-
Notifications
You must be signed in to change notification settings - Fork 328
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into add_disallow_interactive_tty_constraint
- Loading branch information
Showing
305 changed files
with
5,731 additions
and
468 deletions.
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| # These owners are the maintainers and approvers of this repo | ||
| * @open-policy-agent/gatekeeper-library-maintainers |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
22 changes: 22 additions & 0 deletions
22
artifacthub/library/general/automount-serviceaccount-token/1.0.1/artifacthub-pkg.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| version: 1.0.1 | ||
| name: k8spspautomountserviceaccounttokenpod | ||
| displayName: Automount Service Account Token for Pod | ||
| createdAt: "2023-05-23T09:47:24Z" | ||
| description: Controls the ability of any Pod to enable automountServiceAccountToken. | ||
| digest: 8b62e4b2324e9e60a66008e6edcc327bcd2b531d3a905f10bf25a1671079ce6e | ||
| license: Apache-2.0 | ||
| homeURL: https://open-policy-agent.github.io/gatekeeper-library/website/automount-serviceaccount-token | ||
| keywords: | ||
| - gatekeeper | ||
| - open-policy-agent | ||
| - policies | ||
| readme: |- | ||
| # Automount Service Account Token for Pod | ||
| Controls the ability of any Pod to enable automountServiceAccountToken. | ||
| install: |- | ||
| ### Usage | ||
| ```shell | ||
| kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/artifacthub/library/general/automount-serviceaccount-token/1.0.1/template.yaml | ||
| ``` | ||
| provider: | ||
| name: Gatekeeper Library |
2 changes: 2 additions & 0 deletions
2
artifacthub/library/general/automount-serviceaccount-token/1.0.1/kustomization.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| resources: | ||
| - template.yaml |
10 changes: 10 additions & 0 deletions
10
...tomount-serviceaccount-token/1.0.1/samples/automount-serviceaccount-token/constraint.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: constraints.gatekeeper.sh/v1beta1 | ||
| kind: K8sPSPAutomountServiceAccountTokenPod | ||
| metadata: | ||
| name: psp-automount-serviceaccount-token-pod | ||
| spec: | ||
| match: | ||
| kinds: | ||
| - apiGroups: [""] | ||
| kinds: ["Pod"] | ||
| excludedNamespaces: ["kube-system"] |
11 changes: 11 additions & 0 deletions
11
...nt-serviceaccount-token/1.0.1/samples/automount-serviceaccount-token/example_allowed.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| apiVersion: v1 | ||
| kind: Pod | ||
| metadata: | ||
| name: nginx-automountserviceaccounttoken-allowed | ||
| labels: | ||
| app: nginx-not-automountserviceaccounttoken | ||
| spec: | ||
| automountServiceAccountToken: false | ||
| containers: | ||
| - name: nginx | ||
| image: nginx |
11 changes: 11 additions & 0 deletions
11
...serviceaccount-token/1.0.1/samples/automount-serviceaccount-token/example_disallowed.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| apiVersion: v1 | ||
| kind: Pod | ||
| metadata: | ||
| name: nginx-automountserviceaccounttoken-disallowed | ||
| labels: | ||
| app: nginx-automountserviceaccounttoken | ||
| spec: | ||
| automountServiceAccountToken: true | ||
| containers: | ||
| - name: nginx | ||
| image: nginx |
16 changes: 16 additions & 0 deletions
16
...l/automount-serviceaccount-token/1.0.1/samples/automount-serviceaccount-token/update.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| kind: AdmissionReview | ||
| apiVersion: admission.k8s.io/v1beta1 | ||
| request: | ||
| operation: "UPDATE" | ||
| object: | ||
| apiVersion: v1 | ||
| kind: Pod | ||
| metadata: | ||
| name: nginx-automountserviceaccounttoken-update | ||
| labels: | ||
| app: nginx-automountserviceaccounttoken | ||
| spec: | ||
| automountServiceAccountToken: true | ||
| containers: | ||
| - name: nginx | ||
| image: nginx |
21 changes: 21 additions & 0 deletions
21
artifacthub/library/general/automount-serviceaccount-token/1.0.1/suite.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| kind: Suite | ||
| apiVersion: test.gatekeeper.sh/v1alpha1 | ||
| metadata: | ||
| name: automount-serviceaccount-token | ||
| tests: | ||
| - name: automount-serviceaccount-token | ||
| template: template.yaml | ||
| constraint: samples/automount-serviceaccount-token/constraint.yaml | ||
| cases: | ||
| - name: example-allowed | ||
| object: samples/automount-serviceaccount-token/example_allowed.yaml | ||
| assertions: | ||
| - violations: no | ||
| - name: example-disallowed | ||
| object: samples/automount-serviceaccount-token/example_disallowed.yaml | ||
| assertions: | ||
| - violations: yes | ||
| - name: update | ||
| object: samples/automount-serviceaccount-token/update.yaml | ||
| assertions: | ||
| - violations: no |
66 changes: 66 additions & 0 deletions
66
artifacthub/library/general/automount-serviceaccount-token/1.0.1/template.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| apiVersion: templates.gatekeeper.sh/v1 | ||
| kind: ConstraintTemplate | ||
| metadata: | ||
| name: k8spspautomountserviceaccounttokenpod | ||
| annotations: | ||
| metadata.gatekeeper.sh/title: "Automount Service Account Token for Pod" | ||
| metadata.gatekeeper.sh/version: 1.0.1 | ||
| description: >- | ||
| Controls the ability of any Pod to enable automountServiceAccountToken. | ||
| spec: | ||
| crd: | ||
| spec: | ||
| names: | ||
| kind: K8sPSPAutomountServiceAccountTokenPod | ||
| validation: | ||
| openAPIV3Schema: | ||
| type: object | ||
| description: >- | ||
| Controls the ability of any Pod to enable automountServiceAccountToken. | ||
| targets: | ||
| - target: admission.k8s.gatekeeper.sh | ||
| rego: | | ||
| package k8sautomountserviceaccounttoken | ||
| import data.lib.exclude_update.is_update | ||
| violation[{"msg": msg}] { | ||
| # spec.automountServiceAccountToken and spec.containers.volumeMounts fields are immutable. | ||
| not is_update(input.review) | ||
| obj := input.review.object | ||
| mountServiceAccountToken(obj.spec) | ||
| msg := sprintf("Automounting service account token is disallowed, pod: %v", [obj.metadata.name]) | ||
| } | ||
| mountServiceAccountToken(spec) { | ||
| spec.automountServiceAccountToken == true | ||
| } | ||
| # if there is no automountServiceAccountToken spec, check on volumeMount in containers. Service Account token is mounted on /var/run/secrets/kubernetes.io/serviceaccount | ||
| # https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#serviceaccount-admission-controller | ||
| mountServiceAccountToken(spec) { | ||
| not has_key(spec, "automountServiceAccountToken") | ||
| "/var/run/secrets/kubernetes.io/serviceaccount" == input_containers[_].volumeMounts[_].mountPath | ||
| } | ||
| input_containers[c] { | ||
| c := input.review.object.spec.containers[_] | ||
| } | ||
| input_containers[c] { | ||
| c := input.review.object.spec.initContainers[_] | ||
| } | ||
| # Ephemeral containers not checked as it is not possible to set field. | ||
| has_key(x, k) { | ||
| _ = x[k] | ||
| } | ||
| libs: | ||
| - | | ||
| package lib.exclude_update | ||
| is_update(review) { | ||
| review.operation == "UPDATE" | ||
| } |
Oops, something went wrong.