Skip to content

Add rego rule to check for windows securityContext compliance #317

Open
@alegrey91

Description

@alegrey91

In order to support Windows system, we should add rego rules to check for securityContext parameters also for this OS.
Reading from the official documentation, we should implement a control for each of the following listed fields: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#windowssecuritycontextoptions-v1-core
So, the new checks to be added, are the following:

  • gmsaCredentialSpec
  • gmsaCredentialSpecName
  • hostProcess
  • runAsUserName

The equivalent rules should be named like so:

  • set-gmsacredentialspec-value
  • set-gmsacredentialspecname-value
  • set-hostprocess-true (checking also if WindowsHostProcessContainers feature flag is enabled in api-server)
  • runAsUserName

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    Status

    Feature

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions