mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 10:28:36 +00:00
Code Activity

add best-practice: policy_validate_disallow_default_serviceaccount

Browse source
This commit is contained in:
Shuting Zhao 2019-09-16 14:16:54 -07:00
parent 3d02f81434
commit 5e0415911a
6 changed files with 54 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
examples/best_practices/README.md
View file

@ -16,6 +16,6 @@
| Disallow latest tag and pull IfNotPresent | [policy_validate_image_latest_ifnotpresent_deny.yaml](policy_validate_image_latest_ifnotpresent_deny.yaml) |
| Require a namespace (disallow default) | [policy_validate_default_namespace.yaml](policy_validate_default_namespace.yaml) |
| Disallow use of kube-system namespace | |
| Prevent mounting of service account secret | |
| Prevent mounting of default service account | [policy_validate_disallow_default_serviceaccount.yaml](policy_validate_disallow_default_serviceaccount.yaml) |
| Require a default network policy | [policy_validate_default_network_policy.yaml](policy_validate_default_network_policy.yaml) |
| Require namespace quotas and limit ranges | [policy_validate_namespace_quota.yaml](policy_validate_namespace_quota.yaml) |

20
examples/best_practices/policy_validate_disallow_default_serviceaccount.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-disallow-default-serviceaccount
spec:
rules:
- name: prevent-mounting-default-serviceaccount
exclude:
resources:
namespaces:
- kube-system
match:
resources:
kinds:
- Pod
validate:
message: "Prevent mounting of default service account."
pattern:
spec:
serviceAccountName: "!default"

11
examples/best_practices/resources/resource_validate_disallow_default_serviceaccount.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: v1
kind: Pod
metadata:
name: pod-with-default-sa
labels:
app: pod-with-default-sa
spec:
serviceAccountName: default
containers:
- name: nginx
image: nginx

1
pkg/policy/webhookregistration.go
View file

@ -63,7 +63,6 @@ func hasMutateOrValidatePolicies(policies []*kyverno.ClusterPolicy) bool {
func hasMutateOrValidate(policy kyverno.ClusterPolicy) bool {
for _, rule := range policy.Spec.Rules {
if !reflect.DeepEqual(rule.Mutation, kyverno.Mutation{}) || !reflect.DeepEqual(rule.Validation, kyverno.Validation{}) {
glog.Infoln(rule.Name)
return true
}
}

4
pkg/testrunner/testrunner_test.go
View file

@ -107,3 +107,7 @@ func Test_validate_namespace_quota(t *testing.T) {
func Test_validate_disallow_node_port(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_disallow_node_port.yaml")
}
func Test_validate_disallow_default_serviceaccount(t *testing.T) {
testScenario(t, "test/scenarios/test/scenario_validate_disallow_default_serviceaccount.yaml")
}

18
test/scenarios/test/scenario_validate_disallow_default_serviceaccount.yaml Normal file
View file

@ -0,0 +1,18 @@
# file path relative to project root
input:
policy: examples/best_practices/policy_validate_disallow_default_serviceaccount.yaml
resource: examples/best_practices/resources/resource_validate_disallow_default_serviceaccount.yaml
expected:
validation:
policyresponse:
policy: validate-disallow-default-serviceaccount
resource:
kind: Pod
apiVersion: v1
namespace: ''
name: pod-with-default-sa
rules:
- name: prevent-mounting-default-serviceaccount
type: Validation
message: Validation rule 'prevent-mounting-default-serviceaccount' failed at '/spec/serviceAccountName/' for resource Pod//pod-with-default-sa. Prevent mounting of default service account.
success: false