Skip to content

Commit 09a3c70

Browse files
ivanfetch-wtivanfetch-wt
authored
Set the automountServiceAccountToken to ignore, hasPrefix and hasSuffix functions are available in the go template, exempt the prefix system: instead of indifidual entries for RBAC checks (#871)
* `hasPrefix` and `hasSuffix` functions are available in the go template, exempt the prefix `system:` instead of indifidual entries for RBAC checks * The RBAC checks `clusterrolebindingClusterAdmin` and `clusterrolebindingPodExecAttach` now exempt bindings that start with `system:`, instead of listing explicit strings. * The RBAC check `clusterrolePodExecAttach` now exempt ClusterRoles that start with `system:`, instead of listing explicit strings. * Update documentation to include additional Go template functions * Set the `automountServiceAccountToken` check to ignore by default
1 parent 44ee150 commit 09a3c70

14 files changed

+245
-11
lines changed

‎checks/clusterrolePodExecAttach.yaml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,8 @@ schemaString: |
1818
- const: 'admin'
1919
- const: "cluster-admin"
2020
- const: "edit"
21-
- const: "system:aggregate-to-edit"
22-
- const: "system:controller:generic-garbage-collector"
23-
- const: "system:controller:namespace-controller"
21+
- pattern: '^system:'
22+
- const: "gce:podsecuritypolicy:calico-sa"
2423
- properties:
2524
rules:
2625
type: array

‎checks/clusterrolebindingClusterAdmin.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ schemaString: |
1717
type: string
1818
anyOf:
1919
- const: "cluster-admin"
20-
- const: "system:controller:generic-garbage-collector"
21-
- const: "system:controller:namespace-controller"
20+
- pattern: '^system:'
21+
- const: "gce:podsecuritypolicy:calico-sa"
2222
- required: ["roleRef"]
2323
properties:
2424
roleRef:
@@ -39,7 +39,7 @@ additionalSchemaStrings:
3939
rbac.authorization.k8s.io/ClusterRole: |
4040
type: object
4141
# Do not alert on default ClusterRoleBindings.
42-
{{ if and (ne .metadata.name "cluster-admin") (ne .metadata.name "system:controller:generic-garbage-collector") (ne .metadata.name "system:controller:namespace-controller") }}
42+
{{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
4343
required: ["metadata", "rules"]
4444
allOf:
4545
- properties:

‎checks/clusterrolebindingPodExecAttach.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ schemaString: |
1717
type: string
1818
anyOf:
1919
- const: "cluster-admin"
20-
- const: "system:controller:generic-garbage-collector"
21-
- const: "system:controller:namespace-controller"
20+
- pattern: '^system:'
21+
- const: "gce:podsecuritypolicy:calico-sa"
2222
- required: ["roleRef"]
2323
properties:
2424
roleRef:
@@ -37,7 +37,7 @@ additionalSchemaStrings:
3737
rbac.authorization.k8s.io/ClusterRole: |
3838
type: object
3939
# Do not alert on default ClusterRoleBindings.
40-
{{ if and (ne .metadata.name "cluster-admin") (ne .metadata.name "system:controller:generic-garbage-collector") (ne .metadata.name "system:controller:namespace-controller") }}
40+
{{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
4141
required: ["metadata", "rules"]
4242
allOf:
4343
- properties:

‎docs/customization/custom-checks.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,18 @@ schemaString: |
167167
{{ end }}
168168
```
169169

170+
### Additional Go Template Functions
171+
172+
These functions are also available in the GO template.
173+
174+
* [hasPrefix](https://pkg.go.dev/strings#HasPrefix) - for example, `hasPrefix "string" "prefix"`
175+
* [hasSuffix](https://pkg.go.dev/strings#HasSuffix) - for example, `hasSuffix "string" "suffix"`
176+
177+
For example, the `hasPrefix` function can be used in a template to determine whether a resource name starts with `system:`
178+
```
179+
{{ if hasPrefix .metadata.name "system:" }}
180+
```
181+
170182
## Multi-Resource Checks
171183
You can write checks that span multiple resources. This is helpful for ensuring e.g.
172184
that every Deployment has a PDB or an HPA associated with it.

‎examples/config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ checks:
1616
memoryRequestsMissing: warning
1717
memoryLimitsMissing: warning
1818
# security
19-
automountServiceAccountToken: warning
19+
automountServiceAccountToken: ignore
2020
hostIPCSet: danger
2121
hostPIDSet: danger
2222
linuxHardening: warning

‎pkg/config/schema.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,10 @@ func (check SchemaCheck) TemplateForResource(res interface{}) (*SchemaCheck, err
223223
newCheck.AdditionalSchemaStrings = map[string]string{}
224224

225225
for kind, tmplString := range templateStrings {
226-
tmpl := template.New(newCheck.ID)
226+
tmpl := template.New(newCheck.ID).Funcs(template.FuncMap{
227+
"hasPrefix": strings.HasPrefix,
228+
"hasSuffix": strings.HasSuffix,
229+
})
227230
tmpl, err := tmpl.Parse(tmplString)
228231
if err != nil {
229232
return nil, err

‎test/checks/clusterrolePodExecAttach/success.gce_calico_clusterrole.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# This succeeds because the clusterRole is an exempt name `gce:podsecuritypolicy:calico-sa`
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: gce:podsecuritypolicy:calico-sa
6+
rules:
7+
- apiGroups: [ "*" ]
8+
resources: [ "*" ]
9+
verbs: [ "*" ]

‎test/checks/clusterrolePodExecAttach/success.system_prefix.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# This succeeds because the clusterRole has an exempt `system:` prefix.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: system:test
6+
rules:
7+
- apiGroups: [ "*" ]
8+
resources: [ "*" ]
9+
verbs: [ "*" ]

‎test/checks/clusterrolebindingClusterAdmin/failure.binding_to_system_prefix.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards which happens to have a `system:` prefix.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
# The system: prefix does not cause this test to fail, but this test
6+
# avoids incorectly ignoring user-created bindings to system ClusterRoles.
7+
name: system:test
8+
rules:
9+
- apiGroups: [ "*" ]
10+
resources: [ "*" ]
11+
verbs: [ "*" ]
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRoleBinding
15+
metadata:
16+
name: test-binding-to-system-prefix-clusterrole
17+
roleRef:
18+
apiGroup: rbac.authorization.k8s.io
19+
kind: ClusterRole
20+
name: system:test
21+
subjects:
22+
- apiGroup: rbac.authorization.k8s.io
23+
kind: User
24+
name: testuser
25+
---
26+
# This Role exists so there is at least one Role for the additionalSchema to find.
27+
apiVersion: rbac.authorization.k8s.io/v1
28+
kind: Role
29+
metadata:
30+
name: not-used
31+
namespace: test
32+
rules:
33+
- apiGroups: [ "" ]
34+
resources: [ "pods" ]
35+
verbs: [ list ]

‎test/checks/clusterrolebindingClusterAdmin/success.gce_calico_binding.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# This succeeds because the clusterRoleBinding is an exempt name `gce:podsecuritypolicy:calico-sa`
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: test
6+
rules:
7+
- apiGroups: [ "*" ]
8+
resources: [ "*" ]
9+
verbs: [ "*" ]
10+
---
11+
apiVersion: rbac.authorization.k8s.io/v1
12+
kind: ClusterRoleBinding
13+
metadata:
14+
name: gce:podsecuritypolicy:calico-sa
15+
roleRef:
16+
apiGroup: rbac.authorization.k8s.io
17+
kind: ClusterRole
18+
name: test
19+
subjects:
20+
- apiGroup: rbac.authorization.k8s.io
21+
kind: User
22+
name: testuser
23+
---
24+
# This Role exists so there is at least one Role for the additionalSchema to find.
25+
apiVersion: rbac.authorization.k8s.io/v1
26+
kind: Role
27+
metadata:
28+
name: not-used
29+
namespace: test
30+
rules:
31+
- apiGroups: [ "" ]
32+
resources: [ "pods" ]
33+
verbs: [ list ]

0 commit comments

Comments
 (0)