Merge pull request #439 from nirmata/412_no_helm_tiller

add disallow Helm tiller

pkg/testrunner/testrunner_test.go

@@ -122,3 +122,7 @@ func Test_validate_disallow_new_capabilities(t *testing.T) {
 func Test_validate_disallow_docker_sock_mount(t *testing.T) {
 	testScenario(t, "test/scenarios/samples/best_practices/scenario_validate_disallow_docker_sock_mount.yaml")
 }
+
+func Test_validate_disallow_helm_tiller(t *testing.T) {
+	testScenario(t, "test/scenarios/samples/best_practices/scenario_validate_disallow_helm_tiller.yaml")
+}

samples/DisallowHelmTiller.md

@@ -0,0 +1,30 @@
+# Disallow Helm Tiller
+
+Tiller has known security challenges. It requires adminstrative privileges and acts as a shared resource accessible to any authenticated user. Tiller can lead to privilge escalation as restricted users can impact other users.
+
+## Policy YAML 
+
+````yaml
+apiVersion : kyverno.io/v1alpha1
+kind: ClusterPolicy
+metadata:
+  name: disallow-helm-tiller
+  annotations:
+    policies.kyverno.io/category: Security
+    policies.kyverno.io/description: 
+spec:
+  rules:
+  - name: validate-helm-tiller
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "Helm Tiller is not allowed"  
+      pattern:
+        spec:
+          containers:
+          - name: "*"
+            image: "!*tiller*"
+
+````

samples/README.md

@@ -51,7 +51,7 @@ These policies are highly recommended.
 13. [Require pod resource requests and limits](RequirePodRequestsLimits.md)
 14. [Require pod `livenessProbe` and `readinessProbe`](RequirePodProbes.md)
 15. [Default deny all ingress traffic](DefaultDenyAllIngress.md)
-
+16. [Disallow Helm Tiller](DisallowHelmTiller.md)
 
 ## Additional Policies
 

samples/best_practices/disallow_helm_tiller.yaml

@@ -0,0 +1,21 @@
+apiVersion : kyverno.io/v1alpha1
+kind: ClusterPolicy
+metadata:
+  name: disallow-helm-tiller
+  annotations:
+    policies.kyverno.io/category: Security
+    policies.kyverno.io/description: 
+spec:
+  rules:
+  - name: validate-helm-tiller
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "Helm Tiller is not allowed"  
+      pattern:
+        spec:
+          containers:
+          - name: "*"
+            image: "!*tiller*"

test/resources/disallow_helm_tiller.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-helm-tiller
+spec:
+  containers:
+  - name: helm-tiller
+    image: docker.io/tiller:latest

test/scenarios/samples/best_practices/scenario_validate_disallow_helm_tiller.yaml

@@ -0,0 +1,16 @@
+# file paths are relative to project root
+input:
+  policy: samples/best_practices/disallow_helm_tiller.yaml
+  resource: test/resources/disallow_helm_tiller.yaml
+expected:
+  validation:
+    policyresponse:
+      policy: disallow-helm-tiller
+      resource:
+        kind: Pod
+        name: pod-helm-tiller
+      rules:
+        - name: validate-helm-tiller
+          type: Validation
+          message: "Validation rule 'validate-helm-tiller' failed at '/spec/containers/0/image/' for resource Pod//pod-helm-tiller. Helm Tiller is not allowed."
+          success: false