Skip to content
This repository was archived by the owner on Jun 1, 2025. It is now read-only.

Commit fb5c1ca

Browse files
sebhosssebhoss
committed
add require-seccomp-profile-type policy
Signed-off-by: Sebastian Hoß <seb@xn--ho-hia.de>
1 parent 0f307a7 commit fb5c1ca

File tree

14 files changed

+1651
-0
lines changed

14 files changed

+1651
-0
lines changed

‎components/policies/pod-security-standards/restricted/require-seccomp-profile-type/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<!--
2+
SPDX-FileCopyrightText: The vap-collection Authors
3+
SPDX-License-Identifier: Apache-2.0
4+
-->
5+
6+
# require-seccomp-profile-type
7+
8+
Verifies that pods specify their seccomp profile type.
9+
10+
Use the following query to list all pods in your cluster along with their current seccomp profile type usage:
11+
12+
```shell
13+
kubectl get pods --all-namespaces --output yaml | yq '.items[] | select([[.spec.securityContext.seccompProfile.type], .spec.containers[].securityContext.seccompProfile.type, .spec.initContainers[].securityContext.seccompProfile.type, .spec.ephemeralContainers[].securityContext.seccompProfile.type] | flatten | any_c(. != "RuntimeDefault" and . != "Localhost")) | .metadata.namespace + "/" + .metadata.name + ": " + ([[.spec.seccompProfile.type], .spec.containers[].securityContext.seccompProfile.type, .spec.initContainers[].securityContext.seccompProfile.type, .spec.ephemeralContainers[].securityContext.seccompProfile.type] | flatten | join(", "))'
14+
```

‎components/policies/pod-security-standards/restricted/require-seccomp-profile-type/binding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# SPDX-FileCopyrightText: The vap-collection Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
apiVersion: admissionregistration.k8s.io/v1
4+
kind: ValidatingAdmissionPolicyBinding
5+
metadata:
6+
name: require-seccomp-profile-type
7+
labels:
8+
app.kubernetes.io/name: require-seccomp-profile-type
9+
app.kubernetes.io/component: pod-security-standards-baseline
10+
spec:
11+
policyName: require-seccomp-profile-type
12+
validationActions: [Deny]

‎components/policies/pod-security-standards/restricted/require-seccomp-profile-type/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# SPDX-FileCopyrightText: The vap-collection Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
apiVersion: kustomize.config.k8s.io/v1alpha1
4+
kind: Component
5+
resources:
6+
- binding.yaml
7+
- policy.yaml

‎components/policies/pod-security-standards/restricted/require-seccomp-profile-type/policy.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# SPDX-FileCopyrightText: The vap-collection Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
apiVersion: admissionregistration.k8s.io/v1
4+
kind: ValidatingAdmissionPolicy
5+
metadata:
6+
name: require-seccomp-profile-type
7+
labels:
8+
app.kubernetes.io/name: require-seccomp-profile-type
9+
app.kubernetes.io/component: pod-security-standards-baseline
10+
spec:
11+
failurePolicy: Fail
12+
matchConstraints:
13+
resourceRules:
14+
- apiGroups: [""]
15+
apiVersions: ["v1"]
16+
operations: ["CREATE", "UPDATE"]
17+
resources: ["pods"]
18+
scope: "Namespaced"
19+
- apiGroups: ["apps"]
20+
apiVersions: ["v1"]
21+
operations: ["CREATE", "UPDATE"]
22+
resources: ["daemonsets", "deployments", "statefulsets"]
23+
scope: "Namespaced"
24+
- apiGroups: ["batch"]
25+
apiVersions: ["v1"]
26+
operations: ["CREATE", "UPDATE"]
27+
resources: ["cronjobs", "jobs"]
28+
scope: "Namespaced"
29+
variables:
30+
- expression: "['RuntimeDefault', 'Localhost']"
31+
name: allowedProfileTypes
32+
- expression: object.spec.?template.?spec.?securityContext.?seccompProfile.?type
33+
name: controllerSeccompProfileType
34+
- expression: object.spec.?jobTemplate.?spec.?template.?spec.?securityContext.?seccompProfile.?type
35+
name: cronJobSeccompProfileType
36+
- expression: object.spec.?securityContext.?seccompProfile.?type
37+
name: podSeccompProfileType
38+
- expression: variables.controllerSeccompProfileType.or(variables.cronJobSeccompProfileType).or(variables.podSeccompProfileType)
39+
name: allSeccompProfileType
40+
- expression:
41+
object.spec.?template.?spec.?containers.orValue([]) +
42+
object.spec.?template.?spec.?initContainers.orValue([]) +
43+
object.spec.?template.?spec.?ephemeralContainers.orValue([])
44+
name: controllerContainer
45+
- expression:
46+
object.spec.?jobTemplate.?spec.?template.?spec.?containers.orValue([]) +
47+
object.spec.?jobTemplate.?spec.?template.?spec.?initContainers.orValue([]) +
48+
object.spec.?jobTemplate.?spec.?template.?spec.?ephemeralContainers.orValue([])
49+
name: cronJobContainers
50+
- expression:
51+
object.spec.?containers.orValue([]) +
52+
object.spec.?initContainers.orValue([]) +
53+
object.spec.?ephemeralContainers.orValue([])
54+
name: podContainers
55+
- expression: variables.controllerContainer + variables.cronJobContainers + variables.podContainers
56+
name: allContainers
57+
validations:
58+
- expression:
59+
variables.allContainers.all(container,
60+
container.?securityContext.?seccompProfile.?type.or(variables.allSeccompProfileType).orValue('Unconfined') in variables.allowedProfileTypes)
61+
messageExpression: "'Any seccomp profile beyond the allowed list (' + variables.allowedProfileTypes.join(', ') + ') are forbidden.'"
62+
reason: Invalid
63+
auditAnnotations:
64+
- key: name
65+
valueExpression: string(object.metadata.name)

‎components/policies/pod-security-standards/restricted/require-seccomp-profile-type/test/cronjob-bad.yaml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# SPDX-FileCopyrightText: The vap-collection Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
---
4+
apiVersion: batch/v1
5+
kind: CronJob
6+
metadata:
7+
name: badcronjob01
8+
spec:
9+
schedule: "*/1 * * * *"
10+
jobTemplate:
11+
spec:
12+
template:
13+
spec:
14+
restartPolicy: OnFailure
15+
containers:
16+
- name: container01
17+
image: dummyimagename
18+
securityContext:
19+
seccompProfile:
20+
type: Unconfined
21+
---
22+
apiVersion: batch/v1
23+
kind: CronJob
24+
metadata:
25+
name: badcronjob02
26+
spec:
27+
schedule: "*/1 * * * *"
28+
jobTemplate:
29+
spec:
30+
template:
31+
spec:
32+
restartPolicy: OnFailure
33+
containers:
34+
- name: container01
35+
image: dummyimagename
36+
securityContext:
37+
seccompProfile:
38+
type: Unconfined
39+
---
40+
apiVersion: batch/v1
41+
kind: CronJob
42+
metadata:
43+
name: badcronjob03
44+
spec:
45+
schedule: "*/1 * * * *"
46+
jobTemplate:
47+
spec:
48+
template:
49+
spec:
50+
restartPolicy: OnFailure
51+
containers:
52+
- name: container01
53+
image: dummyimagename
54+
- name: container02
55+
image: dummyimagename
56+
securityContext:
57+
seccompProfile:
58+
type: Unconfined
59+
---
60+
apiVersion: batch/v1
61+
kind: CronJob
62+
metadata:
63+
name: badcronjob04
64+
spec:
65+
schedule: "*/1 * * * *"
66+
jobTemplate:
67+
spec:
68+
template:
69+
spec:
70+
restartPolicy: OnFailure
71+
containers:
72+
- name: container01
73+
image: dummyimagename
74+
securityContext:
75+
seccompProfile:
76+
type: RuntimeDefault
77+
- name: container02
78+
image: dummyimagename
79+
securityContext:
80+
seccompProfile:
81+
type: Unconfined
82+
---
83+
apiVersion: batch/v1
84+
kind: CronJob
85+
metadata:
86+
name: badcronjob05
87+
spec:
88+
schedule: "*/1 * * * *"
89+
jobTemplate:
90+
spec:
91+
template:
92+
spec:
93+
restartPolicy: OnFailure
94+
initContainers:
95+
- name: initcontainer01
96+
image: dummyimagename
97+
securityContext:
98+
seccompProfile:
99+
type: Unconfined
100+
containers:
101+
- name: container01
102+
image: dummyimagename
103+
---
104+
apiVersion: batch/v1
105+
kind: CronJob
106+
metadata:
107+
name: badcronjob06
108+
spec:
109+
schedule: "*/1 * * * *"
110+
jobTemplate:
111+
spec:
112+
template:
113+
spec:
114+
restartPolicy: OnFailure
115+
initContainers:
116+
- name: initcontainer01
117+
image: dummyimagename
118+
- name: initcontainer02
119+
image: dummyimagename
120+
securityContext:
121+
seccompProfile:
122+
type: Unconfined
123+
containers:
124+
- name: container01
125+
image: dummyimagename
126+
---
127+
apiVersion: batch/v1
128+
kind: CronJob
129+
metadata:
130+
name: badcronjob07
131+
spec:
132+
schedule: "*/1 * * * *"
133+
jobTemplate:
134+
spec:
135+
template:
136+
spec:
137+
restartPolicy: OnFailure
138+
initContainers:
139+
- name: initcontainer01
140+
image: dummyimagename
141+
securityContext:
142+
seccompProfile:
143+
type: RuntimeDefault
144+
- name: initcontainer02
145+
image: dummyimagename
146+
securityContext:
147+
seccompProfile:
148+
type: Unconfined
149+
containers:
150+
- name: container01
151+
image: dummyimagename
152+
---

0 commit comments

Comments
 (0)