pspmigrator is a tool to migrate from PSP to PSA
Go to file
Kubernetes Prow Robot 72b7ff7439
Merge pull request #2 from samos123/move
Move files from samos123/pspmigrator into here
2022-08-05 16:38:17 -07:00
.github/workflows Move files from samos123/pspmigrator into here 2022-06-24 10:13:51 -07:00
cmd Add UserAgent to client-go client config 2022-07-21 16:41:23 -07:00
tests Move files from samos123/pspmigrator into here 2022-06-24 10:13:51 -07:00
.gitignore Move files from samos123/pspmigrator into here 2022-06-24 10:13:51 -07:00
.goreleaser.yaml Move files from samos123/pspmigrator into here 2022-06-24 10:13:51 -07:00
code-of-conduct.md Initial commit 2022-06-12 15:35:48 -05:00
CONTRIBUTING.md Initial commit 2022-06-12 15:35:48 -05:00
go.mod use k8s psa admission package for getting pod spec 2022-07-22 07:30:10 -07:00
go.sum use k8s psa admission package for getting pod spec 2022-07-22 07:30:10 -07:00
LICENSE Initial commit 2022-06-12 15:35:48 -05:00
migrator_test.go Fix nits and add copyright / license headers 2022-07-21 14:05:40 -07:00
migrator.go Use psaapi.LatestVersion instead of parse 2022-07-22 06:40:25 -07:00
OWNERS Add samos123 to owners and sec contacts 2022-06-23 15:48:38 -07:00
pspmutating_test.go Fix nits and add copyright / license headers 2022-07-21 14:05:40 -07:00
pspmutating.go simplify isMutating logic 2022-07-22 07:40:01 -07:00
README.md Add comment about status and disclaimer 2022-07-20 12:44:03 -07:00
RELEASE.md Initial commit 2022-06-12 15:35:48 -05:00
SECURITY_CONTACTS Add samos123 to owners and sec contacts 2022-06-23 15:48:38 -07:00
SECURITY.md Initial commit 2022-06-12 15:35:48 -05:00

pspmigrator: Migrate from PSP to PSA

pspmigrator is a tool to make it easier for K8s users to migrate from PodSecurityPolicy (PSP) to PodSecurity Standards/Admission (PSA). The tool has the following features:

  • CLI tool to interactively migrate you from PSP to PSA by looking at the running pods in a namespace and suggesting a Pod Security Standard
  • Detect if PSP object is potentially mutating Pods
  • Detect if a Pod is being mutated by a PSP object

Disclaimer: Migrating to PSA might cause new pods to no longer be allowed to run. So make sure you do test this out before applying PodSecurity Standards on your namespaces.

Status: Work in progress, usable for testing purposes

Installation

go install github.com/kubernetes-sigs/pspmigrator/cmd/pspmigrator

Alternatively, you can download a release from here

Usage

Start the migration from PSP to PSA

pspmigrator migrate
# example output
Checking if any pods are being mutated by a PSP object
Suggest using baseline in namespace default
✔ enforce
Applied pod security level baseline on namespace default in enforce control mode
Review the labels by running `kubectl get ns default -o yaml`
There are no pods running in namespace empty. Skipping and going to the next one.
Done with migrating namespaces with pods to PSA

Full help docs available by running:

pspmigrator -h
pspmigrator is a tool to help migrate from PSP to PSA

Usage:
  pspmigrator [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  migrate     Interactive command to migrate from PSP to PSA
  mutating    Check if pods or PSP objects are mutating

Flags:
  -h, --help                help for pspmigrator
  -k, --kubeconfig string   (optional) absolute path to the kubeconfig file (default "/Users/stoelinga/.kube/config")

Use "pspmigrator [command] --help" for more information about a command.

Check if any pods are being mutated by a Pod Security Policy in your K8s cluster:

pspmigrator mutating pods
# example output
+----------------------------------------------------+-------------+---------+------------------------+
|                        NAME                        |  NAMESPACE  | MUTATED |          PSP           |
+----------------------------------------------------+-------------+---------+------------------------+
| nginx-nonpriv-66b6c48dd5-rl6jt                     | default     | true    | my-psp                 |
| event-exporter-gke-5479fd58c8-k8f5k                | kube-system | true    | gce.event-exporter     |
| fluentbit-gke-4hcg8                                | kube-system | true    | gce.fluentbit-gke      |
| gke-metadata-server-8bbrf                          | kube-system | false   | gce.privileged         |
+----------------------------------------------------+-------------+---------+------------------------+

Check if a specific pod called my-pod in namespace my-namespace is being mutated by a Pod Security Policy:

pspmigrator mutating pod my-pod -n my-namespace
# example output
Pod nginx-nonpriv-66b6c48dd5-rl6jt is mutated by PSP my-psp: true, diff: [slice[0]: <nil pointer> != v1.SecurityContext]
PSP profile my-psp has the following mutating fields: [DefaultAddCapabilities] and annotations: []

Demo

Watch the video demo: Watch the video

Community, discussion, contribution, and support

Learn how to engage with the Kubernetes community on the community page.

You can reach the maintainers of this project at:

Code of conduct

Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.