Skip to content

Commit 11c172e

Browse files
slashbenslashben
authored
Merge pull request #14 from suhasgumma/C-0050
ValidatingAdmissionPolicy for C-0050
2 parents 31311bf + a7acbc8 commit 11c172e

File tree

5 files changed

+129
-52
lines changed

5 files changed

+129
-52
lines changed

‎configuration/policy-configuration-definition.yaml

+8-24
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,13 @@ spec:
1616
type: object
1717
properties:
1818
cpuLimitMax:
19-
items:
20-
type: integer
21-
type: array
19+
type: integer
2220
cpuLimitMin:
23-
items:
24-
type: integer
25-
type: array
21+
type: integer
2622
cpuRequestMax:
27-
items:
28-
type: integer
29-
type: array
23+
type: integer
3024
cpuRequestMin:
31-
items:
32-
type: integer
33-
type: array
25+
type: integer
3426
imageRepositoryAllowList:
3527
items:
3628
type: string
@@ -56,21 +48,13 @@ spec:
5648
type: integer
5749
type: array
5850
memoryLimitMax:
59-
items:
60-
type: integer
61-
type: array
51+
type: integer
6252
memoryLimitMin:
63-
items:
64-
type: integer
65-
type: array
53+
type: integer
6654
memoryRequestMax:
67-
items:
68-
type: integer
69-
type: array
55+
type: integer
7056
memoryRequestMin:
71-
items:
72-
type: integer
73-
type: array
57+
type: integer
7458
publicRegistries:
7559
items:
7660
type: string

‎controls/C-0004/policy.yaml

+12-12
Original file line numberDiff line numberDiff line change
@@ -24,27 +24,27 @@ spec:
2424
validations:
2525
- expression: >
2626
object.kind != 'Pod' || object.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.memory))) &&
27-
params.settings.memoryRequestMin.all(mRm, mRm <= int(container.resources.requests.memory)) &&
28-
params.settings.memoryRequestMax.all(mRm, mRm >= int(container.resources.requests.memory))) &&
27+
params.settings.memoryRequestMin <= int(container.resources.requests.memory) &&
28+
params.settings.memoryRequestMax >= int(container.resources.requests.memory)) &&
2929
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.memory))) &&
30-
params.settings.memoryLimitMin.all(mRm, mRm <= int(container.resources.limits.memory)) &&
31-
params.settings.memoryLimitMax.all(mRm, mRm >= int(container.resources.limits.memory))))
30+
params.settings.memoryLimitMin <= int(container.resources.limits.memory) &&
31+
params.settings.memoryLimitMax >= int(container.resources.limits.memory)))
3232
message: "Pods contains container/s with memory limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0004)"
3333
3434
- expression: >
3535
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.memory))) &&
36-
params.settings.memoryRequestMin.all(mRm, mRm <= int(container.resources.requests.memory)) &&
37-
params.settings.memoryRequestMax.all(mRm, mRm >= int(container.resources.requests.memory))) &&
36+
params.settings.memoryRequestMin <= int(container.resources.requests.memory) &&
37+
params.settings.memoryRequestMax >= int(container.resources.requests.memory)) &&
3838
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.memory))) &&
39-
params.settings.memoryLimitMin.all(mRm, mRm <= int(container.resources.limits.memory)) &&
40-
params.settings.memoryLimitMax.all(mRm, mRm >= int(container.resources.limits.memory))))
39+
params.settings.memoryLimitMin <= int(container.resources.limits.memory) &&
40+
params.settings.memoryLimitMax >= int(container.resources.limits.memory)))
4141
message: "Workloads contains container/s with memory limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0004)"
4242
4343
- expression: >
4444
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.memory))) &&
45-
params.settings.memoryRequestMin.all(mRm, mRm <= int(container.resources.requests.memory)) &&
46-
params.settings.memoryRequestMax.all(mRm, mRm >= int(container.resources.requests.memory))) &&
45+
params.settings.memoryRequestMin <= int(container.resources.requests.memory) &&
46+
params.settings.memoryRequestMax >= int(container.resources.requests.memory)) &&
4747
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.memory))) &&
48-
params.settings.memoryLimitMin.all(mRm, mRm <= int(container.resources.limits.memory)) &&
49-
params.settings.memoryLimitMax.all(mRm, mRm >= int(container.resources.limits.memory))))
48+
params.settings.memoryLimitMin <= int(container.resources.limits.memory) &&
49+
params.settings.memoryLimitMax >= int(container.resources.limits.memory)))
5050
message: "CronJob contains container/s with memory limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0004)"

‎controls/C-0050/policy.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
apiVersion: admissionregistration.k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: "kubescape-c-0050-deny-resources-with-cpu-limit-or-request-not-set"
5+
spec:
6+
failurePolicy: Fail
7+
paramKind:
8+
apiVersion: kubescape.io/v1
9+
kind: ControlConfiguration
10+
matchConstraints:
11+
resourceRules:
12+
- apiGroups: [""]
13+
apiVersions: ["v1"]
14+
operations: ["CREATE", "UPDATE"]
15+
resources: ["pods"]
16+
- apiGroups: ["apps"]
17+
apiVersions: ["v1"]
18+
operations: ["CREATE", "UPDATE"]
19+
resources: ["deployments","replicasets","daemonsets","statefulsets"]
20+
- apiGroups: ["batch"]
21+
apiVersions: ["v1"]
22+
operations: ["CREATE", "UPDATE"]
23+
resources: ["jobs","cronjobs"]
24+
validations:
25+
- expression: >
26+
object.kind != 'Pod' || object.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
27+
params.settings.cpuLimitMin <= int(container.resources.requests.cpu) &&
28+
params.settings.cpuLimitMax >= int(container.resources.requests.cpu)) &&
29+
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.cpu))) &&
30+
params.settings.cpuLimitMin <= int(container.resources.limits.cpu) &&
31+
params.settings.cpuLimitMax >= int(container.resources.limits.cpu)))
32+
message: "Pods contains container/s with cpu limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0050)"
33+
34+
- expression: >
35+
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
36+
params.settings.cpuLimitMin <= int(container.resources.requests.cpu) &&
37+
params.settings.cpuLimitMax >= int(container.resources.requests.cpu)) &&
38+
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.cpu))) &&
39+
params.settings.cpuLimitMin <= int(container.resources.limits.cpu) &&
40+
params.settings.cpuLimitMax >= int(container.resources.limits.cpu)))
41+
message: "Workloads contains container/s with cpu limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0050)"
42+
43+
- expression: >
44+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
45+
params.settings.cpuLimitMin <= int(container.resources.requests.cpu) &&
46+
params.settings.cpuLimitMax >= int(container.resources.requests.cpu)) &&
47+
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.cpu))) &&
48+
params.settings.cpuLimitMin <= int(container.resources.limits.cpu) &&
49+
params.settings.cpuLimitMax >= int(container.resources.limits.cpu)))
50+
message: "CronJob contains container/s with cpu limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0050)"

‎controls/C-0050/tests.json

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
[
2+
{
3+
"name": "Pod with container having cpu-request and limits not set is blocked",
4+
"template": "pod.yaml",
5+
"expected": "fail",
6+
"field_change_list": [
7+
]
8+
},
9+
{
10+
"name": "Pod with container having cpu request set and limits not set is blocked",
11+
"template": "pod.yaml",
12+
"expected": "fail",
13+
"field_change_list": [
14+
"spec.containers.[0].resources.requests.cpu=2"
15+
]
16+
},
17+
{
18+
"name": "Pod with container having cpu request and limits set and both values in the limit is allowed",
19+
"template": "pod.yaml",
20+
"expected": "pass",
21+
"field_change_list": [
22+
"spec.containers.[0].resources.requests.cpu=3",
23+
"spec.containers.[0].resources.limits.cpu=3"
24+
]
25+
},
26+
{
27+
"name": "Pod with container having cpu request and limits set and values not in the limit is blocked",
28+
"template": "pod.yaml",
29+
"expected": "fail",
30+
"field_change_list": [
31+
"spec.containers.[0].resources.requests.cpu=1",
32+
"spec.containers.[0].resources.limits.cpu=6"
33+
]
34+
},
35+
{
36+
"name": "Deployment with container having cpu-request and limits not set is blocked",
37+
"template": "deployment.yaml",
38+
"expected": "fail",
39+
"field_change_list": [
40+
]
41+
},
42+
{
43+
"name": "Deployment with container having cpu request and limits set and both values in the limit is allowed",
44+
"template": "deployment.yaml",
45+
"expected": "pass",
46+
"field_change_list": [
47+
"spec.template.spec.containers.[0].resources.requests.cpu=3",
48+
"spec.template.spec.containers.[0].resources.limits.cpu=3"
49+
]
50+
}
51+
]

‎test-resources/default-control-configuration.yaml

+8-16
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,10 @@ kind: ControlConfiguration
33
metadata:
44
name: placeholder
55
settings:
6-
cpuLimitMax:
7-
- 0
8-
cpuLimitMin:
9-
- 0
10-
cpuRequestMax:
11-
- 0
12-
cpuRequestMin:
13-
- 0
6+
cpuLimitMax: 5
7+
cpuLimitMin: 1
8+
cpuRequestMax: 5
9+
cpuRequestMin: 1
1410
imageRepositoryAllowList:
1511
- gcr.io
1612
insecureCapabilities:
@@ -49,14 +45,10 @@ settings:
4945
- 5
5046
maxHighVulnerabilities:
5147
- 10
52-
memoryLimitMax:
53-
- 256
54-
memoryLimitMin:
55-
- 32
56-
memoryRequestMax:
57-
- 256
58-
memoryRequestMin:
59-
- 32
48+
memoryLimitMax: 256
49+
memoryLimitMin: 32
50+
memoryRequestMax: 256
51+
memoryRequestMin: 32
6052
publicRegistries:
6153
- docker.io
6254
- gcr.io

0 commit comments

Comments
 (0)