Skip to content

Commit 1d76bd9

Browse files
slashbenslashben
authored
Merge pull request #47 from kubescape/feature/runtime-policies
Adding runtime policies
2 parents 0c10598 + c64663e commit 1d76bd9

File tree

6 files changed

+255
-0
lines changed

6 files changed

+255
-0
lines changed

‎runtime-policies/attach/policy.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: cluster-policy-deny-attach
5+
spec:
6+
matchConstraints:
7+
resourceRules:
8+
- apiGroups: [""]
9+
apiVersions: ["v1"]
10+
operations: ["CONNECT"]
11+
resources: ["pods/attach"]
12+
failurePolicy: Fail
13+
validations:
14+
- expression: "false"
15+
message: "attach is not allowed"
16+
reason: "Medium"
17+
---
18+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
19+
kind: ValidatingAdmissionPolicyBinding
20+
metadata:
21+
name: cluster-policy-deny-attach-binding
22+
spec:
23+
policyName: cluster-policy-deny-attach
24+
validationActions:
25+
- Deny
26+
- Audit

‎runtime-policies/exec/policy.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: cluster-policy-deny-exec
5+
spec:
6+
matchConstraints:
7+
resourceRules:
8+
- apiGroups: [""]
9+
apiVersions: ["v1"]
10+
operations: ["CONNECT"]
11+
resources: ["pods/exec"]
12+
failurePolicy: Fail
13+
validations:
14+
- expression: "false"
15+
message: "exec is not allowed"
16+
reason: "High"
17+
---
18+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
19+
kind: ValidatingAdmissionPolicyBinding
20+
metadata:
21+
name: cluster-policy-deny-exec-binding
22+
spec:
23+
policyName: cluster-policy-deny-exec
24+
validationActions:
25+
- Audit

‎runtime-policies/hostmount/policy.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: cluster-policy-deny-hostMount
5+
spec:
6+
matchConstraints:
7+
resourceRules:
8+
- apiGroups: [""]
9+
apiVersions: ["v1"]
10+
operations: ["CREATE", "UPDATE"]
11+
resources: ["pods"]
12+
- apiGroups: ["apps"]
13+
apiVersions: ["v1"]
14+
operations: ["CREATE", "UPDATE"]
15+
resources: ["deployments","replicasets","daemonsets","statefulsets"]
16+
- apiGroups: ["batch"]
17+
apiVersions: ["v1"]
18+
operations: ["CREATE", "UPDATE"]
19+
resources: ["jobs","cronjobs"]
20+
failurePolicy: Fail
21+
validations:
22+
- expression: "object.kind != 'Pod' || object.spec.volumes.all(vol, !(has(vol.hostPath)))"
23+
message: "There are one or more hostPath mounts in the Pod! (see more at https://hub.armosec.io/docs/c-0048)"
24+
reason: "Medium"
25+
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)))"
26+
message: "There are one or more hostPath mounts in the Workload! (see more at https://hub.armosec.io/docs/c-0048)"
27+
reason: "Medium"
28+
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.volumes.all(vol, !(has(vol.hostPath)))"
29+
message: "There are one or more hostPath mounts in the CronJob! (see more at https://hub.armosec.io/docs/c-0048)"
30+
reason: "Medium"
31+
---
32+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
33+
kind: ValidatingAdmissionPolicyBinding
34+
metadata:
35+
name: cluster-policy-deny-hostMount-binding
36+
spec:
37+
policyName: cluster-policy-deny-hostMount
38+
validationActions:
39+
- Deny
40+
- Audit

‎runtime-policies/insecure-capabilities/policy.yaml

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
apiVersion: kubescape.io/v1
2+
kind: PolicyConfiguration
3+
metadata:
4+
name: basic-policy-configuration
5+
settings:
6+
insecureCapabilities:
7+
- SETPCAP
8+
- NET_ADMIN
9+
- NET_RAW
10+
- SYS_MODULE
11+
- SYS_RAWIO
12+
- SYS_PTRACE
13+
- SYS_ADMIN
14+
- SYS_BOOT
15+
- MAC_OVERRIDE
16+
- MAC_ADMIN
17+
- PERFMON
18+
- ALL
19+
- BPF
20+
---
21+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
22+
kind: ValidatingAdmissionPolicy
23+
metadata:
24+
name: cluster-policy-deny-insecure-capabilities
25+
spec:
26+
failurePolicy: Fail
27+
paramKind:
28+
apiVersion: kubescape.io/v1
29+
kind: PolicyConfiguration
30+
matchConstraints:
31+
resourceRules:
32+
- apiGroups: [""]
33+
apiVersions: ["v1"]
34+
operations: ["CREATE", "UPDATE"]
35+
resources: ["pods"]
36+
- apiGroups: ["apps"]
37+
apiVersions: ["v1"]
38+
operations: ["CREATE", "UPDATE"]
39+
resources: ["deployments","replicasets","daemonsets","statefulsets"]
40+
- apiGroups: ["batch"]
41+
apiVersions: ["v1"]
42+
operations: ["CREATE", "UPDATE"]
43+
resources: ["jobs","cronjobs"]
44+
validations:
45+
- expression: >
46+
object.kind != 'Pod' ||
47+
object.spec.containers.all(container, params.settings.insecureCapabilities.all(insecureCapability,
48+
!has(container.securityContext) || !has(container.securityContext.capabilities) || !has(container.securityContext.capabilities.add) ||
49+
container.securityContext.capabilities.add.all(capability, capability != insecureCapability)
50+
))
51+
message: "Pod has one or more containers with insecure capabilities! (see more at https://hub.armosec.io/docs/c-0046)"
52+
reason: "High"
53+
- expression: >
54+
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) ||
55+
object.spec.template.spec.containers.all(container, params.settings.insecureCapabilities.all(insecureCapability,
56+
!has(container.securityContext) || !has(container.securityContext.capabilities) || !has(container.securityContext.capabilities.add) ||
57+
container.securityContext.capabilities.add.all(capability, capability != insecureCapability)
58+
))
59+
message: "Workload has one or more containers with insecure capabilities! (see more at https://hub.armosec.io/docs/c-0046)"
60+
reason: "High"
61+
- expression: >
62+
object.kind != 'CronJob' ||
63+
object.spec.jobTemplate.spec.containers.all(container, params.settings.insecureCapabilities.all(insecureCapability,
64+
!has(container.securityContext) || !has(container.securityContext.capabilities) || !has(container.securityContext.capabilities.add) ||
65+
container.securityContext.capabilities.add.all(capability, capability != insecureCapability)
66+
))
67+
message: "CronJob has one or more containers with insecure capabilities! (see more at https://hub.armosec.io/docs/c-0046)"
68+
reason: "High"
69+
---
70+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
71+
kind: ValidatingAdmissionPolicyBinding
72+
metadata:
73+
name: cluster-policy-deny-insecure-capabilities-binding
74+
spec:
75+
policyName: cluster-policy-deny-insecure-capabilities
76+
paramRef:
77+
name: basic-policy-configuration
78+
validationActions:
79+
- Deny
80+
- Audit

‎runtime-policies/portforward/policy.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: cluster-policy-deny-portforward
5+
spec:
6+
matchConstraints:
7+
resourceRules:
8+
- apiGroups: [""]
9+
apiVersions: ["v1"]
10+
operations: ["UPDATE", "PATCH", "CONNECT"]
11+
resources: ["pods/portforward"]
12+
failurePolicy: Fail
13+
validations:
14+
- expression: "false"
15+
message: "portforward is not allowed"
16+
reason: "High"
17+
---
18+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
19+
kind: ValidatingAdmissionPolicyBinding
20+
metadata:
21+
name: cluster-policy-deny-portforward-binding
22+
spec:
23+
policyName: cluster-policy-deny-portforward
24+
validationActions:
25+
- Deny
26+
- Audit

‎runtime-policies/privileged/policy.yaml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: cluster-policy-deny-priviliged-flag
5+
spec:
6+
failurePolicy: Fail
7+
matchConstraints:
8+
resourceRules:
9+
- apiGroups: [""]
10+
apiVersions: ["v1"]
11+
operations: ["CREATE", "UPDATE"]
12+
resources: ["pods"]
13+
- apiGroups: ["apps"]
14+
apiVersions: ["v1"]
15+
operations: ["CREATE", "UPDATE"]
16+
resources: ["deployments","replicasets","daemonsets","statefulsets"]
17+
- apiGroups: ["batch"]
18+
apiVersions: ["v1"]
19+
operations: ["CREATE", "UPDATE"]
20+
resources: ["jobs","cronjobs"]
21+
validations:
22+
- expression: >
23+
object.kind != 'Pod' || object.spec.containers.all(container,
24+
!(has(container.securityContext)) ||
25+
(
26+
(!(has(container.securityContext.privileged)) || container.securityContext.privileged != true) &&
27+
(!(has(container.securityContext.capabilities)) || !(has(container.securityContext.capabilities.add)) ||
28+
container.securityContext.capabilities.add.all(cap, cap != 'SYS_ADM')))
29+
)
30+
message: "Pod has one or more privileged container.(see more at https://hub.armosec.io/docs/c-0057)"
31+
- expression: >
32+
['Deployment','ReplicaSet','DaemonSet','StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container,
33+
!(has(container.securityContext)) ||
34+
(
35+
(!(has(container.securityContext.priviliged)) || container.securityContext.privileged != true) &&
36+
(!(has(container.securityContext.capabilities)) || !(has(container.securityContext.capabilities.add)) ||
37+
container.securityContext.capabilities.add.all(cap, cap != 'SYS_ADM')))
38+
)
39+
message: "Workloads has one or more privileged container.(see more at https://hub.armosec.io/docs/c-0057)"
40+
- expression: >
41+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container,
42+
!(has(container.securityContext)) ||
43+
(
44+
(!(has(container.securityContext.priviliged)) || container.securityContext.privileged != true) &&
45+
(!(has(container.securityContext.capabilities)) || !(has(container.securityContext.capabilities.add)) ||
46+
container.securityContext.capabilities.add.all(cap, cap != 'SYS_ADM')))
47+
)
48+
message: "CronJob has one or more privileged container.(see more at https://hub.armosec.io/docs/c-0057)"
49+
---
50+
apiVersion: admissionregistration.x-k8s.io/v1alpha1
51+
kind: ValidatingAdmissionPolicyBinding
52+
metadata:
53+
name: cluster-policy-deny-privileged-flag-binding
54+
spec:
55+
policyName: cluster-policy-deny-priviliged-flag
56+
validationActions:
57+
- Deny
58+
- Audit

0 commit comments

Comments
 (0)