-
Notifications
You must be signed in to change notification settings - Fork 49
/
restrict-pods-exec.yaml
63 lines (63 loc) · 2.58 KB
/
restrict-pods-exec.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# Copyright 2024 Google LLC
#
# This is “Software” that is licensed under the “General Software” section of
# the Service Specific Terms (https://cloud.google.com/terms/service-terms) for
# usage in accordance with the following “Scope of Use”: This file may only be
# used on an Anthos cluster, including any associated ci/cd use. “Anthos
# cluster” is defined as “A Cluster (of any kind) registered to a fleet project
# where the Anthos API is enabled”.
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRoleRules
metadata:
name: pci-dss-v4.0-restrict-pods-exec
labels:
policycontroller.gke.io/bundleName: pci-dss-v4.0
annotations:
policycontroller.gke.io/bundleVersion: "202403.0"
policycontroller.gke.io/constraintData: |-
"{
bundleName: 'pci-dss-v4.0',
bundleDisplayName: 'PCI DSS v4.0',
bundleLink: 'https://cloud.google.com/anthos-config-management/docs/how-to/using-pci-dss-v4',
bundleVersion: '202403.0',
bundleDescription: 'Use the PCI DSS v4.0 policy bundle with Policy Controller to evaluate the compliance of your cluster resources against some aspects of the Payment Card Industry (PCI) Data Security Standard (DSS) v4.0.',
controlNumbers: '[8.6.1]',
severity: 'UNSPECIFIED',
description: 'Restricts the use of `pods/exec` in `Roles` and `ClusterRoles`.',
remediation: 'Cannot use `pods/exec` permission in `Roles` and `ClusterRoles`. Remove all `pods/exec` rules from your `Roles` and `ClusterRoles`. See "RoleBinding and ClusterRoleBinding" for more information: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding',
minimumTemplateLibraryVersion: '1.15.2',
constraintHash: '448c5cada721af431a7c2773662e62befb98c2ce55afd5698037ae34ff3c1e05'
}"
spec:
enforcementAction: dryrun
match:
excludedNamespaces:
- apigee
kinds:
- apiGroups:
- rbac.authorization.k8s.io
kinds:
- Role
- ClusterRole
parameters:
disallowedRules:
- apiGroups:
- ""
resources:
- pods/exec
verbs:
- create
exemptions:
clusterRoles:
- name: edit
- name: system:aggregate-to-edit
- name: admin
- name: cluster-admin
- name: config-management-operator
- name: vmruntime-vmruntime-manager-role
- name: apigee-cassandra-restore
- name: apigee-cassandra-backup
- name: apigee-manager-role
roles:
- name: agent-updater
namespace: gke-connect