github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/general/manage_all_resources_test.rego (about)

     1  package builtin.kubernetes.KSV046
     2  
     3  test_resource_verb_role_secrets {
     4  	r := deny with input as {
     5  		"apiVersion": "rbac.authorization.k8s.io/v1",
     6  		"kind": "ClusterRole",
     7  		"metadata": {
     8  			"namespace": "default",
     9  			"name": "pod-reader",
    10  		},
    11  		"rules": [{
    12  			"apiGroups": ["*"],
    13  			"resources": ["*"],
    14  			"verbs": ["delete"],
    15  		}],
    16  	}
    17  
    18  	count(r) > 0
    19  }
    20  
    21  test_resource_verb_role_pods {
    22  	r := deny with input as {
    23  		"apiVersion": "rbac.authorization.k8s.io/v1",
    24  		"kind": "ClusterRole",
    25  		"metadata": {
    26  			"namespace": "default",
    27  			"name": "pod-reader",
    28  		},
    29  		"rules": [{
    30  			"apiGroups": ["*"],
    31  			"resources": ["*"],
    32  			"verbs": ["deletecollection"],
    33  		}],
    34  	}
    35  
    36  	count(r) > 0
    37  }
    38  
    39  test_resource_verb_role_deployments {
    40  	r := deny with input as {
    41  		"apiVersion": "rbac.authorization.k8s.io/v1",
    42  		"kind": "ClusterRole",
    43  		"metadata": {
    44  			"namespace": "default",
    45  			"name": "pod-reader",
    46  		},
    47  		"rules": [{
    48  			"apiGroups": ["*"],
    49  			"resources": ["*"],
    50  			"verbs": ["create"],
    51  		}],
    52  	}
    53  
    54  	count(r) > 0
    55  }
    56  
    57  test_resource_verb_role_daemonsets {
    58  	r := deny with input as {
    59  		"apiVersion": "rbac.authorization.k8s.io/v1",
    60  		"kind": "ClusterRole",
    61  		"metadata": {
    62  			"namespace": "default",
    63  			"name": "pod-reader",
    64  		},
    65  		"rules": [{
    66  			"apiGroups": ["*"],
    67  			"resources": ["*"],
    68  			"verbs": ["list"],
    69  		}],
    70  	}
    71  
    72  	count(r) > 0
    73  }
    74  
    75  test_resource_verb_role_statefulsets {
    76  	r := deny with input as {
    77  		"apiVersion": "rbac.authorization.k8s.io/v1",
    78  		"kind": "ClusterRole",
    79  		"metadata": {
    80  			"namespace": "default",
    81  			"name": "pod-reader",
    82  		},
    83  		"rules": [{
    84  			"apiGroups": ["*"],
    85  			"resources": ["*"],
    86  			"verbs": ["get"],
    87  		}],
    88  	}
    89  
    90  	count(r) > 0
    91  }
    92  
    93  test_resource_verb_role_replicationcontrollers {
    94  	r := deny with input as {
    95  		"apiVersion": "rbac.authorization.k8s.io/v1",
    96  		"kind": "ClusterRole",
    97  		"metadata": {
    98  			"namespace": "default",
    99  			"name": "pod-reader",
   100  		},
   101  		"rules": [{
   102  			"apiGroups": ["*"],
   103  			"resources": ["*"],
   104  			"verbs": ["impersonate"],
   105  		}],
   106  	}
   107  
   108  	count(r) > 0
   109  }
   110  
   111  test_resource_resource_role_no_specific_verb {
   112  	r := deny with input as {
   113  		"apiVersion": "rbac.authorization.k8s.io/v1",
   114  		"kind": "ClusterRole",
   115  		"metadata": {
   116  			"namespace": "default",
   117  			"name": "pod-reader",
   118  		},
   119  		"rules": [{
   120  			"apiGroups": ["*"],
   121  			"resources": ["impersonate"],
   122  			"verbs": ["aaa"],
   123  		}],
   124  	}
   125  
   126  	count(r) == 0
   127  }
   128  
   129  test_resource_verb_role_no_any_verb {
   130  	r := deny with input as {
   131  		"apiVersion": "rbac.authorization.k8s.io/v1",
   132  		"kind": "ClusterRole",
   133  		"metadata": {
   134  			"namespace": "default",
   135  			"name": "pod-reader",
   136  		},
   137  		"rules": [{
   138  			"apiGroups": ["*"],
   139  			"resources": ["*"],
   140  			"verbs": ["*"],
   141  		}],
   142  	}
   143  
   144  	count(r) > 0
   145  }