Skip to content

Latest commit

 

History

History
103 lines (86 loc) · 11.1 KB

README.md

File metadata and controls

103 lines (86 loc) · 11.1 KB
Raw

Kubescape Validating Admission Policy library

This is a library of policies based on Kubescape controls ready for use with Kubernetes Validating Admission Policies. In this library, Kubescape controls have been re-implemented in CEL for your convenience.

Using the library

Kubernetes Validating Admission Policy (or VAP) feature was released as a GA feature in version 1.30 and it is a releatively new feature (this library supports alpha and beta versions as well). Before you start playing with it, make sure you have a cluster that supports this feature. Look here for how to set up a playground even for pre-1.30 versions.*

Install latest the release of the library (v1 version of VAP):

# Install configuration CRD
kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/policy-configuration-definition.yaml
# Install basic configuration
kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/basic-control-configuration.yaml
# Install policies
kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/kubescape-validating-admission-policies.yaml

You're good to start to use it 😎

You can apply policies to objects, for example, to apply control C-0016 (deny allowPrivilegeEscalation on containers) on workloads in the namespace with label policy=enforced just run this:

# Creating a binding
kubectl apply -f - <<EOT
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: c0016-binding
spec:
  policyName: kubescape-c-0016-allow-privilege-escalation
  paramRef:
    name: basic-control-configuration
    parameterNotFoundAction: Deny
  validationActions:
  - Deny
  matchResources:
    namespaceSelector:
      matchLabels:
        policy: enforced
EOT
# Creating a namespace for running the example
kubectl create namespace policy-example
kubectl label namespace policy-example policy=enforced
# The next line should fail
kubectl -n policy-example run nginx --image=nginx --restart=Never

Library items

Control ID Name Policy name Configuration parameter
C-0001 Forbidden Container Registries kubescape-c-0001-deny-forbidden-container-registries untrustedRegistries
C-0004 Resources memory limit and request kubescape-c-0004-deny-resources-with-memory-limit-or-request-not-set memoryRequestMin
C-0009 Resource limits kubescape-c-0009-deny-resources-with-memory-or-cpu-limit-not-set not configurable
C-0016 Allow privilege escalation kubescape-c-0016-allow-privilege-escalation not configurable
C-0017 Immutable container filesystem kubescape-c-0017-deny-resources-with-mutable-container-filesystem not configurable
C-0018 Configured readiness probe kubescape-c-0018-deny-resources-without-configured-readiness-probes not configurable
C-0020 Mount service principal kubescape-c-0020-deny-resources-having-volumes-with-potential-access-to-known-cloud-credentials cloudProvider
C-0034 Automatic mapping of service account kubescape-c-0034-deny-resources-with-automount-service-account-token-enabled not configurable
C-0038 Host PID/IPC privileges kubescape-c-0038-deny-resources-with-host-ipc-or-pid-privileges not configurable
C-0041 HostNetwork access kubescape-c-0041-deny-resources-with-host-network-access not configurable
C-0042 SSH server running inside container kubescape-c-0042-deny-resources-with-ssh-server-running not configurable
C-0044 Container hostPort kubescape-c-0044-deny-resources-with-host-port not configurable
C-0045 Writable hostPath mount kubescape-c-0045-deny-workloads-with-hostpath-volumes-readonly-not-false not configurable
C-0046 Insecure capabilities kubescape-c-0046-deny-resources-with-insecure-capabilities insecureCapabilities
C-0048 HostPath mount kubescape-c-0048-deny-workloads-with-hostpath-mounts not configurable
C-0050 Resources CPU limit and request kubescape-c-0050-deny-resources-with-cpu-limit-or-request-not-set cpuLimitMin
C-0055 Linux hardening kubescape-c-0055-linux-hardening not configurable
C-0056 Configured liveness probe kubescape-c-0056-deny-resources-without-configured-liveliness-probes not configurable
C-0057 Privileged container kubescape-c-0057-privileged-container-denied not configurable
C-0061 Pods in default namespace kubescape-c-0061-deny-workloads-in-default-namespace not configurable
C-0062 Sudo in container entrypoint kubescape-c-0062-deny-resources-having-containers-with-sudo-in-entrypoint not configurable
C-0073 Naked PODs kubescape-c-0073-deny-naked-pods not configurable
C-0074 Containers mounting Docker socket kubescape-c-0074-resources-mounting-docker-socket-denied not configurable
C-0075 Image pull policy on latest tag kubescape-c-0075-deny-resources-with-image-pull-policy-not-set-to-always-for-latest-tag not configurable
C-0076 Label usage for resources kubescape-c-0076-deny-resources-without-configured-list-of-labels-not-set recommendedLabels
C-0077 K8s common labels usage kubescape-c-0077-deny-resources-without-configured-list-of-k8s-common-labels-not-set k8sRecommendedLabels
C-0078 Images from allowed registry kubescape-c-0078-only-allow-images-from-allowed-registry imageRepositoryAllowList

Testing Policies

Cluster

You need a cluster that supports Validating Admission Policies. You can start a simple minikube with the script scripts/setup-test-minikube-cluster.sh

Testing a single policy

You can run the tests associated with a single policy by following these steps.

cd controls/C-0016
python ../../scripts/run-control-tests.py

This script reads the tests.json file in the directory, builds the policy bindings and test objects and tests the policy with the binding against the test object.

The tests.json contains test cases where each case has a

  • template object: a YAML in the test-resources directory
  • field changes: what changes to be done to the template object before applying it
  • expected field: what should happen when applying the object after the field changes

Learning about Validating Admission Policies

Check this out