Admission Controller

Sysdig Admission Controller - This chart deploys the Sysdig Admission Controller in your Kubernetes cluster.

TL;DR;

$ helm repo add sysdig https://charts.sysdig.com
$ helm repo update
$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller \
      --create-namespace -n sysdig-admission-controller --version=0.6.1  \
      --set clusterName=CLUSTER_NAME \
      --set sysdig.secureAPIToken=SECURE_API_TOKEN

• Configuration
• Usages
• Confirm Working Status
• Troubleshooting

Introduction

This chart deploys the Sysdig Admission Controller on a Kubernetes cluster using the Helm package manager.

Prerequisites

• Helm 3
• Kubernetes v1.16+
• Cluster Name (pick one to identify your Kubernetes Cluster)
• Sysdig Secure API Token

Installing the Chart

To install the chart with the release name admission-controller:

$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller -n sysdig-admission-controller --version=0.6.1

The command deploys the Sysdig Admission Controller on the Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.

Tip: List all releases using helm list

Uninstalling the Chart

To uninstall/delete the admission-controller:

$ helm delete sysdig-admission-controller -n sysdig-admission-controller

The command removes all the Kubernetes components associated with the chart and deletes the release.

Configuration

The following table lists the configurable parameters of the admission-controller chart and their default values.

Specify each parameter using the --set key=value[,key=value] argument to helm upgrade --install. For example:

$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller \
    --create-namespace -n sysdig-admission-controller --version=0.6.1 \
    --set sysdig.secureAPIToken=YOUR-KEY-HERE,clusterName=YOUR-CLUSTER-NAME

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example:

$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller \
    --create-namespace -n sysdig-admission-controller --version=0.6.1 \
    --values values.yaml

Examples

• Default values.yaml
• Find some examples of these values

Custom Admission Controller Rules to be detected

In case you don’t want to detect some resources you can create your custom rules.

To achieve this, you can change the k8sAuditDetectionsRules variable in the values.yaml file. For example, if you want to filter out secrets from the AC you can try with these rules:

- apiGroups:
  - ""
  apiVersions: [ "*" ]
  operations: [ "*" ]
  resources:
  - bindings
  - componentstatuses
  - configmaps
  - endpoints
  - events
  - limitranges
  - namespaces
  - nodes
  - persistentvolumeclaims
  - persistentvolumes
  - pods/*
  - podtemplates
  - replicationcontrollers
  - resourcequotas
  - serviceaccounts
  - services
  scope: "*"
- apiGroups:
  - apps
  - autoscaling
  - batch
  - networking.k8s.io
  - rbac.authorization.k8s.io
  - extensions
  apiVersions: [ "*" ]
  operations: [ "*" ]
  resources: [ "*/*" ]
  scope: "*"

Proxy Usage

There are several configuration parameters for the proxy usage

• Two involved components webhook.* and scanner.*; reference to the first for communications to the Sysdig backend, while second communicates with the registry from where to pull the image to be scanned.
• configuration values *.httpProxy, *.httpsProxy and *.noProxy. Make sure to use at least https version for Sysdig Secure Backend.

If your Proxy is served with TLS

• The url for those *.httpProxy and *.httpsProxy must be https://
• If using a self-signed certificate you will need to also configure one of the following two options
  1. Set the verifySSL=false parameter
  2. Or set *.ssl.ca.cert for both components webhook and scanner

Usages

Basic

$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller \
      --create-namespace -n sysdig-admission-controller \
      --set clusterName=CLUSTER_NAME \
      --set sysdig.secureAPIToken=SECURE_API_TOKEN

On Prem

Use the following command to deploy in an on-prem:

$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller \
      --create-namespace -n sysdig-admission-controller \
      --set clusterName=CLUSTER_NAME \
      --set sysdig.url=SECURE_URL \
      --set sysdig.secureAPIToken=SECURE_API_TOKEN \
      --set verifySSL=false

Use verifySSL=false if you are using self signed certificates.

CA Provided

The following command will deploy the admission controller with a custom CA: Note: Since the certificates are not provided, they will be autogenerated with the provided CA.

$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller \
      --create-namespace -n sysdig-admission-controller \
      --set clusterName=CLUSTER_NAME \
      --set sysdig.url=SECURE_URL \
      --set sysdig.secureAPIToken=SECURE_API_TOKEN \
      --set webhook.ssl.ca.cert=YOUR_CA_CERT_AS_PEM_ENCODED \
      --set webhook.ssl.ca.key=YOUR_CA_KEY_AS_PEM_ENCODED

CA and Certificates Provided

The following command will deploy the admission controller with a custom CA and valid certificates signed with this CA:

$ helm upgrade --install sysdig-admission-controller sysdig/admission-controller \
      --create-namespace -n sysdig-admission-controller \
      --set clusterName=CLUSTER_NAME \
      --set sysdig.url=SECURE_URL \
      --set sysdig.secureAPIToken=SECURE_API_TOKEN \
      --set webhook.ssl.ca.cert=YOUR_CA_CERT_AS_PEM_ENCODED \
      --set webhook.ssl.ca.key=YOUR_CA_KEY_AS_PEM_ENCODED \
      --set webhook.ssl.cert=YOUR_CERT_AS_PEM_ENCODED \
      --set webhook.ssl.key=YOUR_KEY_AS_PEM_ENCODED

Confirm Working Status

Image Scanning

1. Install Admission Controller on your Kubernetes Cluster following one of the (use-cases)(#usage) described
2. Enable Admission-Controller on your Sysdig Secure > Image Scanning > Admission Controller > Policy Assignments This section can only be accessed by a user with Administrator permissions
3. Add some an assignment to Allow or Deny images within a namespace
4. Tail to the logs from the Admission Controller

    $ kubectl logs -f -n sysdig-admission-controller -l app.kubernetes.io/component=webhook
   

5. Push some deployment into your Kubernetes Cluster to watch the result, for example an nginx image

    $ kubectl run nginx --image=nginx
   

If policy is set to allow, the deployment will be successful.

Either way, you should see some logs in Admission Controller tail

-- allow assignment result
{"level":"info","component":"scanning-evaluator","message":"checking pod=nginx in namespace=default"}
{"level":"info","component":"scanning-evaluator","message":"evaluating container with name=nginx and image=nginx"}
{"level":"info","component":"scanning-evaluator","time":"","message":"matched policy=Allow always for namespace=default and image=nginx"}
{"level":"info","component":"scanning-evaluator","message":"allowing container with name=nginx and image=nginx"}

-- reject assignment result
{"level":"info","component":"scanning-evaluator","message":"checking pod=nginx in namespace=default"}
{"level":"info","component":"scanning-evaluator","message":"evaluating container with name=nginx and image=nginx"}
{"level":"info","component":"scanning-evaluator","message":"matched policy=Reject Allways for namespace=default and image=nginx"}
{"level":"info","component":"scanning-evaluator","message":"denying container with name=nginx and image=nginx reason=\"Reject Always\""}

Troubleshooting

Q: I need to troubleshoot, any way to switch to debug verbose?

S: Add the LOG_LEVEL=debug key-value to the admission configmap and respawn webhook

$ kubectl edit configmaps -n sysdig-admission-controller admission-controller-webhook
$ kubectl delete pod -n sysdig-admission-controller -l app.kubernetes.io/component=webhook

Q: I don’t see Policy Rules honored

S: Review the Admission Controller - Understanding:How Policy Conditions are applied

Q: I don’t see Policy Assignments order honored

A: It may be that you’re using same namespace and image prefix on more than one assignment
S: Review the Admission Controller - Understanding:Evaluation Order

Q: I don’t see changes on Policy Assignments being applied on my cluster

A: Admission Controller pull changes from the Sysdig Secure platform every 5 minutes
S: You can wait those five minutes, or force the admission controller webhook respawn

$ kubectl delete pod -n sysdig-admission-controller -l app.kubernetes.io/component=webhook