Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixing evaluation logic in C-0044 and execution safety in C-0048 #60

Merged
merged 6 commits into from
Jan 30, 2025
Merged

Fixing evaluation logic in C-0044 and execution safety in C-0048 #60

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
cf521aa
Fixing evaluation logic in C-0044 and execution safty in C-0048
slashben Jan 30, 2025
e0f8b9a
Updating dependencies
slashben Jan 30, 2025
8f5c96b
Merge branch 'main' into fix/volumes
slashben Jan 30, 2025
d1b90ce
Fixing tests
slashben Jan 30, 2025
e06aaf6
Merge branch 'fix/volumes' of github.com:slashben/cel-admission-libra…
slashben Jan 30, 2025
d3742e2
Fixing test C-0013
slashben Jan 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions controls/C-0044/policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ spec:
operations: ["CREATE", "UPDATE"]
resources: ["jobs","cronjobs"]
validations:
- expression: "object.kind != 'Pod' || object.spec.containers.all(container, !(has(container.ports)) || !(container.ports.all(port, has(port.hostPort))))"
- expression: "object.kind != 'Pod' || !object.spec.containers.exists(container, has(container.ports) && container.ports.exists(port, has(port.hostPort)))"
message: "One or more containers in the Pod has Host-port! (see more at https://hub.armosec.io/docs/c-0044)"
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, !(has(container.ports)) || !(container.ports.all(port, has(port.hostPort))))"
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || !object.spec.template.spec.containers.exists(container, has(container.ports) && container.ports.exists(port, has(port.hostPort)))"
message: "One or more containers in the Workload has Host-port! (see more at https://hub.armosec.io/docs/c-0044)"
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, !(has(container.ports)) || !(container.ports.all(port, has(port.hostPort))))"
- expression: "object.kind != 'CronJob' || !object.spec.jobTemplate.spec.containers.exists(container, has(container.ports) && container.ports.exists(port, has(port.hostPort)))"
message: "One or more containers in the CronJob has Host-port! (see more at https://hub.armosec.io/docs/c-0044)"
6 changes: 3 additions & 3 deletions controls/C-0048/policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ spec:
operations: ["CREATE", "UPDATE"]
resources: ["jobs","cronjobs"]
validations:
- expression: "object.kind != 'Pod' || object.spec.volumes.all(vol, !(has(vol.hostPath)))"
- expression: "object.kind != 'Pod' || !has(object.spec.volumes) || object.spec.volumes.all(vol, !(has(vol.hostPath)))"
message: "There are one or more hostPath mounts in the Pod! (see more at https://hub.armosec.io/docs/c-0048)"
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)))"
- expression: "['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || !has(object.spec.template.spec.volumes) || object.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)))"
message: "There are one or more hostPath mounts in the Workload! (see more at https://hub.armosec.io/docs/c-0048)"
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.volumes.all(vol, !(has(vol.hostPath)))"
- expression: "object.kind != 'CronJob' || !has(object.spec.jobTemplate.spec.volumes) || object.spec.jobTemplate.spec.volumes.all(vol, !(has(vol.hostPath)))"
message: "There are one or more hostPath mounts in the CronJob! (see more at https://hub.armosec.io/docs/c-0048)"
Loading