feat: add best practices policies in CEL expressions

.github/workflows/test.yml

@@ -32,6 +32,7 @@ jobs:
           - ^argo$
           - ^aws$
           - ^best-practices$
+          - ^best-practices-cel$
           - ^castai$
           - ^cert-manager$
           - ^consul$

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,51 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: disallow-cri-sock-mount
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: ../disallow-cri-sock-mount.yaml
+    - patch:
+        resource:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          metadata:
+            name: disallow-container-sock-mounts
+          spec:
+            validationFailureAction: Enforce
+    - assert:
+        file: policy-ready.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: good-pod.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: pod-containerd-sock.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: pod-docker-sock.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: pod-crio-sock.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: pod-cri-dockerd-sock.yaml
+    - apply:
+        file: pod-emptydir-vol.yaml
+    - apply:
+        file: pod-no-volumes.yaml
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/good-pod.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: goodpod01
+spec:
+  containers:
+  - name: myshell
+    image: "ubuntu:18.04"
+    command:
+    - /bin/sleep
+    - "300"
+  volumes:
+  - name: data
+    hostPath:
+      path: /data
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-containerd-sock.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-with-containerd-sock-mount
+spec:
+  containers:
+  - name: myshell
+    image: "ubuntu:18.04"
+    command:
+    - /bin/sleep
+    - "300"
+  volumes:
+  - name: dockersock
+    hostPath:
+      path: /var/run/containerd/containerd.sock
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-cri-dockerd-sock.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-with-cri-dockerd-sock-mount
+spec:
+  containers:
+  - name: myshell
+    image: "ubuntu:18.04"
+    command:
+    - /bin/sleep
+    - "300"
+  volumes:
+  - name: dockersock
+    hostPath:
+      path: /var/run/cri-dockerd.sock
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-crio-sock.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-with-crio-sock-mount
+spec:
+  containers:
+  - name: myshell
+    image: "ubuntu:18.04"
+    command:
+    - /bin/sleep
+    - "300"
+  volumes:
+  - name: dockersock
+    hostPath:
+      path: /var/run/crio/crio.sock
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-docker-sock.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-with-docker-sock-mount
+spec:
+  containers:
+  - name: myshell
+    image: "ubuntu:18.04"
+    command:
+    - /bin/sleep
+    - "300"
+  volumes:
+  - name: dockersock
+    hostPath:
+      path: /var/run/docker.sock
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-emptydir-vol.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-with-emptydir-volume
+spec:
+  containers:
+  - name: busybox
+    image: busybox:1.35
+    command:
+    - sleep
+    - "3600"
+  volumes:
+    - name: mydir
+      emptyDir: {}
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/pod-no-volumes.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-with-no-volumes
+spec:
+  automountServiceAccountToken: false
+  containers:
+  - name: busybox
+    image: busybox:1.35
+    command:
+    - sleep
+    - "3600"
+

best-practices-cel/disallow-cri-sock-mount/.chainsaw-test/policy-ready.yaml

@@ -0,0 +1,7 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-container-sock-mounts
+status:
+  ready: true
+

best-practices-cel/disallow-cri-sock-mount/.kyverno-test/kyverno-test.yaml

@@ -0,0 +1,22 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: disallow-cri-sock-mount
+policies:
+- ../disallow-cri-sock-mount.yaml
+resources:
+- resource.yaml
+results:
+- kind: Pod
+  policy: disallow-container-sock-mounts
+  resources:
+  - pod-with-docker-sock-mount
+  result: fail
+  rule: validate-socket-mounts
+- kind: Pod
+  policy: disallow-container-sock-mounts
+  resources:
+  - goodpod01
+  result: pass
+  rule: validate-socket-mounts
+

best-practices-cel/disallow-cri-sock-mount/.kyverno-test/resource.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-with-docker-sock-mount
+spec:
+  containers:
+  - name: myshell
+    image: "ubuntu:18.04"
+    command:
+    - /bin/sleep
+    - "300"
+  volumes:
+  - name: dockersock
+    hostPath:
+      path: /var/run/docker.sock
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: goodpod01
+spec:
+  containers:
+  - name: myshell
+    image: "ubuntu:18.04"
+    command:
+    - /bin/sleep
+    - "300"
+  volumes:
+  - name: data
+    hostPath:
+      path: /data
+

best-practices-cel/disallow-cri-sock-mount/artifacthub-pkg.yml

@@ -0,0 +1,25 @@
+name: disallow-cri-sock-mount-cel
+version: 1.0.0
+displayName: Disallow CRI socket mounts in CEL expressions
+description: >-
+  Container daemon socket bind mounts allows access to the container engine on the node. This access can be used for privilege escalation and to manage containers outside of Kubernetes, and hence should not be allowed. This policy validates that the sockets used for CRI engines Docker, Containerd, and CRI-O are not used. In addition to or replacement of this policy, preventing users from mounting the parent directories (/var/run and /var) may be necessary to completely prevent socket bind mounts.
+install: |-
+  ```shell
+  kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/best-practices-cel/disallow-cri-sock-mount/disallow-cri-sock-mount.yaml
+  ```
+keywords:
+  - kyverno
+  - Best Practices
+  - EKS Best Practices
+  - CEL Expressions
+readme: |
+  Container daemon socket bind mounts allows access to the container engine on the node. This access can be used for privilege escalation and to manage containers outside of Kubernetes, and hence should not be allowed. This policy validates that the sockets used for CRI engines Docker, Containerd, and CRI-O are not used. In addition to or replacement of this policy, preventing users from mounting the parent directories (/var/run and /var) may be necessary to completely prevent socket bind mounts.
+
+  Refer to the documentation for more details on Kyverno annotations: https://artifacthub.io/docs/topics/annotations/kyverno/
+annotations:
+  kyverno/category: "Best Practices, EKS Best Practices in CEL"
+  kyverno/kubernetesVersion: "1.26-1.27"
+  kyverno/subject: "Pod"
+digest: 0b91de77f8a6da0cafea457e0ba9eb14f0b8eb6bbcb56419a4e9de09c860753d
+createdAt: "2024-03-14T15:59:52Z"
+

best-practices-cel/disallow-cri-sock-mount/disallow-cri-sock-mount.yaml

@@ -0,0 +1,58 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-container-sock-mounts
+  annotations:
+    policies.kyverno.io/title: Disallow CRI socket mounts in CEL expressions
+    policies.kyverno.io/category: Best Practices, EKS Best Practices in CEL 
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/minversion: 1.11.0
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      Container daemon socket bind mounts allows access to the container engine on the
+      node. This access can be used for privilege escalation and to manage containers
+      outside of Kubernetes, and hence should not be allowed. This policy validates that
+      the sockets used for CRI engines Docker, Containerd, and CRI-O are not used. In addition
+      to or replacement of this policy, preventing users from mounting the parent directories
+      (/var/run and /var) may be necessary to completely prevent socket bind mounts.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+  - name: validate-socket-mounts
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    validate:
+      cel:
+        variables:
+          - name: hasVolumes
+            expression: "!has(object.spec.volumes)"
+          - name: volumes
+            expression: "object.spec.volumes"
+          - name: volumesWithHostPath
+            expression: "variables.volumes.filter(volume, has(volume.hostPath))"
+        expressions:
+          - expression: >-
+              variables.hasVolumes || 
+              variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/docker.sock'))
+            message: "Use of the Docker Unix socket is not allowed."
+
+          - expression: >-
+              variables.hasVolumes || 
+              variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/containerd/containerd.sock'))
+            message: "Use of the Containerd Unix socket is not allowed."
+
+          - expression: >-
+              variables.hasVolumes || 
+              variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/crio/crio.sock'))
+            message: "Use of the CRI-O Unix socket is not allowed."
+
+          - expression: >-
+              variables.hasVolumes || 
+              variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/cri-dockerd.sock'))
+            message: "Use of the Docker CRI socket is not allowed."
+

best-practices-cel/disallow-default-namespace/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,56 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  creationTimestamp: null
+  name: disallow-default-namespace
+spec:
+  steps:
+  - name: step-01
+    try:
+    - apply:
+        file: ../disallow-default-namespace.yaml
+    - patch:
+        resource:
+          apiVersion: kyverno.io/v1
+          kind: ClusterPolicy
+          metadata:
+            name: disallow-default-namespace
+          spec:
+            validationFailureAction: Enforce
+    - assert:
+        file: policy-ready.yaml
+  - name: step-02
+    try:
+    - apply:
+        file: ns.yaml
+  - name: step-03
+    try:
+    - apply:
+        file: good-resources.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: pod-default.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ds-default.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: job-default.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: ss-default.yaml
+    - apply:
+        expect:
+        - check:
+            ($error != null): true
+        file: deploy-default.yaml
+