From ce072855f691fef6de17ce9a0e26a06d9838b3f5 Mon Sep 17 00:00:00 2001 From: Juanita-Balaraj Date: Mon, 12 Dec 2022 17:00:40 -0500 Subject: [PATCH] Added Note for Kata Containers Support Updated Vendor Strings file Signed-off-by: Juanita-Balaraj Change-Id: Ie86b64488321d53d9c4356b745b0302b0b9df87c --- .../container-security-df8a251ec03f.rst | 24 +++++++++++-------- doc/source/shared/abbrevs.txt | 3 +++ .../kubernetes/kata-containers-overview.rst | 4 +++- .../kubernetes/known-limitations.rst | 4 ++++ ...ing-kata-container-runtime-in-pod-spec.rst | 4 ++++ 5 files changed, 28 insertions(+), 11 deletions(-) diff --git a/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst b/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst index 7a5f13ba8..5edd28ab1 100644 --- a/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst +++ b/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst @@ -5,7 +5,7 @@ Container Security Planning =========================== The following container security best practices are recommended as part of your -network security planning. +network security planning. Restrict Direct (SSH) Access to Kubernetes Nodes ------------------------------------------------ @@ -18,7 +18,7 @@ Use Role-based Access Control (RBAC) ------------------------------------ Define RBAC policies to exercise strict control over permissions granted to -non-admin users. Restrict non-admin users to the minimum level of privileges. +non-admin users. Restrict non-admin users to the minimum level of privileges. Use Namespaces -------------- @@ -51,7 +51,7 @@ Specify Minimal-Required Security Context for Pods -------------------------------------------------- Explicitly specify the minimal-required security context for pods, containers -and volumes through pod security policies, for example: +and volumes through pod security policies, for example: - runAsNonRoot @@ -63,11 +63,15 @@ and volumes through pod security policies, for example: Kata Containers --------------- +.. note:: + + Kata Containers will not be supported in |prod-long| |prod-ver|. + Kata containers are an optional capability on |prod| that provide a secure container runtime with lightweight virtual machines that feel and perform like containers, but provide stronger workload isolation. For improved performance with relation to isolation, Kata containers leverages hardware-enforced isolation -with virtualization VT extensions. +with virtualization VT extensions. For more information, see :ref:`starlingx-kubernetes-user-tutorials-overview`. @@ -80,14 +84,14 @@ of security-sensitive aspects of Pod security. PodSecurityPolicies (PSP) define different levels of access to security-sensitive aspects of the pod. RBAC [Cluster]Roles can then be created for these PSPs, with RBAC [Cluster]RoleBindings of these roles to a ‘subject’ (i.e. users, groups, -serviceaccounts, etc.). +serviceaccounts, etc.). -The following considerations apply to PodSecurityPolicies (PSPs): +The following considerations apply to PodSecurityPolicies (PSPs): - includes enabling or disabling options such as running as root, access to host filesystem, access to host networking, etc. -- are disabled by default +- are disabled by default - can be enable by the System Administrator via **system service-parameter-add kubernetes kube_apiserver admission_plugins=PodSecurityPolicy** @@ -105,8 +109,8 @@ usage: - authenticated users can only perform a restricted set of security-sensitive options on Pods and only in namespaces the user is allowed to access - -Administrator can then: + +Administrator can then: - create other custom PodSecurityPolicies and associated RBAC Roles @@ -114,7 +118,7 @@ Administrator can then: ------------------------------------ -Container Image Signature Validation +Container Image Signature Validation ------------------------------------ The Portieris admission controller allows you to enforce image security polices diff --git a/doc/source/shared/abbrevs.txt b/doc/source/shared/abbrevs.txt index eb24c488f..72a8e11cd 100755 --- a/doc/source/shared/abbrevs.txt +++ b/doc/source/shared/abbrevs.txt @@ -24,6 +24,7 @@ .. |eBPF| replace:: :abbr:`eBPF (Extended Berkeley Packet Filter)` .. |CA| replace:: :abbr:`CA (Certificate Authority)` .. |CAs| replace:: :abbr:`CAs (Certificate Authorities)` +.. |CDI| replace:: :abbr:`CDI (Containerized Data Importer)` .. |CLI| replace:: :abbr:`CLI (Command Line Interface)` .. |CLIs| replace:: :abbr:`CLIs (Command Line Interfaces)` .. |CNI| replace:: :abbr:`CNI (Container Networking Interface)` @@ -67,6 +68,7 @@ .. |IPMI| replace:: :abbr:`IPMI (Intelligent Platform Management Interface)` .. |IOPS| replace:: :abbr:`IOPS (I/O operations per second)` .. |IRQ| replace:: :abbr:`IRQ (Interrupt Request)` +.. |ISA| replace:: :abbr:`ISA (Instruction Set Architecture)` .. |KVM| replace:: :abbr:`KVM (Kernel-based Virtual Machine)` .. |LACP| replace:: :abbr:`LACP (Link Aggregation Control Protocol)` .. |LAG| replace:: :abbr:`LAG (Link Aggregation)` @@ -141,6 +143,7 @@ .. |SRIOVs| replace:: :abbr:`SR-IOVs (Single Root I/O Virtualizations)` .. |SSD| replace:: :abbr:`SSD (Solid State Drive)` .. |SSDs| replace:: :abbr:`SSDs (Solid State Drives)` +.. |SSSD| replace:: :abbr:`SSSD (System Security Services Daemon)` .. |SSH| replace:: :abbr:`SSH (Secure Shell)` .. |SSL| replace:: :abbr:`SSL (Secure Socket Layer)` .. |STP| replace:: :abbr:`STP (Spanning Tree Protocol)` diff --git a/doc/source/usertasks/kubernetes/kata-containers-overview.rst b/doc/source/usertasks/kubernetes/kata-containers-overview.rst index 0881f0df2..0eb0e841a 100644 --- a/doc/source/usertasks/kubernetes/kata-containers-overview.rst +++ b/doc/source/usertasks/kubernetes/kata-containers-overview.rst @@ -6,7 +6,9 @@ Kata Containers Overview ======================== -|prod| supports Kata Containers. +.. note:: + + Kata Containers will not be supported in |prod-long| |prod-ver|. |prod| uses a **containerd** :abbr:`CRI (Container Runtime Interface)` that supports both runc and Kata Container runtimes. The default runtime is runc. If you want diff --git a/doc/source/usertasks/kubernetes/known-limitations.rst b/doc/source/usertasks/kubernetes/known-limitations.rst index 0b6d2db5a..8dc4c8efd 100644 --- a/doc/source/usertasks/kubernetes/known-limitations.rst +++ b/doc/source/usertasks/kubernetes/known-limitations.rst @@ -6,6 +6,10 @@ Known Kata Container Limitations ================================ +.. note:: + + Kata Containers will not be supported in |prod-long| |prod-ver|. + This section describes the known limitations when using Kata containers. .. _known-limitations-section-tsh-tl1-zlb: diff --git a/doc/source/usertasks/kubernetes/specifying-kata-container-runtime-in-pod-spec.rst b/doc/source/usertasks/kubernetes/specifying-kata-container-runtime-in-pod-spec.rst index 953544e79..0dfaa15c3 100644 --- a/doc/source/usertasks/kubernetes/specifying-kata-container-runtime-in-pod-spec.rst +++ b/doc/source/usertasks/kubernetes/specifying-kata-container-runtime-in-pod-spec.rst @@ -6,6 +6,10 @@ Specify Kata Container Runtime in Pod Spec ========================================== +.. note:: + + Kata Containers will not be supported in |prod-long| |prod-ver|. + You can specify the use of Kata Container runtime in your pod specification by runtime class or by annotation.