Chapter 2. Pod Security Admission Red Hat OpenShift uses Pod Security Admission (PSA) to apply a set of security rules for application pods that are in the same Red Hat OpenShift cluster. In the context of Cryostat, these application pods include a Cryostat pod and a Report sidecar pod. Optionally, you can enable the Report sidecar pod on a Cryostat custom resource (CR). If an application does not meet the policy standards, the application cannot run in your Red Hat OpenShift cluster. Red Hat OpenShift 4.8 or later no longer supports the PodSecurityPolicy API and uses the PSA instead. The PSA provides the following benefits: Includes a built-in controller that can enforce pod security standards for your application pods. Includes a set of pod security standards that define three different policies: Privileged , Baseline , and Restricted . On Red Hat OpenShift, you can use the PSA with security context constraints (SCCs) to define policies for an Red Hat OpenShift cluster. By default, the restricted-v2 SCC aligns with the Restricted pod security standard. Note By default, the security context for a Cryostat pod conforms to the restricted-v2 SCC, which means that Red Hat OpenShift can admit the pod in namespaces that enforce the Restricted pod security standard. The Restricted policy requires that the Red Hat build of Cryostat Operator configures the container security context as follows: Drops ALL capabilities Sets allowPrivilegeEscaltion to false The Restricted policy requires that the Red Hat build of Cryostat Operator configures the pod security context as follows: Sets runAsNonRoot to true Sets the seccompProfile to RuntimeDefault Additionally, the Red Hat build of Cryostat Operator defines fsGroup in the pod security context for the Cryostat application pod, so that Cryostat can read and write to files in a persistent storage volume on Red Hat OpenShift. If you have additional requirements beyond conforming to the Restricted pod security standard, you can override the default security contexts that Cryostat uses. 2.1. Configuring security contexts You can specify pod and container security contexts in the Cryostat custom resource (CR) on Red Hat OpenShift. The security context applies permissions to the Cryostat pod, the Report sidecar pod (when it is in use), and the containers for each pod. Note If you change the settings of the CR, these settings override the default security context settings. A security context applies specific permissions to an application that exists in a pod. The security context cannot change the criteria of an SCC policy. You can create a custom SCC to instruct the Red Hat OpenShift cluster to enforce strict permissions on the pod, such as actions that the pod can perform or resources that the pod can access. To create a custom SCC you must have cluster administration permissions. You must also create a security context for any pods that operate in the cluster, so that these pods meet the custom SCC requirements. An SCC enforces changes at the Red Hat OpenShift cluster level and namespace level, so that any pods operating inside this cluster receive policy criteria. By contrast, a security context is unique to a pod. By default, the Red Hat build of Cryostat Operator conforms to the restricted-v2 SCC policy for your Cryostat pod. By default, the Red Hat build of Cryostat Operator creates a service account for Cryostat and its components, such as jfr-datasource , grafana , storage . database , and auth-proxy . To enable this service account to use a custom SCC, perform either of the following steps: Create a Role Binding that binds the Cryostat service account to a role that uses your custom SCC. Use a Label Syncer component to instruct your project's namespace to follow PSA policies. Note The Label Syncer component is outside the scope of this document. You cannot use the Label Syncer component on Red Hat OpenShift system namespaces, which are usually prefixed with the openshift- tag. Important Before you configure a security context to apply specific permissions to an application pod, consider the security risks that you might introduce to your cluster on Red Hat OpenShift. The PSA provides three gradient policy levels that typically meet most requirements. Red Hat does not take any responsibility for security context changes that do not align with the Red Hat OpenShift pod security standards. Prerequisites Logged in to the OpenShift Container Platform by using the Red Hat OpenShift web console. Installed the Red Hat build of Cryostat Operator in a project on Red Hat OpenShift. See Installing Cryostat on Red Hat OpenShift by using a Red Hat build of Cryostat Operator (Installing Cryostat). Optional: Read the new PSA and new SCC policies. See Managing security context constraints (OpenShift Container Platform). Optional: Configured your project to use one of the three polices that the PSA provides. If you want to use a custom SCC to enforce specific policies for your pod, you must configure the SCC to enable your pod's service account to access it. Procedure If you want to start creating a Cryostat instance, perform the following steps: On your Red Hat OpenShift web console, click Operators > Installed Operators . From the list of available Operators, select Red Hat build of Cryostat. On the Operator details page, click the Details tab. In the Provided APIs section, select Cryostat, and then click Create instance . Note The Red Hat build of Cryostat Operator does not create a service account for the Report sidecar pods. Instead, these pods use default service accounts in their own namespaces. On the Create Cryostat panel, to configure a security context, choose one of the following options: If you want to use the YAML view: Click the YAML view radio button. From the spec: element, edit the securityOptions and reportOptions properties to match your security requirements. Example configuration for a security context If you want to use the Form view: Click the *Form view" radio button. Expand Advanced Configurations to open additional options on your Red Hat OpenShift web console. Figure 2.1. The Advanced configuration menu options Expand Core Security Context . From the available list of options, define settings for your security context. Expand each of the following security contexts in turn and define settings, as appropriate: Auth Proxy Security Context Data Source Security Context Database Security Context Grafana Security Context Pod Security Context Storage Security Context Optional: If you are using the Report Generator service, you can also configure the security contexts for this service. In this situation, expand Report Options > Advanced Configuration > Security Options . Then expand and define Reports Security Context and Pod Security Context settings, as appropriate. Figure 2.2. Report Generator security contexts If you want to configure other properties in the custom resource (CR) for this Cryostat instance, see the other sections of this document for more information about these properties. If you want to finish creating this Cryostat instance, click Create . When you click Create , this Cryostat instance is available under the Cryostat tab on the Operator details page. You can subsequently edit the CR properties for a Cryostat instance by clicking the instance name on the Operator details page and then select Edit Cryostat from the Actions drop-down menu. Additional resources Pod Security Standard policies . 2.2. Pod Security Standard policies The Pod Security Admission (PSA) includes three policies that cover security levels related to pod security standards. The following table explains each policy: Profile Description Privileged An unrestricted policy that provides a wide level of permissions for your Cryostat pod. Consider setting this policy if you need to provide known privilege escalations to your pods. Baseline Default policy that restricts known privileged escalations. The Baseline policy sets controls where each control defines restricted fields and allowed values. Restricted The Restricted policy that provides a low level of permissions for your Cryostat pod. This policy sets controls with each control defining restricted fields and allowed values.

Commands:
apiVersion: operator.cryostat.io/v1beta2 kind: Cryostat metadata: name: cryostat-sample spec: securityOptions: podSecurityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault coreSecurityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsUser: 1001 dataSourceSecurityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL grafanaSecurityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL reportOptions: replicas: 1 podSecurityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault reportsSecurityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsUser: 1001