Skip to content

Commit 67712a9

Browse files
VedRatanAnurag Rajawat
VedRatan
and
Anurag Rajawat
authored
feat: virtual-patch intent (#245)
* feat: virtual-patch initial commit Signed-off-by: VedRatan <vedratan8@gmail.com> * feat: added kyverno, karmor, netpol policy creation, deletion, and updation logic Signed-off-by: VedRatan <vedratan8@gmail.com> * feat: added support for network policy Signed-off-by: VedRatan <vedratan8@gmail.com> * feat: added scheduled fetching of latest CVE data Signed-off-by: VedRatan <vedratan8@gmail.com> * chore: resolved all the review comments Signed-off-by: VedRatan <vedratan8@gmail.com> * (docs): added intent description (#265) * fix: Fix CRDs version in PROJECT file Signed-off-by: Anurag Rajawat <anurag@accuknox.com> * doc: Add Intent and CRDs spec docs Signed-off-by: Anurag Rajawat <anurag@accuknox.com> * feat: added intent description Signed-off-by: VedRatan <vedratan8@gmail.com> * docs: added pkg-mgr-execution intent desc Signed-off-by: VedRatan <vedratan8@gmail.com> * docs: added coco-workload intent details Signed-off-by: VedRatan <vedratan8@gmail.com> * docs: update exploit-pfa Signed-off-by: VedRatan <vedratan8@gmail.com> * update command Signed-off-by: VedRatan <vedratan8@gmail.com> * doc: Update docs Signed-off-by: Anurag Rajawat <anurag@accuknox.com> * refactored the docs Signed-off-by: VedRatan <vedratan8@gmail.com> * updated quick-tutorials Signed-off-by: VedRatan <vedratan8@gmail.com> --------- Signed-off-by: Anurag Rajawat <anurag@accuknox.com> Signed-off-by: VedRatan <vedratan8@gmail.com> Co-authored-by: Anurag Rajawat <anurag@accuknox.com> * chore: handled error gracefully, update slice search command Signed-off-by: VedRatan <vedratan8@gmail.com> * fix: tests Signed-off-by: VedRatan <vedratan8@gmail.com> * fix: error handling and review comments Signed-off-by: VedRatan <vedratan8@gmail.com> --------- Signed-off-by: VedRatan <vedratan8@gmail.com> Signed-off-by: Anurag Rajawat <anurag@accuknox.com> Signed-off-by: Ved Ratan <82467006+VedRatan@users.noreply.github.com> Co-authored-by: Anurag Rajawat <anurag@accuknox.com>
1 parent f651a04 commit 67712a9

File tree

15 files changed

+708
-70
lines changed

15 files changed

+708
-70
lines changed

‎docs/intents/escape-to-host.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ The escapeToHost intent results in `KyvernoPolicy` and a couple of `KubearmorPol
3030

3131
```
3232
params:
33-
psa_level: ["restricted"]
33+
psaLevel: ["restricted"]
3434
```
3535

3636
- The `escapeToHost` intent and corresponding policy work together to establish a strong security posture for the application. By enforcing pod security standards, the policy reduces the risk of container escape, which is critical for maintaining the integrity of the host system.

‎examples/clusterscoped/escape-to-host-si-csib-with-params.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ spec:
1111
description: "A attacker can breach container boundaries and can gain access to the host machine"
1212
action: Block
1313
params:
14-
psa_level: ["restricted"]
14+
psaLevel: ["restricted"]
1515
---
1616
apiVersion: intent.security.nimbus.com/v1alpha1
1717
kind: ClusterSecurityIntentBinding

‎examples/namespaced/escape-to-host-with-params.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ spec:
1111
description: "A attacker can breach container boundaries and can gain access to the host machine"
1212
action: Block
1313
params:
14-
psa_level: ["restricted"]
14+
psaLevel: ["restricted"]
1515
---
1616
apiVersion: intent.security.nimbus.com/v1alpha1
1717
kind: SecurityIntentBinding

‎examples/namespaced/virtual-patch-si-sib.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
# Copyright 2023 Authors of Nimbus
3+
4+
apiVersion: intent.security.nimbus.com/v1alpha1
5+
kind: SecurityIntent
6+
metadata:
7+
name: virtual-patch
8+
spec:
9+
intent:
10+
id: virtualPatch
11+
description: >
12+
There might exist CVE's associated with certain images, adversaries might exploit these CVE and can cause potential threat,
13+
to any production server. Check and apply virtual patch for a given set of CVEs as per a schedule
14+
action: Block
15+
params:
16+
cveList:
17+
- "CVE-2024-4439"
18+
- "CVE-2024-27268"
19+
schedule: ["0 23 * * SUN"]
20+
21+
---
22+
23+
apiVersion: intent.security.nimbus.com/v1alpha1
24+
kind: SecurityIntentBinding
25+
metadata:
26+
name: virtual-patch-binding
27+
spec:
28+
intents:
29+
- name: virtual-patch
30+
selector:
31+
workloadSelector:
32+
matchLabels:
33+
app: prod

‎pkg/adapter/idpool/idpool.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ const (
1919
CocoWorkload = "cocoWorkload"
2020
AssessTLS = "assessTLS"
2121
DenyENAccess = "denyExternalNetworkAccess"
22+
VirtualPatch = "virtualPatch"
2223
)
2324

2425
// KaIds are IDs supported by KubeArmor.
@@ -45,6 +46,7 @@ var NetPolIDs = []string{
4546
var KyvIds = []string{
4647
EscapeToHost,
4748
CocoWorkload,
49+
VirtualPatch,
4850
}
4951

5052
// k8tlsIds are IDs supported by k8tls.

‎pkg/adapter/nimbus-kyverno/go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ require (
202202
github.com/puzpuzpuz/xsync/v2 v2.5.1 // indirect
203203
github.com/r3labs/diff v1.1.0 // indirect
204204
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
205+
github.com/robfig/cron/v3 v3.0.1
205206
github.com/sagikazarmark/locafero v0.3.0 // indirect
206207
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
207208
github.com/sassoftware/relic v7.2.1+incompatible // indirect

‎pkg/adapter/nimbus-kyverno/go.sum‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1225,6 +1225,9 @@ github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5X
12251225
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
12261226
github.com/richardartoul/molecule v1.0.1-0.20221107223329-32cfee06a052 h1:Qp27Idfgi6ACvFQat5+VJvlYToylpM/hcyLBI3WaKPA=
12271227
github.com/richardartoul/molecule v1.0.1-0.20221107223329-32cfee06a052/go.mod h1:uvX/8buq8uVeiZiFht+0lqSLBHF+uGV8BrTv8W/SIwk=
1228+
github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ=
1229+
github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
1230+
github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
12281231
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
12291232
github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
12301233
github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=

‎pkg/adapter/nimbus-kyverno/manager/manager.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ func Run(ctx context.Context) {
5959
deletedKpCh := make(chan common.Request)
6060
go watcher.WatchKps(ctx, updatedKpCh, deletedKpCh)
6161

62+
6263
for {
6364
select {
6465
case <-ctx.Done():
@@ -431,6 +432,9 @@ func createTriggerForKp(ctx context.Context, nameNamespace common.Request) {
431432
ObjectMeta: metav1.ObjectMeta{
432433
Name: nameNamespace.Name + "-trigger-configmap",
433434
Namespace: nameNamespace.Namespace,
435+
Labels: map[string]string {
436+
"trigger" : "configmap",
437+
},
434438
},
435439
Data: map[string]string{
436440
"data": "dummy",

‎pkg/adapter/nimbus-kyverno/processor/kcpbuilder.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ func clusterCocoRuntimeAddition(cnp *v1alpha1.ClusterNimbusPolicy, rule v1alpha1
121121
}
122122
matchFilters = append(matchFilters, resourceFilter)
123123
}
124-
} else if namespaces[0] == "*" && len(labels) == 0 {
124+
} else if namespaces[0] == "*" && len(labels) == 0 {
125125
if len(excludeNamespaces) > 0 {
126126
resourceFilter = kyvernov1.ResourceFilter{
127127
ResourceDescription: kyvernov1.ResourceDescription{
@@ -167,7 +167,7 @@ func clusterCocoRuntimeAddition(cnp *v1alpha1.ClusterNimbusPolicy, rule v1alpha1
167167
},
168168
Mutation: kyvernov1.Mutation{
169169
Targets: []kyvernov1.TargetResourceSpec{
170-
kyvernov1.TargetResourceSpec{
170+
{
171171
ResourceSpec: kyvernov1.ResourceSpec{
172172
APIVersion: "apps/v1",
173173
Kind: "Deployment",
@@ -185,16 +185,16 @@ func clusterCocoRuntimeAddition(cnp *v1alpha1.ClusterNimbusPolicy, rule v1alpha1
185185
}
186186

187187
func clusterEscapeToHost(cnp *v1alpha1.ClusterNimbusPolicy, rule v1alpha1.Rule) kyvernov1.ClusterPolicy {
188-
var psa_level api.Level = api.LevelBaseline
188+
var psaLevel api.Level = api.LevelBaseline
189189

190-
if rule.Params["psa_level"] != nil {
190+
if rule.Params["psaLevel"] != nil {
191191

192-
switch rule.Params["psa_level"][0] {
192+
switch rule.Params["psaLevel"][0] {
193193
case "restricted":
194-
psa_level = api.LevelRestricted
194+
psaLevel = api.LevelRestricted
195195

196196
default:
197-
psa_level = api.LevelBaseline
197+
psaLevel = api.LevelBaseline
198198
}
199199

200200
}
@@ -241,7 +241,7 @@ func clusterEscapeToHost(cnp *v1alpha1.ClusterNimbusPolicy, rule v1alpha1.Rule)
241241
} else if namespaces[0] == "*" && len(labels) > 0 {
242242
if len(excludeNamespaces) > 0 {
243243
resourceFilter = kyvernov1.ResourceFilter{
244-
ResourceDescription: kyvernov1.ResourceDescription {
244+
ResourceDescription: kyvernov1.ResourceDescription{
245245
Namespaces: excludeNamespaces,
246246
},
247247
}
@@ -296,7 +296,7 @@ func clusterEscapeToHost(cnp *v1alpha1.ClusterNimbusPolicy, rule v1alpha1.Rule)
296296
},
297297
Validation: kyvernov1.Validation{
298298
PodSecurity: &kyvernov1.PodSecurity{
299-
Level: psa_level,
299+
Level: psaLevel,
300300
Version: "latest",
301301
},
302302
},

0 commit comments

Comments
 (0)