mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 10:55:05 +00:00
Code Activity

add policy_validate_hostPID_hosIPC.yaml

Browse source
This commit is contained in:
Shuting Zhao 2019-09-09 17:34:25 -07:00
parent d0fd3e69ef
commit 3eeba1a32b
5 changed files with 54 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
examples/best_practices/README.md
View file

@ -6,7 +6,7 @@
| Disallow privileged and privilege escalation | [policy_validate_container_disallow_priviledgedprivelegesecalation.yaml](policy_validate_container_disallow_priviledgedprivelegesecalation.yaml) |
| Disallow use of host networking and ports | [policy_validate_host_network_port.yaml](policy_validate_host_network_port.yaml) |
| Disallow use of host filesystem | [policy_validate_host_path.yaml](policy_validate_host_path.yaml) |
| Disallow hostPOD and hostIPC | |
| Disallow hostPID and hostIPC | [policy_validate_hostPID_hosIPC.yaml](policy_validate_hostPID_hosIPC.yaml) |
| Require read only root filesystem | |
| Disallow node ports | |
| Allow trusted registries | [policy_validate_image_registries.yaml](policy_validate_image_registries.yaml) |

21
examples/best_practices/policy_validate_hostPID_hosIPC.yaml Normal file
View file

@ -0,0 +1,21 @@
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-hostpid-hostipc
spec:
rules:
- name: validate-hostpid-hostipc
exclude:
resources:
namespaces:
- kube-system
match:
resources:
kinds:
- Pod
validate:
message: "Disallow use of host's pid namespace and host's ipc namespace"
anyPattern:
- spec:
hostPID: false
hostIPC: false

10
examples/best_practices/resources/resource_validate_hostPID_hostIPC.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx-with-hostpid
spec:
hostPID: true
hostIPC: false
containers:
- name: nginx
image: nginx

4
pkg/testrunner/testrunner_test.go
View file

@ -91,3 +91,7 @@ func Test_validate_host_path(t *testing.T) {
func Test_validate_host_network_port(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_host_network_port.yaml")
}
func Test_validate_hostPID_hostIPC(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_hostpid_hostipc.yaml")
}

18
test/scenarios/test/scenario_validate_hostpid_hostipc.yaml Normal file
View file

@ -0,0 +1,18 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_hostPID_hosIPC.yaml
resource: examples/best_practices/resources/resource_validate_hostPID_hostIPC.yaml
expected:
validation:
policyresponse:
policy: validate-hostpid-hostipc
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: "nginx-with-hostpid"
rules:
- name: validate-hostpid-hostipc
type: Validation
message: Validation rule 'validate-hostpid-hostipc' failed to validate patterns defined in anyPattern. Disallow use of host's pid namespace and host's ipc namespace; anyPattern[0] failed at path /spec/hostIPC/
success: false