github.com/Azure/aad-pod-identity@v1.8.17/website/content/en/docs/Configure/aad_pod_identity_on_kubenet.md (about)

     1  ---
     2  title: "Deploy AAD Pod Identity in a Cluster with Kubenet"
     3  linkTitle: "Deploy AAD Pod Identity in a Cluster with Kubenet"
     4  weight: 2
     5  description: >
     6    AAD Pod Identity is disabled by default on Clusters with Kubenet starting from release v1.7. 
     7  ---
     8  
     9  > Starting from 1.7 release
    10  
    11  ## Introduction
    12  
    13  AAD Pod Identity is disabled by default on clusters with Kubenet network plugin. The NMI pods will fail to run with error `AAD Pod Identity is not supported for Kubenet`.
    14  
    15  ## Why this change?
    16  
    17  Kubenet network plugin is susceptible to ARP spoofing. This makes it possible for pods to impersonate as a pod with access to an identity. Using `CAP_NET_RAW` capability the attacker pod could then request token as a pod it's impersonating.
    18  
    19  Network plugins like Azure CNI, Calico, Cilium prevents ARP Spoofing.
    20  
    21  ## Mitigation steps to take before running clusters with Kubenet
    22  
    23  The recommended steps to take before configuring AAD Pod Identity to run on clusters with Kubenet network plugin
    24  
    25  - Add a [`securityContext`](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) that drops the `NET_RAW` capability by default in your applications.
    26      ```yaml
    27      securityContext:
    28        capabilities:
    29          drop:
    30          - NET_RAW
    31      ```
    32    
    33    This shouldn’t affect most applications, since it's only needed for applications that do deep networking inspection/manipulation. Dropping this capability will make sure even if your application code got compromised, the attacker could not perform such network-based attacks on your cluster.
    34  
    35  ## How to run AAD Pod Identity on clusters with Kubenet
    36  
    37  {{% alert title="Warning" color="warning" %}}
    38  Running aad-pod-identity in a cluster with Kubenet is not a recommended configuration because of the security implication. Please follow the mitigation steps and configure policies before enabling aad-pod-identity in a cluster with Kubenet.
    39  {{% /alert %}}
    40  
    41  
    42  Set the `--allow-network-plugin-kubenet=true` arg in the NMI container (or `--set nmi.allowNetworkPluginKubenet=true` if deploying with Helm) to continue running on clusters with Kubenet.
    43  
    44  To mitigate the vulnerability at the cluster level, you can use [OpenPolicyAgent](https://www.openpolicyagent.org/) admission controller together with [Gatekeeper](https://github.com/open-policy-agent/gatekeeper) validating webhook.
    45  
    46  Provided you have Gatekeeper already installed in your cluster, add the `ConstraintTemplate` of type `K8sPSPCapabilities`:
    47  
    48  ```bash
    49  kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/library/pod-security-policy/capabilities/template.yaml
    50  ```
    51  
    52  Add a template to limit the spawning of Pods with the `NET_RAW` capability:
    53  
    54  ```yaml
    55  apiVersion: constraints.gatekeeper.sh/v1beta1
    56  kind: K8sPSPCapabilities
    57  metadata:
    58    name: prevent-net-raw
    59  spec:
    60    match:
    61      kinds:
    62        - apiGroups: [""]
    63          kinds: ["Pod"]
    64      excludedNamespaces:
    65        - "kube-system"
    66    parameters:
    67      requiredDropCapabilities: ["NET_RAW"]
    68  ```
    69  
    70  You can either [exclude specific namespaces](https://github.com/open-policy-agent/gatekeeper/blob/master/README.md#exempting-namespaces-from-gatekeeper) like in the example above or explicitly include namespaces with `spec.match.namespaces`.