Pod Security Policy

[gauravoracle]

Can someone pls suggest how to write annotation template with gatekeeper to allow only admin group users can create/update Pod security policy..?

[anderseknert]

The AdmissionReview object provided to your policy contains a userInfo attribute.. that's what you'll want to check for group membership of the user.

[peteroneilljr]

Cross posting from slack.

// How I think it should look based on the following template
// https://github.com/open-policy-agent/gatekeeper-library/blob/master/library/general/block-endpoint-edit-default-role/template.yaml

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sblockendpointeditdefaultrole
  annotations:
    description: "Non admins should not be allowed to use edit verb"
spec:
  crd:
    spec:
      names:
        kind: K8sBlockEndpointEditNotAdminRole
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sblockendpointeditdefaultrole
        violation[{"msg": msg}] {
          input.review.object.metadata.name == "system:aggregate-to-edit"
          endpointRule(input.review.object.rules[_])
          msg := "NonAdmin system:aggregate-to-edit should not allow endpoint edit permissions."
        }
        endpointRule(rule) {
          "endpoints" == rule.resources[_]
          hasEditVerb(rule.verbs)
        }
        hasEditVerb(verbs) {
          "create" == verbs[_]
        }
        hasEditVerb(verbs) {
          "patch" == verbs[_]
        }
        hasEditVerb(verbs) {
          "update" == verbs[_]
        }


// https://github.com/open-policy-agent/gatekeeper-library/blob/master/library/general/block-endpoint-edit-default-role/samples/block-endpoint-edit-default-role/constraint.yaml

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockEndpointEditDefaultRole
metadata:
  name: block-endpoint-edit-not-admin-role
spec:
  match:
    kinds:
      - apiGroups: ["policy"]
        kinds: ["NotAdminRole"]