github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/pss/baseline/1_host_ipc_test.rego (about) 1 package builtin.kubernetes.KSV008 2 3 test_host_ipc_set_to_true_denied { 4 r := deny with input as { 5 "apiVersion": "v1", 6 "kind": "Pod", 7 "metadata": {"name": "hello-ipc"}, 8 "spec": { 9 "hostIPC": true, 10 "containers": [{ 11 "command": [ 12 "sh", 13 "-c", 14 "echo 'Hello' && sleep 1h", 15 ], 16 "image": "busybox", 17 "name": "hello", 18 }], 19 }, 20 } 21 22 count(r) == 1 23 r[_].msg == "Pod 'hello-ipc' should not set 'spec.template.spec.hostIPC' to true" 24 } 25 26 test_host_ipc_set_to_false_allowed { 27 r := deny with input as { 28 "apiVersion": "v1", 29 "kind": "Pod", 30 "metadata": {"name": "hello-ipc"}, 31 "spec": { 32 "hostIPC": false, 33 "containers": [{ 34 "command": [ 35 "sh", 36 "-c", 37 "echo 'Hello' && sleep 1h", 38 ], 39 "image": "busybox", 40 "name": "hello", 41 }], 42 }, 43 } 44 45 count(r) == 0 46 } 47 48 test_host_ipc_is_undefined_allowed { 49 r := deny with input as { 50 "apiVersion": "v1", 51 "kind": "Pod", 52 "metadata": {"name": "hello-ipc"}, 53 "spec": {"containers": [{ 54 "command": [ 55 "sh", 56 "-c", 57 "echo 'Hello' && sleep 1h", 58 ], 59 "image": "busybox", 60 "name": "hello", 61 }]}, 62 } 63 64 count(r) == 0 65 }