Skip to content

Commit 8f5c96b

Browse files
slashbenslashben
authored
Merge branch 'main' into fix/volumes
Signed-off-by: Ben Hirschberg <[email protected]>
2 parents e0f8b9a + 950d957 commit 8f5c96b

10 files changed

+413
-1
lines changed

‎.github/workflows/release.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ on:
88

99
jobs:
1010
release:
11-
needs: test-all-policies
1211
runs-on: ubuntu-latest
1312
outputs:
1413
upload_url: ${{ steps.create_release.outputs.upload_url }}

‎ADOPTERS.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Adopters
2+
3+
The Kubescape project manages this document in the central project repository.
4+
5+
Go to the [centralized ADOPTERS.md](https://github.com/kubescape/project-governance/blob/main/ADOPTERS.md)

‎CODE_OF_CONDUCT.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Code of Conduct
2+
3+
The Kubescape project manages this document in the central project repository.
4+
5+
Go to the [centralized CODE_OF_CONDUCT.md](https://github.com/kubescape/project-governance/blob/main/CODE_OF_CONDUCT.md)

‎COMMUNITY.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Community
2+
3+
The Kubescape project manages this document in the central project repository.
4+
5+
Go to the [centralized COMMUNITY.md](https://github.com/kubescape/project-governance/blob/main/COMMUNITY.md)

‎CONTRIBUTING.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Contributing
2+
3+
The Kubescape project manages this document in the central project repository.
4+
5+
Go to the [centralized CONTRIBUTING.md](https://github.com/kubescape/project-governance/blob/main/CONTRIBUTING.md)

‎GOVERNANCE.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Governance
2+
3+
The Kubescape project manages this document in the central project repository.
4+
5+
Go to the [centralized GOVERNANCE.md](https://github.com/kubescape/project-governance/blob/main/GOVERNANCE.md)

‎MAINTAINERS.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Maintainers
2+
3+
The Kubescape project manages this document in the central project repository.
4+
5+
Go to the [centralized MAINTAINERS.md](https://github.com/kubescape/project-governance/blob/main/MAINTAINERS.md)

‎SECURITY.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Security
2+
3+
The Kubescape project manages this document in the central project repository.
4+
5+
Go to the [centralized SECURITY.md](https://github.com/kubescape/project-governance/blob/main/SECURITY.md)

‎controls/C-0013/policy.yaml

+194
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
apiVersion: admissionregistration.k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: "kubescape-c-0013-deny-resources-with-capability-to-run-as-root"
5+
spec:
6+
failurePolicy: Fail
7+
matchConstraints:
8+
resourceRules:
9+
- apiGroups: [""]
10+
apiVersions: ["v1"]
11+
operations: ["CREATE", "UPDATE"]
12+
resources: ["pods"]
13+
- apiGroups: ["apps"]
14+
apiVersions: ["v1"]
15+
operations: ["CREATE", "UPDATE"]
16+
resources: ["deployments","replicasets","daemonsets","statefulsets"]
17+
- apiGroups: ["batch"]
18+
apiVersions: ["v1"]
19+
operations: ["CREATE", "UPDATE"]
20+
resources: ["jobs","cronjobs"]
21+
validations:
22+
- expression: >
23+
object.kind != 'Pod' || object.spec.containers.all(container,
24+
(
25+
(
26+
has(container.securityContext) &&
27+
has(container.securityContext.allowPrivilegeEscalation) &&
28+
container.securityContext.allowPrivilegeEscalation == false
29+
) ||
30+
(
31+
(
32+
!has(container.securityContext) || !has(container.securityContext.allowPrivilegeEscalation)
33+
) &&
34+
(
35+
has(object.spec.securityContext) &&
36+
has(object.spec.securityContext.allowPrivilegeEscalation) &&
37+
object.spec.securityContext.allowPrivilegeEscalation == false
38+
)
39+
)
40+
) &&
41+
(
42+
(
43+
(
44+
has(container.securityContext) &&
45+
has(container.securityContext.runAsNonRoot) &&
46+
container.securityContext.runAsNonRoot == true
47+
) ||
48+
(
49+
(
50+
!has(container.securityContext) || !has(container.securityContext.runAsNonRoot)
51+
) &&
52+
(
53+
has(object.spec.securityContext) &&
54+
has(object.spec.securityContext.runAsNonRoot) &&
55+
object.spec.securityContext.runAsNonRoot == true
56+
)
57+
)
58+
) ||
59+
(
60+
(
61+
has(container.securityContext) &&
62+
has(container.securityContext.runAsUser) &&
63+
container.securityContext.runAsUser != 0
64+
) ||
65+
(
66+
(
67+
!has(container.securityContext) || !has(container.securityContext.runAsUser)
68+
) &&
69+
(
70+
has(object.spec.securityContext) &&
71+
has(object.spec.securityContext.runAsUser) &&
72+
object.spec.securityContext.runAsUser != 0
73+
)
74+
)
75+
)
76+
)
77+
)
78+
message: "Pods contains container/s which have the capability to run as root! (see more at https://hub.armosec.io/docs/c-0013)"
79+
80+
- expression: >
81+
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container,
82+
(
83+
(
84+
has(container.securityContext) &&
85+
has(container.securityContext.allowPrivilegeEscalation) &&
86+
container.securityContext.allowPrivilegeEscalation == false
87+
) ||
88+
(
89+
(
90+
!has(container.securityContext) || !has(container.securityContext.allowPrivilegeEscalation)
91+
) &&
92+
(
93+
has(object.spec.template.spec.securityContext) &&
94+
has(object.spec.template.spec.securityContext.allowPrivilegeEscalation) &&
95+
object.spec.template.spec.securityContext.allowPrivilegeEscalation == false
96+
)
97+
)
98+
) &&
99+
(
100+
(
101+
(
102+
has(container.securityContext) &&
103+
has(container.securityContext.runAsNonRoot) &&
104+
container.securityContext.runAsNonRoot == true
105+
) ||
106+
(
107+
(
108+
!has(container.securityContext) || !has(container.securityContext.runAsNonRoot)
109+
) &&
110+
(
111+
has(object.spec.template.spec.securityContext) &&
112+
has(object.spec.template.spec.securityContext.runAsNonRoot) &&
113+
object.spec.template.spec.securityContext.runAsNonRoot == true
114+
)
115+
)
116+
) ||
117+
(
118+
(
119+
has(container.securityContext) &&
120+
has(container.securityContext.runAsUser) &&
121+
container.securityContext.runAsUser != 0
122+
) ||
123+
(
124+
(
125+
!has(container.securityContext) || !has(container.securityContext.runAsUser)
126+
) &&
127+
(
128+
has(object.spec.template.spec.securityContext) &&
129+
has(object.spec.template.spec.securityContext.runAsUser) &&
130+
object.spec.template.spec.securityContext.runAsUser != 0
131+
)
132+
)
133+
)
134+
)
135+
)
136+
message: "Workloads contains container/s which have the capability to run as root! (see more at https://hub.armosec.io/docs/c-0013)"
137+
138+
- expression: >
139+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container,
140+
(
141+
(
142+
has(container.securityContext) &&
143+
has(container.securityContext.allowPrivilegeEscalation) &&
144+
container.securityContext.allowPrivilegeEscalation == false
145+
) ||
146+
(
147+
(
148+
!has(container.securityContext) || !has(container.securityContext.allowPrivilegeEscalation)
149+
) &&
150+
(
151+
has(object.spec.jobTemplate.spec.securityContext) &&
152+
has(object.spec.jobTemplate.spec.securityContext.allowPrivilegeEscalation) &&
153+
object.spec.jobTemplate.spec.securityContext.allowPrivilegeEscalation == false
154+
)
155+
)
156+
) &&
157+
(
158+
(
159+
(
160+
has(container.securityContext) &&
161+
has(container.securityContext.runAsNonRoot) &&
162+
container.securityContext.runAsNonRoot == true
163+
) ||
164+
(
165+
(
166+
!has(container.securityContext) || !has(container.securityContext.runAsNonRoot)
167+
) &&
168+
(
169+
has(object.spec.jobTemplate.spec.securityContext) &&
170+
has(object.spec.jobTemplate.spec.securityContext.runAsNonRoot) &&
171+
object.spec.jobTemplate.spec.securityContext.runAsNonRoot == true
172+
)
173+
)
174+
) ||
175+
(
176+
(
177+
has(container.securityContext) &&
178+
has(container.securityContext.runAsUser) &&
179+
container.securityContext.runAsUser != 0
180+
) ||
181+
(
182+
(
183+
!has(container.securityContext) || !has(container.securityContext.runAsUser)
184+
) &&
185+
(
186+
has(object.spec.jobTemplate.spec.securityContext) &&
187+
has(object.spec.jobTemplate.spec.securityContext.runAsUser) &&
188+
object.spec.jobTemplate.spec.securityContext.runAsUser != 0
189+
)
190+
)
191+
)
192+
)
193+
)
194+
message: "CronJob contains container/s which have the capability to run as root! (see more at https://hub.armosec.io/docs/c-0013)"

0 commit comments

Comments
 (0)