\n",
      "    - --etcd-servers=https://127.0.0.1:2379\n",
      "    - --kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt\n",
      "    - --kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key\n",
      "    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname\n",
      "    - --proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt\n",
      "    - --proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key\n",
      "    - --requestheader-allowed-names=front-proxy-client\n",
      "    - --requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt\n",
      "    - --requestheader-extra-headers-prefix=X-Remote-Extra-\n",
      "    - --requestheader-group-headers=X-Remote-Group\n",
      "    - --requestheader-username-headers=X-Remote-User\n",
      "    - --secure-port=8443\n",
      "    - --service-account-issuer=https://kubernetes.default.svc.cluster.local\n",
      "    - --service-account-key-file=/var/lib/minikube/certs/sa.pub\n",
      "    - --service-account-signing-key-file=/var/lib/minikube/certs/sa.key\n",
      "    - --service-cluster-ip-range=10.96.0.0/12\n",
      "    - --tls-cert-file=/var/lib/minikube/certs/apiserver.crt\n",
      "    - --tls-private-key-file=/var/lib/minikube/certs/apiserver.key\n",
      "    image: k8s.gcr.io/kube-apiserver:v1.22.2\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    livenessProbe:\n",
      "      failureThreshold: 8\n",
      "      httpGet:\n",
      "        host: 192.168.49.2\n",
      "        path: /livez\n",
      "        port: 8443\n",
      "        scheme: HTTPS\n",
      "      initialDelaySeconds: 10\n",
      "      periodSeconds: 10\n",
      "      timeoutSeconds: 15\n",
      "    name: kube-apiserver\n",
      "    readinessProbe:\n",
      "      failureThreshold: 3\n",
      "      httpGet:\n",
      "        host: 192.168.49.2\n",
      "        path: /readyz\n",
      "        port: 8443\n",
      "        scheme: HTTPS\n",
      "      periodSeconds: 1\n",
      "      timeoutSeconds: 15\n",
      "    resources:\n",
      "      requests:\n",
      "        cpu: 250m\n",
      "    startupProbe:\n",
      "      failureThreshold: 24\n",
      "      httpGet:\n",
      "        host: 192.168.49.2\n",
      "        path: /livez\n",
      "        port: 8443\n",
      "        scheme: HTTPS\n",
      "      initialDelaySeconds: 10\n",
      "      periodSeconds: 10\n",
      "      timeoutSeconds: 15\n",
      "    volumeMounts:\n",
      "    - mountPath: /etc/ssl/certs\n",
      "      name: ca-certs\n",
      "      readOnly: true\n",
      "    - mountPath: /etc/ca-certificates\n",
      "      name: etc-ca-certificates\n",
      "      readOnly: true\n",
      "    - mountPath: /var/lib/minikube/certs\n",
      "      name: k8s-certs\n",
      "      readOnly: true\n",
      "    - mountPath: /usr/local/share/ca-certificates\n",
      "      name: usr-local-share-ca-certificates\n",
      "      readOnly: true\n",
      "    - mountPath: /usr/share/ca-certificates\n",
      "      name: usr-share-ca-certificates\n",
      "      readOnly: true\n",
      "  hostNetwork: true\n",
      "  priorityClassName: system-node-critical\n",
      "  securityContext:\n",
      "    seccompProfile:\n",
      "      type: RuntimeDefault\n",
      "  volumes:\n",
      "  - hostPath:\n",
      "      path: /etc/ssl/certs\n",
      "      type: DirectoryOrCreate\n",
      "    name: ca-certs\n",
      "  - hostPath:\n",
      "      path: /etc/ca-certificates\n",
      "      type: DirectoryOrCreate\n",
      "    name: etc-ca-certificates\n",
      "  - hostPath:\n",
      "      path: /var/lib/minikube/certs\n",
      "      type: DirectoryOrCreate\n",
      "    name: k8s-certs\n",
      "  - hostPath:\n",
      "      path: /usr/local/share/ca-certificates\n",
      "      type: DirectoryOrCreate\n",
      "    name: usr-local-share-ca-certificates\n",
      "  - hostPath:\n",
      "      path: /usr/share/ca-certificates\n",
      "      type: DirectoryOrCreate\n",
      "    name: usr-share-ca-certificates\n",
      "status: {}\n"
     ]
    }
   ],
   "source": [
    "grep -E '$|PodSecurityPolicy|RBAC' --color=always /etc/kubernetes/manifests/kube-apiserver.yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Verify the process is running with appropriate parameters"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/nginx-deployment created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f https://k8s.io/examples/application/deployment.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                    READY   STATUS    RESTARTS   AGE\n",
      "pod/nginx-deployment-66b6c48dd5-bmrp2   1/1     Running   0          17s\n",
      "pod/nginx-deployment-66b6c48dd5-ssm2v   1/1     Running   0          17s\n",
      "\n",
      "NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   106s\n",
      "\n",
      "NAME                               READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/nginx-deployment   2/2     2            2           17s\n",
      "\n",
      "NAME                                          DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/nginx-deployment-66b6c48dd5   2         2         2       17s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Everything works, we are fine\n",
    "### let's destroy the shiny, happyworld"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps \"nginx-deployment\" deleted\n"
     ]
    }
   ],
   "source": [
    "kubectl delete deployment nginx-deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "sed -i 's/--enable-admission-plugins=.*$/&,PodSecurityPolicy/' /etc/kubernetes/manifests/kube-apiserver.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "kind: Pod\n",
      "metadata:\n",
      "  annotations:\n",
      "    kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 192.168.49.2:8443\n",
      "  creationTimestamp: null\n",
      "  labels:\n",
      "    component: kube-apiserver\n",
      "    tier: control-plane\n",
      "  name: kube-apiserver\n",
      "  namespace: kube-system\n",
      "spec:\n",
      "  containers:\n",
      "  - command:\n",
      "    - kube-apiserver\n",
      "    - --advertise-address=192.168.49.2\n",
      "    - --allow-privileged=true\n",
      "    - --authorization-mode=Node,\u001b[01;31m\u001b[KRBAC\u001b[m\u001b[K\n",
      "    - --client-ca-file=/var/lib/minikube/certs/ca.crt\n",
      "    - --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,\u001b[01;31m\u001b[KPodSecurityPolicy\u001b[m\u001b[K\n",
      "    - --enable-bootstrap-token-auth=true\n",
      "    - --etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt\n",
      "    - --etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt\n",
      "    - --etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key\n",
      "    - --etcd-servers=https://127.0.0.1:2379\n",
      "    - --kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt\n",
      "    - --kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key\n",
      "    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname\n",
      "    - --proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt\n",
      "    - --proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key\n",
      "    - --requestheader-allowed-names=front-proxy-client\n",
      "    - --requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt\n",
      "    - --requestheader-extra-headers-prefix=X-Remote-Extra-\n",
      "    - --requestheader-group-headers=X-Remote-Group\n",
      "    - --requestheader-username-headers=X-Remote-User\n",
      "    - --secure-port=8443\n",
      "    - --service-account-issuer=https://kubernetes.default.svc.cluster.local\n",
      "    - --service-account-key-file=/var/lib/minikube/certs/sa.pub\n",
      "    - --service-account-signing-key-file=/var/lib/minikube/certs/sa.key\n",
      "    - --service-cluster-ip-range=10.96.0.0/12\n",
      "    - --tls-cert-file=/var/lib/minikube/certs/apiserver.crt\n",
      "    - --tls-private-key-file=/var/lib/minikube/certs/apiserver.key\n",
      "    image: k8s.gcr.io/kube-apiserver:v1.22.2\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    livenessProbe:\n",
      "      failureThreshold: 8\n",
      "      httpGet:\n",
      "        host: 192.168.49.2\n",
      "        path: /livez\n",
      "        port: 8443\n",
      "        scheme: HTTPS\n",
      "      initialDelaySeconds: 10\n",
      "      periodSeconds: 10\n",
      "      timeoutSeconds: 15\n",
      "    name: kube-apiserver\n",
      "    readinessProbe:\n",
      "      failureThreshold: 3\n",
      "      httpGet:\n",
      "        host: 192.168.49.2\n",
      "        path: /readyz\n",
      "        port: 8443\n",
      "        scheme: HTTPS\n",
      "      periodSeconds: 1\n",
      "      timeoutSeconds: 15\n",
      "    resources:\n",
      "      requests:\n",
      "        cpu: 250m\n",
      "    startupProbe:\n",
      "      failureThreshold: 24\n",
      "      httpGet:\n",
      "        host: 192.168.49.2\n",
      "        path: /livez\n",
      "        port: 8443\n",
      "        scheme: HTTPS\n",
      "      initialDelaySeconds: 10\n",
      "      periodSeconds: 10\n",
      "      timeoutSeconds: 15\n",
      "    volumeMounts:\n",
      "    - mountPath: /etc/ssl/certs\n",
      "      name: ca-certs\n",
      "      readOnly: true\n",
      "    - mountPath: /etc/ca-certificates\n",
      "      name: etc-ca-certificates\n",
      "      readOnly: true\n",
      "    - mountPath: /var/lib/minikube/certs\n",
      "      name: k8s-certs\n",
      "      readOnly: true\n",
      "    - mountPath: /usr/local/share/ca-certificates\n",
      "      name: usr-local-share-ca-certificates\n",
      "      readOnly: true\n",
      "    - mountPath: /usr/share/ca-certificates\n",
      "      name: usr-share-ca-certificates\n",
      "      readOnly: true\n",
      "  hostNetwork: true\n",
      "  priorityClassName: system-node-critical\n",
      "  securityContext:\n",
      "    seccompProfile:\n",
      "      type: RuntimeDefault\n",
      "  volumes:\n",
      "  - hostPath:\n",
      "      path: /etc/ssl/certs\n",
      "      type: DirectoryOrCreate\n",
      "    name: ca-certs\n",
      "  - hostPath:\n",
      "      path: /etc/ca-certificates\n",
      "      type: DirectoryOrCreate\n",
      "    name: etc-ca-certificates\n",
      "  - hostPath:\n",
      "      path: /var/lib/minikube/certs\n",
      "      type: DirectoryOrCreate\n",
      "    name: k8s-certs\n",
      "  - hostPath:\n",
      "      path: /usr/local/share/ca-certificates\n",
      "      type: DirectoryOrCreate\n",
      "    name: usr-local-share-ca-certificates\n",
      "  - hostPath:\n",
      "      path: /usr/share/ca-certificates\n",
      "      type: DirectoryOrCreate\n",
      "    name: usr-share-ca-certificates\n",
      "status: {}\n"
     ]
    }
   ],
   "source": [
    "grep -E '$|PodSecurityPolicy|RBAC' --color=always /etc/kubernetes/manifests/kube-apiserver.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "root        4032 21.8  2.2 1104196 347200 ?      Ssl  14:19   0:08 \u001b[01;31m\u001b[Kkube-apiserver\u001b[m\u001b[K\n",
      "--advertise-address=192.168.49.2\n",
      "--allow-privileged=true\n",
      "--authorization-mode=Node,RBAC\n",
      "--client-ca-file=/var/lib/minikube/certs/ca.crt\n",
      "--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,\u001b[01;31m\u001b[KPodSecurityPolicy\u001b[m\u001b[K\n",
      "--enable-bootstrap-token-auth=true\n",
      "--etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt\n",
      "--etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt\n",
      "--etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key\n",
      "--etcd-servers=https://127.0.0.1:2379\n",
      "--kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt\n",
      "--kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key\n",
      "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname\n",
      "--proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt\n",
      "--proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key\n",
      "--requestheader-allowed-names=front-proxy-client\n",
      "--requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt\n",
      "--requestheader-extra-headers-prefix=X-Remote-Extra-\n",
      "--requestheader-group-headers=X-Remote-Group\n",
      "--requestheader-username-headers=X-Remote-User\n",
      "--secure-port=8443\n",
      "--service-account-issuer=https://kubernetes.default.svc.cluster.local\n",
      "--service-account-key-file=/var/lib/minikube/certs/sa.pub\n",
      "--service-account-signing-key-file=/var/lib/minikube/certs/sa.key\n",
      "--service-cluster-ip-range=10.96.0.0/12\n",
      "--tls-cert-file=/var/lib/minikube/certs/apiserver.crt\n",
      "--tls-private-key-file=/var/lib/minikube/certs/apiserver.key\n",
      "root        4233  0.0  0.0   5212  2496 pts/1    S+   14:19   0:00 grep\n",
      "--color=auto -E \u001b[01;31m\u001b[Kkube-apiserver\u001b[m\u001b[K|\u001b[01;31m\u001b[KPodSecurityPolicy\u001b[m\u001b[K\n",
      "--color=always\n"
     ]
    }
   ],
   "source": [
    "ps auxwww | grep  -E \"kube-apiserver|PodSecurityPolicy\" --color=always |  sed  \"s/ --/\\n--/g\"  "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Check the influence of empty PodSecurityPolicies\n",
    "\n",
    "Can we start an nginx?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/nginx-deployment created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "apiVersion: apps/v1\n",
    "kind: Deployment\n",
    "metadata:\n",
    "  name: nginx-deployment\n",
    "  namespace: default\n",
    "  labels:\n",
    "    app: nginx\n",
    "spec:\n",
    "  replicas: 1\n",
    "  selector:\n",
    "    matchLabels:\n",
    "      app: nginx\n",
    "  template:\n",
    "    metadata:\n",
    "      labels:\n",
    "        app: nginx\n",
    "    spec:\n",
    "      containers:\n",
    "      - name: nginx\n",
    "        image: nginx\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   2m50s\n",
      "\n",
      "NAME                               READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/nginx-deployment   0/1     0            0           8s\n",
      "\n",
      "NAME                                          DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/nginx-deployment-6799fc88d8   1         0         0       8s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "nginx-deployment-6799fc88d8\n"
     ]
    }
   ],
   "source": [
    "RS=$(kubectl get rs | awk '/nginx-deployment/{print $1}' | head -1)\n",
    "echo $RS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Name:           nginx-deployment-6799fc88d8\n",
      "Namespace:      default\n",
      "Selector:       app=nginx,pod-template-hash=6799fc88d8\n",
      "Labels:         app=nginx\n",
      "                pod-template-hash=6799fc88d8\n",
      "Annotations:    deployment.kubernetes.io/desired-replicas: 1\n",
      "                deployment.kubernetes.io/max-replicas: 2\n",
      "                deployment.kubernetes.io/revision: 1\n",
      "Controlled By:  Deployment/nginx-deployment\n",
      "Replicas:       0 current / 1 desired\n",
      "Pods Status:    0 Running / 0 Waiting / 0 Succeeded / 0 Failed\n",
      "Pod Template:\n",
      "  Labels:  app=nginx\n",
      "           pod-template-hash=6799fc88d8\n",
      "  Containers:\n",
      "   nginx:\n",
      "    Image:        nginx\n",
      "    Port:         <none>\n",
      "    Host Port:    <none>\n",
      "    Environment:  <none>\n",
      "    Mounts:       <none>\n",
      "  Volumes:        <none>\n",
      "Conditions:\n",
      "  Type             Status  Reason\n",
      "  ----             ------  ------\n",
      "  ReplicaFailure   True    \u001b[01;31m\u001b[KFailedCreate\u001b[m\u001b[K\n",
      "Events:\n",
      "  Type     Reason        Age                From                   Message\n",
      "  ----     ------        ----               ----                   -------\n",
      "  Warning  \u001b[01;31m\u001b[KFailedCreate\u001b[m\u001b[K  8s (x13 over 29s)  replicaset-controller  Error creating: pods \"nginx-deployment-6799fc88d8-\" is \u001b[01;31m\u001b[Kforbidden\u001b[m\u001b[K: PodSecurityPolicy: unable to admit pod: []\n"
     ]
    }
   ],
   "source": [
    "kubectl describe rs $RS | grep --color=always -E '$|FailedCreate|forbidden' "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Without an existing PSP nobody can start anything. \n",
    "\n",
    "Note that the *replicaset* is reporting the failure.\n",
    "\n",
    "The pod does not exist, thus there are no logs we can watch"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[33;1mWarning:\u001b[0m policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+\n",
      "No resources found\n"
     ]
    }
   ],
   "source": [
    "kubectl get psp"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Policies\n",
    "\n",
    "* can be applied to each account, including \n",
    " * Users\n",
    " * ServiceAccounts\n",
    "* give fine grained control over rights\n",
    "\n",
    "We start with the *restrictive* Policy from the Kubernets Documentation\n",
    "https://kubernetes.io/docs/concepts/policy/pod-security-policy\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[33;1mWarning:\u001b[0m policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+\n",
      "podsecuritypolicy.policy/restrictive created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f  - <<EOF\n",
    "apiVersion: policy/v1beta1\n",
    "kind: PodSecurityPolicy\n",
    "metadata:\n",
    "  name: restrictive\n",
    "spec:\n",
    "  privileged: false\n",
    "  hostNetwork: false\n",
    "  allowPrivilegeEscalation: false\n",
    "  defaultAllowPrivilegeEscalation: false\n",
    "  hostPID: false\n",
    "  hostIPC: false\n",
    "  runAsUser:\n",
    "    rule: RunAsAny\n",
    "  fsGroup:\n",
    "    rule: RunAsAny\n",
    "  seLinux:\n",
    "    rule: RunAsAny\n",
    "  supplementalGroups:\n",
    "    rule: RunAsAny\n",
    "  volumes:\n",
    "  - 'configMap'\n",
    "  - 'downwardAPI'\n",
    "  - 'emptyDir'\n",
    "  - 'persistentVolumeClaim'\n",
    "  - 'secret'\n",
    "  - 'projected'\n",
    "  allowedCapabilities:\n",
    "  - '*'\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps \"nginx-deployment\" deleted\n"
     ]
    }
   ],
   "source": [
    "kubectl delete deployment nginx-deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pod/pause created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f- <<EOF\n",
    "apiVersion: v1\n",
    "kind: Pod\n",
    "metadata:\n",
    "  name: pause\n",
    "spec:\n",
    "  containers:\n",
    "    - name: pause\n",
    "      image: k8s.gcr.io/pause\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME    READY   STATUS    RESTARTS   AGE\n",
      "pause   1/1     Running   0          7s\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "      kubernetes.io/psp: restrictive\n"
     ]
    }
   ],
   "source": [
    "kubectl get pod $(kubectl get po | egrep -o nginx[A-Za-z0-9-]+) -o yaml | grep -i psp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "kind: Pod\n",
      "metadata:\n",
      "  annotations:\n",
      "    kubernetes.io/\u001b[01;31m\u001b[Kpsp\u001b[m\u001b[K: restrictive\n",
      "  creationTimestamp: \"2021-11-25T14:22:19Z\"\n",
      "  name: pause\n",
      "  namespace: default\n",
      "  resourceVersion: \"744\"\n",
      "  uid: 36ad33b9-aa1d-4348-8fb9-69e6d72153a2\n",
      "spec:\n",
      "  containers:\n",
      "  - image: k8s.gcr.io/pause\n",
      "    imagePullPolicy: Always\n",
      "    name: pause\n",
      "    resources: {}\n",
      "    securityContext:\n",
      "      allowPrivilegeEscalation: false\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-mcggx\n",
      "      readOnly: true\n",
      "  dnsPolicy: ClusterFirst\n",
      "  enableServiceLinks: true\n",
      "  nodeName: minikube\n",
      "  preemptionPolicy: PreemptLowerPriority\n",
      "  priority: 0\n",
      "  restartPolicy: Always\n",
      "  schedulerName: default-scheduler\n",
      "  securityContext: {}\n",
      "  serviceAccount: default\n",
      "  serviceAccountName: default\n",
      "  terminationGracePeriodSeconds: 30\n",
      "  tolerations:\n",
      "  - effect: NoExecute\n",
      "    key: node.kubernetes.io/not-ready\n",
      "    operator: Exists\n",
      "    tolerationSeconds: 300\n",
      "  - effect: NoExecute\n",
      "    key: node.kubernetes.io/unreachable\n",
      "    operator: Exists\n",
      "    tolerationSeconds: 300\n",
      "  volumes:\n",
      "  - name: kube-api-access-mcggx\n",
      "    projected:\n",
      "      defaultMode: 420\n",
      "      sources:\n",
      "      - serviceAccountToken:\n",
      "          expirationSeconds: 3607\n",
      "          path: token\n",
      "      - configMap:\n",
      "          items:\n",
      "          - key: ca.crt\n",
      "            path: ca.crt\n",
      "          name: kube-root-ca.crt\n",
      "      - downwardAPI:\n",
      "          items:\n",
      "          - fieldRef:\n",
      "              apiVersion: v1\n",
      "              fieldPath: metadata.namespace\n",
      "            path: namespace\n",
      "status:\n",
      "  conditions:\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2021-11-25T14:22:19Z\"\n",
      "    status: \"True\"\n",
      "    type: Initialized\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2021-11-25T14:22:23Z\"\n",
      "    status: \"True\"\n",
      "    type: Ready\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2021-11-25T14:22:23Z\"\n",
      "    status: \"True\"\n",
      "    type: ContainersReady\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2021-11-25T14:22:19Z\"\n",
      "    status: \"True\"\n",
      "    type: PodScheduled\n",
      "  containerStatuses:\n",
      "  - containerID: docker://3677eaf922016bd61ace1168e000ec7ca79dc43df9817bf27e4b832fb52c4a64\n",
      "    image: k8s.gcr.io/pause:latest\n",
      "    imageID: docker-pullable://k8s.gcr.io/pause@sha256:a78c2d6208eff9b672de43f880093100050983047b7b0afe0217d3656e1b0d5f\n",
      "    lastState: {}\n",
      "    name: pause\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    started: true\n",
      "    state:\n",
      "      running:\n",
      "        startedAt: \"2021-11-25T14:22:22Z\"\n",
      "  hostIP: 192.168.49.2\n",
      "  phase: Running\n",
      "  podIP: 172.17.0.3\n",
      "  podIPs:\n",
      "  - ip: 172.17.0.3\n",
      "  qosClass: BestEffort\n",
      "  startTime: \"2021-11-25T14:22:19Z\"\n"
     ]
    }
   ],
   "source": [
    "kubectl get pod pause -o yaml | grep --color=always -E '$|psp' "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Again\n",
    "\n",
    "\n",
    "Go back to the nginx example and start again\n",
    "Let us restart the deployment again\n",
    "\n",
    "Still not working because the psp is not bound"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Roles \n",
    "\n",
    "We create a restrictive *ClusterRole*"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "clusterrole.rbac.authorization.k8s.io/psp-restrictive created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "kind: ClusterRole\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "metadata:\n",
    "  name: psp-restrictive\n",
    "rules:\n",
    "- apiGroups:\n",
    "  - extensions\n",
    "  resources:\n",
    "  - podsecuritypolicies\n",
    "  resourceNames:\n",
    "  - restrictive\n",
    "  verbs:\n",
    "  - use\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## RoleBindings\n",
    "\n",
    "We need to bind the role to a user"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "rolebinding.rbac.authorization.k8s.io/restrictive created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f - <<EOF\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "kind: RoleBinding\n",
    "metadata:\n",
    "  name: restrictive\n",
    "  namespace: default\n",
    "roleRef:\n",
    "  apiGroup: rbac.authorization.k8s.io\n",
    "  kind: ClusterRole\n",
    "  name: psp-restrictive\n",
    "subjects:\n",
    "- kind: ServiceAccount\n",
    "  name: default\n",
    "  namespace: default\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/nginx-deployment created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "apiVersion: apps/v1\n",
    "kind: Deployment\n",
    "metadata:\n",
    "  name: nginx-deployment\n",
    "  namespace: default\n",
    "  labels:\n",
    "    app: nginx\n",
    "spec:\n",
    "  replicas: 1\n",
    "  selector:\n",
    "    matchLabels:\n",
    "      app: nginx\n",
    "  template:\n",
    "    metadata:\n",
    "      labels:\n",
    "        app: nginx\n",
    "    spec:\n",
    "      containers:\n",
    "      - name: nginx\n",
    "        image: nginx\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                    READY   STATUS    RESTARTS   AGE\n",
      "pod/nginx-deployment-6799fc88d8-2znzz   1/1     Running   0          24s\n",
      "pod/pause                               1/1     Running   0          12m\n",
      "\n",
      "NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   17m\n",
      "\n",
      "NAME                               READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/nginx-deployment   1/1     1            1           24s\n",
      "deployment.apps/nginx-strict       0/3     0            0           8m30s\n",
      "\n",
      "NAME                                          DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/nginx-deployment-6799fc88d8   1         1         1       24s\n",
      "replicaset.apps/nginx-strict-746cddb8f        3         0         0       8m30s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Create a Permissive Policy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 66,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[33;1mWarning:\u001b[0m policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+\n",
      "podsecuritypolicy.policy/privileged created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "apiVersion: policy/v1beta1\n",
    "kind: PodSecurityPolicy\n",
    "metadata:\n",
    "  name: privileged\n",
    "spec:\n",
    "  privileged: true\n",
    "  allowPrivilegeEscalation: true\n",
    "  allowedCapabilities:\n",
    "  - '*'\n",
    "  volumes:\n",
    "  - '*'\n",
    "  hostNetwork: true\n",
    "  hostPorts:\n",
    "  - min: 0\n",
    "    max: 65535\n",
    "  hostIPC: true\n",
    "  hostPID: true\n",
    "  runAsUser:\n",
    "    rule: 'RunAsAny'\n",
    "  seLinux:\n",
    "    rule: 'RunAsAny'\n",
    "  supplementalGroups:\n",
    "    rule: 'RunAsAny'\n",
    "  fsGroup:\n",
    "    rule: 'RunAsAny'\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "clusterrole.rbac.authorization.k8s.io/psp-privileged created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "kind: ClusterRole\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "metadata:\n",
    "  name: psp-privileged\n",
    "rules:\n",
    "- apiGroups:\n",
    "  - extensions\n",
    "  resources:\n",
    "  - podsecuritypolicies\n",
    "  resourceNames:\n",
    "  - restrictive\n",
    "  verbs:\n",
    "  - use\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "rolebinding.rbac.authorization.k8s.io/privileged created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f - <<EOF\n",
    "apiVersion: rbac.authorization.k8s.io/v1\n",
    "kind: RoleBinding\n",
    "metadata:\n",
    "  name:  privileged\n",
    "  namespace: default\n",
    "roleRef:\n",
    "  apiGroup: rbac.authorization.k8s.io\n",
    "  kind: ClusterRole\n",
    "  name: psp-privileged\n",
    "subjects:\n",
    "- kind: ServiceAccount\n",
    "  name: default\n",
    "  namespace: default\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Which policy has been applied\n",
    "\n",
    "how can we detect, which policy is in use for a given pod "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "nginx-deployment-6799fc88d8-2znzz\n"
     ]
    }
   ],
   "source": [
    "POD=$(kubectl get  pod | awk '/nginx-deployment/{print $1}' | head -1)\n",
    "echo $POD"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                READY   STATUS    RESTARTS   AGE\n",
      "nginx-deployment-6799fc88d8-2znzz   1/1     Running   0          64s\n",
      "pause                               1/1     Running   0          13m\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Pedestrians approach"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 61,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "      kubernetes.io/psp: restrictive\n"
     ]
    }
   ],
   "source": [
    "kubectl get pod $(kubectl get po | egrep -o nginx[A-Za-z0-9-]+) -o yaml | grep -i psp"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Enjoy the beauty of the jsonpath template,\n",
    "\n",
    "`.metadata.annotations` is a map"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"kubernetes.io/psp\":\"restrictive\"}"
     ]
    }
   ],
   "source": [
    "kubectl get pod $POD -o jsonpath='{.metadata.annotations}'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "`kubernetes\\.io/psp` is a valid name\n",
    "* the `/` is a usual character in a string\n",
    "* the `.` needs to be escaped"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "restrictive"
     ]
    }
   ],
   "source": [
    "kubectl get pod $POD -o jsonpath='{.metadata.annotations.kubernetes\\.io/psp}'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "and now all pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "restrictive restrictive"
     ]
    }
   ],
   "source": [
    "kubectl get pod --all-namespaces -o jsonpath='{.items[*].metadata.annotations.kubernetes\\.io/psp}'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 60,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[33;1mWarning:\u001b[0m policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+\n",
      "NAME         PRIV   CAPS   SELINUX    RUNASUSER   FSGROUP    SUPGROUP   READONLYROOTFS   VOLUMES\n",
      "privileged   true   *      RunAsAny   RunAsAny    RunAsAny   RunAsAny   false            *\n"
     ]
    }
   ],
   "source": [
    "kubectl get psp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[33;1mWarning:\u001b[0m policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+\n",
      "podsecuritypolicy.policy \"restrictive\" deleted\n"
     ]
    }
   ],
   "source": [
    "kubectl delete psp restrictive"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 67,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Error from server (NotFound): deployments.apps \"nginx-deployment\" not found\n"
     ]
    },
    {
     "ename": "",
     "evalue": "1",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "kubectl delete deployment nginx-deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 80,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/nginx-strict created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "apiVersion: apps/v1\n",
    "kind: Deployment\n",
    "metadata:\n",
    "  name: nginx-strict\n",
    "  labels:\n",
    "    app: nginx\n",
    "spec:\n",
    "  replicas: 3\n",
    "  selector:\n",
    "    matchLabels:\n",
    "      app: nginx\n",
    "  template:\n",
    "    metadata:\n",
    "      labels:\n",
    "        app: nginx\n",
    "    spec:\n",
    "      securityContext:\n",
    "        runAsUser: 110\n",
    "        runAsGroup: 110\n",
    "        fsGroup: 110\n",
    "      containers:\n",
    "      - name: nginx\n",
    "        image: nginxinc/nginx-unprivileged\n",
    "        ports:\n",
    "        - containerPort: 8080\n",
    "EOF\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 82,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                            READY   STATUS              RESTARTS   AGE\n",
      "nginx-strict-74f7c96556-chdhb   1/1     Running             0          7s\n",
      "nginx-strict-74f7c96556-g2g8s   1/1     Running             0          7s\n",
      "nginx-strict-74f7c96556-qvb26   0/1     ContainerCreating   0          7s\n",
      "pause                           1/1     Running             0          28m\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl delete deployment nginx-strict"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 83,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                                READY   STATUS    RESTARTS   AGE\n",
      "pod/nginx-strict-74f7c96556-chdhb   1/1     Running   0          23s\n",
      "pod/nginx-strict-74f7c96556-g2g8s   1/1     Running   0          23s\n",
      "pod/nginx-strict-74f7c96556-qvb26   1/1     Running   0          23s\n",
      "pod/pause                           1/1     Running   0          29m\n",
      "\n",
      "NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   34m\n",
      "\n",
      "NAME                           READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/nginx-strict   3/3     3            3           23s\n",
      "\n",
      "NAME                                      DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/nginx-strict-74f7c96556   3         3         3       23s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 84,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Name:           nginx-strict-74f7c96556\n",
      "Namespace:      default\n",
      "Selector:       app=nginx,pod-template-hash=74f7c96556\n",
      "Labels:         app=nginx\n",
      "                pod-template-hash=74f7c96556\n",
      "Annotations:    deployment.kubernetes.io/desired-replicas: 3\n",
      "                deployment.kubernetes.io/max-replicas: 4\n",
      "                deployment.kubernetes.io/revision: 1\n",
      "Controlled By:  Deployment/nginx-strict\n",
      "Replicas:       3 current / 3 desired\n",
      "Pods Status:    3 Running / 0 Waiting / 0 Succeeded / 0 Failed\n",
      "Pod Template:\n",
      "  Labels:  app=nginx\n",
      "           pod-template-hash=74f7c96556\n",
      "  Containers:\n",
      "   nginx:\n",
      "    Image:        nginxinc/nginx-unprivileged\n",
      "    Port:         8080/TCP\n",
      "    Host Port:    0/TCP\n",
      "    Environment:  <none>\n",
      "    Mounts:       <none>\n",
      "  Volumes:        <none>\n",
      "Events:\n",
      "  Type    Reason            Age   From                   Message\n",
      "  ----    ------            ----  ----                   -------\n",
      "  Normal  SuccessfulCreate  30s   replicaset-controller  Created pod: nginx-strict-74f7c96556-chdhb\n",
      "  Normal  SuccessfulCreate  30s   replicaset-controller  Created pod: nginx-strict-74f7c96556-qvb26\n",
      "  Normal  SuccessfulCreate  30s   replicaset-controller  Created pod: nginx-strict-74f7c96556-g2g8s\n"
     ]
    }
   ],
   "source": [
    "kubectl describe rs  nginx-strict-74f7c96556"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Summary \n",
    "\n",
    "* we have started one pod\n",
    "* with the restrictive PodSecurityPolicy\n",
    "* bound to the default serviceaccount\n",
    "* in the default namespace\n",
    "\n",
    "[ ![High Five](https://image.freepik.com/free-photo/blonde-african-young-women-giving-high-five-against-grey-background_23-2148178786.jpg) ](https://www.freepik.com/free-photo/blonde-african-young-women-giving-high-five-against-grey-background_4732025.htm)\n",
    "\n",
    "Attribution: [Background photo created by freepik](https://www.freepik.com/photos/background), thanks to [freepik](https://www.freepik.com)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}