Skip to content

Commit 2841287

Browse files
slashbenslashben
committed
Fixing CronJob support accross all controls
Signed-off-by: Ben <[email protected]>
1 parent 924f0fb commit 2841287

File tree

29 files changed

+156
-49
lines changed

29 files changed

+156
-49
lines changed

‎controls/C-0001/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,5 @@ spec:
3030
message: "Pods uses an image from a forbidden registry! (see more at https://hub.armosec.io/docs/c-0001)"
3131
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, params.settings.untrustedRegistries.all(registry,!container.image.startsWith(registry)))"
3232
message: "Workloads uses an image from a forbidden registry! (see more at https://hub.armosec.io/docs/c-0001)"
33-
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, params.settings.untrustedRegistries.all(registry,!container.image.startsWith(registry)))"
33+
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container, params.settings.untrustedRegistries.all(registry,!container.image.startsWith(registry)))"
3434
message: "CronJob uses an image from a forbidden registry! (see more at https://hub.armosec.io/docs/c-0001)"

‎controls/C-0001/tests.json

+16-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
"template": "pod.yaml",
55
"expected": "fail",
66
"field_change_list": [
7-
"spec.containers.[0].image=quay.io/openshift/origin-cli:latest"
7+
"spec.containers.[0].image=quay.io/openshift/origin-cli:latest"
88
]
99
},
1010
{
@@ -13,5 +13,20 @@
1313
"expected": "pass",
1414
"field_change_list": [
1515
]
16+
},
17+
{
18+
"name": "CronJob with image from quay.io is blocked",
19+
"template": "cronjob.yaml",
20+
"expected": "fail",
21+
"field_change_list": [
22+
"spec.jobTemplate.spec.template.spec.containers.[0].image=quay.io/openshift/origin-cli:latest"
23+
]
24+
},
25+
{
26+
"name": "CronJob without image from quay.io is allowed",
27+
"template": "cronjob.yaml",
28+
"expected": "pass",
29+
"field_change_list": [
30+
]
1631
}
1732
]

‎controls/C-0004/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ spec:
4545
message: "Workloads contains container/s with memory limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0004)"
4646
4747
- expression: >
48-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.memory))) &&
48+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.memory))) &&
4949
params.settings.memoryRequestMin <= int(container.resources.requests.memory) &&
5050
params.settings.memoryRequestMax >= int(container.resources.requests.memory)) &&
5151
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.memory))) &&

‎controls/C-0004/tests.json

+9-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"name": "Pod with container having memory-request and limits not set is blocked",
44
"template": "pod.yaml",
55
"expected": "fail",
6-
"field_change_list": [
6+
"field_change_list": [
77
]
88
},
99
{
@@ -36,7 +36,7 @@
3636
"name": "Deployment with container having memory-request and limits not set is blocked",
3737
"template": "deployment.yaml",
3838
"expected": "fail",
39-
"field_change_list": [
39+
"field_change_list": [
4040
]
4141
},
4242
{
@@ -47,5 +47,12 @@
4747
"spec.template.spec.containers.[0].resources.requests.memory=128",
4848
"spec.template.spec.containers.[0].resources.limits.memory=128"
4949
]
50+
},
51+
{
52+
"name": "CronJob with container having memory request and limits set and both values in the limit is allowed",
53+
"template": "cronjob.yaml",
54+
"expected": "pass",
55+
"field_change_list": [
56+
]
5057
}
5158
]

‎controls/C-0009/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ spec:
4343
message: "Workloads contains container/s with memory limit and/or cpu limit not set! (see more at https://hub.armosec.io/docs/c-0009)"
4444
4545
- expression: >
46-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container,
46+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container,
4747
has(container.resources) &&
4848
has(container.resources.limits) &&
4949
has(container.resources.limits.memory) &&

‎controls/C-0012/policy.yaml

+7-7
Original file line numberDiff line numberDiff line change
@@ -27,28 +27,28 @@ spec:
2727
resources: ["configmaps"]
2828
validations:
2929
# Note that if the value is mounted using a secret or a configMap, this policy will allow the resource to be deployed in the cluster.
30-
- expression: >
31-
object.kind != 'Pod' || object.spec.containers.all(container, !has(container.env) || container.env.all(envVariable,
30+
- expression: >
31+
object.kind != 'Pod' || object.spec.containers.all(container, !has(container.env) || container.env.all(envVariable,
3232
!params.settings.sensitiveKeyNames.exists(sensitiveKey, envVariable.name.lowerAscii().contains(sensitiveKey)) ||
3333
!has(envVariable.value) || (envVariable.value == "") ||
3434
params.settings.sensitiveValuesAllowed.exists(allowedVal, envVariable.value == allowedVal)
3535
))
3636
message: "Pods has one or more containers with sensitive information in environment variables! (see more at https://hub.armosec.io/docs/c-0012)"
37-
- expression: >
38-
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, !has(container.env) || container.env.all(envVariable,
37+
- expression: >
38+
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, !has(container.env) || container.env.all(envVariable,
3939
!params.settings.sensitiveKeyNames.exists(sensitiveKey, envVariable.name.lowerAscii().contains(sensitiveKey)) ||
4040
!has(envVariable.value) || (envVariable.value == "") ||
4141
params.settings.sensitiveValuesAllowed.exists(allowedVal, envVariable.value == allowedVal)
4242
))
4343
message: "Workloads has one or more containers with sensitive information in environment variables! (see more at https://hub.armosec.io/docs/c-0012)"
44-
- expression: >
45-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, !has(container.env) || container.env.all(envVariable,
44+
- expression: >
45+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container, !has(container.env) || container.env.all(envVariable,
4646
!params.settings.sensitiveKeyNames.exists(sensitiveKey, envVariable.name.lowerAscii().contains(sensitiveKey)) ||
4747
!has(envVariable.value) || (envVariable.value == "") ||
4848
params.settings.sensitiveValuesAllowed.exists(allowedVal, envVariable.value == allowedVal)
4949
))
5050
message: "CronJob has one or more containers with sensitive information in environment variables! (see more at https://hub.armosec.io/docs/c-0012)"
51-
- expression: >
51+
- expression: >
5252
object.kind != 'ConfigMap' || object.data.all(key,
5353
(
5454
(

‎controls/C-0013/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ spec:
136136
message: "Workloads contains container/s which have the capability to run as root! (see more at https://hub.armosec.io/docs/c-0013)"
137137
138138
- expression: >
139-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container,
139+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container,
140140
(
141141
(
142142
has(container.securityContext) &&

‎controls/C-0020/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ spec:
111111
message: "Workload contains volumes with potential access to known cloud credentials! (see more at https://hub.armosec.io/docs/c-0020)"
112112
113113
- expression: >
114-
object.kind != 'CronJob' || !has(object.spec.jobTemplate.spec.volumes) || object.spec.jobTemplate.spec.volumes.all(vol,
114+
object.kind != 'CronJob' || !has(object.spec.jobTemplate.spec.volumes) || object.spec.jobTemplate.spec.template.spec.volumes.all(vol,
115115
!has(vol.hostPath) || !has(vol.hostPath.path) ||
116116
(
117117
(params.settings.cloudProvider != 'eks' ||

‎controls/C-0044/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,5 @@ spec:
2727
message: "One or more containers in the Pod has Host-port! (see more at https://hub.armosec.io/docs/c-0044)"
2828
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || !object.spec.template.spec.containers.exists(container, has(container.ports) && container.ports.exists(port, has(port.hostPort)))"
2929
message: "One or more containers in the Workload has Host-port! (see more at https://hub.armosec.io/docs/c-0044)"
30-
- expression: "object.kind != 'CronJob' || !object.spec.jobTemplate.spec.containers.exists(container, has(container.ports) && container.ports.exists(port, has(port.hostPort)))"
30+
- expression: "object.kind != 'CronJob' || !object.spec.jobTemplate.spec.template.spec.containers.exists(container, has(container.ports) && container.ports.exists(port, has(port.hostPort)))"
3131
message: "One or more containers in the CronJob has Host-port! (see more at https://hub.armosec.io/docs/c-0044)"

‎controls/C-0044/tests.json

+17-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
"template": "pod.yaml",
55
"expected": "fail",
66
"field_change_list": [
7-
"spec.containers.[0].ports.[0].hostPort=2023"
7+
"spec.containers.[0].ports.[0].hostPort=2023"
88
]
99
},
1010
{
@@ -19,7 +19,7 @@
1919
"template": "deployment.yaml",
2020
"expected": "fail",
2121
"field_change_list": [
22-
"spec.template.spec.containers.[0].ports.[0].hostPort=2023"
22+
"spec.template.spec.containers.[0].ports.[0].hostPort=2023"
2323
]
2424
},
2525
{
@@ -28,5 +28,20 @@
2828
"expected": "pass",
2929
"field_change_list": [
3030
]
31+
},
32+
{
33+
"name": "CronJob with container not having hostPort allowed",
34+
"template": "cronjob.yaml",
35+
"expected": "pass",
36+
"field_change_list": [
37+
]
38+
},
39+
{
40+
"name": "CronJob with container having hostPort blocked",
41+
"template": "cronjob.yaml",
42+
"expected": "fail",
43+
"field_change_list": [
44+
"spec.jobTemplate.spec.template.spec.containers.[0].ports.[0].hostPort=2023"
45+
]
3146
}
3247
]

‎controls/C-0045/policy.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ spec:
3838
)))
3939
message: "One or more hostPath Volumes in the Workload has readOnly not set to false! (see more at https://hub.armosec.io/docs/c-0045)"
4040
- expression: >
41-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.volumes.all(vol, !(has(vol.hostPath)) ||
42-
object.spec.jobTemplate.spec.containers.all(container, !(has(container.volumeMounts)) || container.volumeMounts.all(
41+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)) ||
42+
object.spec.jobTemplate.spec.template.spec.containers.all(container, !(has(container.volumeMounts)) || container.volumeMounts.all(
4343
containerVol, containerVol.name != vol.name ||
4444
(has(containerVol.readOnly) && containerVol.readOnly == true)
4545
)))

‎controls/C-0046/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ spec:
4242
message: "Workload has one or more containers with insecure capabilities! (see more at https://hub.armosec.io/docs/c-0046)"
4343
- expression: >
4444
object.kind != 'CronJob' ||
45-
object.spec.jobTemplate.spec.containers.all(container, params.settings.insecureCapabilities.all(insecureCapability,
45+
object.spec.jobTemplate.spec.template.spec.containers.all(container, params.settings.insecureCapabilities.all(insecureCapability,
4646
!has(container.securityContext) || !has(container.securityContext.capabilities) || !has(container.securityContext.capabilities.add) ||
4747
container.securityContext.capabilities.add.all(capability, capability != insecureCapability)
4848
))

‎controls/C-0048/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,5 @@ spec:
2727
message: "There are one or more hostPath mounts in the Pod! (see more at https://hub.armosec.io/docs/c-0048)"
2828
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || !has(object.spec.template.spec.volumes) || object.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)))"
2929
message: "There are one or more hostPath mounts in the Workload! (see more at https://hub.armosec.io/docs/c-0048)"
30-
- expression: "object.kind != 'CronJob' || !has(object.spec.jobTemplate.spec.volumes) || object.spec.jobTemplate.spec.volumes.all(vol, !(has(vol.hostPath)))"
30+
- expression: "object.kind != 'CronJob' || !has(object.spec.jobTemplate.spec.volumes) || object.spec.jobTemplate.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)))"
3131
message: "There are one or more hostPath mounts in the CronJob! (see more at https://hub.armosec.io/docs/c-0048)"

‎controls/C-0050/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ spec:
4545
message: "Workloads contains container/s with cpu limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0050)"
4646
4747
- expression: >
48-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
48+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
4949
params.settings.cpuRequestMin <= int(container.resources.requests.cpu) &&
5050
params.settings.cpuRequestMax >= int(container.resources.requests.cpu)) &&
5151
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.cpu))) &&

‎controls/C-0055/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ spec:
4343
object.kind != 'CronJob' ||
4444
(has(object.spec.jobTemplate.metadata.annotations) && object.spec.jobTemplate.metadata.annotations.exists(annotation, annotation.startsWith("container.apparmor.security.beta.kubernetes.io"))) ||
4545
(has(object.spec.jobTemplate.spec.securityContext) && (has(object.spec.jobTemplate.spec.securityContext.seccompProfile) || has(object.spec.jobTemplate.spec.securityContext.seLinuxOptions))) ||
46-
object.spec.jobTemplate.spec.containers.all(container, has(container.securityContext) && (has(container.securityContext.seccompProfile) ||
46+
object.spec.jobTemplate.spec.template.spec.containers.all(container, has(container.securityContext) && (has(container.securityContext.seccompProfile) ||
4747
has(container.securityContext.seLinuxOptions) ||
4848
(has(container.securityContext.capabilities) && has(container.securityContext.capabilities.drop))))
4949
message: "CronJob could have more security hardening! (see more at https://hub.armosec.io/docs/c-0055)"

‎controls/C-0062/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,5 @@ spec:
2727
message: "Pod has a container/s having sudo in entrypoint! (see more at https://hub.armosec.io/docs/c-0062)"
2828
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, !(has(container.command)) || container.command.all(cmd, cmd != 'sudo'))"
2929
message: "Workload has a container/s having sudo in entrypoint! (see more at https://hub.armosec.io/docs/c-0062)"
30-
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, !(has(container.command)) || container.command.all(cmd, cmd != 'sudo'))"
30+
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container, !(has(container.command)) || container.command.all(cmd, cmd != 'sudo'))"
3131
message: "CronJob has a container/s having sudo in entrypoint! (see more at https://hub.armosec.io/docs/c-0062)"

‎controls/C-0062/tests.json

+17-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"name": "Pod with container having sudo in command is blocked",
44
"template": "pod-for-list-items.yaml",
55
"expected": "fail",
6-
"field_change_list": [
6+
"field_change_list": [
77
]
88
},
99
{
@@ -17,7 +17,7 @@
1717
"name": "Deployment with container having sudo in command is blocked",
1818
"template": "deployment-for-list-items.yaml",
1919
"expected": "fail",
20-
"field_change_list": [
20+
"field_change_list": [
2121
]
2222
},
2323
{
@@ -26,5 +26,20 @@
2626
"expected": "pass",
2727
"field_change_list": [
2828
]
29+
},
30+
{
31+
"name": "CronJob with container having sudo in command is blocked",
32+
"template": "cronjob.yaml",
33+
"expected": "fail",
34+
"field_change_list": [
35+
"spec.jobTemplate.spec.template.spec.containers.[0].command.[0]=sudo"
36+
]
37+
},
38+
{
39+
"name": "CronJob with container not having sudo in command is allowed",
40+
"template": "cronjob.yaml",
41+
"expected": "pass",
42+
"field_change_list": [
43+
]
2944
}
3045
]

‎controls/C-0074/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ spec:
4343
message: "Workload has one or more containers mounting Docker socket! (see more at https://hub.armosec.io/docs/c-0074)"
4444
- expression: >
4545
object.kind != 'CronJob' || !(has(object.spec.jobTemplate.spec.volumes)) ||
46-
object.spec.jobTemplate.spec.volumes.all(vol, !(has(vol.hostPath)) ||
46+
object.spec.jobTemplate.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)) ||
4747
!(has(vol.hostPath.path)) ||
4848
(
4949
vol.hostPath.path != '/var/run/docker.sock' &&

‎controls/C-0075/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ spec:
4646
message: "Workloads contains container/s image with latest tag and imagePullPolicy not set to Always! (see more at https://hub.armosec.io/docs/c-0075)"
4747
4848
- expression: >
49-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container,
49+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container,
5050
!(
5151
container.image.findAll(":[\\w][\\w.-]{0,127}(\\/)?").all(substring, substring.endsWith("/")) ||
5252
container.image.findAll(":[\\w][\\w.-]{0,127}(\\/)?").exists(substring, substring == ":latest" || substring.matches("^:[a-zA-Z]{1,127}$"))

‎controls/C-0078/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ spec:
4444
message: "Workloads uses an image from a registry that is not in the allow list! (see more at https://hub.armosec.io/docs/c-0078)"
4545
- expression: >
4646
object.kind != 'CronJob' ||
47-
object.spec.jobTemplate.spec.containers.all(container, params.settings.imageRepositoryAllowList.exists(registry,
47+
object.spec.jobTemplate.spec.template.spec.containers.all(container, params.settings.imageRepositoryAllowList.exists(registry,
4848
(
4949
(registry == 'docker.io' && !container.image.contains('/')) ||
5050
(container.image.startsWith(registry))

‎controls/C-0268/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ spec:
4141
message: "Workloads contains container/s with cpu request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0268)"
4242
4343
- expression: >
44-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container,
44+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container,
4545
(!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
4646
params.settings.cpuRequestMin <= int(container.resources.requests.cpu) &&
4747
params.settings.cpuRequestMax >= int(container.resources.requests.cpu)))

‎controls/C-0269/policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ spec:
4141
message: "Workloads contains container/s with memory request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0269)"
4242
4343
- expression: >
44-
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container,
44+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(container,
4545
(!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.memory))) &&
4646
params.settings.memoryRequestMin <= int(container.resources.requests.memory) &&
4747
params.settings.memoryRequestMax >= int(container.resources.requests.memory)))

0 commit comments

Comments
 (0)