mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

best-practice: validate default proc mount

Browse source
This commit is contained in:
Shuting Zhao 2019-10-04 17:48:57 -07:00
parent 1bd8663e4c
commit 0c09ba53eb
7 changed files with 60 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
examples/best_practices/README.md
View file

@ -19,5 +19,6 @@
| Prevent mounting of default service account | [policy_validate_disallow_default_serviceaccount.yaml](policy_validate_disallow_default_serviceaccount.yaml) |
| Require a default network policy | [policy_validate_default_network_policy.yaml](policy_validate_default_network_policy.yaml) |
| Require namespace quotas and limit ranges | [policy_validate_namespace_quota.yaml](policy_validate_namespace_quota.yaml) |
| Require an FSGroup that owns the pod's volumes | [policy_validate_fsgroup.yaml](policy_validate_fsgroup.yaml) |
| Require the SELinux level of the container | [policy_validate_selinux_context.yaml](policy_validate_selinux_context.yaml) |
| Allow an FSGroup that owns the pod's volumes | [policy_validate_fsgroup.yaml](policy_validate_fsgroup.yaml) |
| Require SELinux level of the container | [policy_validate_selinux_context.yaml](policy_validate_selinux_context.yaml) |
| Allow default Proc Mount type | [policy_validate_default_proc_mount.yaml](policy_validate_default_proc_mount.yaml) |

19
examples/best_practices/policy_validate_default_proc_mount.yaml Normal file
View file

@ -0,0 +1,19 @@
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-default-proc-mount
spec:
validationFailureAction: "audit"
rules:
- name: validate-default-proc-mount
match:
resources:
kinds:
- Pod
validate:
message: "Default proc mount should set to Unmasked"
pattern:
spec:
containers:
- securityContext:
procMount: Unmasked

4
examples/best_practices/policy_validate_selinux_context.yaml
View file

@ -11,10 +11,10 @@ spec:
kinds:
- Pod
validate:
message: "SELinux level should be set to s0:c123,c456"
message: "SELinux level is required"
pattern:
spec:
containers:
- securityContext:
seLinuxOptions:
level: "s0:c123,c456"
level: "*"

12
examples/best_practices/resources/resource_validate_default_proc_mount.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx-proc-mount
labels:
app: nginx-proc-mount
spec:
containers:
- name: nginx
image: nginx
securityContext:
procMount: Unmasked #Default

4
pkg/testrunner/testrunner_test.go
View file

@ -119,3 +119,7 @@ func Test_validate_fsgroup(t *testing.T) {
func Test_validate_selinux_context(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_selinux_context.yaml")
}
func Test_validate_proc_mount(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_default_proc_mount.yaml")
}

19
test/scenarios/test/scenario_validate_default_proc_mount.yaml Normal file
View file

@ -0,0 +1,19 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_default_proc_mount.yaml
resource: examples/best_practices/resources/resource_validate_default_proc_mount.yaml
expected:
validation:
policyresponse:
policy: validate-default-proc-mount
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: nginx-proc-mount
rules:
- name: validate-default-proc-mount
type: Validation
message: "Validation rule 'validate-default-proc-mount' succesfully validated"
success: true

2
test/scenarios/test/scenario_validate_selinux_context.yaml
View file

@ -15,5 +15,5 @@ expected:
rules:
- name: validate-selinux-options
type: Validation
message: "Validation rule 'validate-selinux-options' failed at '/spec/containers/0/securityContext/seLinuxOptions/level/' for resource Pod/default/busybox-selinux. SELinux level should be set to s0:c123,c456"
message: "Validation rule 'validate-selinux-options' failed at '/spec/containers/0/securityContext/seLinuxOptions/' for resource Pod/default/busybox-selinux. SELinux level is required"
success: false