Merge pull request #328 from accurics/update-k8s-initial-policies

updated k8s policy set and documentation
tenable · Sep 16, 2020 · ab92377 · ab92377
2 parents 4c30787 + ecd531b
commit ab92377
Show file tree

Hide file tree

Showing 134 changed files with 1,008 additions and 350 deletions.
diff --git a/docs/policies/k8s.md b/docs/policies/k8s.md
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.33.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.33.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.34.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.34.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.35.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.35.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.36.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.36.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.37.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.37.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.38.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.38.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.39.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.39.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.40.json b/pkg/policies/opa/rego/k8s/container_host_ipc/accurics.kubernetes.IAM.40.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.33.json b/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.33.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.34.json b/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.34.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.35.json b/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.35.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.36.json b/pkg/policies/opa/rego/k8s/container_host_network/accurics.kubernetes.IAM.36.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.41.json b/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.41.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.42.json b/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.42.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.43.json b/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.43.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.44.json b/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.44.json
diff --git a/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.45.json b/pkg/policies/opa/rego/k8s/container_host_pid/accurics.kubernetes.IAM.45.json
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_namespace/accurics.kubernetes.OPS.460.json b/pkg/policies/opa/rego/k8s/kubernetes_namespace/accurics.kubernetes.OPS.460.json
@@ -0,0 +1,16 @@
+{
+    "name": "defaultNamespaceUsed",
+    "file": "defaultNamespaceUsed.rego",
+    "template_args": {
+        "generate_name": "generate_name",
+        "name": "defaultNamespaceUsed",
+        "prefix": "",
+        "resource_type": "kubernetes_pod",
+        "suffix": ""
+    },
+    "severity": "LOW",
+    "description": "The default namespace should not be used",
+    "reference_id": "accurics.kubernetes.OPS.460",
+    "category": "Operational Efficiency",
+    "version": 1
+}
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_namespace/accurics.kubernetes.OPS.461.json b/pkg/policies/opa/rego/k8s/kubernetes_namespace/accurics.kubernetes.OPS.461.json
@@ -0,0 +1,16 @@
+{
+    "name": "defaultNamespaceUsed2",
+    "file": "defaultNamespaceUsed.rego",
+    "template_args": {
+        "generate_name": "generate_name",
+        "name": "defaultNamespaceUsed2",
+        "prefix": "",
+        "resource_type": "kubernetes_deployment",
+        "suffix": ""
+    },
+    "severity": "LOW",
+    "description": "The default namespace should not be used",
+    "reference_id": "accurics.kubernetes.OPS.461",
+    "category": "Operational Efficiency",
+    "version": 1
+}
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_namespace/accurics.kubernetes.OPS.462.json b/pkg/policies/opa/rego/k8s/kubernetes_namespace/accurics.kubernetes.OPS.462.json
@@ -0,0 +1,16 @@
+{
+    "name": "defaultNamespaceUsed4",
+    "file": "defaultNamespaceUsed.rego",
+    "template_args": {
+        "generate_name": "generate_name",
+        "name": "defaultNamespaceUsed4",
+        "prefix": "",
+        "resource_type": "kubernetes_job",
+        "suffix": ""
+    },
+    "severity": "LOW",
+    "description": "The default namespace should not be used",
+    "reference_id": "accurics.kubernetes.OPS.462",
+    "category": "Operational Efficiency",
+    "version": 1
+}
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_namespace/defaultNamespaceUsed.rego b/pkg/policies/opa/rego/k8s/kubernetes_namespace/defaultNamespaceUsed.rego
@@ -0,0 +1,32 @@
+package accurics
+
+{{.prefix}}{{.name}}{{.suffix}}[api.id]
+{
+    api := input.{{.resource_type}}[_]
+    metadata := api.config.metadata
+    metadata.namespace == "default"
+}
+
+{{.prefix}}{{.name}}{{.suffix}}[api.id]
+{
+    api := input.{{.resource_type}}[_]
+    metadata := api.config.metadata
+    metadata.namespace == ""
+}
+
+{{.prefix}}{{.name}}{{.suffix}}[api.id]
+{
+    api := input.{{.resource_type}}[_]
+    metadata := api.config.metadata
+    not metadata.namespace
+    not metadata.{{.generate_name}}
+}
+
+{{.prefix}}{{.name}}{{.suffix}}[api.id]
+{
+    api := input.{{.resource_type}}[_]
+    metadata := api.config.metadata
+    not metadata.namespace
+    metadata.{{.generate_name}} == false
+}
+
diff --git a/...escalation/accurics.kubernetes.IAM.1.json → ...escalation/accurics.kubernetes.IAM.1.json b/...escalation/accurics.kubernetes.IAM.1.json → ...escalation/accurics.kubernetes.IAM.1.json
@@ -3,6 +3,7 @@
     "file": "containerAllowPrivilegeEscalationIsTrue.rego",
     "template_args": {
         "is_init": false,
+        "name": "containerAllowPrivilegeEscalationIsTrue",
         "prefix": "",
         "resource_type": "kubernetes_cron_job",
         "suffix": ""

diff --git a/...scalation/accurics.kubernetes.IAM.10.json → ...scalation/accurics.kubernetes.IAM.10.json b/...scalation/accurics.kubernetes.IAM.10.json → ...scalation/accurics.kubernetes.IAM.10.json
@@ -3,6 +3,7 @@
     "file": "containerAllowPrivilegeEscalationIsTrue.rego",
     "template_args": {
         "is_init": true,
+        "name": "containerAllowPrivilegeEscalationIsTrue",
         "prefix": "",
         "resource_type": "kubernetes_daemonset",
         "suffix": ""

diff --git a/...scalation/accurics.kubernetes.IAM.11.json → ...scalation/accurics.kubernetes.IAM.11.json b/...scalation/accurics.kubernetes.IAM.11.json → ...scalation/accurics.kubernetes.IAM.11.json
@@ -3,6 +3,7 @@
     "file": "containerAllowPrivilegeEscalationIsTrue.rego",
     "template_args": {
         "is_init": true,
+        "name": "containerAllowPrivilegeEscalationIsTrue",
         "prefix": "",
         "resource_type": "kubernetes_deployment",
         "suffix": ""

diff --git a/...scalation/accurics.kubernetes.IAM.12.json → ...scalation/accurics.kubernetes.IAM.12.json b/...scalation/accurics.kubernetes.IAM.12.json → ...scalation/accurics.kubernetes.IAM.12.json
@@ -3,6 +3,7 @@
     "file": "containerAllowPrivilegeEscalationIsTrue.rego",
     "template_args": {
         "is_init": true,
+        "name": "containerAllowPrivilegeEscalationIsTrue",
         "prefix": "",
         "resource_type": "kubernetes_job",
         "suffix": ""

diff --git a/...scalation/accurics.kubernetes.IAM.13.json → ...scalation/accurics.kubernetes.IAM.13.json b/...scalation/accurics.kubernetes.IAM.13.json → ...scalation/accurics.kubernetes.IAM.13.json
@@ -3,6 +3,7 @@
     "file": "containerAllowPrivilegeEscalationIsTrue.rego",
     "template_args": {
         "is_init": true,
+        "name": "containerAllowPrivilegeEscalationIsTrue",
         "prefix": "",
         "resource_type": "kubernetes_pod",
         "suffix": ""