Update some of our policies that are targeting Pod, to make them process higher level objects

[jvanz]

Update some of our policies that are targeting Pod, to make them process higher level objects like deployments. This is a better practice because we prevent the resources to be created instead of failing in the deployment phase when the pods are created.

The following list is the policies with rules targeting pod resource which need to be updated

Go-based:

• Update policy volumes-psp-policy to target high level resources  volumes-psp-policy#11
• Update policy sysctl-psp-policy to target high level resources  sysctl-psp-policy#13
• Update policy hostpaths-psp-policy to target high level resources  hostpaths-psp-policy#11

Rust-based:

• Update policy allow-privilege-escalation-psp-policy to target high level resources  allow-privilege-escalation-psp-policy#32
• Update policy pod-privileged-policy to target high level resources pod-privileged-policy#33
• Update policy user-group-psp-policy to target high level resources  user-group-psp-policy#33
• Update policy apparmor-psp-policy to target high level resources  apparmor-psp-policy#22
• Update policy capabilities-psp-policy to target high level resources capabilities-psp-policy capabilities-psp-policy#27
• Update policy trusted-repos-policy to target high level resources trusted-repos-policy trusted-repos-policy#29
• Update policy pod-runtime-class-policy to target high level resources pod-runtime-class-policy pod-runtime-class-policy#13
• Update policy readonly-root-filesystem-psp-policy to target high level resources readonly-root-filesystem-psp-policy#20
• Update policy allowed-fsgroups-psp-policy to target high level resources  allowed-fsgroups-psp-policy#18
• Update policy seccomp-psp-policy to target high level resources  seccomp-psp-policy#25
• Update policy allowed-proc-mount-types-psp-policy to target high level resources  allowed-proc-mount-types-psp-policy#18
• Update policy verify-image-signatures to target high level resources  verify-image-signatures#37
• Update policy host-namespaces-psp-policy to target high level resources  host-namespaces-psp-policy#12
• Update policy selinux-psp-policy to target high level resources  selinux-psp-policy#30
• Update policy flexvolume-drivers-psp-policy to target high level resources  flexvolume-drivers-psp-policy#19

For the rust policies, it's possible to use a recent feature added to the rust SDK which allow policy authors to get the pod definition from the high level resources. It would be nice to have a similar feature in the others SDKs as well.

• Add a function to mutate pod sec policy-sdk-rust#63

[jvanz]

As we are not working on this now, I've re added the issue in the board to keep it in the "waiting triage" queue.

[flavio]

Instead of updating all our policies targeting Pods to cover for high order resources, we might consider doing something like Kyverno aug-gen rules

[adnanhashmi09]

I would like to work on this issue. Please assign this to me.

[jvanz]

@adnanhashmi09, please, select a sub task. I'll assign it for you as well.

[flavio]

wait, I'm a bit confused. I don't know if @adnanhashmi09 wants to work on the original task or attempt to implement what I described inside of #282 (comment)

@adnanhashmi09: can you please clarify?

[adnanhashmi09]

I am working on this sub-issue.. I left a comment there. @flavio

[flavio]

JFYI, I've created kubewarden/rfc#23 to keep track of what I described inside of #282 (comment).

I suggest to put this issue on hold until we understand whether we can have a generic way to make Pod-specific policies work against higher-order resources

[niheetes]

Any progress on the generic way to make these policies work on higher level resources?

[jvanz]

Any progress on the generic way to make these policies work on higher level resources?

No, this is issue is on hold for now. May I ask you why you're interested on this? Are you facing some issue writing policies or something similar? Do you want to contribute?

[jvanz]

@niheetes sorry for the long delay to give you a feedback. We've discussed this issue during our planning session and we do not want to fix all the policies manually. Because that will required a lot of changes and it not future proof. In other words, we would like to avoid to remember that policy must be handle pod inside high level resources every time. Therefore, we will refine this card to decide the proper way to move it forward.

However, we do not want to leave you if a workaround. Thus, we would like to know which policies you want to get fix. Therefore, we can work on them while we do not find the final solution for this issue. Can you share that with us?