From 20736e5e812d68c7081e12087be01fb497b4d6d0 Mon Sep 17 00:00:00 2001 From: Jim Bugwadia <jim@nirmata.com> Date: Sun, 10 Nov 2019 15:50:18 -0800 Subject: [PATCH] update disallow_default_namespace and disallow_host_network_port and disallow_host_pid_ipc --- pkg/testrunner/testrunner_test.go | 6 +++--- samples/DisallowDefaultNamespace.md | 10 +++++----- samples/DisallowHostPIDIPC.md | 8 ++++---- samples/README.md | 16 ++++++++-------- .../disallow_default_namespace.yaml | 19 +++++++++++-------- .../disallow_host_network_port.yaml | 10 +++------- ...ostipc.yaml => disallow_host_pid_ipc.yaml} | 4 ++-- ...e.yaml => disallow_default_namespace.yaml} | 8 +++----- ...ostipc.yaml => disallow_host_pid_ipc.yaml} | 8 ++++---- 9 files changed, 43 insertions(+), 46 deletions(-) rename samples/best_practices/{disallow_hostpid_hostipc.yaml => disallow_host_pid_ipc.yaml} (92%) rename test/scenarios/samples/best_practices/{scenario_validate_disallow_default_namespace.yaml => disallow_default_namespace.yaml} (61%) rename test/scenarios/samples/best_practices/{scenario_validate_disallow_hostpid_hostipc.yaml => disallow_host_pid_ipc.yaml} (64%) diff --git a/pkg/testrunner/testrunner_test.go b/pkg/testrunner/testrunner_test.go index bed584cee7..6f42c68f8c 100644 --- a/pkg/testrunner/testrunner_test.go +++ b/pkg/testrunner/testrunner_test.go @@ -41,15 +41,15 @@ func Test_validate_disallow_automoutingapicred_pass(t *testing.T) { } func Test_validate_disallow_default_namespace(t *testing.T) { - testScenario(t, "test/scenarios/samples/best_practices/scenario_validate_disallow_default_namespace.yaml") + testScenario(t, "test/scenarios/samples/best_practices/disallow_default_namespace.yaml") } func Test_validate_host_network_port(t *testing.T) { testScenario(t, "test/scenarios/samples/best_practices/disallow_host_network_port.yaml") } -func Test_validate_hostPID_hostIPC(t *testing.T) { - testScenario(t, "test/scenarios/samples/best_practices/scenario_validate_disallow_hostpid_hostipc.yaml") +func Test_validate_host_PID_IPC(t *testing.T) { + testScenario(t, "test/scenarios/samples/best_practices/disallow_host_pid_ipc.yaml") } func Test_validate_ro_rootfs(t *testing.T) { diff --git a/samples/DisallowDefaultNamespace.md b/samples/DisallowDefaultNamespace.md index a15719678d..03d1845a83 100644 --- a/samples/DisallowDefaultNamespace.md +++ b/samples/DisallowDefaultNamespace.md @@ -1,6 +1,6 @@ # Disallow use of default namespace -Kubernetes namespaces provide a way to segment and isolate cluster resources across multiple applictaions and users. It is recommended that each workload be isolated in its own namespace and that use of the default namespace be not allowed. +Kubernetes namespaces are an optional feature that provide a way to segment and isolate cluster resources across multiple applications and users. As a best practice, workloads should be isolated with namespaces. Namespaces should be required and the default (empty) namespace should not be used. ## Policy YAML @@ -10,20 +10,20 @@ Kubernetes namespaces provide a way to segment and isolate cluster resources acr apiVersion: kyverno.io/v1alpha1 kind: ClusterPolicy metadata: - name: validate-namespace + name: disallow-default-namespace spec: rules: - - name: check-default-namespace + - name: validate-namespace match: resources: kinds: - Pod validate: - message: "Using 'default' namespace is restricted" + message: "Using 'default' namespace is not allowed" pattern: metadata: namespace: "!default" - - name: check-namespace-exist + - name: require-namespace match: resources: kinds: diff --git a/samples/DisallowHostPIDIPC.md b/samples/DisallowHostPIDIPC.md index 6d68e06400..6820a332e4 100644 --- a/samples/DisallowHostPIDIPC.md +++ b/samples/DisallowHostPIDIPC.md @@ -6,13 +6,13 @@ To avoid pod container from having visibility to host process space, validate th ## Policy YAML -[disallow_hostpid_hostipc.yaml](best_practices/disallow_hostpid_hostipc.yaml) +[disallow_host_pid_ipc.yaml](best_practices/disallow_host_pid_ipc.yaml) ````yaml apiVersion: kyverno.io/v1alpha1 kind: ClusterPolicy metadata: - name: validate-host-pid-ipc + name: disallow-host-pid-ipc annotations: policies.kyverno.io/category: Security policies.kyverno.io/description: Sharing the host's PID namespace allows visibility of process @@ -20,9 +20,9 @@ metadata: the container process to communicate with processes on the host. To avoid pod container from having visibility to host process space, validate that 'hostPID' and 'hostIPC' are set to 'false'. spec: - validationFailureAction: enforce + validationFailureAction: audit rules: - - name: validate-host-pid-ipc + - name: validate-hostPID-hostIPC match: resources: kinds: diff --git a/samples/README.md b/samples/README.md index 6adc53e290..6b62ab8b83 100644 --- a/samples/README.md +++ b/samples/README.md @@ -44,14 +44,14 @@ These policies are highly recommended. 6. [Disallow docker socket bind mount](DisallowDockerSockMount.md) 7. [Disallow `hostNetwork` and `hostPort`](DisallowHostNetworkPort.md) 8. [Disallow `hostPID` and `hostIPC`](DisallowHostPIDIPC.md) -9. [Disallow unknown image registries](DisallowUnknownRegistries.md) +9. [Disallow use of default namespace](DisallowDefaultNamespace.md) 10. [Disallow latest image tag](DisallowLatestTag.md) -11. [Disallow use of default namespace](DisallowDefaultNamespace.md) -12. [Require namespace limits and quotas](RequireNSLimitsQuotas.md) -13. [Require pod resource requests and limits](RequirePodRequestsLimits.md) -14. [Require pod `livenessProbe` and `readinessProbe`](RequirePodProbes.md) -15. [Default deny all ingress traffic](DefaultDenyAllIngress.md) -16. [Disallow Helm Tiller](DisallowHelmTiller.md) +11. [Disallow Helm Tiller](DisallowHelmTiller.md) +12. [Restrict image registries](DisallowUnknownRegistries.md) +13. [Require namespace limits and quotas](RequireNSLimitsQuotas.md) +14. [Require pod resource requests and limits](RequirePodRequestsLimits.md) +15. [Require pod `livenessProbe` and `readinessProbe`](RequirePodProbes.md) +16. [Default deny all ingress traffic](DefaultDenyAllIngress.md) 17. [Add `safe-to-evict` for pods with `emptyDir` and `hostPath` volumes](AddSafeToEvict.md) ## Additional Policies @@ -62,4 +62,4 @@ The policies provide additional best practices and are worthy of close considera 19. [Limit automount of Service Account credentials](DisallowAutomountSACredentials.md) 20. [Configure Linux Capabilities](AssignLinuxCapabilities.md) 21. [Limit Kernel parameter access](ConfigureKernelParmeters.md) -22. [Restrict ingress class](KnownIngressClass.md) +22. [Restrict ingress classes](KnownIngressClass.md) diff --git a/samples/best_practices/disallow_default_namespace.yaml b/samples/best_practices/disallow_default_namespace.yaml index 03043d7940..4e334e4770 100644 --- a/samples/best_practices/disallow_default_namespace.yaml +++ b/samples/best_practices/disallow_default_namespace.yaml @@ -1,24 +1,26 @@ apiVersion: kyverno.io/v1alpha1 kind: ClusterPolicy metadata: - name: validate-namespace - annotations: - policies.kyverno.io/category: Workload Isolation - policies.kyverno.io/description: With many users spread across multiple teams, restricting - use of the default namespace and subdividing the cluster by namesoace isolates workloads. + name: disallow-default-namespace + policies.kyverno.io/category: Isolation + policies.kyverno.io/description: Kubernetes namespaces are an optional feature + that provide a way to segment and isolate cluster resources across multiple + applications and users. As a best practice, workloads should be isolated with + namespaces. Namespaces should be required and the default (empty) namespace + should not be used. spec: rules: - - name: check-default-namespace + - name: validate-namespace match: resources: kinds: - Pod validate: - message: "Using 'default' namespace is restricted" + message: "Using 'default' namespace is not allowed" pattern: metadata: namespace: "!default" - - name: check-namespace-exist + - name: require-namespace match: resources: kinds: @@ -28,3 +30,4 @@ spec: pattern: metadata: namespace: "?*" + diff --git a/samples/best_practices/disallow_host_network_port.yaml b/samples/best_practices/disallow_host_network_port.yaml index e375eece68..5348f56a70 100644 --- a/samples/best_practices/disallow_host_network_port.yaml +++ b/samples/best_practices/disallow_host_network_port.yaml @@ -1,11 +1,7 @@ apiVersion: kyverno.io/v1alpha1 kind: ClusterPolicy metadata: - name: validate-host-network-hostport - annotations: - policies.kyverno.io/category: Security - policies.kyverno.io/description: Using 'hostPort' and 'hostNetwork' allows pods to share - the host network stack, allowing potential snooping of network traffic from an application pod. + name: disallow-host-network-port spec: rules: - name: validate-host-network-port @@ -14,11 +10,11 @@ spec: kinds: - Pod validate: - message: "Defining hostNetwork and hostPort are not allowed" + message: "Using host networking is not allowed" pattern: spec: (hostNetwork): false containers: - name: "*" ports: - - hostPort: null + - hostPort: null \ No newline at end of file diff --git a/samples/best_practices/disallow_hostpid_hostipc.yaml b/samples/best_practices/disallow_host_pid_ipc.yaml similarity index 92% rename from samples/best_practices/disallow_hostpid_hostipc.yaml rename to samples/best_practices/disallow_host_pid_ipc.yaml index 545d72fafd..b6d68389cf 100644 --- a/samples/best_practices/disallow_hostpid_hostipc.yaml +++ b/samples/best_practices/disallow_host_pid_ipc.yaml @@ -1,7 +1,7 @@ apiVersion: kyverno.io/v1alpha1 kind: ClusterPolicy metadata: - name: validate-host-pid-ipc + name: disallow-host-pid-ipc annotations: policies.kyverno.io/category: Security policies.kyverno.io/description: Sharing the host's PID namespace allows visibility of process @@ -11,7 +11,7 @@ metadata: spec: validationFailureAction: audit rules: - - name: validate-host-pid-ipc + - name: validate-hostPID-hostIPC match: resources: kinds: diff --git a/test/scenarios/samples/best_practices/scenario_validate_disallow_default_namespace.yaml b/test/scenarios/samples/best_practices/disallow_default_namespace.yaml similarity index 61% rename from test/scenarios/samples/best_practices/scenario_validate_disallow_default_namespace.yaml rename to test/scenarios/samples/best_practices/disallow_default_namespace.yaml index 682d8363cc..fe44d3389d 100644 --- a/test/scenarios/samples/best_practices/scenario_validate_disallow_default_namespace.yaml +++ b/test/scenarios/samples/best_practices/disallow_default_namespace.yaml @@ -5,7 +5,7 @@ input: expected: validation: policyresponse: - policy: validate-namespace + policy: disallow-default-namespace resource: kind: Pod apiVersion: v1 @@ -14,12 +14,10 @@ expected: namespace: 'default' name: myapp-pod rules: - - name: check-default-namespace + - name: validate-namespace type: Validation - message: "Validation error: Using 'default' namespace is restricted\nValidation rule 'check-default-namespace' failed at path '/metadata/namespace/'." success: false - - name: check-namespace-exist + - name: require-namespace type: Validation - message: "Validation rule 'check-namespace-exist' succeeded." success: true diff --git a/test/scenarios/samples/best_practices/scenario_validate_disallow_hostpid_hostipc.yaml b/test/scenarios/samples/best_practices/disallow_host_pid_ipc.yaml similarity index 64% rename from test/scenarios/samples/best_practices/scenario_validate_disallow_hostpid_hostipc.yaml rename to test/scenarios/samples/best_practices/disallow_host_pid_ipc.yaml index 9d57910743..14591d60e5 100644 --- a/test/scenarios/samples/best_practices/scenario_validate_disallow_hostpid_hostipc.yaml +++ b/test/scenarios/samples/best_practices/disallow_host_pid_ipc.yaml @@ -1,17 +1,17 @@ # file path relative to project root input: - policy: samples/best_practices/disallow_hostpid_hostipc.yaml + policy: samples/best_practices/disallow_host_pid_ipc.yaml resource: test/resources/disallow_hostpid_hostipc.yaml expected: validation: policyresponse: - policy: validate-host-pid-ipc + policy: disallow-host-pid-ipc resource: kind: Pod apiVersion: v1 namespace: '' name: "nginx-with-hostpid" rules: - - name: validate-host-pid-ipc + - name: validate-hostPID-hostIPC type: Validation - success: false \ No newline at end of file + success: false \ No newline at end of file