Skip to content

Commit b855979

Browse files
slashbenslashben
authored
Merge pull request #17 from slashben/main
Creating a better getting started with the library
2 parents 11c172e + 58ad134 commit b855979

6 files changed

+197
-11
lines changed

‎.github/workflows/release.yaml

+25-1
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,17 @@ jobs:
3636
upload_url: ${{ steps.create_release.outputs.upload_url }}
3737
steps:
3838
- uses: actions/checkout@v3
39+
3940
- name: Verify release tagged commit is on main
4041
run: |
4142
git fetch origin main
4243
git merge-base --is-ancestor ${GITHUB_REF##*/} origin/main && echo "${GITHUB_REF##*/} is a commit on main!"
44+
4345
- name: Create release artifacts
4446
run: |
4547
mkdir release
4648
./scripts/create-release-objects.sh release
49+
4750
- name: Create a GitHub release
4851
id: create_release
4952
uses: actions/create-release@v1
@@ -54,12 +57,33 @@ jobs:
5457
release_name: "Release ${{ github.ref_name }}"
5558
draft: false
5659
prerelease: false
57-
- name: Publish release artifacts
60+
61+
- name: Publish policy object artifact
5862
uses: actions/upload-release-asset@v1
5963
env:
6064
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6165
with:
6266
upload_url: ${{ steps.create_release.outputs.upload_url }}
6367
asset_path: release/kubescape-validating-admission-policies.yaml
6468
asset_name: kubescape-validating-admission-policies.yaml
69+
asset_content_type: text/yaml
70+
71+
- name: Publish policy configuration CRD artifact
72+
uses: actions/upload-release-asset@v1
73+
env:
74+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
75+
with:
76+
upload_url: ${{ steps.create_release.outputs.upload_url }}
77+
asset_path: configuration/policy-configuration-definition.yaml
78+
asset_name: policy-configuration-definition.yaml
79+
asset_content_type: text/yaml
80+
81+
- name: Publish basic policy configuration
82+
uses: actions/upload-release-asset@v1
83+
env:
84+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85+
with:
86+
upload_url: ${{ steps.create_release.outputs.upload_url }}
87+
asset_path: configuration/basic-control-configuration.yaml
88+
asset_name: basic-control-configuration.yaml
6589
asset_content_type: text/yaml

‎README.md

+36-3
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,48 @@ This is a library of polcies based on [Kubescape controls](https://hub.armosec.i
44

55
## Using the library
66

7-
87
*Note: Kubernetes Validating Admission Policy feature is still it is early phase.
98
It has been released as a alphav1 feature in Kubernetes 1.26,
109
and you need to enable its feature gate to be able to use it. Therefore it is not yet production ready.*
1110

12-
You can apply policies directly from GitHub, for example to apply control [C-0016](https://hub.armosec.io/docs/c-0016) (deny `allowPrivilegeEscalation` on containers) just run this:
11+
12+
Install latest release of the library:
13+
```bash
14+
# Install configuration CRD
15+
kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/download/latest/policy-configuration-definition.yaml
16+
# Install basic configuration
17+
kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/download/latest/basic-control-configuration.yaml
18+
# Install policies
19+
kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/download/latest/kubescape-validating-admission-policies.yaml
20+
```
21+
22+
You're good to start to use it 😎
23+
24+
You can apply policies to objects, for example to apply control [C-0016](https://hub.armosec.io/docs/c-0016) (deny `allowPrivilegeEscalation` on containers) on workloads in namespace with label `policy=enforced` just run this:
25+
1326
```bash
14-
kubectl apply -f https://raw.githubusercontent.com/kubescape/cel-admission-library/main/controls/C-0016/policy.yaml
27+
# Creating a binding
28+
kubectl apply -f - <<EOT
29+
apiVersion: admissionregistration.k8s.io/v1alpha1
30+
kind: ValidatingAdmissionPolicyBinding
31+
metadata:
32+
name: c0016-binding
33+
spec:
34+
policyName: kubescape-c-0016-allow-privilege-escalation
35+
paramRef:
36+
name: basic-control-configuration
37+
matchResources:
38+
namespaceSelector:
39+
matchLabels:
40+
policy: enforced
41+
EOT
42+
# Creating a namespace for running the example
43+
kubectl create namespace policy-example
44+
kubectl label namespace policy-example policy=enforced
45+
# The next line should fail
46+
kubectl -n policy-example run nginx --image=nginx --restart=Never
1547
```
48+
1649
## Testing policies
1750

1851
### Cluster

‎configuration/basic-control-configuration.yaml

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
apiVersion: "kubescape.io/v1"
2+
kind: ControlConfiguration
3+
metadata:
4+
name: basic-control-configuration
5+
settings:
6+
cpuLimitMax: 5
7+
cpuLimitMin: 0.5
8+
cpuRequestMax: 5
9+
cpuRequestMin: 0.1
10+
imageRepositoryAllowList:
11+
- gcr.io
12+
insecureCapabilities:
13+
- SETPCAP
14+
- NET_ADMIN
15+
- NET_RAW
16+
- SYS_MODULE
17+
- SYS_RAWIO
18+
- SYS_PTRACE
19+
- SYS_ADMIN
20+
- SYS_BOOT
21+
- MAC_OVERRIDE
22+
- MAC_ADMIN
23+
- PERFMON
24+
- ALL
25+
- BPF
26+
k8sRecommendedLabels:
27+
- app.kubernetes.io/name
28+
- app.kubernetes.io/instance
29+
- app.kubernetes.io/version
30+
- app.kubernetes.io/component
31+
- app.kubernetes.io/part-of
32+
- app.kubernetes.io/managed-by
33+
- app.kubernetes.io/created-by
34+
listOfDangerousArtifacts:
35+
- bin/bash
36+
- sbin/sh
37+
- bin/ksh
38+
- bin/tcsh
39+
- bin/zsh
40+
- usr/bin/scsh
41+
- bin/csh
42+
- bin/busybox
43+
- usr/bin/busybox
44+
maxCriticalVulnerabilities:
45+
- 5
46+
maxHighVulnerabilities:
47+
- 10
48+
memoryLimitMax: 256
49+
memoryLimitMin: 32
50+
memoryRequestMax: 256
51+
memoryRequestMin: 32
52+
publicRegistries:
53+
- docker.io
54+
- gcr.io
55+
- quay.io
56+
- registry.hub.docker.com
57+
recommendedLabels:
58+
- app
59+
- tier
60+
- phase
61+
- version
62+
- owner
63+
- env
64+
sensitiveInterfaces:
65+
- nifi
66+
- argo-server
67+
- weave-scope-app
68+
- kubeflow
69+
- kubernetes-dashboard
70+
- jenkins
71+
- prometheus-deployment
72+
sensitiveKeyNames:
73+
- aws_access_key_id
74+
- aws_secret_access_key
75+
- azure_batchai_storage_account
76+
- azure_batchai_storage_key
77+
- azure_batch_account
78+
- azure_batch_key
79+
- secret
80+
- key
81+
- password
82+
- pwd
83+
- token
84+
- jwt
85+
- bearer
86+
- credential
87+
sensitiveValues:
88+
- BEGIN \w+ PRIVATE KEY
89+
- PRIVATE KEY
90+
- eyJhbGciO
91+
- JWT
92+
- Bearer
93+
- _key_
94+
- _secret_
95+
sensitiveValuesAllowed:
96+
- ''
97+
servicesNames:
98+
- nifi-service
99+
- argo-server
100+
- minio
101+
- postgres
102+
- workflow-controller-metrics
103+
- weave-scope-app
104+
- kubernetes-dashboard
105+
untrustedRegistries:
106+
- docker.io
107+
- gcr.io
108+
- quay.io
109+
- registry.hub.docker.com
110+
wlKnownNames:
111+
- coredns
112+
- kube-proxy
113+
- event-exporter-gke
114+
- kube-dns
115+
- 17-default-backend
116+
- metrics-server
117+
- ca-audit
118+
- ca-dashboard-aggregator
119+
- ca-notification-server
120+
- ca-ocimage
121+
- ca-oracle
122+
- ca-posture
123+
- ca-rbac
124+
- ca-vuln-scan
125+
- ca-webhook
126+
- ca-websocket
127+
- clair-clair
128+

‎configuration/policy-configuration-definition.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ spec:
1616
type: object
1717
properties:
1818
cpuLimitMax:
19-
type: integer
19+
type: number
2020
cpuLimitMin:
21-
type: integer
21+
type: number
2222
cpuRequestMax:
23-
type: integer
23+
type: number
2424
cpuRequestMin:
25-
type: integer
25+
type: number
2626
imageRepositoryAllowList:
2727
items:
2828
type: string

‎scripts/create-release-objects.sh

+3-2
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ RELEASE_DIR=$1
1414
RELEASE_POLICY_YAML_FILE_NAME=$RELEASE_DIR/kubescape-validating-admission-policies.yaml
1515

1616
echo "Creating release policy YAML file $RELEASE_POLICY_YAML_FILE_NAME"
17-
touch $RELEASE_POLICY_YAML_FILE_NAME
17+
echo "" > $RELEASE_POLICY_YAML_FILE_NAME
1818

1919
# Loop through all policies and add them to the release YAML file
2020
for control in $(ls controls); do
@@ -24,8 +24,9 @@ for control in $(ls controls); do
2424
continue
2525
fi
2626
# Copy policy file contents to release YAML file
27+
echo controls/$control/policy.yaml
2728
cat controls/$control/policy.yaml >> $RELEASE_POLICY_YAML_FILE_NAME
28-
echo "---" >> $RELEASE_POLICY_YAML_FILE_NAME
29+
printf "\n---\n" >> $RELEASE_POLICY_YAML_FILE_NAME
2930
done
3031

3132
# Delete the last line of the policy file

‎test-resources/default-control-configuration.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ settings:
66
cpuLimitMax: 5
77
cpuLimitMin: 1
88
cpuRequestMax: 5
9-
cpuRequestMin: 1
9+
cpuRequestMin: 0.1
1010
imageRepositoryAllowList:
1111
- gcr.io
1212
insecureCapabilities:

0 commit comments

Comments
 (0)