docs: add SECURITY_GUIDANCE.md

[bcressey]

Issue number:
#766

Description of changes:
Adds documentation for security recommendations and example configurations.

Testing done:
Verified that a specially crafted pod was rejected by the example PSP policy.

apiVersion: v1
kind: Pod
metadata:
  name: attack-pod
spec:
  volumes:
  - name: api-socket
    hostPath:
      path: /run/api.sock
  hostNetwork: true
  hostIPC: true
  hostPID: true
  securityContext:
    runAsUser: 1
    runAsGroup: 1
    fsGroup: 274
    seLinuxOptions:
      user: system_u
      role: system_r
      type: super_t
      level: s0
  containers:
  - name:  pause
    image: k8s.gcr.io/pause
    volumeMounts:
    - mountPath: /run/api.sock
      name: api-socket
    securityContext:
      allowPrivilegeEscalation: true
      privileged: true

Error from server (Forbidden): error when creating "attack-pod.yaml": pods "attack-pod" is forbidden: unable to validate against any pod security policy: [spec.securityContext.fsGroup: Invalid value: []int64{274}: group 274 must be in the ranges: [{1000 65535}] spec.securityContext.seLinuxOptions.type: Invalid value: "super_t": must be container_t spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used spec.securityContext.hostPID: Invalid value: true: Host PID is not allowed to be used spec.securityContext.hostIPC: Invalid value: true: Host IPC is not allowed to be used spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used spec.containers[0].securityContext.runAsUser: Invalid value: 1: must be in the ranges: [{1000 65535}] spec.containers[0].securityContext.seLinuxOptions.type: Invalid value: "super_t": must be container_t spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[0].securityContext.allowPrivilegeEscalation: Invalid value: true: Allowing privilege escalation for containers is not allowed]

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[tjkirch]

With the policy in place, you were able to do normal, useful things with a pod, right? :)

[bcressey]

With the policy in place, you were able to do normal, useful things with a pod, right? :)

This policy is sufficiently restrictive that it won't work for all workloads; some of the pods in the kube-system namespace need a different policy to function correctly.

[abby-fuller]

I was in the middle of commenting more things, but you addressed them on the fly!