Skip to content

Latest commit

 

History

History

community

README.md

Policies -- Community

Policies in this folder are organized by NIST Special Publication 800-53. NIST SP 800-53 Rev 4 also includes mapping to the ISO/IEC 27001 controls. For more information, read Appendix H in NIST.SP.800-53r4.

Table of Contents

Security control catalog

Access Control

Policy Description Prerequisites
Disallowed roles policy Use the disallowed roles policy to make sure no pods are being granted full access in violation of least privilege. Check Using RBAC Authorization to learn more about Kubernetes RBAC authorization.

Awareness and Training

Policy Description Prerequisites
No policies yet

Audit and Accountability

Policy Description Prerequisites
Example of configuring audit logging with a policy Use policy-openshift-audit-logs-sample.yaml policy to configure audit logging in your OpenShift cluster. For example, you can deploy the policy to configure Elasticsearch to store the audit logs data and view them on Kibana console. See the OpenShift Documentation. This policy is only valid for OpenShift 4.6.x and needs to be adjusted for the proper environment.

Security Assessment and Authorization

Policy Description Prerequisites
Install Upstream Compliance Operator policy Use the upstream compliance operator installation, policy-comp-operator policy, to enable continuous compliance monitoring for your cluster. After you install this operator, you must select what benchmark you want to comply to, and create the appropriate objects for the scans to be run. See Compliance Operator for more details.

Configuration Management

Policy Description Prerequisites
Upgrade OpenShift-Cluster Sample policy Use this policy to upgrade an OpenShift cluster. In the provided example, a version 4.5 cluster is upgraded to version 4.5.3. Change the channel and the desired version if you want to upgrade other versions.
Egress sample policy With the egress firewall you can define rules (per-project) to allow or deny traffic (TCP-or UDP) to the external network. See the OpenShift Security Guide. Use the OpenShift Security Guide to secure your OpenShift cluster.
Example of configuring a cluster-wide proxy with a policy Use this policy to configure a cluster-wide proxy. See the OpenShift Documentation. This policy is only valid for OpenShift 4.x and needs to be adjusted for the proper environment.
Example of configuring DNS with a policy Use this policy to configure DNS in your OpenShift cluster. For example, you can remove public DNS. See the OpenShift Documentation This policy is only valid for OpenShift 4.x and needs to be adjusted for the proper environment.
Example of configuring the Cluster Network Operator with a policy Use this policy to configure the network of your OpenShift cluster. See the OpenShift Documentation. This policy is only valid for OpenShift 4.x and needs to be adjusted for the proper environment.
Example of creating a deployment object This example generates 5 replicas of `nginx-pods`. See the Kubernetes Documentation to learn more about Deployments.
Example of a policy used to configure GitHub-Authentication Use this policy to log in to your OpenShift cluster with GitHub-Authentication. See the OpenShift Documentation, Configuring a GitHub or GitHub Enterprise identify provider to learn more information.
Example of installing Performance Addon Operator Use this policy to install the Performance Addon Operator, which provides the ability to enable advanced node performance tunings on a set of nodes. See the ACM & Performance Addon Operator repository documentation for more details.
Example of installing PTP Operator Use this policy to install the Precision Time Protocol (PTP) Operator, which creates and manages the linuxptp services on a set of nodes. See the ACM & PTP Operator repository documentation for more details.
Example of installing SR-IOV Network Operator Use this policy to install the Single Root I/O Virtualization (SR-IOV) Network Operator, which manages the SR-IOV network devices and network attachments in your clusters. See the ACM & SR-IOV Network Operator repository documentation for more details.
Example of labelling nodes of a cluster Use this policy to label nodes in your managed clusters. Notice you must know the name of the node or nodes to label. See the OpenShift Documentation to learn more about labelling objects.
Example of a policy used to configure GitHub-Authentication Use this policy to log in to your OpenShift cluster with GitHub-Authentication. See the OpenShift Documentation, Configuring a GitHub or GitHub Enterprise identify provider to learn more information.
Example to configure an image policy Use the image policy to define the repositories from where OpenShift can pull images. See the OpenShift Security Guide. Use the OpenShift Security Guide to secure your OpenShift cluster.
Gatekeeper operator policy Use the Gatekeeper operator policy to install the community version of Gatekeeper on a managed cluster. See the Gatekeeper Operator.
Gatekeeper container image with the latest tag Use the Gatekeeper policy to enforce containers in deployable resources to not use images with the latest tag. See the Gatekeeper documentation. Note: Gatekeeper controllers must be installed to use the gatekeeper policy. See the Gatekeeper operator policy.
Gatekeeper liveness probe not set Use the Gatekeeper policy to enforce pods that have a liveness probe. See the Gatekeeper documentation. Note: Gatekeeper controllers must be installed to use the gatekeeper policy. See the Gatekeeper operator policy.
Gatekeeper readiness probe not set Use the Gatekeeper policy to enforce pods that have a readiness probe. See the Gatekeeper documentation. Note: Gatekeeper controllers must be installed to use the gatekeeper policy. See the Gatekeeper operator policy.
Gatekeeper allowed external IPs Use the Gatekeeper allowed external IPs policy to define external IPs that can be applied to a managed cluster. See the Gatekeeper. Note: Gatekeeper controllers must be installed to use the gatekeeper policy. See the Gatekeeper operator policy.
Gatekeeper sample policy Use the Gatekeeper sample policy to view an example of how a gatekeeper policy can be applied to a managed cluster. See the Gatekeeper. Note: Gatekeeper controllers must be installed to use the gatekeeper policy. See the Gatekeeper operator policy.
Gatekeeper mutation policy (owner annotation) Use the Gatekeeper mutation policy to set the owner annotation on pods. See the Gatekeeper. Note: Gatekeeper controllers must be installed to use the gatekeeper policy. See the Gatekeeper operator policy. You must enable mutatingWebhook to use the gatekeeper mutation feature.
Gatekeeper mutation policy (image pull policy) Use the Gatekeeper mutation policy to set or update image pull policy on pods. See the Gatekeeper. Note: Gatekeeper controllers must be installed to use the gatekeeper policy. See the Gatekeeper operator policy. You must enable mutatingWebhook to use the gatekeeper mutation feature.
MachineConfig Chrony sample policy Use the MachineConfig Chrony policy to configure /etc/chrony.conf on certain machines . For more information see, Modifying node configurations in OpenShift 4.x blog. Note: The policy requires that the managed cluster is OpenShift Container Platform.
Network-Policy-Samples Use the Network policy to specify how groups of pods are allowed to communicate with each other and other network endpoints. See the OpenShift Security Guide. Note: The policy might be modified to the actual usecases.
OPA sample policy Use the Open Policy Agent (OPA) Sample policy to view an example of how an OPA policy can be created. You can also view an example of adding a REGO script into a ConfigMap, which is evaluated by the OPA. See the OPA example repository. Note: OPA must be installed to use the OPA ConfigMap policy.
Trusted Container policy Use the trusted container policy to detect if running pods are using trusted images. Trusted Container Policy Controller
Trusted Node policy Use the trusted node policy to detect if there are untrusted or unattested nodes in the cluster. Trusted Node Policy Controller
ETCD Backup Use the ETCD Backup policy to receive the last six backup snapshots for etcd. This policy uses the etcd container image in the policy because it contains all required tools like etcdctl. For more information, see OpenShift 4 with default storage class.
Integrity Shield Use the Integrity Shield to protect the integrity of Kubernetes resources in a cluster (e.g. OpenShift). See the Integrity Shield documentation.
Integrity Shield Events Use the Integrity Shield Events policy to show a status, which represents whether Integrity Shield has denied some requests in a cluster or not. See the Integrity Shield documentation.
PolicyReport failures The policy-check-reports policy searches for any PolicyReport resources that contain failures in the results. An example of a tool that creates PolicyReports is Kyverno.
Kyverno sample policy Use the Kyverno sample policy to view an example of how a kyverno policy can be applied to a managed cluster. This policy is evaluated by the kyverno controller on a managed cluster. See the Installation instructions and How to write Kyverno policies. Note: Kyverno must be installed on managed cluster to use Kyverno policy.

Contingency Planning

Policy Description Prerequisites
No policies yet

Identification and Authentication

Policy Description Prerequisites
No policies yet

Incident Response

Policy Description Prerequisites
No policies yet

Maintenance

Policy Description Prerequisites
No policies yet

Media Protection

Policy Description Prerequisites
No policies yet

Physical and Environmental Protection

Policy Description Prerequisites
No policies yet

Planning

Policy Description Prerequisites
No policies yet

Personnel Security

Policy Description Prerequisites
No policies yet

Risk Assessment

Policy Description Prerequisites
No policies yet

System and Services Acquisition

Policy Description Prerequisites
No policies yet

System and Communications Protection

Policy Description Prerequisites
OpenShift Certificate Expiration Policy Monitor the OpenShift 4.x namespaces to validate that certificates managed by the infrastructure are rotated as expected. OpenShift 4

System and Information Integrity

Policy Description Prerequisites
Falco Cloud-Native runtime security Falco parses Linux system calls from the kernel at runtime, and asserts the stream against a powerful rules engine. If a rule is violated a Falco alert is triggered. The Falco Project
Sysdig Agent The Sysdig Secure DevOps Platform converges security and compliance with performance and capacity monitoring to create a secure DevOps workflow. It uses the same data to monitor and secure, so you can correlate system activity with Kubernetes services. Check Sysdig and start a Free Trial.

Deploying community policies to your cluster

While the policies in the stable folder all have out-of-the-box support installed with Red Hat Advanced Cluster Management, community policies are maintained by the open source community. You might need to deploy extra policy consumers in order for community policies to work as intended. If you are seeing the error no matches for kind "<resource name>" in version "<group>/<version>", you must deploy the CustomResourceDefiniton (CRD) for the policy before you create it. If some of the policies in this folder are not behaving properly, you must deploy the corresponding policy consumers to handle them.

Custom policy controllers

Custom policy controllers are created from forks of the sample policy controller repo, and as such the process for deploying them is essentially the same as the process for deploying the sample controller.

  • Run the following command on your cluster to install the CRD for the custom policy: kubectl apply -f <CRD path>
  • Run the following command to set up the operator and service account that runs the controller on your cluster: kubectl apply -f deploy/

Policy consumers on operator hub

Some policy consumers are packaged as operators and are available on the Operator hub. These consumers can simply be deployed by creating a policy with child configuration policies to handle the install. The configuration policies might include the following information:

  • A namespace to deploy the operator on, if necessary
  • A ClusterServiceVersion with install capabilities to install the operator from the operator hub
  • A OperatorGroup
  • A Subscription
  • The custom resource defined by the consumer to enforce custom policies For a more specific example of this method of deploying a policy consumer from the operator hub, see policy-falco.

Other custom policy consumers

Occasionally, policies in this folder might be consumed by controllers that do not fall into either of the two categories previously mentioned. To get the most out of these policies, see the Security control catalog