feat: added gatekeeper policy to require PSS labels

vicenteherrera · Nov 23, 2023 · 94440ba · 94440ba
1 parent 65080a8
commit 94440ba
Show file tree

Hide file tree

Showing 2 changed files with 58 additions and 0 deletions.
diff --git a/charts/gatekeeper/chart-constraints/templates/c-namespace-pss.yaml b/charts/gatekeeper/chart-constraints/templates/c-namespace-pss.yaml
@@ -0,0 +1,27 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sNamespacePSS
+metadata:
+  name: namespace-must-have-pss-labels
+spec:
+  enforcementAction: warn
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Namespace"]
+  parameters:
+
+    exemptNamespaces:
+    # privileged
+    - kube-system
+    - falco
+    - promstack
+    # baseline
+    - helm-exporter
+    - robusta
+    - vault
+    - default
+    # other
+    - cert-manater
+    - default
+    - kube-node-lease
+    - kube-public
diff --git a/charts/gatekeeper/chart-templates/templates/t-namespace-pss.yaml b/charts/gatekeeper/chart-templates/templates/t-namespace-pss.yaml
@@ -0,0 +1,31 @@
+apiVersion: templates.gatekeeper.sh/v1beta1
+kind: ConstraintTemplate
+metadata:
+  name: k8snamespacepss
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sNamespacePSS
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8snamespacepss
+
+        namespace_exempt(obj, parameters) {
+          parameters.exemptNamespaces[_] == obj.metadata.name
+        }
+        violation[{"msg": msg, "details": {}}] {
+          not namespace_exempt(input.review.object, input.parameters)  
+          # Violation if object doesn't have pss enforce label
+          not input.review.object.metadata.labels["pod-security.kubernetes.io/enforce"]
+          msg := sprintf("namespace '%v' not allowed, it must PSS label 'pod-security.kubernetes.io/enforce'", [input.review.object.metadata.name])
+        }
+        violation[{"msg": msg, "details": {}}] {
+          not namespace_exempt(input.review.object, input.parameters)         
+          # Violation if object doesn't have pss enforce label to restricted
+          input.review.object.metadata.labels["pod-security.kubernetes.io/enforce"]!="restricted"
+          msg := sprintf("namespace '%v' not allowed, PSS label 'pod-security.kubernetes.io/enforce' requires value 'privileged', found '%v'", 
+          [input.review.object.metadata.name, input.review.object.metadata.labels["pod-security.kubernetes.io/enforce"]])
+        }
+