github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/aquacommercial/service_with_externalip.rego (about)

     1  # METADATA
     2  # title: "Service with External IP"
     3  # description: "Services with external IP addresses allows direct access from the internet and might expose risk for CVE-2020-8554"
     4  # scope: package
     5  # schemas:
     6  # - input: schema["kubernetes"]
     7  # custom:
     8  #   id: AVD-KSV-0108
     9  #   avd_id: AVD-KSV-0108
    10  #   severity: HIGH
    11  #   short_code: no_svc_with_extip
    12  #   recommended_action: "Do not set spec.externalIPs"
    13  #   input:
    14  #     selector:
    15  #     - type: kubernetes
    16  package builtin.kubernetes.KSV0108
    17  
    18  import data.lib.kubernetes
    19  
    20  allowedIPs = set()
    21  
    22  allowedNames = set()
    23  
    24  # failExtIpsOrName is true if service has external IPs
    25  failExtIpsOrName {
    26  	kubernetes.kind == "Service"
    27  	externalIPs := {ip | ip := kubernetes.object.spec.externalIPs[_]}
    28  	forbiddenIPs := externalIPs - allowedIPs
    29  	count(forbiddenIPs) > 0
    30  }
    31  
    32  # failExtIpsOrName is true if service has external Name
    33  failExtIpsOrName {
    34  	kubernetes.kind == "Service"
    35  	not allowedNames[kubernetes.object.spec.externalName]
    36  }
    37  
    38  deny[res] {
    39  	failExtIpsOrName
    40  	msg := kubernetes.format(sprintf("%s '%s' in '%s' namespace should not set external IPs or external Name", [kubernetes.kind, kubernetes.name, kubernetes.namespace]))
    41  	res := result.new(msg, kubernetes.kind)
    42  }