Skip to content

Commit

Permalink
Updates K8s security checks (#273)
Browse files Browse the repository at this point in the history
This is a pretty major overhaul of the K8S security policy checks. This
PR uses the most current style of check writing to ensure checks return
"clear, accurate, and actionable" results.

## Current Method Example: Container should not allow privilege
escalation

The current check is written as follows:

```coffee
      k8s.deployment {
        initContainers {
          securityContext['allowPrivilegeEscalation'] != true
        }
        containers {
          securityContext['allowPrivilegeEscalation'] != true
        }
      }
```

While the check does make an assertion, the results return data.
```
k8s.deployment: {
  initContainers: []
  containers: [
    0: {
      securityContext[allowPrivilegeEscalation] != true: true
    }
  ]
}
```

## Updated Method: Container should not allow privilege escalation

This PR updates the check as follows:

```
k8s.deployment.initContainers.all( securityContext['allowPrivilegeEscalation'] != true )
k8s.deployment.containers.all( securityContext['allowPrivilegeEscalation'] != true )
```

The results from a passing check look like this:

```
[ok] value: true
```

The results from failed check will return the following:

```
[failed] [].all()
  actual:   [
    0: k8s.container {
      securityContext: {
        privileged: false
      }
      securityContext[allowPrivilegeEscalation]: null
      name: "dvwa"
    }
  ]
```

---------

Signed-off-by: Scott Ford <[email protected]>
  • Loading branch information
scottford-io authored Oct 16, 2023
1 parent ce9d45b commit b5831cf
Show file tree
Hide file tree
Showing 2 changed files with 189 additions and 889 deletions.
1 change: 1 addition & 0 deletions .github/actions/spelling/expect.txt
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ passcode
Passfilt
pgp
pki
privs
projectssh
qps
rdp
Expand Down
Loading

0 comments on commit b5831cf

Please sign in to comment.