Security Migration: RBAC, Pod Security, Identity, and Compliance¶

# Before (on-prem): RBAC binding to local user
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: cluster-admin-binding
subjects:
    - kind: User
      name: admin@internal.gov
      apiGroup: rbac.authorization.k8s.io
roleRef:
    kind: ClusterRole
    name: cluster-admin
    apiGroup: rbac.authorization.k8s.io


# After (AKS): RBAC binding to Entra ID group
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: cluster-admin-binding
subjects:
    - kind: Group
      name: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # Entra ID group Object ID
      apiGroup: rbac.authorization.k8s.io
roleRef:
    kind: ClusterRole
    name: cluster-admin
    apiGroup: rbac.authorization.k8s.io

# Namespace-scoped role for application team
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
    name: app-team-role
    namespace: production
rules:
    - apiGroups: ["", "apps", "batch", "networking.k8s.io"]
      resources:
          [
              "deployments",
              "services",
              "pods",
              "configmaps",
              "jobs",
              "cronjobs",
              "ingresses",
          ]
      verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
    - apiGroups: [""]
      resources: ["secrets"]
      verbs: ["get", "list", "watch"] # No create/update for secrets (managed in Key Vault)
    - apiGroups: [""]
      resources: ["pods/log", "pods/exec"]
      verbs: ["get", "create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: app-team-binding
    namespace: production
subjects:
    - kind: Group
      name: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # Entra ID group: App Team Production
      apiGroup: rbac.authorization.k8s.io
roleRef:
    kind: Role
    name: app-team-role
    apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: Namespace
metadata:
    name: production
    labels:
        # Enforce restricted PSS (block non-compliant pods)
        pod-security.kubernetes.io/enforce: restricted
        pod-security.kubernetes.io/enforce-version: latest
        # Audit and warn on restricted violations
        pod-security.kubernetes.io/audit: restricted
        pod-security.kubernetes.io/warn: restricted

# Before: Pod relying on SCC anyuid (running as root)
spec:
  containers:
    - name: app
      image: legacy-app:latest  # Runs as root by default

# After: Pod compliant with PSS restricted
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: csainaboxacr.azurecr.io/legacy-app:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL

# SecretProviderClass
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
    name: kv-secrets
    namespace: production
spec:
    provider: azure
    parameters:
        usePodIdentity: "false"
        useVMManagedIdentity: "false"
        clientID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # Workload Identity client ID
        keyvaultName: kv-csa-prod
        tenantId: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        objects: |
            array:
              - |
                objectName: db-password
                objectType: secret
              - |
                objectName: api-key
                objectType: secret
              - |
                objectName: tls-cert
                objectType: secret
    secretObjects:
        - secretName: app-secrets
          type: Opaque
          data:
              - objectName: db-password
                key: DB_PASSWORD
              - objectName: api-key
                key: API_KEY
---
# Pod mounting Key Vault secrets
apiVersion: apps/v1
kind: Deployment
metadata:
    name: app
    namespace: production
spec:
    template:
        metadata:
            labels:
                azure.workload.identity/use: "true"
        spec:
            serviceAccountName: app-sa
            containers:
                - name: app
                  image: csainaboxacr.azurecr.io/app:latest
                  envFrom:
                      - secretRef:
                            name: app-secrets
                  volumeMounts:
                      - name: secrets-store
                        mountPath: "/mnt/secrets"
                        readOnly: true
            volumes:
                - name: secrets-store
                  csi:
                      driver: secrets-store.csi.k8s.io
                      readOnly: true
                      volumeAttributes:
                          secretProviderClass: kv-secrets

# Require approved container registries only
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
    name: k8sallowedregistries
spec:
    crd:
        spec:
            names:
                kind: K8sAllowedRegistries
            validation:
                openAPIV3Schema:
                    type: object
                    properties:
                        registries:
                            type: array
                            items:
                                type: string
    targets:
        - target: admission.k8s.gatekeeper.sh
          rego: |
              package k8sallowedregistries
              violation[{"msg": msg}] {
                container := input.review.object.spec.containers[_]
                not startswith(container.image, input.parameters.registries[_])
                msg := sprintf("Container image '%v' is not from an approved registry", [container.image])
              }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRegistries
metadata:
    name: require-approved-registries
spec:
    match:
        kinds:
            - apiGroups: [""]
              kinds: ["Pod"]
        excludedNamespaces:
            - kube-system
            - gatekeeper-system
    parameters:
        registries:
            - "csainaboxacr.azurecr.io/"
            - "mcr.microsoft.com/"