Repository navigation
Set secure-pod-defaults to "enabled" by default #14029
Description
In what area(s)?
/area API
Describe the feature
As per configmap comment:
serving/config/core/configmaps/features.yaml
Lines 46 to 48 in c91f8c4
It says "probably Knative 1.10" but it is still disabled by default.
I opened this for tracking issue.
/cc @evankanderson
Activity
kauana commentedon Jun 15, 2023
/unassign @pradnyavmw
kauana commentedon Jun 15, 2023
/assign @kauana
secure-pod-defaults is enabled by default
secure-pod-defaults is enabled by default
secure-pod-defaults is enabled by default
13 remaining items
dprotaso commentedon Nov 20, 2023
Following up on Evan's feedback - we can make
secure-pod-defaultsan enumDisabled- do nothingEnabled- enable most options but it still works with non-root images - still warn about nonRootRestricted- enable all options that the restricted profile requiresdsimansk commentedon Jun 2, 2025
@dprotaso wanna go with this proposal? Or just enable the current restricted profile?
nader-ziada commentedon Aug 21, 2025
@dprotaso I started looking at this issue, you still want to proceed with the enum approach, just checking since its been a while since this issue has been around
dprotaso commentedon Aug 22, 2025
Yeah that'd be great
nader-ziada commentedon Aug 25, 2025
@dprotaso @dsimansk what about
kubernetes.podspec-securitycontext? what's the impact on it with this change?dprotaso commentedon Aug 26, 2025
That property allows end-users to set whatever they want on the podspec security context.
secure-pod-defaultsjust specifies which defaults to applyevankanderson commentedon Aug 27, 2025
In particular, Kubernetes chooses compatible but less secure defaults for a number of these security settings (in particular, pods with default settings will fail to run under the
restrictedpod security admission policy).The proposed flag would change the Knative defaults for pods which don't supply security settings to match the
restrictedrequirements. Explicitly setting these security settings would still be honored, it would only affect pods which don't specify anything security-wise.