github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/README.md (about) 1 ## Comprehensive REGO library for Kubernetes workload configuration checks 2 3 Examples: 4 - Use our REGO policies with tools such as OPA Gatekeeper and Conftest to check kubernetes resources configurations 5 - Ensure pods and controllers are not running as privileged 6 - Ensure pods images are hosted in a trusted ECR/GCR/ACR registry 7 - And more checks to comply with PSP, PSS and additional standards 8 9 # Quick start 10 Follow these steps to pull a policy and test Kubernetes workload manifest: 11 12 1. Create a directory named "myPolicy" to host all the required rego checks 13 14 ``` 15 mkdir myPolicy 16 ``` 17 2. Download the main library and the desired checks(s) into "myPolicy" directory - in this example we use the "host_ipc" check only 18 ``` 19 wget https://github.com/khulnasoft-lab/defsec/raw/master/policies/kubernetes/lib/kubernetes.rego 20 wget https://github.com/khulnasoft-lab/defsec/raw/master/policies/kubernetes/lib/utils.rego 21 wget https://github.com/khulnasoft-lab/defsec/raw/master/policies/defsec/lib/defsec.rego 22 wget https://github.com/khulnasoft-lab/defsec/raw/master/policies/kubernetes/policies/pss/baseline/1_host_ipc.rego 23 ``` 24 3. Download an example of a non-compliant kubernetes deployment (in yaml format) 25 ``` 26 wget https://github.com/khulnasoft-lab/defsec/raw/master/test/testdata/kubernetes/KSV008/denied.yaml 27 ``` 28 4. Use any tool that supports REGO to test the example file. In this example we are using conftest 29 ``` 30 conftest test denied.yaml --policy myPolicy/ --namespace builtin.kubernetes.KSV008 31 ``` 32 33 # Standards and best practices 34 This GitHub repository has controls that cover both [PodSecurityPolicy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) (PSP) and the Kubernetes [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) (PSS), plus additional best practices. 35 36 ## PSS and PSP 37 The Kubernetes Pod Security Standards (PSS) are the official standard for security best practices for pods. These standards overlaps with the checks that PodSecurityPolicies can enforce. 38 39 PSS has 14 controls that are grouped into three standards: Baseline, Restricted and Privileged. Appshield uses Baseline and Restricted; the Privileged standard specifically allows privileged execution. We named the controls in this repository under the PSS controls because they are more up-to-date and have better coverage than PSP. The below table maps PSS controls to PSP controls: 40 41 ### PSS - Baseline 42 43 | PSS control | PSP control(s) | 44 |-------------------------|------------------------------------------------------------------| 45 | 1-Host Namespaces | 2-Usage of host namespaces. 3-Usage of host networking and ports | 46 | 2-Privileged Containers | 1-Running of privileged containers | 47 | 3-Capabilities | 11-Linux capabilities | 48 | 4-HostPath Volumes | 5-Usage of the host filesystem | 49 | 5-Host Ports | Not covered in PSP | 50 | 6-AppArmor (optional) | 14-The AppArmor profile used by containers | 51 | 7-SELinux (optional) | 12-The SELinux context of the container | 52 | 8-/proc Mount Type | 13-The Allowed Proc Mount types for the container | 53 | 9-Sysctls | 16-The sysctl profile used by containers | 54 55 The REGO rules are available [here](https://github.com/khulnasoft-lab/defsec/tree/master/policies/kubernetes/policies/pss) 56 57 ### PSS - Restricted 58 59 | PSS control | PSP control | 60 |:------------------------|:-----------------------------------------------------------------------------------------------------------------| 61 | 1-Volume Types | 4-Usage of volume types 6-Allow specific FlexVolume drivers. 8-Requiring the use of a read-only root file system | 62 | 2-Privilege Escalation | 10-Restricting escalation to root privileges | 63 | 3-Running as Non-root | Not covered in PSP | 64 | 4-Non-root groups | 7-Allocating an FSGroup that owns the Pod's volumes. 9-The user and group IDs of the container | 65 | 5-Seccomp | 15-The seccomp profile used by containers | 66 67 The REGO rules are available [here](https://github.com/khulnasoft-lab/defsec/tree/master/policies/kubernetes/policies/pss) 68 69 ## Optional best practices 70 71 Top Examples: 72 73 | Best practice | tested field in the manifest | 74 |:-----------------------------------------|:-----------------------------------------------| 75 | Trust ECR registries only | container(s).image != ECR domain in prefix | 76 | Trust ACR registries only | container(s).image != ACR domain in prefix | 77 | Trust GCR registries only | container(s).image != GCR domain in prefix | 78 | Block public registries | container(s).image != null or docker.io prefix | 79 | HostPath volume mounted with docker.sock | hostPath.path != /var/run/docker.sock | 80 81 Additional REGO rules available [here](https://github.com/khulnasoft-lab/defsec/tree/master/policies/kubernetes/policies/advanced/optional)