Mithilfe von Einschränkungsvorlagen können Sie die Funktionsweise einer Einschränkung definieren, aber die Details dieser Einschränkung an eine Einzelperson oder Gruppe mit Fachkenntnissen delegieren. Neben der Trennung von Fragestellungen wird auch die Logik der Einschränkung von der Definition getrennt.
Alle Einschränkungen enthalten den Abschnitt match, in dem die Objekte definiert werden, auf die eine Einschränkung angewendet wird. Weitere Informationen zum Konfigurieren dieses Abschnitts finden Sie unter Abschnitt zum Einschränkungsabgleich.
Nicht alle Einschränkungsvorlagen sind für alle Versionen von Policy Controller verfügbar und Vorlagen können zwischen den Versionen geändert werden. Über folgende Links können Sie Einschränkungen von unterstützten Versionen vergleichen:
Links zu früheren Versionen dieser Seite
Damit Sie vollständigen Support erhalten, empfehlen wir die Verwendung von Einschränkungsvorlagen aus einer unterstützten Version von Policy Controller.
Damit Sie sehen können, wie die Einschränkungsvorlagen funktionieren, enthält jede Vorlage eine Beispieleinschränkung und eine Ressource, die gegen die Einschränkung verstößt.
Verfügbare Einschränkungsvorlagen
| Einschränkungsvorlage | Beschreibung | Referenziell |
|---|---|---|
| AllowedServicePortName | Erfordert, dass Dienstportnamen ein Präfix aus einer angegebenen Liste haben. | Nein |
| AsmAuthzPolicyDefaultDeny | Erzwingen Sie die AuthorizationPolicy für standardmäßige Ablehnung auf Mesh-Ebene. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#use-default-deny-patterns. | Ja |
| AsmAuthzPolicyDisallowedPrefix | Erfordert, dass Hauptkonten und Namespaces in "AuthorizationPolicy"-Regeln von Istio kein Präfix aus einer angegebenen Liste haben. https://istio.io/latest/docs/reference/config/security/authorization-policy/ | Nein |
| AsmAuthzPolicyEnforceSourcePrincipals | Erfordert, dass das Istio AuthorizationPolicy-Feld "from", wenn definiert, Quellprinzipien hat, die auf etwas anderes als "*" gesetzt sein müssen. https://istio.io/latest/docs/reference/config/security/authorization-policy/ | Nein |
| AsmAuthzPolicyNormalization | Erzwingen Sie die Normalisierung der AuthorizationPolicy. Lesen Sie dazu https://istio.io/latest/docs/reference/config/security/normalization/. | Nein |
| AsmAuthzPolicySafePattern | Erzwingen Sie die sicheren Muster der AuthorizationPolicy. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#safer-authorization-policy-patterns. | Nein |
| AsmIngressgatewayLabel | Erzwingen Sie die Labelverwendung von Istio-Ingressgateways nur für Ingressgateway-Pods. | Nein |
| AsmPeerAuthnMeshStrictMtls | Erzwingen Sie die strikte mTLS PeerAuthentication auf Mesh-Ebene. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls. | Ja |
| AsmPeerAuthnStrictMtls | Erzwingen Sie, dass alle PeerAuthentications keine strikten mTLS überschreiben können. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls. | Nein |
| AsmRequestAuthnProhibitedOutputHeaders | Erzwingen Sie bei RequestAuthentication, dass das Feld „jwtRules.outPayloadToHeader“ keine bekannten HTTP-Anfrageheader oder benutzerdefinierten verbotenen Header enthält. Referenz zu https://istio.io/latest/docs/reference/config/security/jwt/#JWTRule. | Nein |
| AsmSidecarInjection | Erzwingen Sie, dass die istio-Proxy-Sidecar-Datei immer in die Workload-Pods eingefügt wird. | Nein |
| DestinationRuleTLSEnabled | Verbietet die Deaktivierung von TLS für alle Hosts und Hostteilmengen in Istio DestinationRules. | Nein |
| DisallowedAuthzPrefix | Erfordert, dass Hauptkonten und Namespaces in "AuthorizationPolicy"-Regeln von Istio kein Präfix aus einer angegebenen Liste haben. https://istio.io/latest/docs/reference/config/security/authorization-policy/ | Nein |
| GCPStorageLocationConstraintV1 | Beschränkt die zulässigen "Standorte" für StorageBucket Config Connector-Ressourcen auf die Liste der in der Einschränkung angegebenen Standorte. Bucket-Namen in der -Liste sind ausgenommen. | Nein |
| GkeSpotVMTerminationGrace | Erfordert Pods und Pod-Vorlagen mit "nodeSelector" oder "nodeAfffinty" von "gke-spot" mit einer "terminationGracePeriodSeconds" von maximal 15 Sekunden. | Ja |
| K8sAllowedRepos | Erfordert Container-Images, die mit einem String aus der angegebenen Liste beginnen sollen. | Nein |
| K8sAvoidUseOfSystemMastersGroup | Verhindert die Verwendung der Gruppe "system:masters". Hat keine Auswirkungen während der Prüfung. | Nein |
| K8sBlockAllIngress | Verhindert das Erstellen von Ingress-Objekten (Typen „Ingress“, „Gateway“ und „Service“ von „NodePort“ und „LoadBalancer“). | Nein |
| K8sBlockCreationWithDefaultServiceAccount | Verhindert das Erstellen von Ressourcen mit einem Standarddienstkonto. Hat keine Auswirkungen während der Prüfung. | Nein |
| K8sBlockEndpointEditDefaultRole | Viele Kubernetes-Installationen haben standardmäßig eine system:aggregate-to-edit ClusterRole, die den Zugriff auf die Bearbeitung von Endpunkten nicht richtig einschränkt. Dieses ConstraintTemplate verbietet der system:aggregate-to-edit ClusterRole, die Erlaubnis zur Erstellung/Patch/Aktualisierung von Endpunkten zu erteilen. ClusterRole/system:aggregation-to-edit sollte aufgrund von CVE-2021-25740-Berechtigungen, den Endpoint- und EndpointSlice-Berechtigungen, die Namespace-übergreifende Weiterleitung nicht zulassen, https://github.com/kubernetes/kubernetes/issues/103675. | Nein |
| K8sBlockLoadBalancer | Verhindert alle Dienste mit dem Typ LoadBalancer. https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer | Nein |
| K8sBlockNodePort | Verhindert alle Dienste mit dem Typ NodePort. https://kubernetes.io/docs/concepts/services-networking/service/#nodeport | Nein |
| K8sBlockObjectsOfType | Verhindert das Objekt unzulässiger Typen. | Nein |
| K8sBlockProcessNamespaceSharing | Unterbindet Pod-Spezifikationen, bei denen „shareProcessNamespace“ auf „true“ gesetzt ist. Dadurch werden Szenarien vermieden, in denen alle Container in einem Pod den gleichen PID-Namespace verwenden und auf das Dateisystem und den Arbeitsspeicher des jeweils anderen Systems zugreifen können. | Nein |
| K8sBlockWildcardIngress | Nutzer sollten keine Ingresses mit einem leeren oder Platzhalternamen (*) erstellen können, da sie dadurch Traffic für andere Dienste im Cluster abfangen könnten, selbst wenn sie keinen Zugriff auf diese Dienste haben. | Nein |
| K8sContainerEphemeralStorageLimit | Erfordert, dass für Container ein sitzungsspezifisches Speicherlimit festgelegt ist und dass das Limit innerhalb der angegebenen Höchstwerte liegt. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | Nein |
| K8sContainerLimits | Erfordert, dass in Containern Speicher- und CPU-Beschränkungen festgelegt sind, die innerhalb der angegebenen Höchstwerte liegen müssen. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | Nein |
| K8sContainerRatios | Legt ein maximales Verhältnis für Containerressourcenlimits zu Anfragen fest. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | Nein |
| K8sContainerRequests | Erfordert, dass in Containern Arbeitsspeicher- und CPU-Anfragen festgelegt sind und dass Anfragen innerhalb der angegebenen Höchstwerte liegen müssen. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | Nein |
| K8sCronJobAllowedRepos | Erfordert Container-Images von CronJobs, die mit einem String aus der angegebenen Liste beginnen sollen. | Nein |
| K8sDisallowAnonymous | Verbietet die Zuordnung von ClusterRole- und Rollen-Ressourcen zum Nutzer "system:anonymous" und zur Gruppe "system:unauthenticated". | Nein |
| K8sDisallowInteractiveTTY | Erfordert, dass für die Objekte die Felder "spec.tty" und "spec.stbin" auf "false" oder nicht festgelegt sind. | Nein |
| K8sDisallowedRepos | Unzulässige Container-Repositories, die mit einem String aus der angegebenen Liste beginnen. | Nein |
| K8sDisallowedRoleBindingSubjects | Unterbindet RoleBinding oder ClusterRoleBinding mit Subjekten, die mit einem als Parameter übergebenen "disallowedSubjects" übereinstimmen. | Nein |
| K8sDisallowedTags | Erfordert, dass Container-Images ein Image-Tag haben, das sich von denen in der angegebenen Liste unterscheidet. https://kubernetes.io/docs/concepts/containers/images/#image-names | Nein |
| K8sEmptyDirHasSizeLimit | Erfordert, dass alle "emptyDir"-Volumes ein "sizeLimit" angeben. Optional kann der Parameter „maxSizeLimit“ in der Einschränkung bereitgestellt werden, um eine maximal zulässige Größenbeschränkung anzugeben. | Nein |
| K8sEnforceCloudArmorBackendConfig | Erzwingt die Cloud Armor-Konfiguration für BackendConfig-Ressourcen | Nein |
| K8sEnforceConfigManagement | Erfordert das Vorhandensein und den Betrieb von Config Management. Einschränkungen, die dieses "ConstraintTemplate" verwenden, werden unabhängig vom "enforcementAction"-Wert nur geprüft. | Ja |
| K8sExternalIPs | Beschränkt externe IP-Adressen auf eine zulässige Liste von IP-Adressen. https://kubernetes.io/docs/concepts/services-networking/service/#external-ips | Nein |
| K8sHorizontalPodAutoscaler | Die folgenden Szenarien sollen bei der Bereitstellung von "HorizontalPodAutoscalers" 1 nicht zugelassen werden. Bereitstellung von HorizontalPodAutoscalern mit ".spec.minReplicas" oder ".spec.maxReplicas" außerhalb der in der Einschränkung 2 definierten Bereiche. Bereitstellung von HorizontalPodAutoscalern, bei denen der Unterschied zwischen ".spec.minReplicas" und ".spec.maxReplicas" kleiner als der konfigurierte "minimumReplicaSpread" 3 ist. Bereitstellung von HorizontalPodAutoscalern, die nicht auf ein gültiges "scaleTargetRef" verweisen (z. B. Deployment, ReplicationController, ReplicaSet, StatefulSet). | Ja |
| K8sHttpsOnly | Erfordert Ingress-Ressourcen, um nur HTTPS zu verwenden. Ingress-Ressourcen müssen die Annotation „kubernetes.io/ingress.allow-http“ enthalten, die auf „false“ gesetzt ist. Standardmäßig ist eine gültige TLS-{}-Konfiguration erforderlich. Dies kann optional durch Festlegen des Parameters „tlsOptional“ auf „true“ erfolgen. https://kubernetes.io/docs/concepts/services-networking/ingress/#TLS | Nein |
| K8sImageDigests | Erfordert, dass Container-Images einen Digest enthalten. https://kubernetes.io/docs/concepts/containers/images/ | Nein |
| K8sLocalStorageRequireSafeToEvict | Erfordert Pods, die lokalen Speicher („emptyDir“ oder „hostPath“) mit der Annotation „cluster-autoscaler.kubernetes.io/safe-to-evict“: „true“ verwenden. Cluster Autoscaler löscht Pods ohne diese Annotation nicht. | Nein |
| K8sMemoryRequestEqualsLimit | Erhöht die Pod-Stabilität. Dafür muss der angeforderte Speicher aller Container genau dem Speicherlimit entsprechen, sodass sich Pods nie in einem Zustand befinden, in dem die Speichernutzung den angeforderten Umfang überschreitet. Andernfalls kann Kubernetes Pods beenden, die zusätzlichen Speicher anfordern, wenn der Speicher auf dem Knoten benötigt wird. | Nein |
| K8sNoEnvVarSecrets | Verbindet Secrets als Umgebungsvariablen in Pod-Containerdefinitionen. Verwenden Sie stattdessen bereitgestellte Secret-Dateien in Datenvolumen: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod | Nein |
| K8sNoExternalServices | Verhindert das Erstellen bekannter Ressourcen, die Arbeitslasten für externe IP-Adressen verfügbar machen. Dazu gehören Istio-Gateway-Ressourcen und Kubernetes Ingress-Ressourcen. Kubernetes-Dienste sind ebenfalls nur zulässig, wenn sie die folgenden Kriterien erfüllen: Jeder Dienst vom Typ "LoadBalancer" in Google Cloud muss die Annotation "networking.gke.io/load-balancer-type": "Intern" haben. Jeder Dienst vom Typ „LoadBalancer“ in AWS muss die Annotation „service.beta.kubernetes.io/aws-load-balancer-internal“ haben. Alle "externen IP-Adressen" (außerhalb des Clusters), die an den Dienst gebunden sind, müssen Mitglied eines Bereichs internen CIDRs sein, wie für die Einschränkung angegeben. | Nein |
| K8sPSPAllowPrivilegeEscalationContainer | Steuert die Einschränkung der Eskalation auf Root-Berechtigungen. Entspricht dem Feld in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation | Nein |
| K8sPSPAllowedUsers | Steuert die Nutzer- und Gruppen-IDs des Containers und einige Volumes. Entspricht den Feldern "runAsUser", "runAsGroup"," sichernalGroups" und "fsGroup" in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups | Nein |
| K8sPSPAppArmor | Konfiguriert eine Zulassungsliste von AppArmor-Profilen für die Verwendung durch Container. Das entspricht bestimmten Annotationen, die auf eine PodSecurityPolicy angewendet werden. Informationen zu AppArmor finden Sie unter https://kubernetes.io/docs/tutorials/clusters/apparmor/ | Nein |
| K8sPSPAutomountServiceAccountTokenPod | Steuert die Fähigkeit jedes Pods, das automountServiceAccountToken zu aktivieren. | Nein |
| K8sPSPCapabilities | Steuert Linux-Funktionen für Container. Entspricht den Feldern "allowedCapabilities" und "requiredDropCapabilities" in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#functions | Nein |
| K8sPSPFSGroup | Steuert die Zuweisung einer FSGroup, die die Volumes des Pods besitzt. Entspricht dem Feld "fsGroup" in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | Nein |
| K8sPSPFlexVolumes | Steuert die Zulassungsliste der FlexVolume-Treiber. Entspricht dem Feld "allowedFlexVolumes" in PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#flexvolume-drivers. | Nein |
| K8sPSPForbiddenSysctls | Steuert das von Containern verwendete "sysctl"-Profil. Entspricht den Feldern "allowedUnsafeSysctls" und "ForbiddenSysctls" in einer PodSecurityPolicy. Wenn angegeben, wird jeder sysctl, der nicht im Parameter „allowedSysctls“ enthalten ist, als unzulässig betrachtet. Der Parameter "forbiddenSysctls" hat Vorrang vor dem Parameter "allowedSysctls". Weitere Informationen finden Sie unter https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ | Nein |
| K8sPSPHostFilesystem | Steuert die Nutzung des Hostdateisystems. Entspricht dem Feld in einer "allowedHostPaths". Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | Nein |
| K8sPSPHostNamespace | Verhindert die Freigabe von Host-PID- und IPC-Namespaces nach Pod-Containern. Entspricht den Feldern "hostPID" und "hostIPC" in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces | Nein |
| K8sPSPHostNetworkingPorts | Steuert die Nutzung des Hostnetzwerk-Namespace nach Pod-Containern. Bestimmte Ports müssen angegeben werden. Entspricht den Feldern "hostNetwork" und "hostPorts" in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces | Nein |
| K8sPSPPrivilegedContainer | Steuert die Fähigkeit eines Containers, den privilegierten Modus zu aktivieren. Entspricht dem Feld "privileged" in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged. | Nein |
| K8sPSPProcMount | Steuert die zulässigen "procMount"-Typen für den Container. Entspricht dem Feld allowedProcMountTypes" in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowprocmounttypes. | Nein |
| K8sPSPReadOnlyRootFilesystem | Erfordert die Verwendung eines schreibgeschützten Root-Dateisystems durch Pod-Container. Entspricht dem Feld `readOnlyRootFilesystem` in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | Nein |
| K8sPSPSELinuxV2 | Definiert eine Zulassungsliste von seLinuxOptions-Konfigurationen für Pod-Container. Entspricht einer PodSecurityPolicy, die SELinux-Konfigurationen erfordert. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux | Nein |
| K8sPSPSeccomp | Steuert das von Containern verwendete seccomp-Profil. Entspricht der Annotation „seccomp.security.alpha.kubernetes.io/allowedProfileNames“ in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp | Nein |
| K8sPSPVolumeTypes | Beschränkt die bereitstellbaren Volume-Typen auf die vom Nutzer angegebenen Volumes. Entspricht dem Feld `volumes` in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | Nein |
| K8sPSPWindowsHostProcess | Schränkt die Ausführung von Windows HostProcess-Containern/-Pods ein. Weitere Informationen finden Sie unter https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/. | Nein |
| K8sPSSRunAsNonRoot | Erfordert, dass Container als Nutzer ohne Root-Berechtigung ausgeführt werden. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/security/pod-security-standards/ | Nein |
| K8sPodDisruptionBudget | Die folgenden Szenarien sollen bei der Bereitstellung von PodDisruptionBudgets oder Ressourcen, die die Replikatunterressource implementieren (z. B. Deployment, ReplicationController, ReplicaSet, StatefulSet), nicht zugelassen werden: 1. Bereitstellung von PodDisruptionBudgets mit .spec.maxUnavailable == 0. 2. Bereitstellung von PodDisruptionBudgets mit .spec.minAvailable == .spec.replicas der Ressource mit Replikatunterressource. Dies verhindert, dass PodDisruptionBudgets freiwillige Störungen wie das Leeren von Knoten blockieren. https://kubernetes.io/docs/concepts/workloads/Pods/Unterbrechungen/ | Ja |
| K8sPodResourcesBestPractices | Erfordert, dass Container nicht auf Best-Effort-Basis (durch Festlegen von CPU- und Arbeitsspeicheranforderungen) und gemäß den Best Practices für Bursts funktionieren (die Arbeitsspeicherspeicheranfrage muss genau dem Limit entsprechen). Optional können Annotationsschlüssel konfiguriert werden, um das Überspringen der verschiedenen Validierungen zu ermöglichen. | Nein |
| K8sPodsRequireSecurityContext | Erfordert, dass alle Pods securityContext definieren. Erfordert, dass alle in Pods definierten Container einen SecurityContext auf Pod- oder Containerebene definieren. | Nein |
| K8sProhibitRoleWildcardAccess | Erfordert, dass Roles und ClusterRoles den Ressourcenzugriff nicht auf einen Platzhalterwert ("*") festlegen. Dies gilt nicht für die ausgenommenen Roles und ClusterRoles, die als Ausnahmen angegeben werden. Beschränkt den Platzhalterzugriff auf untergeordnete Ressourcen wie „*/status“. | Nein |
| K8sReplicaLimits | Erfordert, dass Objekte mit dem Feld "spec.replicas" (Deployments, ReplicaSets usw.) eine Anzahl von Replikaten innerhalb definierter Bereiche angeben. | Nein |
| K8sRequireAdmissionController | Erfordert entweder "Pod Security Admission" oder ein externes Richtlinienkontrollsystem | Ja |
| K8sRequireBinAuthZ | Erfordert validierenden Zulassungs-Webhook der Binärautorisierung. Einschränkungen, die dieses "ConstraintTemplate" verwenden, werden unabhängig vom "enforcementAction"-Wert nur geprüft. | Ja |
| K8sRequireCosNodeImage | Erzwingt die Verwendung von Container-Optimized OS von Google auf Knoten. | Nein |
| K8sRequireDaemonsets | Erfordert die vorhandene Liste der Daemonsets. | Ja |
| K8sRequireDefaultDenyEgressPolicy | Erfordert, dass jeder im Cluster definierte Namespace eine standardmäßige NetworkPolicy für ausgehenden Traffic hat. | Ja |
| K8sRequireNamespaceNetworkPolicies | Erfordert, dass jeder im Cluster definierte Namespace eine NetworkPolicy hat. | Ja |
| K8sRequireValidRangesForNetworks | Erzwingt, welche CIDR-Blöcke für eingehenden und ausgehenden Netzwerktraffic zulässig sind. | Nein |
| K8sRequiredAnnotations | Erfordert Ressourcen, die bestimmte Annotationen enthalten, wobei Werte mit den regulären Ausdrücken übereinstimmen. | Nein |
| K8sRequiredLabels | Erfordert, dass Ressourcen bestimmte Labels enthalten, wobei Werte mit den regulären Ausdrücken übereinstimmen. | Nein |
| K8sRequiredProbes | Erfordert, dass Pods über Bereitschafts- und/oder Aktivitätsprüfungen verfügen. | Nein |
| K8sRequiredResources | Erfordert, dass Container definierte Ressourcen festlegen. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | Nein |
| K8sRestrictAdmissionController | Dynamische Zulassungs-Controller auf zulässige Zulassungs-Controller beschränken | Nein |
| K8sRestrictAutomountServiceAccountTokens | Beschränkt die Verwendung von Dienstkonto-Tokens. | Nein |
| K8sRestrictLabels | Verhindert, dass Ressourcen bestimmte Labels enthalten, es sei denn, es gibt eine Ausnahme für die jeweilige Ressource. | Nein |
| K8sRestrictNamespaces | Schränkt die Verwendung von Namespaces durch Ressourcen ein, die unter dem Parameter restrictedNamespaces aufgeführt sind. | Nein |
| K8sRestrictNfsUrls | Verhindert, dass Ressourcen NFS-URLs enthalten, sofern nicht anders angegeben. | Nein |
| K8sRestrictRbacSubjects | Schränkt die Verwendung von Namen in RBAC auf zulässige Werte ein. | Nein |
| K8sRestrictRoleBindings | Beschränkt die in ClusterRoleBindings und RoleBindings angegebenen Subjekte auf eine Liste zulässiger Subjekte. | Nein |
| K8sRestrictRoleRules | Schränkt Regeln ein, die für Role- und ClusterRole-Objekte festgelegt werden können. | Nein |
| K8sStorageClass | Erfordert die Angabe von Speicherklassen, wenn verwendet. Nur Gatekeeper 3.9+ und nicht sitzungsspezifische Container werden unterstützt. | Ja |
| K8sUniqueIngressHost | Alle Ingress-Regelhosts müssen eindeutig sein. Unterstützt keine Hostnamen-Platzhalter: https://kubernetes.io/docs/concepts/services-networking/ingress/ | Ja |
| K8sUniqueServiceSelector | Dienste müssen einen eindeutigen Selektor innerhalb eines Namespace haben. Selektoren werden als identisch betrachtet, wenn sie identische Schlüssel und Werte haben. Selektoren können ein Schlüssel/Wert-Paar verwenden, solange sich mindestens ein separates Schlüssel/Wert-Paar zwischen ihnen befindet. https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service | Ja |
| NoUpdateServiceAccount | Blockiert das Aktualisieren des Dienstkontos für Ressourcen, die über Pods abstrahiert werden. Diese Richtlinie wird im Prüfmodus ignoriert. | Nein |
| PolicyStrictOnly | Erfordert, dass die gegenseitige TLS-Authentifizierung von IstioT immer angegeben wird, wenn [PeerAuthentication](https://istio.io/latest/docs/reference/config/security/peer_authentication/) verwendet wird. Mit dieser Einschränkung wird auch sichergestellt, dass die verworfene [Richtlinie](https://istio.io/v1.4/docs/reference/config/security/istio.authentication.v1alpha1/#Policy) und die MeshPolicy-Ressourcen gegenseitiges TLS des Typs „STRICT“ erzwingen. Weitere Informationen finden Sie unter https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/#lock-down-mutual-tls-for-the-entire-mesh | Nein |
| RestrictNetworkExclusions | Steuert, welche Eingangs-Ports, Ausgangs-Ports und Ausgangs-IP-Bereiche von der Istio-Netzwerkerfassung ausgeschlossen werden können. Ports und IP-Bereiche, die die Istio-Netzwerkerfassung umgehen, werden vom Istio-Proxy nicht verarbeitet und unterliegen nicht der Authentifizierung, der Autorisierungsrichtlinie und anderen Istio-Features von Istio mTLS. Mithilfe dieser Einschränkung können Einschränkungen auf die Verwendung der folgenden Annotationen angewendet werden:
Weitere Informationen finden Sie unter https://istio.io/latest/docs/reference/config/annotations/. Beim Einschränken von Ausgangs-IP-Bereichen berechnet die Einschränkung, ob ausgeschlossene IP-Bereiche übereinstimmen oder ein Teil der zulässigen IP-Bereichsausschlüsse sind. Wenn Sie diese Einschränkung verwenden, müssen alle Eingangs- und Ausgangs-IP-Bereiche immer einbezogen werden. Setzen Sie dazu entweder die entsprechenden "include"-Annotationen auf "*" oder legen Sie sie nicht fest. Das Festlegen einer der folgenden Anmerkungen auf etwas anderes als"*" ist nicht zulässig:
Mit dieser Einschränkung kann Port 15020 immer ausgeschlossen werden, da der Istio-Sidecar-Injektor immer die Annotation |
Nein |
| SourceNotAllAuthz | Erfordert, dass die AuthorizationPolicy-Regeln von Istio Quellhauptkonten auf etwas anderes als "*" gesetzt haben. https://istio.io/latest/docs/reference/config/security/authorization-policy/ | Nein |
| VerifyDeprecatedAPI | Verifiziert verworfene Kubernetes APIs, um sicherzustellen, dass alle API-Versionen aktuell sind. Diese Vorlage gilt nicht für Audits, da Audits die Ressourcen betrachten, die bereits im Cluster mit nicht verworfenen API-Versionen vorhanden sind. | Nein |
AllowedServicePortName
Allowed Service Port Names v1.0.1
Erfordert, dass Dienstportnamen ein Präfix aus einer angegebenen Liste haben.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AllowedServicePortName
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# prefixes <array>: Prefixes of allowed service port names.
prefixes:
- <string>
Beispiele
port-name-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AllowedServicePortName
metadata:
name: port-name-constraint
spec:
enforcementAction: deny
match:
kinds:
- apiGroups:
- ""
kinds:
- Service
parameters:
prefixes:
- http-
- http2-
- grpc-
- mongo-
- redis-
- tcp-
Zulässig
apiVersion: v1
kind: Service
metadata:
labels:
app: helloworld
name: port-name-http
spec:
ports:
- name: http-helloport
port: 5000
selector:
app: helloworld
Nicht zugelassen
apiVersion: v1
kind: Service
metadata:
labels:
app: helloworld
name: port-name-tcp
spec:
ports:
- name: foo-helloport
port: 5000
selector:
app: helloworld
apiVersion: v1
kind: Service
metadata:
labels:
app: helloworld
name: port-name-bad
spec:
ports:
- name: helloport
port: 5000
selector:
app: helloworld
AsmAuthzPolicyDefaultDeny
ASM AuthorizationPolicy Default Deny v1.0.4
Erzwingen Sie die AuthorizationPolicy für standardmäßige Ablehnung auf Mesh-Ebene. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#use-default-deny-patterns.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# rootNamespace <string>: Anthos Service Mesh root namespace, default value
# is "istio-system" if not specified.
rootNamespace: <string>
# strictnessLevel <string>: Level of AuthorizationPolicy strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "security.istio.io"
version: "v1beta1"
kind: "AuthorizationPolicy"
Beispiele
asm-authz-policy-default-deny-with-input-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-with-input-constraint
spec:
enforcementAction: dryrun
parameters:
rootNamespace: istio-system
strictnessLevel: High
Zulässig
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-with-input-constraint
spec:
enforcementAction: dryrun
parameters:
rootNamespace: istio-system
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: default-deny-no-action
namespace: istio-system
spec: null
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-with-input-constraint
spec:
enforcementAction: dryrun
parameters:
rootNamespace: istio-system
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: default-deny-with-action
namespace: istio-system
spec:
action: ALLOW
Nicht zugelassen
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-with-input-constraint
spec:
enforcementAction: dryrun
parameters:
rootNamespace: istio-system
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: not-default-deny
namespace: istio-system
spec:
action: DENY
rules:
- to:
- operation:
notMethods:
- GET
- POST
asm-authz-policy-default-deny-no-input-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-no-input-constraint
spec:
enforcementAction: dryrun
parameters:
strictnessLevel: High
Zulässig
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-no-input-constraint
spec:
enforcementAction: dryrun
parameters:
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: default-deny-no-action
namespace: istio-system
spec: null
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-no-input-constraint
spec:
enforcementAction: dryrun
parameters:
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: default-deny-with-action
namespace: istio-system
spec:
action: ALLOW
Nicht zugelassen
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: asm-authz-policy-default-deny-no-input-constraint
spec:
enforcementAction: dryrun
parameters:
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: not-default-deny
namespace: istio-system
spec:
action: DENY
rules:
- to:
- operation:
notMethods:
- GET
- POST
AsmAuthzPolicyDisallowedPrefix
ASM AuthorizationPolicy Disallowed Prefixes v1.0.2
Erfordert, dass Hauptkonten und Namespaces in AuthorizationPolicy-Regeln von Istio kein Präfix aus einer angegebenen Liste haben.
https://istio.io/latest/docs/reference/config/security/authorization-policy/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDisallowedPrefix
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# disallowedNamespacePrefixes <array>: Disallowed prefixes for namespaces.
disallowedNamespacePrefixes:
- <string>
# disallowedPrincipalPrefixes <array>: Disallowed prefixes for principals.
disallowedPrincipalPrefixes:
- <string>
Beispiele
asm-authz-policy-disallowed-prefix-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDisallowedPrefix
metadata:
name: asm-authz-policy-disallowed-prefix-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- AuthorizationPolicy
parameters:
disallowedNamespacePrefixes:
- bad-ns-prefix
- worse-ns-prefix
disallowedPrincipalPrefixes:
- bad-principal-prefix
- worse-principal-prefix
Zulässig
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: valid-authz-policy
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- source:
namespaces:
- test
selector:
matchLabels:
app: httpbin
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: bad-source-principal
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/worse-principal-prefix-sleep
- source:
namespaces:
- test
selector:
matchLabels:
app: httpbin
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: bad-source-namespace
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- source:
namespaces:
- bad-ns-prefix-test
selector:
matchLabels:
app: httpbin
AsmAuthzPolicyEnforceSourcePrincipals
ASM AuthorizationPolicy Enforcement Principals v1.0.2
Erfordert, dass das Istio AuthorizationPolicy-Feld "from", wenn definiert, Quellprinzipien hat, die auf etwas anderes als "*" gesetzt sein müssen. https://istio.io/latest/docs/reference/config/security/authorization-policy/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyEnforceSourcePrincipals
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
asm-authz-policy-enforce-source-principals-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyEnforceSourcePrincipals
metadata:
name: asm-authz-policy-enforce-source-principals-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- AuthorizationPolicy
Zulässig
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: valid-authz-policy
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: no-source-principals
spec:
rules:
- from:
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: source-principals-wildcard
spec:
rules:
- from:
- source:
principals:
- '*'
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: source-principals-contains-wildcard
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- '*'
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
AsmAuthzPolicyNormalization
ASM AuthorizationPolicy Normalization v1.0.2
Erzwingen Sie die Normalisierung der AuthorizationPolicy. Lesen Sie dazu https://istio.io/latest/docs/reference/config/security/normalization/.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyNormalization
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
asm-authz-policy-normalization-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyNormalization
metadata:
name: asm-authz-policy-normalization-sample
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- AuthorizationPolicy
Zulässig
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: good-authz-policy
spec:
action: ALLOW
rules:
- to:
- operation:
methods:
- GET
paths:
- /test/foo
- when:
- key: source.ip
values:
- 10.1.2.3
- 10.2.0.0/16
- key: request.headers[User-Agent]
values:
- Mozilla/*
selector:
matchLabels:
app: httpbin
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: bad-method-lowercase
spec:
action: ALLOW
rules:
- to:
- operation:
methods:
- get
selector:
matchLabels:
app: httpbin
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: bad-request-header-whitespace
spec:
action: ALLOW
rules:
- to:
- operation:
methods:
- GET
- when:
- key: source.ip
values:
- 10.1.2.3
- 10.2.0.0/16
- key: request.headers[User-Ag ent]
values:
- Mozilla/*
selector:
matchLabels:
app: httpbin
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: path-unnormalized
spec:
action: ALLOW
rules:
- to:
- operation:
methods:
- GET
paths:
- /test\/foo
- when:
- key: source.ip
values:
- 10.1.2.3
- 10.2.0.0/16
- key: request.headers[User-Agent]
values:
- Mozilla/*
selector:
matchLabels:
app: httpbin
AsmAuthzPolicySafePattern
ASM AuthorizationPolicy Safe Patterns v1.0.4
Erzwingen Sie die sicheren Muster der AuthorizationPolicy. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#safer-authorization-policy-patterns.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicySafePattern
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# strictnessLevel <string>: Level of AuthorizationPolicy strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Beispiele
asm-authz-policy-safe-pattern-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicySafePattern
metadata:
name: asm-authz-policy-safe-pattern-sample
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- AuthorizationPolicy
parameters:
strictnessLevel: High
Zulässig
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: good-authz-policy-istio-ingress
spec:
action: ALLOW
rules:
- to:
- operation:
hosts:
- test.com
- test.com:*
methods:
- GET
selector:
matchLabels:
istio: ingressgateway
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: good-authz-policy-asm-ingress
spec:
action: ALLOW
rules:
- to:
- operation:
hosts:
- test.com
- test.com:*
methods:
- GET
selector:
matchLabels:
asm: ingressgateway
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: hosts-on-noningress
spec:
action: ALLOW
rules:
- to:
- operation:
hosts:
- test.com
- test.com:*
methods:
- GET
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: invalid-hosts
spec:
action: ALLOW
rules:
- to:
- operation:
hosts:
- test.com
methods:
- GET
selector:
matchLabels:
istio: ingressgateway
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: allow-negative-match
spec:
action: ALLOW
rules:
- to:
- operation:
hosts:
- test.com
- test.com:*
notMethods:
- GET
selector:
matchLabels:
istio: ingressgateway
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: deny-positive-match
spec:
action: DENY
rules:
- to:
- operation:
hosts:
- test.com
- test.com:*
methods:
- GET
selector:
matchLabels:
istio: ingressgateway
AsmIngressgatewayLabel
ASM Ingress Gateway Label v1.0.3
Erzwingen Sie die Labelverwendung von Istio-Ingressgateways nur für Ingressgateway-Pods.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmIngressgatewayLabel
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
asm-ingressgateway-label-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmIngressgatewayLabel
metadata:
name: asm-ingressgateway-label-sample
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: sleep
istio: istio
name: sleep
spec:
containers:
- image: curlimages/curl
name: sleep
- image: gcr.io/gke-release/asm/proxyv2:release
name: istio-proxy
ports:
- containerPort: 15090
name: http-envoy-prom
protocol: TCP
apiVersion: v1
kind: Pod
metadata:
labels:
app: istio-ingressgateway
istio: ingressgateway
name: istio-ingressgateway
spec:
containers:
- image: gcr.io/gke-release/asm/proxyv2:release
name: istio-proxy
ports:
- containerPort: 15090
name: http-envoy-prom
protocol: TCP
apiVersion: v1
kind: Pod
metadata:
labels:
app: asm-ingressgateway
asm: ingressgateway
name: asm-ingressgateway
spec:
containers:
- image: gcr.io/gke-release/asm/proxyv2:release
name: istio-proxy
ports:
- containerPort: 15090
name: http-envoy-prom
protocol: TCP
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: sleep
istio: ingressgateway
name: sleep
spec:
containers:
- image: curlimages/curl
name: sleep
apiVersion: v1
kind: Pod
metadata:
labels:
app: sleep
asm: ingressgateway
name: sleep
spec:
containers:
- image: curlimages/curl
name: sleep
apiVersion: v1
kind: Pod
metadata:
labels:
app: sleep
istio: ingressgateway
name: sleep
spec:
containers:
- image: curlimages/curl
name: sleep
- image: gcr.io/gke-release/asm/proxyv2:release
name: istio-proxy
ports:
- containerPort: 15090
name: http-envoy-prom
protocol: TCP
AsmPeerAuthnMeshStrictMtls
ASM Peer Authentication Mesh Strict mTLS v1.0.4
Erzwingen Sie die strikte mTLS PeerAuthentication auf Mesh-Ebene. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# rootNamespace <string>: Anthos Service Mesh root namespace, default value
# is "istio-system" if not specified.
rootNamespace: <string>
# strictnessLevel <string>: Level of PeerAuthentication strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "security.istio.io"
version: "v1beta1"
kind: "PeerAuthentication"
Beispiele
asm-peer-authn-mesh-strict-mtls-with-input-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: asm-peer-authn-mesh-strict-mtls-with-input-constraint
spec:
enforcementAction: dryrun
parameters:
rootNamespace: asm-root
strictnessLevel: High
Zulässig
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: asm-peer-authn-mesh-strict-mtls-with-input-constraint
spec:
enforcementAction: dryrun
parameters:
rootNamespace: asm-root
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mesh-strict-mtls
namespace: asm-root
spec:
mtls:
mode: STRICT
Nicht zugelassen
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: asm-peer-authn-mesh-strict-mtls-with-input-constraint
spec:
enforcementAction: dryrun
parameters:
rootNamespace: asm-root
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mesh-permissive-mtls
namespace: asm-root
spec:
mtls:
mode: PERMISSIVE
asm-peer-authn-mesh-strict-mtls-no-input-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: asm-peer-authn-mesh-strict-mtls-no-input-constraint
spec:
enforcementAction: dryrun
parameters:
strictnessLevel: High
Zulässig
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: asm-peer-authn-mesh-strict-mtls-no-input-constraint
spec:
enforcementAction: dryrun
parameters:
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mesh-strict-mtls
namespace: istio-system
spec:
mtls:
mode: STRICT
Nicht zugelassen
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: asm-peer-authn-mesh-strict-mtls-no-input-constraint
spec:
enforcementAction: dryrun
parameters:
strictnessLevel: High
---
# Referential Data
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mesh-permissive-mtls
namespace: istio-system
spec:
mtls:
mode: PERMISSIVE
AsmPeerAuthnStrictMtls
ASM Peer Authentication Strict mTLS v1.0.3
Erzwingen Sie, dass alle PeerAuthentications keine strikten mTLS überschreiben können. Lesen Sie dazu https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnStrictMtls
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# strictnessLevel <string>: Level of PeerAuthentication strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Beispiele
asm-peer-authn-strict-mtls-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnStrictMtls
metadata:
name: asm-peer-authn-strict-mtls-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- PeerAuthentication
parameters:
strictnessLevel: High
Zulässig
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: valid-strict-mtls-pa
namespace: foo
spec:
mtls:
mode: UNSET
portLevelMtls:
"80":
mode: UNSET
"443":
mode: STRICT
selector:
matchLabels:
app: bar
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: invalid-permissive-mtls-pa
namespace: foo
spec:
mtls:
mode: PERMISSIVE
portLevelMtls:
"80":
mode: UNSET
"443":
mode: STRICT
selector:
matchLabels:
app: bar
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: invalid-port-disable-mtls-pa
namespace: foo
spec:
mtls:
mode: UNSET
portLevelMtls:
"80":
mode: DISABLE
"443":
mode: STRICT
selector:
matchLabels:
app: bar
AsmRequestAuthnProhibitedOutputHeaders
ASM RequestAuthentication Prohibited Output Headers v1.0.2
Erzwingen Sie bei RequestAuthentication, dass das Feld jwtRules.outPayloadToHeader keine bekannten HTTP-Anfrageheader oder benutzerdefinierten verbotenen Header enthält. Referenz zu https://istio.io/latest/docs/reference/config/security/jwt/#JWTRule.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmRequestAuthnProhibitedOutputHeaders
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# prohibitedHeaders <array>: User predefined prohibited headers.
prohibitedHeaders:
- <string>
Beispiele
asm-request-authn-prohibited-output-headers-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmRequestAuthnProhibitedOutputHeaders
metadata:
name: asm-request-authn-prohibited-output-headers-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- RequestAuthentication
parameters:
prohibitedHeaders:
- Bad-Header
- X-Bad-Header
Zulässig
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
name: valid-request-authn
namespace: istio-system
spec:
jwtRules:
- issuer: example.com
outputPayloadToHeader: Good-Header
selector:
matchLabels:
app: istio-ingressgateway
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
name: deny-predefined-output-header
namespace: istio-system
spec:
jwtRules:
- issuer: example.com
outputPayloadToHeader: Host
selector:
matchLabels:
app: istio-ingressgateway
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
name: deny-predefined-output-header
namespace: istio-system
spec:
jwtRules:
- issuer: example.com
outputPayloadToHeader: X-Bad-Header
selector:
matchLabels:
app: istio-ingressgateway
AsmSidecarInjection
ASM Sidecar Injection v1.0.2
Erzwingen Sie, dass die istio-Proxy-Sidecar-Datei immer in die Workload-Pods eingefügt wird.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmSidecarInjection
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# strictnessLevel <string>: Level of sidecar injection strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Beispiele
asm-sidecar-injection-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmSidecarInjection
metadata:
name: asm-sidecar-injection-sample
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
strictnessLevel: High
Zulässig
apiVersion: v1
kind: Pod
metadata:
annotations:
sidecar.istio.io/inject: "true"
name: sleep
spec:
containers:
- image: curlimages/curl
name: sleep
- image: gcr.io/gke-release/asm/proxyv2:release
name: istio-proxy
ports:
- containerPort: 15090
name: http-envoy-prom
protocol: TCP
apiVersion: v1
kind: Pod
metadata:
annotations:
"false": "false"
name: sleep
spec:
containers:
- image: curlimages/curl
name: sleep
- image: gcr.io/gke-release/asm/proxyv2:release
name: istio-proxy
ports:
- containerPort: 15090
name: http-envoy-prom
protocol: TCP
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
annotations:
sidecar.istio.io/inject: "false"
name: sleep
spec:
containers:
- image: curlimages/curl
name: sleep
DestinationRuleTLSEnabled
Destination Rule TLS Enabled v1.0.1
Verbietet die Deaktivierung von TLS für alle Hosts und Hostteilmengen in Istio DestinationRules.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DestinationRuleTLSEnabled
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
dr-tls-enabled
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DestinationRuleTLSEnabled
metadata:
name: dr-tls-enabled
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- networking.istio.io
kinds:
- DestinationRule
Unzulässig
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: dr-subset-tls-disable
namespace: default
spec:
host: myservice
subsets:
- name: v1
trafficPolicy:
tls:
mode: DISABLE
- name: v2
trafficPolicy:
tls:
mode: SIMPLE
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: dr-traffic-tls-disable
namespace: default
spec:
host: myservice
trafficPolicy:
tls:
mode: DISABLE
DisallowedAuthzPrefix
Disallow Istio AuthorizationPolicy Prefixes v1.0.2
Erfordert, dass Hauptkonten und Namespaces in AuthorizationPolicy-Regeln von Istio kein Präfix aus einer angegebenen Liste haben.
https://istio.io/latest/docs/reference/config/security/authorization-policy/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DisallowedAuthzPrefix
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# disallowedprefixes <array>: Disallowed prefixes of principals and
# namespaces.
disallowedprefixes:
- <string>
Beispiele
disallowed-authz-prefix-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DisallowedAuthzPrefix
metadata:
name: disallowed-authz-prefix-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- AuthorizationPolicy
parameters:
disallowedprefixes:
- badprefix
- reallybadprefix
Zulässig
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: good
namespace: foo
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
version: v1
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: bad-source-principal
namespace: foo
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/badprefix-sleep
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
version: v1
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: bad-source-namespace
namespace: foo
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- source:
namespaces:
- badprefix-test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
version: v1
GCPStorageLocationConstraintV1
GCP Storage Location Constraint v1.0.3
Beschränkt den zulässigen locations für StorageBucket Config Connector-Ressourcen auf die Liste der in der Einschränkung angegebenen Standorte. Bucket-Namen in der exemptions-Liste sind ausgenommen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: GCPStorageLocationConstraintV1
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptions <array>: A list of bucket names that are exempt from this
# constraint.
exemptions:
- <string>
# locations <array>: A list of locations that a bucket is permitted to
# have.
locations:
- <string>
Beispiele
singapore-and-jakarta-only
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: GCPStorageLocationConstraintV1
metadata:
name: singapore-and-jakarta-only
spec:
enforcementAction: deny
match:
kinds:
- apiGroups:
- storage.cnrm.cloud.google.com
kinds:
- StorageBucket
parameters:
exemptions:
- my_project_id_cloudbuild
locations:
- asia-southeast1
- asia-southeast2
Zulässig
apiVersion: storage.cnrm.cloud.google.com/v1beta1 kind: StorageBucket metadata: name: bucket-in-permitted-location spec: location: asia-southeast1
Nicht zugelassen
apiVersion: storage.cnrm.cloud.google.com/v1beta1 kind: StorageBucket metadata: name: bucket-in-disallowed-location spec: location: us-central1
apiVersion: storage.cnrm.cloud.google.com/v1beta1 kind: StorageBucket metadata: name: bucket-without-specific-location spec: null
GkeSpotVMTerminationGrace
Restricts terminationGracePeriodSeconds for GKE Spot VMs v1.1.3
Erfordert Pods und Pod-Vorlagen mit nodeSelector oder nodeAfffinty von gke-spot, um einen terminationGracePeriodSeconds von maximal 15 Sekunden zu haben.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: GkeSpotVMTerminationGrace
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# includePodOnSpotNodes <boolean>: Require `terminationGracePeriodSeconds`
# of 15s or less for all `Pod` on a `gke-spot` Node.
includePodOnSpotNodes: <boolean>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: ""
version: "v1"
kind: "Node"
Beispiele
spotvm-termination-grace
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: GkeSpotVMTerminationGrace
metadata:
name: spotvm-termination-grace
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
includePodOnSpotNodes: true
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: example-allowed
spec:
containers:
- image: nginx
name: nginx
nodeSelector:
cloud.google.com/gke-spot: "true"
terminationGracePeriodSeconds: 15
apiVersion: v1
kind: Pod
metadata:
name: example-allowed
spec:
containers:
- image: nginx
name: nginx
nodeSelector:
cloud.google.com/gke-spot: "true"
terminationGracePeriodSeconds: 15
apiVersion: v1
kind: Pod
metadata:
name: example-with-termGrace
spec:
Nodename: default
containers:
- image: nginx
name: nginx
terminationGracePeriodSeconds: 15
---
# Referential Data
apiVersion: v1
kind: Node
metadata:
labels:
cloud.google.com/gke-spot: "true"
name: default
apiVersion: v1
kind: Pod
metadata:
name: example-with-termGrace
spec:
Nodename: default
containers:
- image: nginx
name: nginx
terminationGracePeriodSeconds: 15
---
# Referential Data
apiVersion: v1
kind: Node
metadata:
name: default
apiVersion: v1
kind: Pod
metadata:
name: example-without-termGrace
spec:
Nodename: default
containers:
- image: nginx
name: nginx
---
# Referential Data
apiVersion: v1
kind: Node
metadata:
name: default
Unzulässig
apiVersion: v1
kind: Pod
metadata:
name: example-disallowed
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: cloud.google.com/gke-spot
operator: In
values:
- "true"
containers:
- image: nginx
name: nginx
terminationGracePeriodSeconds: 30
apiVersion: v1
kind: Pod
metadata:
name: example-disallowed
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: cloud.google.com/gke-spot
operator: In
values:
- "true"
containers:
- image: nginx
name: nginx
apiVersion: v1
kind: Pod
metadata:
name: example-disallowed
spec:
containers:
- image: nginx
name: nginx
nodeSelector:
cloud.google.com/gke-spot: "true"
terminationGracePeriodSeconds: 30
apiVersion: v1
kind: Pod
metadata:
name: example-disallowed
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: cloud.google.com/gke-spot
operator: In
values:
- "true"
containers:
- image: nginx
name: nginx
apiVersion: v1
kind: Pod
metadata:
name: example-without-termGrace
spec:
Nodename: default
containers:
- image: nginx
name: nginx
---
# Referential Data
apiVersion: v1
kind: Node
metadata:
labels:
cloud.google.com/gke-spot: "true"
name: default
K8sAllowedRepos
Erlaubte Repositories v1.0.1
Erfordert Container-Images, die mit einem String aus der angegebenen Liste beginnen sollen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# repos <array>: The list of prefixes a container image is allowed to have.
repos:
- <string>
Beispiele
repo-is-openpolicyagent
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
name: repo-is-openpolicyagent
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
namespaces:
- default
parameters:
repos:
- openpolicyagent/
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 30Mi
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: nginx-disallowed
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 100m
memory: 30Mi
apiVersion: v1
kind: Pod
metadata:
name: nginx-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 30Mi
initContainers:
- image: nginx
name: nginxinit
resources:
limits:
cpu: 100m
memory: 30Mi
apiVersion: v1
kind: Pod
metadata:
name: nginx-disallowed
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 100m
memory: 30Mi
initContainers:
- image: nginx
name: nginxinit
resources:
limits:
cpu: 100m
memory: 30Mi
apiVersion: v1
kind: Pod
metadata:
name: nginx-disallowed
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 100m
memory: 30Mi
ephemeralContainers:
- image: nginx
name: nginx
resources:
limits:
cpu: 100m
memory: 30Mi
initContainers:
- image: nginx
name: nginx
resources:
limits:
cpu: 100m
memory: 30Mi
K8sAvoidUseOfSystemMastersGroup
Disallow the use of 'system:masters' group v1.0.0
Verhindert die Verwendung der Gruppe "system:masters". Hat keine Auswirkungen während der Prüfung.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAvoidUseOfSystemMastersGroup
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowlistedUsernames <array>: allowlistedUsernames is the list of
# usernames that are allowed to use system:masters group.
allowlistedUsernames:
- <string>
Beispiele
avoid-use-of-system-masters-group
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sAvoidUseOfSystemMastersGroup metadata: name: avoid-use-of-system-masters-group
Zugelassen
apiVersion: v1 kind: Namespace metadata: name: example-namespace
K8sBlockAllIngress
Ingress v1.0.4 vollständig blockieren
Verhindert das Erstellen von Ingress-Objekten (die Typen Ingress, Gateway und Service von NodePort und LoadBalancer).
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockAllIngress
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowList <array>: A list of regular expressions for the Ingress object
# names that are exempt from the constraint.
allowList:
- <string>
Beispiele
block-all-ingress
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockAllIngress
metadata:
name: block-all-ingress
spec:
enforcementAction: dryrun
parameters:
allowList:
- name1
- name2
- name3
- my-*
Zulässig
apiVersion: v1
kind: Service
metadata:
name: my-service
spec:
ports:
- port: 80
protocol: TCP
targetPort: 9376
selector:
app.kubernetes.io/name: MyApp
type: LoadBalancer
apiVersion: v1
kind: Service
metadata:
name: allowed-clusterip-service-example
spec:
ports:
- port: 80
protocol: TCP
targetPort: 9376
selector:
app.kubernetes.io/name: MyApp
type: ClusterIP
Nicht zugelassen
apiVersion: v1
kind: Service
metadata:
name: disallowed-service-example
spec:
ports:
- port: 80
protocol: TCP
targetPort: 9376
selector:
app.kubernetes.io/name: MyApp
type: LoadBalancer
apiVersion: v1
kind: Service
metadata:
name: disallowed-service-example
spec:
ports:
- port: 80
protocol: TCP
targetPort: 9376
selector:
app.kubernetes.io/name: MyApp
type: LoadBalancer
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: disallowed-gateway-example
spec:
gatewayClassName: istio
listeners:
- allowedRoutes:
namespaces:
from: All
hostname: '*.example.com'
name: default
port: 80
protocol: HTTP
K8sBlockCreationWithDefaultServiceAccount
Block Creation with Default Service Account v1.0.2
Verhindert das Erstellen von Ressourcen mit einem Standarddienstkonto. Hat keine Auswirkungen während der Prüfung.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockCreationWithDefaultServiceAccount
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
block-creation-with-default-serviceaccount
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockCreationWithDefaultServiceAccount metadata: name: block-creation-with-default-serviceaccount spec: enforcementAction: dryrun
Zugelassen
apiVersion: v1 kind: Namespace metadata: name: example-namespace
K8sBlockEndpointEditDefaultRole
Block Endpoint Edit Default Role v1.0.0
Viele Kubernetes-Installationen haben standardmäßig eine system:aggregate-to-edit ClusterRole, die den Zugriff auf die Bearbeitung von Endpunkten nicht richtig einschränkt. Dieses ConstraintTemplate verbietet der system:aggregate-to-edit ClusterRole, die Erlaubnis zur Erstellung/Patch/Aktualisierung von Endpunkten zu erteilen. ClusterRole/system:aggregation-to-edit sollte aufgrund von CVE-2021-25740-Berechtigungen, den Endpoint- und EndpointSlice-Berechtigungen, die Namespace-übergreifende Weiterleitung nicht zulassen, https://github.com/kubernetes/kubernetes/issues/103675.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockEndpointEditDefaultRole
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
block-endpoint-edit-default-role
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockEndpointEditDefaultRole
metadata:
name: block-endpoint-edit-default-role
spec:
match:
kinds:
- apiGroups:
- rbac.authorization.k8s.io
kinds:
- ClusterRole
Zulässig
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
rbac.authorization.k8s.io/aggregate-to-edit: "true"
name: system:aggregate-to-edit
rules:
- apiGroups:
- ""
resources:
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
- secrets
- services/proxy
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- impersonate
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- ""
resources:
- configmaps
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- apps
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- statefulsets/scale
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- ingresses
- networkpolicies
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- networking.k8s.io
resources:
- ingresses
- networkpolicies
verbs:
- create
- delete
- deletecollection
- patch
- update
Nicht zugelassen
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
rbac.authorization.k8s.io/aggregate-to-edit: "true"
name: system:aggregate-to-edit
rules:
- apiGroups:
- ""
resources:
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
- secrets
- services/proxy
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- impersonate
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- ""
resources:
- configmaps
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
verbs:
- create
- delete
- deletecollection
- patch
- update
- apiGroups:
- apps
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- endpoints
- replicasets
- replicasets/scale
- statefulsets
- statefulsets/scale
verbs:
- create
- delete
- deletecollection
- patch
- update
K8sBlockLoadBalancer
Dienste mit dem Typ LoadBalancer v1.0.0 blockieren
Verhindert alle Dienste mit dem Typ LoadBalancer. https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockLoadBalancer
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
block-load-balancer
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockLoadBalancer
metadata:
name: block-load-balancer
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Service
Zulässig
apiVersion: v1
kind: Service
metadata:
name: my-service-allowed
spec:
ports:
- port: 80
targetPort: 80
type: ClusterIP
Unzulässig
apiVersion: v1
kind: Service
metadata:
name: my-service-disallowed
spec:
ports:
- nodePort: 30007
port: 80
targetPort: 80
type: LoadBalancer
K8sBlockNodePort
NodePort v1.0.0 blockieren
Verhindert alle Dienste mit dem Typ NodePort. https://kubernetes.io/docs/concepts/services-networking/service/#nodeport
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockNodePort
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
block-node-port
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockNodePort
metadata:
name: block-node-port
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Service
Nicht zugelassen
apiVersion: v1
kind: Service
metadata:
name: my-service-disallowed
spec:
ports:
- nodePort: 30007
port: 80
targetPort: 80
type: NodePort
K8sBlockObjectsOfType
Objekte des Typs v1.0.1 blockieren
Verhindert das Objekt unzulässiger Typen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockObjectsOfType
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
forbiddenTypes:
- <string>
Beispiele
block-secrets-of-type-basic-auth
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockObjectsOfType
metadata:
name: block-secrets-of-type-basic-auth
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Secret
parameters:
forbiddenTypes:
- kubernetes.io/basic-auth
Zulässig
apiVersion: v1 data: password: ZHVtbXlwYXNz username: ZHVtbXl1c2Vy kind: Secret metadata: name: credentials namespace: default type: Opaque
Nicht zugelassen
apiVersion: v1 data: password: YmFzaWMtcGFzc3dvcmQ= username: YmFzaWMtdXNlcm5hbWU= kind: Secret metadata: name: secret-basic-auth namespace: default type: kubernetes.io/basic-auth
K8sBlockProcessNamespaceSharing
Prozess-Namespace-Freigabe blockieren v1.0.1
Unterbindet Pod-Spezifikationen, bei denen shareProcessNamespace auf true festgelegt ist. Dadurch werden Szenarien vermieden, in denen alle Container in einem Pod den gleichen PID-Namespace verwenden und auf das Dateisystem und den Arbeitsspeicher des jeweils anderen Systems zugreifen können.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockProcessNamespaceSharing
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
block-process-namespace-sharing
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockProcessNamespaceSharing metadata: name: block-process-namespace-sharing
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: good-pod
namespace: default
spec:
containers:
- image: nginx
name: nginx
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: bad-pod
namespace: default
spec:
containers:
- image: nginx
name: nginx
shareProcessNamespace: true
K8sBlockWildcardIngress
Platzhalter Ingress Version 1.0.1 blockieren
Nutzer sollten keine Ingresses mit einem leeren oder Platzhalternamen (*) erstellen können, da sie dadurch Traffic für andere Dienste im Cluster abfangen könnten, selbst wenn sie keinen Zugriff auf diese Dienste haben.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockWildcardIngress
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
block-wildcard-ingress
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockWildcardIngress
metadata:
name: block-wildcard-ingress
spec:
match:
kinds:
- apiGroups:
- extensions
- networking.k8s.io
kinds:
- Ingress
Zulässig
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: non-wildcard-ingress
spec:
rules:
- host: myservice.example.com
http:
paths:
- backend:
service:
name: example
port:
number: 80
path: /
pathType: Prefix
Nicht zugelassen
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: wildcard-ingress
spec:
rules:
- host: ""
http:
paths:
- backend:
service:
name: example
port:
number: 80
path: /
pathType: Prefix
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: wildcard-ingress
spec:
rules:
- http:
paths:
- backend:
service:
name: example
port:
number: 80
path: /
pathType: Prefix
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: wildcard-ingress
spec:
rules:
- host: '*.example.com'
http:
paths:
- backend:
service:
name: example
port:
number: 80
path: /
pathType: Prefix
- host: valid.example.com
http:
paths:
- backend:
service:
name: example
port:
number: 80
path: /
pathType: Prefix
K8sContainerEphemeralStorageLimit
Flüchtiger Container-Speicherlimit (Version 1.0.2)
Erfordert, dass für Container ein sitzungsspezifisches Speicherlimit festgelegt ist und dass das Limit innerhalb der angegebenen Höchstwerte liegt. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerEphemeralStorageLimit
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# ephemeral-storage <string>: The maximum allowed ephemeral storage limit
# on a Pod, exclusive.
ephemeral-storage: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
container-ephemeral-storage-limit
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerEphemeralStorageLimit
metadata:
name: container-ephemeral-storage-limit
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
ephemeral-storage: 500Mi
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
ephemeral-storage: 100Mi
memory: 1Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
ephemeral-storage: 100Mi
memory: 1Gi
initContainers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: init-opa
resources:
limits:
cpu: 100m
ephemeral-storage: 100Mi
memory: 1Gi
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 2Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
ephemeral-storage: 1Pi
memory: 1Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
ephemeral-storage: 100Mi
memory: 1Gi
initContainers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: init-opa
resources:
limits:
cpu: 100m
ephemeral-storage: 1Pi
memory: 1Gi
K8sContainerLimits
Containerlimits v1.0.1
Erfordert, dass in Containern Speicher- und CPU-Beschränkungen festgelegt sind, die innerhalb der angegebenen Höchstwerte liegen müssen. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerLimits
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cpu <string>: The maximum allowed cpu limit on a Pod, exclusive.
cpu: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# memory <string>: The maximum allowed memory limit on a Pod, exclusive.
memory: <string>
Beispiele
container-must-have-limits
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerLimits
metadata:
name: container-must-have-limits
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
cpu: 200m
memory: 1Gi
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 1Gi
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 2Gi
K8sContainerRatios
Containerverhältnisse v1.0.1
Legt ein maximales Verhältnis für Containerressourcenlimits zu Anfragen fest. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerRatios
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cpuRatio <string>: The maximum allowed ratio of `resources.limits.cpu` to
# `resources.requests.cpu` on a container. If not specified, equal to
# `ratio`.
cpuRatio: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# ratio <string>: The maximum allowed ratio of `resources.limits` to
# `resources.requests` on a container.
ratio: <string>
Beispiele
container-must-meet-ratio
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerRatios
metadata:
name: container-must-meet-ratio
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
ratio: "2"
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 800m
memory: 2Gi
requests:
cpu: 100m
memory: 100Mi
container-must-meet-memory-and-cpu-ratio
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerRatios
metadata:
name: container-must-meet-memory-and-cpu-ratio
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
cpuRatio: "10"
ratio: "1"
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: "4"
memory: 2Gi
requests:
cpu: "1"
memory: 2Gi
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: "4"
memory: 2Gi
requests:
cpu: 100m
memory: 2Gi
K8sContainerRequests
Containeranfragen v1.0.1
Erfordert, dass in Containern Arbeitsspeicher- und CPU-Anfragen festgelegt sind und dass Anfragen innerhalb der angegebenen Höchstwerte liegen müssen. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerRequests
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cpu <string>: The maximum allowed cpu request on a Pod, exclusive.
cpu: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# memory <string>: The maximum allowed memory request on a Pod, exclusive.
memory: <string>
Beispiele
container-must-have-requests
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerRequests
metadata:
name: container-must-have-requests
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
cpu: 200m
memory: 1Gi
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
requests:
cpu: 100m
memory: 1Gi
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
requests:
cpu: 100m
memory: 2Gi
K8sCronJobAllowedRepos
CronJob-Zulässige Repositories v1.0.1
Erfordert Container-Images von CronJobs, die mit einem String aus der angegebenen Liste beginnen sollen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sCronJobAllowedRepos
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# repos <array>: The list of prefixes a container image is allowed to have.
repos:
- <string>
Beispiele
cronjob-restrict-repos
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sCronJobAllowedRepos
metadata:
name: cronjob-restrict-repos
spec:
match:
kinds:
- apiGroups:
- batch
kinds:
- CronJob
parameters:
repos:
- gke.gcr.io/
Zulässig
apiVersion: batch/v1
kind: CronJob
metadata:
name: hello
spec:
jobTemplate:
spec:
template:
spec:
containers:
- image: gke.gcr.io/busybox:1.28
name: hello
schedule: '* * * * *'
Nicht zugelassen
apiVersion: batch/v1
kind: CronJob
metadata:
name: hello
spec:
jobTemplate:
spec:
template:
spec:
containers:
- image: busybox:1.28
name: hello
schedule: '* * * * *'
K8sDisallowAnonymous
Anonymen Zugriff nicht zulassen v1.0.0
Verbietet die Zuordnung von ClusterRole- und Rollen-Ressourcen zum Nutzer "system:anonymous" und zur Gruppe "system:unauthenticated".
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowAnonymous
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedRoles <array>: The list of ClusterRoles and Roles that may be
# associated with the `system:unauthenticated` group and `system:anonymous`
# user.
allowedRoles:
- <string>
Beispiele
no-anonymous
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowAnonymous
metadata:
name: no-anonymous
spec:
match:
kinds:
- apiGroups:
- rbac.authorization.k8s.io
kinds:
- ClusterRoleBinding
- apiGroups:
- rbac.authorization.k8s.io
kinds:
- RoleBinding
parameters:
allowedRoles:
- cluster-role-1
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cluster-role-binding-1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-role-1 subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
Nicht zugelassen
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cluster-role-binding-2 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-role-2 subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
K8sDisallowInteractiveTTY
Interaktive TTY-Container v1.0.0 nicht zulassen
Erfordert, dass die Felder spec.tty und spec.stdin der Objekte auf "false" gesetzt oder nicht festgelegt sind.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowInteractiveTTY
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
no-interactive-tty-containers
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowInteractiveTTY
metadata:
name: no-interactive-tty-containers
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-interactive-tty
name: nginx-interactive-tty-allowed
spec:
containers:
- image: nginx
name: nginx
stdin: false
tty: false
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-privilege-escalation
name: nginx-privilege-escalation-disallowed
spec:
containers:
- image: nginx
name: nginx
stdin: true
tty: true
K8sDisallowedRepos
Unzulässige Repositories v1.0.0
Unzulässige Container-Repositories, die mit einem String aus der angegebenen Liste beginnen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedRepos
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# repos <array>: The list of prefixes a container image is not allowed to
# have.
repos:
- <string>
Beispiele
repo-must-not-be-k8s-gcr-io
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedRepos
metadata:
name: repo-must-not-be-k8s-gcr-io
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
repos:
- k8s.gcr.io/
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: kustomize-allowed
spec:
containers:
- image: registry.k8s.io/kustomize/kustomize:v3.8.9
name: kustomize
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: kustomize-disallowed
spec:
containers:
- image: k8s.gcr.io/kustomize/kustomize:v3.8.9
name: kustomize
apiVersion: v1
kind: Pod
metadata:
name: kustomize-disallowed
spec:
containers:
- image: registry.k8s.io/kustomize/kustomize:v3.8.9
name: kustomize
initContainers:
- image: k8s.gcr.io/kustomize/kustomize:v3.8.9
name: kustomizeinit
apiVersion: v1
kind: Pod
metadata:
name: kustomize-disallowed
spec:
containers:
- image: k8s.gcr.io/kustomize/kustomize:v3.8.9
name: kustomize
initContainers:
- image: k8s.gcr.io/kustomize/kustomize:v3.8.9
name: kustomizeinit
apiVersion: v1
kind: Pod
metadata:
name: kustomize-disallowed
spec:
containers:
- image: k8s.gcr.io/kustomize/kustomize:v3.8.9
name: kustomize
ephemeralContainers:
- image: k8s.gcr.io/kustomize/kustomize:v3.8.9
name: kustomize
initContainers:
- image: k8s.gcr.io/kustomize/kustomize:v3.8.9
name: kustomize
K8sDisallowedRoleBindingSubjects
Unzulässige Rollenbindungsthemen v1.0.1
Unterbindet RoleBinding oder ClusterRoleBinding mit Subjekten, die mit einem als Parameter übergebenen disallowedSubjects übereinstimmen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedRoleBindingSubjects
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# disallowedSubjects <array>: A list of subjects that cannot appear in a
# RoleBinding.
disallowedSubjects:
- # apiGroup <string>: The Kubernetes API group of the disallowed role
# binding subject. Currently ignored.
apiGroup: <string>
# kind <string>: The kind of the disallowed role binding subject.
kind: <string>
# name <string>: The name of the disallowed role binding subject.
name: <string>
Beispiele
disallowed-rolebinding-subjects
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedRoleBindingSubjects
metadata:
name: disallowed-rolebinding-subjects
spec:
parameters:
disallowedSubjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:unauthenticated
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: good-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-role subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated
Unzulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: bad-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-role subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
K8sDisallowedTags
Tags v1.0.1 nicht zulassen
Erfordert, dass Container-Images ein Image-Tag haben, das sich von denen in der angegebenen Liste unterscheidet. https://kubernetes.io/docs/concepts/containers/images/#image-names
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedTags
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# tags <array>: Disallowed container image tags.
tags:
- <string>
Beispiele
container-image-must-not-have-latest-tag
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedTags
metadata:
name: container-image-must-not-have-latest-tag
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
namespaces:
- default
parameters:
exemptImages:
- openpolicyagent/opa-exp:latest
- openpolicyagent/opa-exp2:latest
tags:
- latest
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
apiVersion: v1
kind: Pod
metadata:
name: opa-exempt-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa-exp:latest
name: opa-exp
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/init:v1
name: opa-init
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa-exp2:latest
name: opa-exp2
Unzulässig
apiVersion: v1
kind: Pod
metadata:
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa
name: opa
apiVersion: v1
kind: Pod
metadata:
name: opa-disallowed-2
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:latest
name: opa
apiVersion: v1
kind: Pod
metadata:
name: opa-disallowed-ephemeral
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
ephemeralContainers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:latest
name: opa
apiVersion: v1
kind: Pod
metadata:
name: opa-disallowed-3
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa-exp:latest
name: opa
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/init:latest
name: opa-init
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa-exp2:latest
name: opa-exp2
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/monitor:latest
name: opa-monitor
K8sEmptyDirHasSizeLimit
Leeres Verzeichnis hat eine Größenbeschränkung von v1.0.5
Erfordert, dass alle emptyDir-Volumes einen sizeLimit angeben. Optional kann in der Einschränkung der Parameter maxSizeLimit angegeben werden, um ein maximal zulässiges Größenlimit anzugeben.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEmptyDirHasSizeLimit
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptVolumesRegex <array>: Exempt Volume names as regex match.
exemptVolumesRegex:
- <string>
# maxSizeLimit <string>: When set, the declared size limit for each volume
# must be less than `maxSizeLimit`.
maxSizeLimit: <string>
Beispiele
empty-dir-has-size-limit
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEmptyDirHasSizeLimit
metadata:
name: empty-dir-has-size-limit
spec:
match:
excludedNamespaces:
- istio-system
- kube-system
- gatekeeper-system
parameters:
exemptVolumesRegex:
- ^istio-[a-z]+$
maxSizeLimit: 4Gi
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: good-pod
namespace: default
spec:
containers:
- image: nginx
name: nginx
volumes:
- emptyDir:
sizeLimit: 2Gi
name: good-pod-volume
apiVersion: v1
kind: Pod
metadata:
name: exempt-pod
namespace: default
spec:
containers:
- image: nginx
name: nginx
volumes:
- emptyDir: {}
name: istio-envoy
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: bad-pod
namespace: default
spec:
containers:
- image: nginx
name: nginx
volumes:
- emptyDir: {}
name: bad-pod-volume
K8sEnforceCloudArmorBackendConfig
Cloud Armor für BackendConfig-Ressourcen v1.0.2 erzwingen
Erzwingt die Cloud Armor-Konfiguration für BackendConfig-Ressourcen
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEnforceCloudArmorBackendConfig
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
enforce-cloudarmor-backendconfig
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sEnforceCloudArmorBackendConfig metadata: name: enforce-cloudarmor-backendconfig spec: enforcementAction: dryrun
Zulässig
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
name: my-backendconfig
namespace: examplenamespace
spec:
securityPolicy:
name: example-security-policy
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
name: second-backendconfig
spec:
securityPolicy:
name: my-security-policy
Nicht zugelassen
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
name: my-backendconfig
namespace: examplenamespace
spec:
securityPolicy:
name: null
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
name: my-backendconfig
namespace: examplenamespace
spec:
securityPolicy:
name: ""
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
name: my-backendconfig
spec:
logging:
enable: true
sampleRate: 0.5
K8sEnforceConfigManagement
Config Management Version 1.1.6 erzwingen
Erfordert das Vorhandensein und den Betrieb von Config Management. Einschränkungen mit diesem ConstraintTemplate werden unabhängig vom enforcementAction-Wert nur geprüft.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEnforceConfigManagement
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# requireDriftPrevention <boolean>: Require Config Sync drift prevention to
# prevent config drift.
requireDriftPrevention: <boolean>
# requireRootSync <boolean>: Require a Config Sync `RootSync` object for
# cluster config management.
requireRootSync: <boolean>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "configsync.gke.io"
version: "v1beta1"
kind: "RootSync"
Beispiele
enforce-config-management
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEnforceConfigManagement
metadata:
name: enforce-config-management
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- configmanagement.gke.io
kinds:
- ConfigManagement
Zulässig
apiVersion: configmanagement.gke.io/v1
kind: ConfigManagement
metadata:
annotations:
configmanagement.gke.io/managed-by-hub: "true"
configmanagement.gke.io/update-time: "1663586155"
name: config-management
spec:
binauthz:
enabled: true
clusterName: tec6ea817b5b4bb2-cluster
enableMultiRepo: true
git:
proxy: {}
syncRepo: git@test-git-server.config-management-system-test:/git-server/repos/sot.git
hierarchyController: {}
policyController:
auditIntervalSeconds: 60
enabled: true
monitoring:
backends:
- prometheus
- cloudmonitoring
mutation: {}
referentialRulesEnabled: true
templateLibraryInstalled: true
status:
configManagementVersion: v1.12.2-rc.2
healthy: true
Unzulässig
apiVersion: configmanagement.gke.io/v1
kind: ConfigManagement
metadata:
annotations:
configmanagement.gke.io/managed-by-hub: "true"
configmanagement.gke.io/update-time: "1663586155"
name: config-management
spec:
binauthz:
enabled: true
clusterName: tec6ea817b5b4bb2-cluster
enableMultiRepo: true
git:
syncRepo: git@test-git-server.config-management-system-test:/git-server/repos/sot.git
hierarchyController: {}
policyController:
auditIntervalSeconds: 60
enabled: true
monitoring:
backends:
- prometheus
- cloudmonitoring
mutation: {}
referentialRulesEnabled: true
templateLibraryInstalled: true
status:
configManagementVersion: v1.12.2-rc.2
K8sExternalIPs
Externe IP-Adressen v1.0.0
Beschränkt externe IP-Adressen auf eine zulässige Liste von IP-Adressen. https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sExternalIPs
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedIPs <array>: An allow-list of external IP addresses.
allowedIPs:
- <string>
Beispiele
external-ips
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sExternalIPs
metadata:
name: external-ips
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Service
parameters:
allowedIPs:
- 203.0.113.0
Zulässig
apiVersion: v1
kind: Service
metadata:
name: allowed-external-ip
spec:
externalIPs:
- 203.0.113.0
ports:
- name: http
port: 80
protocol: TCP
targetPort: 8080
selector:
app: MyApp
Nicht zugelassen
apiVersion: v1
kind: Service
metadata:
name: disallowed-external-ip
spec:
externalIPs:
- 1.1.1.1
ports:
- name: http
port: 80
protocol: TCP
targetPort: 8080
selector:
app: MyApp
K8sHorizontalPodAutoscaler
Horizontales Pod-Autoscaling v1.0.1
Die folgenden Szenarien sollen bei der Bereitstellung von HorizontalPodAutoscalers 1 nicht zugelassen werden. Bereitstellung von HorizontalPodAutoscalern mit .spec.minReplicas oder .spec.maxReplicas außerhalb der in der Einschränkung 2 definierten Bereiche Bereitstellung von HorizontalPodAutoscalern, bei denen der Unterschied zwischen .spec.minReplicas und .spec.maxReplicas kleiner als der konfigurierte minimumReplicaSpread 3 ist Bereitstellung von HorizontalPodAutoscalern, die nicht auf ein gültiges scaleTargetRef verweisen (z.B. Deployment, ReplicationController, ReplicaSet, StatefulSet).
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sHorizontalPodAutoscaler
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# enforceScaleTargetRef <boolean>: If set to true it validates the HPA
# scaleTargetRef exists
enforceScaleTargetRef: <boolean>
# minimumReplicaSpread <integer>: If configured it enforces the minReplicas
# and maxReplicas in an HPA must have a spread of at least this many
# replicas
minimumReplicaSpread: <integer>
# ranges <array>: Allowed ranges for numbers of replicas. Values are
# inclusive.
ranges:
# <list item: object>: A range of allowed replicas. Values are
# inclusive.
- # max_replicas <integer>: The maximum number of replicas allowed,
# inclusive.
max_replicas: <integer>
# min_replicas <integer>: The minimum number of replicas allowed,
# inclusive.
min_replicas: <integer>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "apps"
version: "v1"
kind: "Deployment"
OR
- group: "apps"
version: "v1"
kind: "StatefulSet"
Beispiele
horizontal-pod-autoscaler
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sHorizontalPodAutoscaler
metadata:
name: horizontal-pod-autoscaler
spec:
enforcementAction: deny
match:
kinds:
- apiGroups:
- autoscaling
kinds:
- HorizontalPodAutoscaler
parameters:
enforceScaleTargetRef: true
minimumReplicaSpread: 1
ranges:
- max_replicas: 6
min_replicas: 3
Zulässig
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: nginx-hpa-allowed
namespace: default
spec:
maxReplicas: 6
metrics:
- resource:
name: cpu
target:
averageUtilization: 900
type: Utilization
type: Resource
minReplicas: 3
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: nginx-deployment
---
# Referential Data
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: allowed-deployment
template:
metadata:
labels:
app: nginx
example: allowed-deployment
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
Unzulässig
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: nginx-hpa-disallowed-replicas
namespace: default
spec:
maxReplicas: 7
metrics:
- resource:
name: cpu
target:
averageUtilization: 900
type: Utilization
type: Resource
minReplicas: 2
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: nginx-deployment
---
# Referential Data
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: allowed-deployment
template:
metadata:
labels:
app: nginx
example: allowed-deployment
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: nginx-hpa-disallowed-replicaspread
namespace: default
spec:
maxReplicas: 4
metrics:
- resource:
name: cpu
target:
averageUtilization: 900
type: Utilization
type: Resource
minReplicas: 4
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: nginx-deployment
---
# Referential Data
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: allowed-deployment
template:
metadata:
labels:
app: nginx
example: allowed-deployment
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: nginx-hpa-disallowed-scaletarget
namespace: default
spec:
maxReplicas: 6
metrics:
- resource:
name: cpu
target:
averageUtilization: 900
type: Utilization
type: Resource
minReplicas: 3
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: nginx-deployment-missing
---
# Referential Data
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: allowed-deployment
template:
metadata:
labels:
app: nginx
example: allowed-deployment
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
K8sHttpsOnly
Nur HTTPS v1.0.2
Erfordert Ingress-Ressourcen, um nur HTTPS zu verwenden. Ingress-Ressourcen müssen die kubernetes.io/ingress.allow-http-Annotation enthalten, die auf false festgelegt sein muss. Standardmäßig ist eine gültige TLS-{}-Konfiguration erforderlich. Dies kann optional durch das Festlegen des Parameters tlsOptional auf true erfolgen.
https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sHttpsOnly
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# tlsOptional <boolean>: When set to `true` the TLS {} is optional,
# defaults to false.
tlsOptional: <boolean>
Beispiele
ingress-https-only
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sHttpsOnly
metadata:
name: ingress-https-only
spec:
match:
kinds:
- apiGroups:
- extensions
- networking.k8s.io
kinds:
- Ingress
Zulässig
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.allow-http: "false"
name: ingress-demo-allowed
spec:
rules:
- host: example-host.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
tls:
- {}
Nicht zugelassen
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-demo-disallowed
spec:
rules:
- host: example-host.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
ingress-https-only-tls-optional
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sHttpsOnly
metadata:
name: ingress-https-only-tls-optional
spec:
match:
kinds:
- apiGroups:
- extensions
- networking.k8s.io
kinds:
- Ingress
parameters:
tlsOptional: true
Zulässig
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.allow-http: "false"
name: ingress-demo-allowed-tls-optional
spec:
rules:
- host: example-host.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
Nicht zugelassen
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-demo-disallowed-tls-optional
spec:
rules:
- host: example-host.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
K8sImageDigests
Image Digests v1.0.1
Erfordert, dass Container-Images einen Digest enthalten. https://kubernetes.io/docs/concepts/containers/images/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sImageDigests
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
container-image-must-have-digest
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sImageDigests
metadata:
name: container-image-must-have-digest
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
namespaces:
- default
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2@sha256:04ff8fce2afd1a3bc26260348e5b290e8d945b1fad4b4c16d22834c2f3a1814a
name: opa
Unzulässig
apiVersion: v1
kind: Pod
metadata:
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
initContainers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opainit
apiVersion: v1
kind: Pod
metadata:
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
ephemeralContainers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
initContainers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opainit
K8sLocalStorageRequireSafeToEvict
Lokaler Speicher erfordert Sicherheit zum Entfernen von v1.0.1
Erfordert Pods, die lokalen Speicher (emptyDir oder hostPath) mit der Annotation "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" verwenden. Cluster Autoscaler löscht Pods ohne diese Annotation nicht.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sLocalStorageRequireSafeToEvict
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
local-storage-require-safe-to-evict
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sLocalStorageRequireSafeToEvict
metadata:
name: local-storage-require-safe-to-evict
spec:
match:
excludedNamespaces:
- kube-system
- istio-system
- gatekeeper-system
Zulässig
apiVersion: v1
kind: Pod
metadata:
annotations:
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
name: good-pod
namespace: default
spec:
containers:
- image: redis
name: redis
volumeMounts:
- mountPath: /data/redis
name: redis-storage
volumes:
- emptyDir: {}
name: redis-storage
Unzulässig
apiVersion: v1
kind: Pod
metadata:
name: bad-pod
namespace: default
spec:
containers:
- image: redis
name: redis
volumeMounts:
- mountPath: /data/redis
name: redis-storage
volumes:
- emptyDir: {}
name: redis-storage
K8sMemoryRequestEqualsLimit
Speicheranfrage entspricht Limit v1.0.4
Erhöht die Pod-Stabilität. Dafür muss der angeforderte Speicher aller Container genau dem Speicherlimit entsprechen, sodass sich Pods nie in einem Zustand befinden, in dem die Speichernutzung den angeforderten Umfang überschreitet. Andernfalls kann Kubernetes Pods beenden, die zusätzlichen Speicher anfordern, wenn der Speicher auf dem Knoten benötigt wird.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sMemoryRequestEqualsLimit
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptContainersRegex <array>: Exempt Container names as regex match.
exemptContainersRegex:
- <string>
Beispiele
container-must-request-limit
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sMemoryRequestEqualsLimit
metadata:
name: container-must-request-limit
spec:
match:
excludedNamespaces:
- kube-system
- resource-group-system
- asm-system
- istio-system
- config-management-system
- config-management-monitoring
parameters:
exemptContainersRegex:
- ^istio-[a-z]+$
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: good-pod
namespace: default
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 100m
memory: 4Gi
requests:
cpu: 50m
memory: 4Gi
apiVersion: v1
kind: Pod
metadata:
name: exempt-pod
namespace: default
spec:
containers:
- image: auto
name: istio-proxy
resources:
limits:
cpu: 100m
memory: 4Gi
requests:
cpu: 50m
memory: 2Gi
Unzulässig
apiVersion: v1
kind: Pod
metadata:
name: bad-pod
namespace: default
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 100m
memory: 4Gi
requests:
cpu: 50m
memory: 2Gi
K8sNoEnvVarSecrets
Keine Secrets für Umgebungsvariablen v1.0.1
Verbindet Secrets als Umgebungsvariablen in Pod-Containerdefinitionen. Verwenden Sie stattdessen bereitgestellte Secret-Dateien in Datenvolumen: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoEnvVarSecrets
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
no-secrets-as-env-vars-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sNoEnvVarSecrets metadata: name: no-secrets-as-env-vars-sample spec: enforcementAction: dryrun
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: allowed-example
spec:
containers:
- image: redis
name: test
volumeMounts:
- mountPath: /etc/test
name: test
readOnly: true
volumes:
- name: test
secret:
secretName: mysecret
Unzulässig
apiVersion: v1
kind: Pod
metadata:
name: disallowed-example
spec:
containers:
- env:
- name: MY_PASSWORD
valueFrom:
secretKeyRef:
key: password
name: mysecret
image: redis
name: test
K8sNoExternalServices
Keine externen Dienste v1.0.3
Verhindert das Erstellen bekannter Ressourcen, die Arbeitslasten für externe IP-Adressen verfügbar machen. Dazu gehören Istio-Gateway-Ressourcen und Kubernetes Ingress-Ressourcen. Kubernetes-Dienste sind ebenfalls nur zulässig, wenn sie die folgenden Kriterien erfüllen: Jeder Dienst vom Typ LoadBalancer in Google Cloud muss eine "networking.gke.io/load-balancer-type": "Internal"-Annotation haben.
Jeder Dienst vom Typ LoadBalancer in AWS muss eine service.beta.kubernetes.io/aws-load-balancer-internal: "true-Annotation haben.
Alle "externen IP-Adressen" (außerhalb des Clusters), die an den Dienst gebunden sind, müssen Mitglied eines Bereichs internen CIDRs sein, wie für die Einschränkung angegeben.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoExternalServices
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cloudPlatform <string>: The hosting cloud platform. Only `GCP` and `AWS`
# are supported currently.
cloudPlatform: <string>
# internalCIDRs <array>: A list of CIDRs that are only accessible
# internally, for example: `10.3.27.0/24`. Which IP ranges are
# internal-only is determined by the underlying network infrastructure.
internalCIDRs:
- <string>
Beispiele
no-external
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoExternalServices
metadata:
name: no-external
spec:
parameters:
internalCIDRs:
- 10.0.0.1/32
Zulässig
apiVersion: v1
kind: Service
metadata:
name: good-service
namespace: default
spec:
externalIPs:
- 10.0.0.1
ports:
- port: 8888
protocol: TCP
targetPort: 8888
apiVersion: v1
kind: Service
metadata:
annotations:
networking.gke.io/load-balancer-type: Internal
name: allowed-internal-load-balancer
namespace: default
spec:
type: LoadBalancer
Nicht zugelassen
apiVersion: v1
kind: Service
metadata:
name: bad-service
namespace: default
spec:
externalIPs:
- 10.0.0.2
ports:
- port: 8888
protocol: TCP
targetPort: 8888
no-external-aws
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoExternalServices
metadata:
name: no-external-aws
spec:
parameters:
cloudPlatform: AWS
Zulässig
apiVersion: v1
kind: Service
metadata:
annotations:
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
name: good-aws-service
namespace: default
spec:
type: LoadBalancer
Unzulässig
apiVersion: v1
kind: Service
metadata:
annotations:
cloud.google.com/load-balancer-type: Internal
name: bad-aws-service
namespace: default
spec:
type: LoadBalancer
K8sPSPAllowPrivilegeEscalationContainer
Rechteausweitung in Container v1.0.1 zulassen
Steuert die Einschränkung der Eskalation auf Root-Berechtigungen. Entspricht dem Feld allowPrivilegeEscalation in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowPrivilegeEscalationContainer
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
psp-allow-privilege-escalation-container-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowPrivilegeEscalationContainer
metadata:
name: psp-allow-privilege-escalation-container-sample
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-privilege-escalation
name: nginx-privilege-escalation-allowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
allowPrivilegeEscalation: false
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-privilege-escalation
name: nginx-privilege-escalation-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
allowPrivilegeEscalation: true
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-privilege-escalation
name: nginx-privilege-escalation-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
securityContext:
allowPrivilegeEscalation: true
K8sPSPAllowedUsers
Zulässige Nutzer v1.0.2
Steuert die Nutzer- und Gruppen-IDs des Containers und einige Volumes. Entspricht den Feldern runAsUser, runAsGroup, supplementalGroups und fsGroup in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowedUsers
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# fsGroup <object>: Controls the fsGroup values that are allowed in a Pod
# or container-level SecurityContext.
fsGroup:
# ranges <array>: A list of group ID ranges affected by the rule.
ranges:
# <list item: object>: The range of group IDs affected by the rule.
- # max <integer>: The maximum group ID in the range, inclusive.
max: <integer>
# min <integer>: The minimum group ID in the range, inclusive.
min: <integer>
# rule <string>: A strategy for applying the fsGroup restriction.
# Allowed Values: MustRunAs, MayRunAs, RunAsAny
rule: <string>
# runAsGroup <object>: Controls which group ID values are allowed in a Pod
# or container-level SecurityContext.
runAsGroup:
# ranges <array>: A list of group ID ranges affected by the rule.
ranges:
# <list item: object>: The range of group IDs affected by the rule.
- # max <integer>: The maximum group ID in the range, inclusive.
max: <integer>
# min <integer>: The minimum group ID in the range, inclusive.
min: <integer>
# rule <string>: A strategy for applying the runAsGroup restriction.
# Allowed Values: MustRunAs, MayRunAs, RunAsAny
rule: <string>
# runAsUser <object>: Controls which user ID values are allowed in a Pod or
# container-level SecurityContext.
runAsUser:
# ranges <array>: A list of user ID ranges affected by the rule.
ranges:
# <list item: object>: The range of user IDs affected by the rule.
- # max <integer>: The maximum user ID in the range, inclusive.
max: <integer>
# min <integer>: The minimum user ID in the range, inclusive.
min: <integer>
# rule <string>: A strategy for applying the runAsUser restriction.
# Allowed Values: MustRunAs, MustRunAsNonRoot, RunAsAny
rule: <string>
# supplementalGroups <object>: Controls the supplementalGroups values that
# are allowed in a Pod or container-level SecurityContext.
supplementalGroups:
# ranges <array>: A list of group ID ranges affected by the rule.
ranges:
# <list item: object>: The range of group IDs affected by the rule.
- # max <integer>: The maximum group ID in the range, inclusive.
max: <integer>
# min <integer>: The minimum group ID in the range, inclusive.
min: <integer>
# rule <string>: A strategy for applying the supplementalGroups
# restriction.
# Allowed Values: MustRunAs, MayRunAs, RunAsAny
rule: <string>
Beispiele
psp-pods-allowed-user-ranges
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowedUsers
metadata:
name: psp-pods-allowed-user-ranges
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
fsGroup:
ranges:
- max: 200
min: 100
rule: MustRunAs
runAsGroup:
ranges:
- max: 200
min: 100
rule: MustRunAs
runAsUser:
ranges:
- max: 200
min: 100
rule: MustRunAs
supplementalGroups:
ranges:
- max: 200
min: 100
rule: MustRunAs
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-users
name: nginx-users-allowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
runAsGroup: 199
runAsUser: 199
securityContext:
fsGroup: 199
supplementalGroups:
- 199
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-users
name: nginx-users-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
runAsGroup: 250
runAsUser: 250
securityContext:
fsGroup: 250
supplementalGroups:
- 250
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-users
name: nginx-users-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
securityContext:
runAsGroup: 250
runAsUser: 250
securityContext:
fsGroup: 250
supplementalGroups:
- 250
K8sPSPAppArmor
App Armor v1.0.0
Konfiguriert eine Zulassungsliste von AppArmor-Profilen für die Verwendung durch Container. Das entspricht bestimmten Annotationen, die auf eine PodSecurityPolicy angewendet werden. Informationen zu AppArmor finden Sie unter https://kubernetes.io/docs/tutorials/clusters/apparmor/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAppArmor
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedProfiles <array>: An array of AppArmor profiles. Examples:
# `runtime/default`, `unconfined`.
allowedProfiles:
- <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
psp-apparmor
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAppArmor
metadata:
name: psp-apparmor
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
allowedProfiles:
- runtime/default
Zulässig
apiVersion: v1
kind: Pod
metadata:
annotations:
container.apparmor.security.beta.kubernetes.io/nginx: runtime/default
labels:
app: nginx-apparmor
name: nginx-apparmor-allowed
spec:
containers:
- image: nginx
name: nginx
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
annotations:
container.apparmor.security.beta.kubernetes.io/nginx: unconfined
labels:
app: nginx-apparmor
name: nginx-apparmor-disallowed
spec:
containers:
- image: nginx
name: nginx
apiVersion: v1
kind: Pod
metadata:
annotations:
container.apparmor.security.beta.kubernetes.io/nginx: unconfined
labels:
app: nginx-apparmor
name: nginx-apparmor-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
K8sPSPAutomountServiceAccountTokenPod
Automount-Dienstkonto-Token für Pod v1.0.1
Steuert die Fähigkeit jedes Pods, das automountServiceAccountToken zu aktivieren.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAutomountServiceAccountTokenPod
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
<object>
Beispiele
psp-automount-serviceaccount-token-pod
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAutomountServiceAccountTokenPod
metadata:
name: psp-automount-serviceaccount-token-pod
spec:
match:
excludedNamespaces:
- kube-system
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-not-automountserviceaccounttoken
name: nginx-automountserviceaccounttoken-allowed
spec:
automountServiceAccountToken: false
containers:
- image: nginx
name: nginx
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-automountserviceaccounttoken
name: nginx-automountserviceaccounttoken-disallowed
spec:
automountServiceAccountToken: true
containers:
- image: nginx
name: nginx
K8sPSPCapabilities
Funktionen Version 1.0.2
Steuert Linux-Funktionen für Container. Entspricht den Feldern allowedCapabilities und requiredDropCapabilities in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPCapabilities
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedCapabilities <array>: A list of Linux capabilities that can be
# added to a container.
allowedCapabilities:
- <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# requiredDropCapabilities <array>: A list of Linux capabilities that are
# required to be dropped from a container.
requiredDropCapabilities:
- <string>
Beispiele
capabilities-demo
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPCapabilities
metadata:
name: capabilities-demo
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
namespaces:
- default
parameters:
allowedCapabilities:
- something
requiredDropCapabilities:
- must_drop
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 30Mi
securityContext:
capabilities:
add:
- something
drop:
- must_drop
- another_one
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 30Mi
securityContext:
capabilities:
add:
- disallowedcapability
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
ephemeralContainers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 30Mi
securityContext:
capabilities:
add:
- disallowedcapability
K8sPSPFSGroup
FS Group v1.0.2
Steuert die Zuweisung einer FSGroup, die die Volumes des Pods besitzt. Entspricht dem Feld fsGroup in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPFSGroup
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# ranges <array>: GID ranges affected by the rule.
ranges:
- # max <integer>: The maximum GID in the range, inclusive.
max: <integer>
# min <integer>: The minimum GID in the range, inclusive.
min: <integer>
# rule <string>: An FSGroup rule name.
# Allowed Values: MayRunAs, MustRunAs, RunAsAny
rule: <string>
Beispiele
psp-fsgroup
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPFSGroup
metadata:
name: psp-fsgroup
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
ranges:
- max: 1000
min: 1
rule: MayRunAs
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: fsgroup-disallowed
spec:
containers:
- command:
- sh
- -c
- sleep 1h
image: busybox
name: fsgroup-demo
volumeMounts:
- mountPath: /data/demo
name: fsgroup-demo-vol
securityContext:
fsGroup: 500
volumes:
- emptyDir: {}
name: fsgroup-demo-vol
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: fsgroup-disallowed
spec:
containers:
- command:
- sh
- -c
- sleep 1h
image: busybox
name: fsgroup-demo
volumeMounts:
- mountPath: /data/demo
name: fsgroup-demo-vol
securityContext:
fsGroup: 2000
volumes:
- emptyDir: {}
name: fsgroup-demo-vol
K8sPSPFlexVolumes
FlexVolumes Version 1.0.1
Steuert die Zulassungsliste der FlexVolume-Treiber. Entspricht dem Feld allowedFlexVolumes in PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#flexvolume-drivers.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPFlexVolumes
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedFlexVolumes <array>: An array of AllowedFlexVolume objects.
allowedFlexVolumes:
- # driver <string>: The name of the FlexVolume driver.
driver: <string>
Beispiele
psp-flexvolume-drivers
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPFlexVolumes
metadata:
name: psp-flexvolume-drivers
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
allowedFlexVolumes:
- driver: example/lvm
- driver: example/cifs
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-flexvolume-driver
name: nginx-flexvolume-driver-allowed
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /test
name: test-volume
readOnly: true
volumes:
- flexVolume:
driver: example/lvm
name: test-volume
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-flexvolume-driver
name: nginx-flexvolume-driver-disallowed
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /test
name: test-volume
readOnly: true
volumes:
- flexVolume:
driver: example/testdriver
name: test-volume
K8sPSPForbiddenSysctls
Forbidden Sysctls v1.1.3
Steuert das von Containern verwendete Profil sysctl. Entspricht den Feldern allowedUnsafeSysctls und forbiddenSysctls in einer PodSecurityPolicy. Wenn angegeben, wird jeder sysctl, der nicht im allowedSysctls-Parameter enthalten ist, als unzulässig betrachtet. Der Parameter forbiddenSysctls hat Vorrang vor dem Parameter allowedSysctls. Weitere Informationen finden Sie unter https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPForbiddenSysctls
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedSysctls <array>: An allow-list of sysctls. `*` allows all sysctls
# not listed in the `forbiddenSysctls` parameter.
allowedSysctls:
- <string>
# forbiddenSysctls <array>: A disallow-list of sysctls. `*` forbids all
# sysctls.
forbiddenSysctls:
- <string>
Beispiele
psp-forbidden-sysctls
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPForbiddenSysctls
metadata:
name: psp-forbidden-sysctls
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
allowedSysctls:
- '*'
forbiddenSysctls:
- kernel.*
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-forbidden-sysctls
name: nginx-forbidden-sysctls-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
sysctls:
- name: net.core.somaxconn
value: "1024"
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-forbidden-sysctls
name: nginx-forbidden-sysctls-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
sysctls:
- name: kernel.msgmax
value: "65536"
- name: net.core.somaxconn
value: "1024"
K8sPSPHostFilesystem
Hostdateisystem v1.0.2
Steuert die Nutzung des Hostdateisystems. Entspricht dem Feld allowedHostPaths in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostFilesystem
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedHostPaths <array>: An array of hostpath objects, representing
# paths and read/write configuration.
allowedHostPaths:
- # pathPrefix <string>: The path prefix that the host volume must
# match.
pathPrefix: <string>
# readOnly <boolean>: when set to true, any container volumeMounts
# matching the pathPrefix must include `readOnly: true`.
readOnly: <boolean>
Beispiele
psp-host-filesystem
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostFilesystem
metadata:
name: psp-host-filesystem
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
allowedHostPaths:
- pathPrefix: /foo
readOnly: true
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-filesystem-disallowed
name: nginx-host-filesystem
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /cache
name: cache-volume
readOnly: true
volumes:
- hostPath:
path: /foo/bar
name: cache-volume
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-filesystem-disallowed
name: nginx-host-filesystem
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /cache
name: cache-volume
readOnly: true
volumes:
- hostPath:
path: /tmp
name: cache-volume
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-filesystem-disallowed
name: nginx-host-filesystem
spec:
ephemeralContainers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /cache
name: cache-volume
readOnly: true
volumes:
- hostPath:
path: /tmp
name: cache-volume
K8sPSPHostNamespace
Host Namespace v1.0.1
Verhindert die Freigabe von Host-PID- und IPC-Namespaces nach Pod-Containern. Entspricht den Feldern hostPID und hostIPC in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostNamespace
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
<object>
Beispiele
psp-host-namespace-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostNamespace
metadata:
name: psp-host-namespace-sample
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-namespace
name: nginx-host-namespace-allowed
spec:
containers:
- image: nginx
name: nginx
hostIPC: false
hostPID: false
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-namespace
name: nginx-host-namespace-disallowed
spec:
containers:
- image: nginx
name: nginx
hostIPC: true
hostPID: true
K8sPSPHostNetworkingPorts
Hostnetzwerkports v1.0.2
Steuert die Nutzung des Hostnetzwerk-Namespace nach Pod-Containern. Bestimmte Ports müssen angegeben werden. Entspricht den Feldern hostNetwork und hostPorts in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostNetworkingPorts
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# hostNetwork <boolean>: Determines if the policy allows the use of
# HostNetwork in the pod spec.
hostNetwork: <boolean>
# max <integer>: The end of the allowed port range, inclusive.
max: <integer>
# min <integer>: The start of the allowed port range, inclusive.
min: <integer>
Beispiele
psp-host-network-ports-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostNetworkingPorts
metadata:
name: psp-host-network-ports-sample
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
hostNetwork: true
max: 9000
min: 80
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-networking-ports
name: nginx-host-networking-ports-allowed
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 9000
hostPort: 80
hostNetwork: false
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-networking-ports
name: nginx-host-networking-ports-disallowed
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 9001
hostPort: 9001
hostNetwork: true
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-host-networking-ports
name: nginx-host-networking-ports-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
ports:
- containerPort: 9001
hostPort: 9001
hostNetwork: true
K8sPSPPrivilegedContainer
Privilegierter Container v1.0.1
Steuert die Fähigkeit eines Containers, den privilegierten Modus zu aktivieren. Entspricht dem Feld privileged in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
psp-privileged-container-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
name: psp-privileged-container-sample
spec:
match:
excludedNamespaces:
- kube-system
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-privileged
name: nginx-privileged-allowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: false
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-privileged
name: nginx-privileged-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
privileged: true
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-privileged
name: nginx-privileged-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
securityContext:
privileged: true
K8sPSPProcMount
Proc Mount v1.0.3
Steuert die zulässigen procMount-Typen für den Container. Entspricht dem Feld allowedProcMountTypes in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowprocmounttypes.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPProcMount
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# procMount <string>: Defines the strategy for the security exposure of
# certain paths in `/proc` by the container runtime. Setting to `Default`
# uses the runtime defaults, where `Unmasked` bypasses the default
# behavior.
# Allowed Values: Default, Unmasked
procMount: <string>
Beispiele
psp-proc-mount
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPProcMount
metadata:
name: psp-proc-mount
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
procMount: Default
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-proc-mount
name: nginx-proc-mount-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
procMount: Default
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-proc-mount
name: nginx-proc-mount-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
procMount: Unmasked
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-proc-mount
name: nginx-proc-mount-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
securityContext:
procMount: Unmasked
K8sPSPReadOnlyRootFilesystem
Schreibgeschütztes Root-Dateisystem v1.0.1
Erfordert die Verwendung eines schreibgeschützten Root-Dateisystems durch Pod-Container. Entspricht dem Feld readOnlyRootFilesystem in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPReadOnlyRootFilesystem
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
psp-readonlyrootfilesystem
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPReadOnlyRootFilesystem
metadata:
name: psp-readonlyrootfilesystem
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-readonlyrootfilesystem
name: nginx-readonlyrootfilesystem-allowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
readOnlyRootFilesystem: true
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-readonlyrootfilesystem
name: nginx-readonlyrootfilesystem-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
readOnlyRootFilesystem: false
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-readonlyrootfilesystem
name: nginx-readonlyrootfilesystem-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
securityContext:
readOnlyRootFilesystem: false
K8sPSPSELinuxV2
SELinux V2 v1.0.3
Definiert eine Zulassungsliste von seLinuxOptions-Konfigurationen für Pod-Container. Entspricht einer PodSecurityPolicy, die SELinux-Konfigurationen erfordert. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPSELinuxV2
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedSELinuxOptions <array>: An allow-list of SELinux options
# configurations.
allowedSELinuxOptions:
# <list item: object>: An allowed configuration of SELinux options for a
# pod container.
- # level <string>: An SELinux level.
level: <string>
# role <string>: An SELinux role.
role: <string>
# type <string>: An SELinux type.
type: <string>
# user <string>: An SELinux user.
user: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
psp-selinux-v2
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPSELinuxV2
metadata:
name: psp-selinux-v2
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
allowedSELinuxOptions:
- level: s0:c123,c456
role: object_r
type: svirt_sandbox_file_t
user: system_u
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-selinux
name: nginx-selinux-allowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
seLinuxOptions:
level: s0:c123,c456
role: object_r
type: svirt_sandbox_file_t
user: system_u
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-selinux
name: nginx-selinux-disallowed
spec:
containers:
- image: nginx
name: nginx
securityContext:
seLinuxOptions:
level: s1:c234,c567
role: sysadm_r
type: svirt_lxc_net_t
user: sysadm_u
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-selinux
name: nginx-selinux-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
securityContext:
seLinuxOptions:
level: s1:c234,c567
role: sysadm_r
type: svirt_lxc_net_t
user: sysadm_u
K8sPSPSeccomp
Seccomp v1.0.1
Steuert das von Containern verwendete seccomp-Profil. Entspricht der Annotation seccomp.security.alpha.kubernetes.io/allowedProfileNames in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPSeccomp
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedLocalhostFiles <array>: When using securityContext naming scheme
# for seccomp and including `Localhost` this array holds the allowed
# profile JSON files. Putting a `*` in this array will allows all JSON
# files to be used. This field is required to allow `Localhost` in
# securityContext as with an empty list it will block.
allowedLocalhostFiles:
- <string>
# allowedProfiles <array>: An array of allowed profile values for seccomp
# on Pods/Containers. Can use the annotation naming scheme:
# `runtime/default`, `docker/default`, `unconfined` and/or
# `localhost/some-profile.json`. The item `localhost/*` will allow any
# localhost based profile. Can also use the securityContext naming scheme:
# `RuntimeDefault`, `Unconfined` and/or `Localhost`. For securityContext
# `Localhost`, use the parameter `allowedLocalhostProfiles` to list the
# allowed profile JSON files. The policy code will translate between the
# two schemes so it is not necessary to use both. Putting a `*` in this
# array allows all Profiles to be used. This field is required since with
# an empty list this policy will block all workloads.
allowedProfiles:
- <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Beispiele
psp-seccomp
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPSeccomp
metadata:
name: psp-seccomp
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
allowedProfiles:
- runtime/default
- docker/default
Zulässig
apiVersion: v1
kind: Pod
metadata:
annotations:
container.seccomp.security.alpha.kubernetes.io/nginx: runtime/default
labels:
app: nginx-seccomp
name: nginx-seccomp-allowed
spec:
containers:
- image: nginx
name: nginx
apiVersion: v1
kind: Pod
metadata:
annotations:
seccomp.security.alpha.kubernetes.io/pod: runtime/default
labels:
app: nginx-seccomp
name: nginx-seccomp-allowed2
spec:
containers:
- image: nginx
name: nginx
Unzulässig
apiVersion: v1
kind: Pod
metadata:
annotations:
seccomp.security.alpha.kubernetes.io/pod: unconfined
labels:
app: nginx-seccomp
name: nginx-seccomp-disallowed2
spec:
containers:
- image: nginx
name: nginx
apiVersion: v1
kind: Pod
metadata:
annotations:
container.seccomp.security.alpha.kubernetes.io/nginx: unconfined
labels:
app: nginx-seccomp
name: nginx-seccomp-disallowed
spec:
containers:
- image: nginx
name: nginx
apiVersion: v1
kind: Pod
metadata:
annotations:
container.seccomp.security.alpha.kubernetes.io/nginx: unconfined
labels:
app: nginx-seccomp
name: nginx-seccomp-disallowed
spec:
ephemeralContainers:
- image: nginx
name: nginx
K8sPSPVolumeTypes
Volume-Typen v1.0.2
Beschränkt die bereitstellbaren Volume-Typen auf die vom Nutzer angegebenen Volumes. Entspricht dem Feld volumes in einer PodSecurityPolicy. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPVolumeTypes
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# volumes <array>: `volumes` is an array of volume types. All volume types
# can be enabled using `*`.
volumes:
- <string>
Beispiele
psp-volume-types
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPVolumeTypes
metadata:
name: psp-volume-types
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
volumes:
- configMap
- emptyDir
- projected
- secret
- downwardAPI
- persistentVolumeClaim
- flexVolume
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-volume-types
name: nginx-volume-types-allowed
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /cache
name: cache-volume
- image: nginx
name: nginx2
volumeMounts:
- mountPath: /cache2
name: demo-vol
volumes:
- emptyDir: {}
name: cache-volume
- emptyDir: {}
name: demo-vol
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx-volume-types
name: nginx-volume-types-disallowed
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /cache
name: cache-volume
- image: nginx
name: nginx2
volumeMounts:
- mountPath: /cache2
name: demo-vol
volumes:
- hostPath:
path: /tmp
name: cache-volume
- emptyDir: {}
name: demo-vol
K8sPSPWindowsHostProcess
Schränkt Windows-HostProcess-Container/-Pods ein. V1.0.0
Schränkt die Ausführung von Windows HostProcess-Containern/-Pods ein. Weitere Informationen finden Sie unter https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPWindowsHostProcess
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
restrict-windows-hostprocess
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPWindowsHostProcess
metadata:
name: restrict-windows-hostprocess
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: nanoserver-ping-loop
spec:
containers:
- command:
- ping
- -t
- 127.0.0.1
image: mcr.microsoft.com/windows/nanoserver:1809
name: ping-loop
nodeSelector:
kubernetes.io/os: windows
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: nanoserver-ping-loop-hostprocess-container
spec:
containers:
- command:
- ping
- -t
- 127.0.0.1
image: mcr.microsoft.com/windows/nanoserver:1809
name: ping-test
securityContext:
windowsOptions:
hostProcess: true
runAsUserName: NT AUTHORITY\SYSTEM
hostNetwork: true
nodeSelector:
kubernetes.io/os: windows
apiVersion: v1
kind: Pod
metadata:
name: nanoserver-ping-loop-hostprocess-pod
spec:
containers:
- command:
- ping
- -t
- 127.0.0.1
image: mcr.microsoft.com/windows/nanoserver:1809
name: ping-test
hostNetwork: true
nodeSelector:
kubernetes.io/os: windows
securityContext:
windowsOptions:
hostProcess: true
runAsUserName: NT AUTHORITY\SYSTEM
K8sPSSRunAsNonRoot
Erfordert, dass Container als Nutzer ohne Root-Berechtigung ausgeführt werden. V1.0.0
Erfordert, dass Container als Nutzer ohne Root-Berechtigung ausgeführt werden. Weitere Informationen finden Sie unter https://kubernetes.io/docs/concepts/security/pod-security-standards/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSSRunAsNonRoot
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
restrict-runasnonroot
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSSRunAsNonRoot
metadata:
name: restrict-runasnonroot
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod-allowed
spec:
containers:
- image: nginx
name: nginx-container-allowed
securityContext:
runAsNonRoot: true
securityContext:
runAsNonRoot: true
apiVersion: v1
kind: Pod
metadata:
name: nginx-allowed
spec:
containers:
- image: nginx
name: nginx-allowed
securityContext:
runAsNonRoot: true
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod-allowed
spec:
containers:
- image: nginx
name: nginx-container-disallowed
securityContext:
runAsNonRoot: false
securityContext:
runAsNonRoot: true
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod-disallowed
spec:
containers:
- image: nginx
name: nginx-container-allowed
securityContext:
runAsNonRoot: true
securityContext:
runAsNonRoot: false
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod-disallowed
spec:
containers:
- image: nginx
name: nginx-container-disallowed
securityContext:
runAsNonRoot: false
K8sPodDisruptionBudget
Budget für Pod-Störungen v1.0.3
Die folgenden Szenarien sollen bei der Bereitstellung von PodDisruptionBudgets oder Ressourcen, die die Replikatunterressource implementieren (z. B. Deployment, ReplicationController, ReplicaSet, StatefulSet), nicht zugelassen werden: 1. Bereitstellung von PodDisruptionBudgets mit .spec.maxUnavailable == 0. 2. Bereitstellung von PodDisruptionBudgets mit .spec.minAvailable == .spec.replicas der Ressource mit Replikatunterressource. Dies verhindert, dass PodDisruptionBudgets freiwillige Störungen wie das Leeren von Knoten blockieren. https://kubernetes.io/docs/concepts/workloads/Pods/Unterbrechungen/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPodDisruptionBudget
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "policy"
version: "v1"
kind: "PodDisruptionBudget"
Beispiele
pod-distruption-budget
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPodDisruptionBudget
metadata:
name: pod-distruption-budget
spec:
match:
kinds:
- apiGroups:
- apps
kinds:
- Deployment
- ReplicaSet
- StatefulSet
- apiGroups:
- policy
kinds:
- PodDisruptionBudget
- apiGroups:
- ""
kinds:
- ReplicationController
Zulässig
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: nginx-pdb-allowed
namespace: default
spec:
maxUnavailable: 1
selector:
matchLabels:
foo: bar
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment-allowed-1
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: allowed-deployment-1
template:
metadata:
labels:
app: nginx
example: allowed-deployment-1
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
---
# Referential Data
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: inventory-nginx-pdb-allowed-1
namespace: default
spec:
minAvailable: 2
selector:
matchLabels:
app: nginx
example: allowed-deployment-1
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment-allowed-2
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: allowed-deployment-2
template:
metadata:
labels:
app: nginx
example: allowed-deployment-2
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
---
# Referential Data
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: inventory-nginx-pdb-allowed-2
namespace: default
spec:
maxUnavailable: 1
selector:
matchLabels:
app: nginx
example: allowed-deployment-2
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment-allowed-3
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: allowed-deployment-3
template:
metadata:
labels:
app: nginx
example: allowed-deployment-3
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
---
# Referential Data
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: inventory-nginx-pdb-allowed-3
namespace: default
spec:
minAvailable: 2
selector:
matchLabels:
app: nginx
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: non-matching-nginx
name: nginx-deployment-allowed-4
namespace: default
spec:
replicas: 1
selector:
matchLabels:
app: non-matching-nginx
example: allowed-deployment-4
template:
metadata:
labels:
app: non-matching-nginx
example: allowed-deployment-4
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
---
# Referential Data
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: inventory-mongo-pdb-allowed-3
namespace: default
spec:
minAvailable: 2
selector:
matchLabels:
app: mongo
example: non-matching-deployment-3
Nicht zugelassen
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: nginx-pdb-disallowed
namespace: default
spec:
maxUnavailable: 0
selector:
matchLabels:
foo: bar
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment-disallowed
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: nginx
example: disallowed-deployment
template:
metadata:
labels:
app: nginx
example: disallowed-deployment
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
---
# Referential Data
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: inventory-nginx-pdb-disallowed
namespace: default
spec:
minAvailable: 3
selector:
matchLabels:
app: nginx
example: disallowed-deployment
K8sPodResourcesBestPractices
Erfordert Container, die nicht auf Best-Effort-Basis und gemäß den Best Practices für Burstable v1.0.5
Erfordert, dass Container nicht auf Best-Effort-Basis (durch Festlegen von CPU- und Arbeitsspeicheranforderungen) und gemäß den Best Practices für Bursts funktionieren (die Arbeitsspeicherspeicheranfrage muss genau dem Limit entsprechen). Optional können Annotationsschlüssel konfiguriert werden, um das Überspringen der verschiedenen Validierungen zu ermöglichen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPodResourcesBestPractices
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: A list of exempt Images.
exemptImages:
- <string>
# skipBestEffortValidationAnnotationKey <string>: Optional annotation key
# to skip best-effort container validation.
skipBestEffortValidationAnnotationKey: <string>
# skipBurstableValidationAnnotationKey <string>: Optional annotation key to
# skip burstable container validation.
skipBurstableValidationAnnotationKey: <string>
# skipResourcesBestPracticesValidationAnnotationKey <string>: Optional
# annotation key to skip both best-effort and burstable validation.
skipResourcesBestPracticesValidationAnnotationKey: <string>
Beispiele
gke-pod-resources-best-practices
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPodResourcesBestPractices
metadata:
name: gke-pod-resources-best-practices
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
skipBestEffortValidationAnnotationKey: skip_besteffort_validation
skipBurstableValidationAnnotationKey: skip_burstable_validation
skipResourcesBestPracticesValidationAnnotationKey: skip_resources_best_practices_validation
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-cpu-requests-memory-limits
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
memory: 500Mi
requests:
cpu: 250m
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-limits-only
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 250m
memory: 100Mi
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-requests-memory-limits
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
memory: 100Mi
requests:
cpu: 250m
memory: 100Mi
apiVersion: v1
kind: Pod
metadata:
annotations:
skip_besteffort_validation: "true"
skip_burstable_validation: "true"
skip_resources_best_practices_validation: "false"
name: pod-skip-validation
spec:
containers:
- image: nginx
name: nginx
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: pod-not-setting-cpu-burstable-on-memory
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
memory: 500Mi
requests:
memory: 100Mi
apiVersion: v1
kind: Pod
metadata:
name: pod-not-setting-requests
spec:
containers:
- image: nginx
name: nginx
restartPolicy: OnFailure
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-cpu-not-burstable-on-memory
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
memory: 500Mi
requests:
cpu: 250m
memory: 100Mi
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-memory-requests-cpu-limits
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 30m
requests:
memory: 100Mi
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-only-cpu-limits
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 250m
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-only-cpu-requests
spec:
containers:
- image: nginx
name: nginx
resources:
requests:
cpu: 250m
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-only-cpu
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
cpu: 500m
requests:
cpu: 250m
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-only-memory-limits
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
memory: 250Mi
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-only-memory-requests
spec:
containers:
- image: nginx
name: nginx
resources:
requests:
memory: 100Mi
apiVersion: v1
kind: Pod
metadata:
name: pod-setting-only-memory
spec:
containers:
- image: nginx
name: nginx
resources:
limits:
memory: 100Mi
requests:
memory: 100Mi
K8sPodsRequireSecurityContext
Pods erfordern Sicherheitskontext v1.1.1
Erfordert, dass alle Pods securityContext definieren. Erfordert, dass alle in Pods definierten Container einen SecurityContext auf Pod- oder Containerebene definieren.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPodsRequireSecurityContext
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: A list of exempt Images.
exemptImages:
- <string>
Beispiele
pods-require-security-context-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPodsRequireSecurityContext
metadata:
name: pods-require-security-context-sample
spec:
enforcementAction: dryrun
parameters:
exemptImages:
- nginix-exempt
- alpine*
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: allowed-example
spec:
containers:
- image: nginx
name: nginx
securityContext:
runAsUser: 2000
apiVersion: v1
kind: Pod
metadata:
name: allowed-example-exemptImage
spec:
containers:
- image: nginix-exempt
name: nginx
apiVersion: v1
kind: Pod
metadata:
name: allowed-example-exemptImage-wildcard
spec:
containers:
- image: alpine17
name: alpine
Unzulässig
apiVersion: v1
kind: Pod
metadata:
name: disallowed-example
spec:
containers:
- image: nginx
name: nginx
K8sProhibitRoleWildcardAccess
Platzhalterzugriff (Version 1.0.5) untersagen
Erfordert, dass Roles und ClusterRoles den Ressourcenzugriff nicht auf einen Platzhalterwert "" festlegen. Dies gilt nicht für die ausgenommenen Roles und ClusterRoles, die als Ausnahmen angegeben werden. Beschränkt den Platzhalterzugriff auf untergeordnete Ressourcen wie „/status“.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sProhibitRoleWildcardAccess
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptions <object>: The list of exempted Roles and/or ClusterRoles name
# that are allowed to set resource access to a wildcard.
exemptions:
clusterRoles:
- # name <string>: The name of the ClusterRole to be exempted.
name: <string>
# regexMatch <boolean>: The flag to allow a regular expression
# based match on the name.
regexMatch: <boolean>
roles:
- # name <string>: The name of the Role to be exempted.
name: <string>
# namespace <string>: The namespace of the Role to be exempted.
namespace: <string>
Beispiele
prohibit-role-wildcard-access-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sProhibitRoleWildcardAccess metadata: name: prohibit-role-wildcard-access-sample spec: enforcementAction: dryrun
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cluster-role-example rules: - apiGroups: - "" resources: - pods verbs: - get
Nicht zugelassen
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cluster-role-bad-example rules: - apiGroups: - "" resources: - pods verbs: - '*'
prohibit-wildcard-except-exempted-cluster-role
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sProhibitRoleWildcardAccess
metadata:
name: prohibit-wildcard-except-exempted-cluster-role
spec:
enforcementAction: dryrun
parameters:
exemptions:
clusterRoles:
- name: cluster-role-allowed-example
roles:
- name: role-allowed-example
namespace: role-ns-allowed-example
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cluster-role-allowed-example rules: - apiGroups: - "" resources: - pods verbs: - '*'
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: role-allowed-example namespace: role-ns-allowed-example rules: - apiGroups: - "" resources: - pods verbs: - '*'
Unzulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cluster-role-not-allowed-example rules: - apiGroups: - "" resources: - pods verbs: - '*'
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: role-not-allowed-example namespace: role-ns-not-allowed-example rules: - apiGroups: - "" resources: - pods verbs: - '*'
K8sReplicaLimits
Replikatlimits v1.0.2
Erfordert, dass Objekte mit dem Feld spec.replicas (Deployments, ReplicaSets usw.) eine Anzahl von Replikaten innerhalb definierter Bereiche angeben.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sReplicaLimits
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# ranges <array>: Allowed ranges for numbers of replicas. Values are
# inclusive.
ranges:
# <list item: object>: A range of allowed replicas. Values are
# inclusive.
- # max_replicas <integer>: The maximum number of replicas allowed,
# inclusive.
max_replicas: <integer>
# min_replicas <integer>: The minimum number of replicas allowed,
# inclusive.
min_replicas: <integer>
Beispiele
replica-limits
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sReplicaLimits
metadata:
name: replica-limits
spec:
match:
kinds:
- apiGroups:
- apps
kinds:
- Deployment
parameters:
ranges:
- max_replicas: 50
min_replicas: 3
Zulässig
apiVersion: apps/v1
kind: Deployment
metadata:
name: allowed-deployment
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
Nicht zugelassen
apiVersion: apps/v1
kind: Deployment
metadata:
name: disallowed-deployment
spec:
replicas: 100
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
K8sRequireAdmissionController
Admission-Controller v1.0.0 erforderlich machen
Erfordert entweder "Pod Security Admission" oder ein externes Richtlinienkontrollsystem
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireAdmissionController
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# permittedValidatingWebhooks <array>: List of permitted validating
# webhooks which are valid external policy control systems
permittedValidatingWebhooks:
- <string>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "admissionregistration.k8s.io"
version: "v1" OR "v1beta1"
kind: "ValidatingWebhookConfiguration"
Beispiele
require-admission-controller
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireAdmissionController
metadata:
name: require-admission-controller
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Namespace
Zulässig
apiVersion: v1
kind: Namespace
metadata:
labels:
pod-security.kubernetes.io/enforce: baseline
pod-security.kubernetes.io/enforce-version: v1.28
name: allowed-namespace
Nicht zugelassen
apiVersion: v1 kind: Namespace metadata: name: disallowed-namespace
K8sRequireBinAuthZ
Erfordert Binärautorisierung v1.0.2
Erfordert validierenden Zulassungs-Webhook der Binärautorisierung. Einschränkungen mit diesem ConstraintTemplate werden unabhängig vom enforcementAction-Wert nur geprüft.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireBinAuthZ
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "admissionregistration.k8s.io"
version: "v1" OR "v1beta1"
kind: "ValidatingWebhookConfiguration"
Beispiele
require-binauthz
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireBinAuthZ
metadata:
name: require-binauthz
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- ""
kinds:
- Namespace
Zulässig
apiVersion: v1
kind: Namespace
metadata:
name: default
---
# Referential Data
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: binauthz-admission-controller
webhooks:
- admissionReviewVersions:
- v1
- v1beta1
clientConfig:
url: https://binaryauthorization.googleapis.com/internal/projects/ap-bps-experimental-gke/policy/locations/us-central1/clusters/acm-test-cluster:admissionReview
name: imagepolicywebhook.image-policy.k8s.io
rules:
- operations:
- CREATE
- UPDATE
- apiVersion:
- v1
sideEffects: None
Nicht zugelassen
apiVersion: v1 kind: Namespace metadata: name: default
K8sRequireCosNodeImage
COS-Knoten-Image erforderlich v1.1.1
Erzwingt die Verwendung von Container-Optimized OS von Google auf Knoten.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireCosNodeImage
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptOsImages <array>: A list of exempt OS Images.
exemptOsImages:
- <string>
Beispiele
nodes-have-consistent-time
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireCosNodeImage
metadata:
name: nodes-have-consistent-time
spec:
enforcementAction: dryrun
parameters:
exemptOsImages:
- Debian
- Ubuntu*
Zulässig
apiVersion: v1
kind: Node
metadata:
name: allowed-example
status:
nodeInfo:
osImage: Container-Optimized OS from Google
apiVersion: v1
kind: Node
metadata:
name: example-exempt
status:
nodeInfo:
osImage: Debian
apiVersion: v1
kind: Node
metadata:
name: example-exempt-wildcard
status:
nodeInfo:
osImage: Ubuntu 18.04.5 LTS
Nicht zugelassen
apiVersion: v1
kind: Node
metadata:
name: disallowed-example
status:
nodeInfo:
osImage: Debian GNUv1.0
K8sRequireDaemonsets
Erforderliche Daemonsets v1.1.2
Erfordert die vorhandene Liste der Daemonsets.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireDaemonsets
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# requiredDaemonsets <array>: A list of names and namespaces of the
# required daemonsets.
requiredDaemonsets:
- # name <string>: The name of the required daemonset.
name: <string>
# namespace <string>: The namespace for the required daemonset.
namespace: <string>
# restrictNodeSelector <boolean>: The daemonsets cannot include
# `NodeSelector`.
restrictNodeSelector: <boolean>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "extensions"
version: "v1beta1"
kind: "DaemonSet"
OR
- group: "apps"
version: "v1beta2" OR "v1"
kind: "DaemonSet"
Beispiele
require-daemonset
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireDaemonsets
metadata:
name: require-daemonset
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- ""
kinds:
- Namespace
parameters:
requiredDaemonsets:
- name: clamav
namespace: pci-dss-av
restrictNodeSelector: true
Zulässig
apiVersion: v1
kind: Namespace
metadata:
name: pci-dss-av
---
# Referential Data
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: other
namespace: pci-dss-av
spec:
selector:
matchLabels:
name: other
template:
spec:
containers:
- image: us.gcr.io/{your-project-id}/other:latest
name: other
---
# Referential Data
apiVersion: apps/v1
kind: DaemonSet
metadata:
labels:
k8s-app: clamav-host-scanner
name: clamav
namespace: pci-dss-av
spec:
selector:
matchLabels:
name: clamav
template:
metadata:
labels:
name: clamav
spec:
containers:
- image: us.gcr.io/{your-project-id}/clamav:latest
livenessProbe:
exec:
command:
- /health.sh
initialDelaySeconds: 60
periodSeconds: 30
name: clamav-scanner
resources:
limits:
memory: 3Gi
requests:
cpu: 500m
memory: 2Gi
volumeMounts:
- mountPath: /data
name: data-vol
- mountPath: /host-fs
name: host-fs
readOnly: true
- mountPath: /logs
name: logs
terminationGracePeriodSeconds: 30
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
volumes:
- emptyDir: {}
name: data-vol
- hostPath:
path: /
name: host-fs
- hostPath:
path: /var/log/clamav
name: logs
Nicht zugelassen
apiVersion: v1 kind: Namespace metadata: name: pci-dss-av
apiVersion: v1
kind: Namespace
metadata:
name: pci-dss-av
---
# Referential Data
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: other
namespace: pci-dss-av
spec:
selector:
matchLabels:
name: other
template:
spec:
containers:
- image: us.gcr.io/{your-project-id}/other:latest
name: other
apiVersion: v1
kind: Namespace
metadata:
name: pci-dss-av
---
# Referential Data
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: clamav
namespace: pci-dss-av
spec:
selector:
matchLabels:
name: clamav
template:
spec:
containers:
- image: us.gcr.io/{your-project-id}/other:latest
name: clamav
nodeSelector:
cloud.google.com/gke-spot: "true"
K8sRequireDefaultDenyEgressPolicy
Standardrichtlinie zum Ablehnen von ausgehendem Traffic erforderlich machen v1.0.3
Erfordert, dass jeder im Cluster definierte Namespace eine standardmäßige NetworkPolicy für ausgehenden Traffic hat.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireDefaultDenyEgressPolicy
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "extensions"
version: "v1beta1"
kind: "NetworkPolicy"
OR
- group: "networking.k8s.io"
version: "v1"
kind: "NetworkPolicy"
Beispiele
require-default-deny-network-policies
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sRequireDefaultDenyEgressPolicy metadata: name: require-default-deny-network-policies spec: enforcementAction: dryrun
Zulässig
apiVersion: v1
kind: Namespace
metadata:
name: example-namespace
---
# Referential Data
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-egress
namespace: example-namespace
spec:
podSelector: {}
policyTypes:
- Egress
Unzulässig
apiVersion: v1 kind: Namespace metadata: name: example-namespace
apiVersion: v1
kind: Namespace
metadata:
name: example-namespace2
---
# Referential Data
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-egress
namespace: example-namespace
spec:
podSelector: {}
policyTypes:
- Egress
K8sRequireNamespaceNetworkPolicies
Namespace-Netzwerkrichtlinien 1.0.6 erforderlich
Erfordert, dass jeder im Cluster definierte Namespace eine NetworkPolicy hat.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireNamespaceNetworkPolicies
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "extensions"
version: "v1beta1"
kind: "NetworkPolicy"
OR
- group: "networking.k8s.io"
version: "v1"
kind: "NetworkPolicy"
Beispiele
require-namespace-network-policies-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sRequireNamespaceNetworkPolicies metadata: name: require-namespace-network-policies-sample spec: enforcementAction: dryrun
Zulässig
apiVersion: v1 kind: Namespace metadata: name: require-namespace-network-policies-example --- # Referential Data apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: require-namespace-network-policies-example
Nicht zugelassen
apiVersion: v1 kind: Namespace metadata: name: require-namespace-network-policies-example
K8sRequireValidRangesForNetworks
Gültige Bereiche für Netzwerke erforderlich machen v1.0.2
Erzwingt, welche CIDR-Blöcke für eingehenden und ausgehenden Netzwerktraffic zulässig sind.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireValidRangesForNetworks
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedEgress <array>: IP ranges in CIDR format (0.0.0.0/32) that are
# allowed for egress.
allowedEgress:
- <string>
# allowedIngress <array>: IP ranges in CIDR format (0.0.0.0/32) that are
# allowed for ingress.
allowedIngress:
- <string>
Beispiele
require-valid-network-ranges
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireValidRangesForNetworks
metadata:
name: require-valid-network-ranges
spec:
enforcementAction: dryrun
parameters:
allowedEgress:
- 10.0.0.0/32
allowedIngress:
- 10.0.0.0/24
Zulässig
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
egress:
- ports:
- port: 5978
protocol: TCP
to:
- ipBlock:
cidr: 10.0.0.0/32
ingress:
- from:
- ipBlock:
cidr: 10.0.0.0/29
- ipBlock:
cidr: 10.0.0.100/29
- namespaceSelector:
matchLabels:
project: myproject
- podSelector:
matchLabels:
role: frontend
ports:
- port: 6379
protocol: TCP
podSelector:
matchLabels:
role: db
policyTypes:
- Ingress
- Egress
Unzulässig
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy-disallowed
namespace: default
spec:
egress:
- ports:
- port: 5978
protocol: TCP
to:
- ipBlock:
cidr: 1.1.2.0/31
ingress:
- from:
- ipBlock:
cidr: 1.1.2.0/24
- ipBlock:
cidr: 2.1.2.0/24
- namespaceSelector:
matchLabels:
project: myproject
- podSelector:
matchLabels:
role: frontend
ports:
- port: 6379
protocol: TCP
podSelector:
matchLabels:
role: db
policyTypes:
- Ingress
- Egress
K8sRequiredAnnotations
Erforderliche Annotationen v1.0.1
Erfordert Ressourcen, die bestimmte Annotationen enthalten, wobei Werte mit den regulären Ausdrücken übereinstimmen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredAnnotations
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# annotations <array>: A list of annotations and values the object must
# specify.
annotations:
- # allowedRegex <string>: If specified, a regular expression the
# annotation's value must match. The value must contain at least one
# match for the regular expression.
allowedRegex: <string>
# key <string>: The required annotation.
key: <string>
message: <string>
Beispiele
all-must-have-certain-set-of-annotations
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredAnnotations
metadata:
name: all-must-have-certain-set-of-annotations
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Service
parameters:
annotations:
- allowedRegex: ^([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}|[a-z]{1,39})$
key: a8r.io/owner
- allowedRegex: ^(http:\/\/www\.|https:\/\/www\.|http:\/\/|https:\/\/)?[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,5}(:[0-9]{1,5})?(\/.*)?$
key: a8r.io/runbook
message: All services must have a `a8r.io/owner` and `a8r.io/runbook` annotations.
Zulässig
apiVersion: v1
kind: Service
metadata:
annotations:
a8r.io/owner: dev-team-alfa@contoso.com
a8r.io/runbook: https://confluence.contoso.com/dev-team-alfa/runbooks
name: allowed-service
spec:
ports:
- name: http
port: 80
targetPort: 8080
selector:
app: foo
Unzulässig
apiVersion: v1
kind: Service
metadata:
name: disallowed-service
spec:
ports:
- name: http
port: 80
targetPort: 8080
selector:
app: foo
K8sRequiredLabels
Erforderliche Labels v1.0.1
Erfordert, dass Ressourcen bestimmte Labels enthalten, wobei Werte mit den regulären Ausdrücken übereinstimmen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# labels <array>: A list of labels and values the object must specify.
labels:
- # allowedRegex <string>: If specified, a regular expression the
# annotation's value must match. The value must contain at least one
# match for the regular expression.
allowedRegex: <string>
# key <string>: The required label.
key: <string>
message: <string>
Beispiele
all-must-have-owner
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
name: all-must-have-owner
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Namespace
parameters:
labels:
- allowedRegex: ^[a-zA-Z]+.agilebank.demo$
key: owner
message: All namespaces must have an `owner` label that points to your company
username
Zulässig
apiVersion: v1
kind: Namespace
metadata:
labels:
owner: user.agilebank.demo
name: allowed-namespace
Unzulässig
apiVersion: v1 kind: Namespace metadata: name: disallowed-namespace
K8sRequiredProbes
Erforderliche Prüfungen v1.0.1
Erfordert, dass Pods über Bereitschafts- und/oder Aktivitätsprüfungen verfügen.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredProbes
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# probeTypes <array>: The probe must define a field listed in `probeType`
# in order to satisfy the constraint (ex. `tcpSocket` satisfies
# `['tcpSocket', 'exec']`)
probeTypes:
- <string>
# probes <array>: A list of probes that are required (ex: `readinessProbe`)
probes:
- <string>
Beispiele
must-have-probes
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredProbes
metadata:
name: must-have-probes
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
probeTypes:
- tcpSocket
- httpGet
- exec
probes:
- readinessProbe
- livenessProbe
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: test-pod1
spec:
containers:
- image: tomcat
livenessProbe:
initialDelaySeconds: 5
periodSeconds: 10
tcpSocket:
port: 80
name: tomcat
ports:
- containerPort: 8080
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 10
tcpSocket:
port: 8080
volumes:
- emptyDir: {}
name: cache-volume
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: test-pod1
spec:
containers:
- image: nginx:1.7.9
name: nginx-1
ports:
- containerPort: 80
volumeMounts:
- mountPath: /tmp/cache
name: cache-volume
- image: tomcat
name: tomcat
ports:
- containerPort: 8080
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 10
tcpSocket:
port: 8080
volumes:
- emptyDir: {}
name: cache-volume
apiVersion: v1
kind: Pod
metadata:
name: test-pod2
spec:
containers:
- image: nginx:1.7.9
livenessProbe:
initialDelaySeconds: 5
periodSeconds: 10
tcpSocket:
port: 80
name: nginx-1
ports:
- containerPort: 80
volumeMounts:
- mountPath: /tmp/cache
name: cache-volume
- image: tomcat
name: tomcat
ports:
- containerPort: 8080
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 10
tcpSocket:
port: 8080
volumes:
- emptyDir: {}
name: cache-volume
K8sRequiredResources
Erforderliche Ressourcen v1.0.1
Erfordert, dass Container definierte Ressourcen festlegen. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredResources
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# limits <array>: A list of limits that should be enforced (`cpu`,
# `memory`, or both).
limits:
# Allowed Values: cpu, memory
- <string>
# requests <array>: A list of requests that should be enforced (`cpu`,
# `memory`, or both).
requests:
# Allowed Values: cpu, memory
- <string>
Beispiele
container-must-have-limits-and-requests
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredResources
metadata:
name: container-must-have-limits-and-requests
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
limits:
- cpu
- memory
requests:
- cpu
- memory
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 1Gi
requests:
cpu: 100m
memory: 1Gi
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
requests:
cpu: 100m
memory: 2Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
memory: 2Gi
requests:
cpu: 100m
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
memory: 2Gi
container-must-have-cpu-requests-memory-limits-and-requests
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredResources
metadata:
name: container-must-have-cpu-requests-memory-limits-and-requests
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
limits:
- memory
requests:
- cpu
- memory
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 1Gi
requests:
cpu: 100m
memory: 1Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
memory: 2Gi
requests:
cpu: 100m
memory: 2Gi
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
requests:
cpu: 100m
memory: 2Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
memory: 2Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources: {}
no-enforcements
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredResources
metadata:
name: no-enforcements
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
Zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-allowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
cpu: 100m
memory: 1Gi
requests:
cpu: 100m
memory: 1Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
requests:
cpu: 100m
memory: 2Gi
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources:
limits:
memory: 2Gi
requests:
cpu: 100m
apiVersion: v1
kind: Pod
metadata:
labels:
owner: me.agilebank.demo
name: opa-disallowed
spec:
containers:
- args:
- run
- --server
- --addr=localhost:8080
image: openpolicyagent/opa:0.9.2
name: opa
resources: {}
K8sRestrictAdmissionController
Admission-Controller v1.0.0 einschränken
Dynamische Zulassungs-Controller auf zulässige Zulassungs-Controller beschränken
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictAdmissionController
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# permittedMutatingWebhooks <array>: List of permitted mutating webhooks
# (mutating admission controllers)
permittedMutatingWebhooks:
- <string>
# permittedValidatingWebhooks <array>: List of permitted validating
# webhooks (validating admission controllers)
permittedValidatingWebhooks:
- <string>
Beispiele
Admission-Controller einschränken
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictAdmissionController
metadata:
name: restrict-admission-controller
spec:
match:
kinds:
- apiGroups:
- admissionregistration.k8s.io
kinds:
- MutatingWebhookConfiguration
- ValidatingWebhookConfiguration
parameters:
permittedMutatingWebhooks:
- allowed-mutating-webhook
permittedValidatingWebhooks:
- allowed-validating-webhook
Zulässig
apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: allowed-validating-webhook
Nicht zugelassen
apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: disallowed-validating-webhook
K8sRestrictAutomountServiceAccountTokens
Dienstkonto-Tokens v1.0.1 einschränken
Beschränkt die Verwendung von Dienstkonto-Tokens.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictAutomountServiceAccountTokens
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
restrict-serviceaccounttokens
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictAutomountServiceAccountTokens
metadata:
name: restrict-serviceaccounttokens
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
- ServiceAccount
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: allowed-example-pod
spec:
containers:
- image: nginx
name: nginx
apiVersion: v1 kind: ServiceAccount metadata: name: disallowed-example-serviceaccount
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: disallowed-example-pod
spec:
automountServiceAccountToken: true
containers:
- image: nginx
name: nginx
apiVersion: v1 automountServiceAccountToken: true kind: ServiceAccount metadata: name: allowed-example-serviceaccount
K8sRestrictLabels
Labels einschränken v1.0.2
Verhindert, dass Ressourcen bestimmte Labels enthalten, es sei denn, es gibt eine Ausnahme für die jeweilige Ressource.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictLabels
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exceptions <array>: Objects listed here are exempt from enforcement of
# this constraint. All fields must be provided.
exceptions:
# <list item: object>: A single object's identification, based on group,
# kind, namespace, and name.
- # group <string>: The Kubernetes group of the exempt object.
group: <string>
# kind <string>: The Kubernetes kind of the exempt object.
kind: <string>
# name <string>: The name of the exempt object.
name: <string>
# namespace <string>: The namespace of the exempt object. For
# cluster-scoped resources, use the empty string `""`.
namespace: <string>
# restrictedLabels <array>: A list of label keys strings.
restrictedLabels:
- <string>
Beispiele
restrict-label-example
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictLabels
metadata:
name: restrict-label-example
spec:
enforcementAction: dryrun
parameters:
exceptions:
- group: ""
kind: Pod
name: allowed-example
namespace: default
restrictedLabels:
- label-example
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
label-example: example
name: allowed-example
namespace: default
spec:
containers:
- image: nginx
name: nginx
Unzulässig
apiVersion: v1
kind: Pod
metadata:
labels:
label-example: example
name: disallowed-example
namespace: default
spec:
containers:
- image: nginx
name: nginx
K8sRestrictNamespaces
Namespaces einschränken v1.0.1
Schränkt die Verwendung von Namespaces durch Ressourcen ein, die unter dem Parameter restrictedNamespaces aufgeführt sind.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictNamespaces
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# restrictedNamespaces <array>: A list of Namespaces to restrict.
restrictedNamespaces:
- <string>
Beispiele
restrict-default-namespace-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictNamespaces
metadata:
name: restrict-default-namespace-sample
spec:
enforcementAction: dryrun
parameters:
restrictedNamespaces:
- default
Zulässig
apiVersion: v1
kind: Pod
metadata:
name: allowed-example
namespace: test-namespace
spec:
containers:
- image: nginx
name: nginx
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
name: disallowed-example
namespace: default
spec:
containers:
- image: nginx
name: nginx
K8sRestrictNfsUrls
NFS-URLs v1.0.1 einschränken
Verhindert, dass Ressourcen NFS-URLs enthalten, sofern nicht anders angegeben.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictNfsUrls
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedNfsUrls <array>: A list of allowed NFS URLs
allowedNfsUrls:
- <string>
Beispiele
restrict-label-example
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictNfsUrls
metadata:
name: restrict-label-example
spec:
enforcementAction: dryrun
parameters:
allowedNfsUrls:
- my-nfs-server.example.com/my-nfs-volume
- my-nfs-server.example.com/my-wildcard-nfs-volume/*
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
label-example: example
name: allowed-example
namespace: default
spec:
containers:
- image: nginx
name: nginx
apiVersion: v1
kind: Pod
metadata:
labels:
label-example: example
name: allowed-example-nfs
namespace: default
spec:
containers:
- image: nginx
name: nginx
- name: test-volume
nfs:
path: /my-nfs-volume
server: my-nfs-server.example.com
apiVersion: v1
kind: Pod
metadata:
labels:
label-example: example
name: allowed-example-nfs-wildcard
namespace: default
spec:
containers:
- image: nginx
name: nginx
- name: test-volume
nfs:
path: /my-nfs-volume/my-wildcard-nfs-volume/wildcard_matched_path
server: my-nfs-server.example.com
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
labels:
label-example: example
name: disallowed-example-nfs
namespace: default
spec:
containers:
- image: nginx
name: nginx
volumes:
- name: test-volume
nfs:
path: /my-nfs-volume
server: disallowed-nfs-server.example.com
apiVersion: v1
kind: Pod
metadata:
labels:
label-example: example
name: disallowed-example-nfs-mixed
namespace: default
spec:
containers:
- image: nginx
name: nginx
volumes:
- name: test-volume-allowed
nfs:
path: /my-nfs-volume
server: my-nfs-server.example.com
- name: test-volume-disallowed
nfs:
path: /my-nfs-volume
server: disallowed-nfs-server.example.com
K8sRestrictRbacSubjects
RBAC Subjects v1.0.3 einschränken
Schränkt die Verwendung von Namen in RBAC auf zulässige Werte ein.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRbacSubjects
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedSubjects <array>: The list of names permitted in RBAC subjects.
allowedSubjects:
- # name <string>: The exact-name or the pattern of the allowed subject
name: <string>
# regexMatch <boolean>: The flag to allow a regular expression based
# match on the name.
regexMatch: <boolean>
Beispiele
restrict-rbac-subjects
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRbacSubjects
metadata:
name: restrict-rbac-subjects
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- rbac.authorization.k8s.io
kinds:
- RoleBinding
- ClusterRoleBinding
parameters:
allowedSubjects:
- name: system:masters
- name: ^.+@gcp-sa-[a-z-]+.iam.gserviceaccount.com$
regexMatch: true
- name: ^.+@system.gserviceaccount.com$
regexMatch: true
- name: ^.+@google.com$
regexMatch: true
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: good-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: user@google.com - apiGroup: rbac.authorization.k8s.io kind: Group name: system:masters - apiGroup: rbac.authorization.k8s.io kind: User name: service-1234567890@gcp-sa-ktd-control.iam.gserviceaccount.com
Unzulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: bad-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: user1@example.com - apiGroup: rbac.authorization.k8s.io kind: User name: user2@example.com
K8sRestrictRoleBindings
Rollenbindungen einschränken v1.0.3
Beschränkt die in ClusterRoleBindings und RoleBindings angegebenen Subjekte auf eine Liste zulässiger Subjekte.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRoleBindings
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedSubjects <array>: The list of subjects that are allowed to bind to
# the restricted role.
allowedSubjects:
- # apiGroup <string>: The Kubernetes API group of the subject.
apiGroup: <string>
# kind <string>: The Kubernetes kind of the subject.
kind: <string>
# name <string>: The name of the subject which is matched exactly as
# provided as well as based on a regular expression.
name: <string>
# regexMatch <boolean>: The flag to allow a regular expression based
# match on the name.
regexMatch: <boolean>
# restrictedRole <object>: The role that cannot be bound to unless
# expressly allowed.
restrictedRole:
# apiGroup <string>: The Kubernetes API group of the role.
apiGroup: <string>
# kind <string>: The Kubernetes kind of the role.
kind: <string>
# name <string>: The name of the role.
name: <string>
Beispiele
restrict-clusteradmin-rolebindings-sample
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRoleBindings
metadata:
name: restrict-clusteradmin-rolebindings-sample
spec:
enforcementAction: dryrun
parameters:
allowedSubjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:masters
restrictedRole:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: good-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:masters
Nicht zugelassen
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: bad-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
restrict-clusteradmin-rolebindings-regex
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRoleBindings
metadata:
name: restrict-clusteradmin-rolebindings-regex
spec:
enforcementAction: dryrun
parameters:
allowedSubjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: ^service-[0-9]+@gcp-sa-anthosconfigmanagement.iam.gserviceaccount.com$
regexMatch: true
restrictedRole:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: good-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: service-123456789@gcp-sa-anthosconfigmanagement.iam.gserviceaccount.com
Nicht zugelassen
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: bad-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: someotherservice-123456789@gcp-sa-anthosconfigmanagement.iam.gserviceaccount.com
K8sRestrictRoleRules
Schränken Sie Role- und ClusterRole-Regeln ein. V1.0.4
Schränkt Regeln ein, die für Role- und ClusterRole-Objekte festgelegt werden können.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRoleRules
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedRules <array>: AllowedRules is the list of rules that are allowed
# on Role or ClusterRole objects. If set, any item off this list will be
# rejected.
allowedRules:
- # apiGroups <array>: APIGroups is the name of the APIGroup that
# contains the resources. If multiple API groups are specified, any
# action requested against one of the enumerated resources in any API
# group will be allowed. "" represents the core API group and "*"
# represents all API groups.
apiGroups:
- <string>
# resources <array>: Resources is a list of resources this rule
# applies to. '*' represents all resources.
resources:
- <string>
# verbs <array>: Verbs is a list of Verbs that apply to ALL the
# ResourceKinds contained in this rule. '*' represents all verbs.
verbs:
- <string>
# disallowedRules <array>: DisallowedRules is the list of rules that are
# NOT allowed on Role or ClusterRole objects. If set, any item on this list
# will be rejected.
disallowedRules:
- # apiGroups <array>: APIGroups is the name of the APIGroup that
# contains the resources. If multiple API groups are specified, any
# action requested against one of the enumerated resources in any API
# group will be disallowed. "" represents the core API group and "*"
# represents all API groups.
apiGroups:
- <string>
# resources <array>: Resources is a list of resources this rule
# applies to. '*' represents all resources.
resources:
- <string>
# verbs <array>: Verbs is a list of Verbs that apply to ALL the
# ResourceKinds contained in this rule. '*' represents all verbs.
verbs:
- <string>
# exemptions <object>: Exemptions is the list of Roles and/or ClusterRoles
# names that are allowed to violate this policy.
exemptions:
clusterRoles:
- # name <string>: Name is the name or a pattern of the ClusterRole
# to be exempted.
name: <string>
# regexMatch <boolean>: RegexMatch is the flag to toggle exact vs
# regex match of the ClusterRole name.
regexMatch: <boolean>
roles:
- # name <string>: Name is the name of the Role to be exempted.
name: <string>
# namespace <string>: Namespace is the namespace of the Role to be
# exempted.
namespace: <string>
Beispiele
restrict-pods-exec
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRoleRules
metadata:
name: restrict-pods-exec
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- rbac.authorization.k8s.io
kinds:
- Role
- ClusterRole
parameters:
disallowedRules:
- apiGroups:
- ""
resources:
- pods/exec
verbs:
- create
Zulässig
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: allowed-role-example rules: - apiGroups: - "" resources: - pods verbs: - get - list - watch
Nicht zugelassen
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: disallowed-cluster-role-example rules: - apiGroups: - "" resources: - pods/exec verbs: - '*'
K8sStorageClass
Speicherklasse v1.1.2
Erfordert die Angabe von Speicherklassen, wenn verwendet. Nur Gatekeeper 3.9+ und nicht sitzungsspezifische Container werden unterstützt.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sStorageClass
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedStorageClasses <array>: An optional allow-list of storage classes.
# If specified, any storage class not in the `allowedStorageClasses`
# parameter is disallowed.
allowedStorageClasses:
- <string>
includeStorageClassesInMessage: <boolean>
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "storage.k8s.io"
version: "v1"
kind: "StorageClass"
Beispiele
Speicherklasse
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sStorageClass
metadata:
name: storageclass
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- PersistentVolumeClaim
- apiGroups:
- apps
kinds:
- StatefulSet
parameters:
includeStorageClassesInMessage: true
Zulässig
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: ok
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi
storageClassName: somestorageclass
volumeMode: Filesystem
---
# Referential Data
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: somestorageclass
provisioner: foo
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: volumeclaimstorageclass
spec:
replicas: 1
selector:
matchLabels:
app: volumeclaimstorageclass
serviceName: volumeclaimstorageclass
template:
metadata:
labels:
app: volumeclaimstorageclass
spec:
containers:
- image: registry.k8s.io/nginx-slim:0.8
name: main
volumeMounts:
- mountPath: /usr/share/nginx/html
name: data
volumeClaimTemplates:
- metadata:
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: somestorageclass
---
# Referential Data
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: somestorageclass
provisioner: foo
Nicht zugelassen
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: badstorageclass
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi
storageClassName: badstorageclass
volumeMode: Filesystem
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: badvolumeclaimstorageclass
spec:
replicas: 1
selector:
matchLabels:
app: badvolumeclaimstorageclass
serviceName: badvolumeclaimstorageclass
template:
metadata:
labels:
app: badvolumeclaimstorageclass
spec:
containers:
- image: registry.k8s.io/nginx-slim:0.8
name: main
volumeMounts:
- mountPath: /usr/share/nginx/html
name: data
volumeClaimTemplates:
- metadata:
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: badstorageclass
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nostorageclass
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi
volumeMode: Filesystem
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: novolumeclaimstorageclass
spec:
replicas: 1
selector:
matchLabels:
app: novolumeclaimstorageclass
serviceName: novolumeclaimstorageclass
template:
metadata:
labels:
app: novolumeclaimstorageclass
spec:
containers:
- image: registry.k8s.io/nginx-slim:0.8
name: main
volumeMounts:
- mountPath: /usr/share/nginx/html
name: data
volumeClaimTemplates:
- metadata:
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
allowed-storageclass
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sStorageClass
metadata:
name: allowed-storageclass
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- PersistentVolumeClaim
- apiGroups:
- apps
kinds:
- StatefulSet
parameters:
allowedStorageClasses:
- allowed-storage-class
includeStorageClassesInMessage: true
Zulässig
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: allowed-storage-class-pvc
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi
storageClassName: allowed-storage-class
volumeMode: Filesystem
---
# Referential Data
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: allowed-storage-class
provisioner: foo
Unzulässig
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: disallowed-storage-class-pvc
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi
storageClassName: disallowed-storage-class
volumeMode: Filesystem
---
# Referential Data
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: allowed-storage-class
provisioner: foo
K8sUniqueIngressHost
Eindeutiger Ingress-Host v1.0.4
Alle Ingress-Regelhosts müssen eindeutig sein. Unterstützt keine Hostnamen-Platzhalter: https://kubernetes.io/docs/concepts/services-networking/ingress/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sUniqueIngressHost
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: "extensions"
version: "v1beta1"
kind: "Ingress"
OR
- group: "networking.k8s.io"
version: "v1beta1" OR "v1"
kind: "Ingress"
Beispiele
unique-ingress-host
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sUniqueIngressHost
metadata:
name: unique-ingress-host
spec:
match:
kinds:
- apiGroups:
- extensions
- networking.k8s.io
kinds:
- Ingress
Zulässig
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-host-allowed
namespace: default
spec:
rules:
- host: example-allowed-host.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
- host: example-allowed-host1.example.com
http:
paths:
- backend:
service:
name: nginx2
port:
number: 80
path: /
pathType: Prefix
Nicht zugelassen
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-host-disallowed
namespace: default
spec:
rules:
- host: example-host.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
---
# Referential Data
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-host-example
namespace: default
spec:
rules:
- host: example-host.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-host-disallowed2
namespace: default
spec:
rules:
- host: example-host2.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
- host: example-host3.example.com
http:
paths:
- backend:
service:
name: nginx2
port:
number: 80
path: /
pathType: Prefix
---
# Referential Data
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-host-example2
namespace: default
spec:
rules:
- host: example-host2.example.com
http:
paths:
- backend:
service:
name: nginx
port:
number: 80
path: /
pathType: Prefix
K8sUniqueServiceSelector
Eindeutiger Service Selector v1.0.2
Dienste müssen einen eindeutigen Selektor innerhalb eines Namespace haben. Selektoren werden als identisch betrachtet, wenn sie identische Schlüssel und Werte haben. Selektoren können ein Schlüssel/Wert-Paar verwenden, solange sich mindestens ein separates Schlüssel/Wert-Paar zwischen ihnen befindet. https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sUniqueServiceSelector
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Referenzielle Einschränkung
Diese Einschränkung ist referenziell. Vor der Verwendung müssen Sie referenzielle Einschränkungen aktivieren und eine Konfiguration erstellen, die Policy Controller mitteilt, welche Arten von Objekten beobachtet werden sollen.
Ihr Policy Controller Config erfordert einen syncOnly-Eintrag ähnlich dem folgenden:
spec:
sync:
syncOnly:
- group: ""
version: "v1"
kind: "Service"
Beispiele
unique-service-selector
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sUniqueServiceSelector
metadata:
labels:
owner: admin.agilebank.demo
name: unique-service-selector
Zulässig
apiVersion: v1
kind: Service
metadata:
name: gatekeeper-test-service-disallowed
namespace: default
spec:
ports:
- port: 443
selector:
key: other-value
Nicht zugelassen
apiVersion: v1
kind: Service
metadata:
name: gatekeeper-test-service-disallowed
namespace: default
spec:
ports:
- port: 443
selector:
key: value
---
# Referential Data
apiVersion: v1
kind: Service
metadata:
name: gatekeeper-test-service-example
namespace: default
spec:
ports:
- port: 443
selector:
key: value
NoUpdateServiceAccount
Aktualisierung des Dienstkontos v1.0.1 blockieren
Blockiert das Aktualisieren des Dienstkontos für Ressourcen, die über Pods abstrahiert werden. Diese Richtlinie wird im Prüfmodus ignoriert.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: NoUpdateServiceAccount
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedGroups <array>: Groups that should be allowed to bypass the
# policy.
allowedGroups:
- <string>
# allowedUsers <array>: Users that should be allowed to bypass the policy.
allowedUsers:
- <string>
Beispiele
no-update-kube-system-service-account
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: NoUpdateServiceAccount
metadata:
name: no-update-kube-system-service-account
spec:
match:
kinds:
- apiGroups:
- ""
kinds:
- ReplicationController
- apiGroups:
- apps
kinds:
- ReplicaSet
- Deployment
- StatefulSet
- DaemonSet
- apiGroups:
- batch
kinds:
- CronJob
namespaces:
- kube-system
parameters:
allowedGroups: []
allowedUsers: []
Zulässig
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: policy-test
name: policy-test
namespace: kube-system
spec:
replicas: 1
selector:
matchLabels:
app: policy-test-deploy
template:
metadata:
labels:
app: policy-test-deploy
spec:
containers:
- command:
- /bin/bash
- -c
- sleep 99999
image: ubuntu
name: policy-test
serviceAccountName: policy-test-sa-1
PolicyStrictOnly
STRICT Istio mTLS-Richtlinie v1.0.4 erforderlich machen
Erfordert, dass die STRICT gegenseitige Istio-TLS-Authentifizierung immer angegeben wird, wenn PeerAuthentication verwendet wird. Diese Einschränkung sorgt auch dafür, dass die verworfenen Policy-- und MeshPolicy-Ressourcen STRICT die gegenseitige TLS-Authentifizierung erzwingen. Weitere Informationen finden Sie unter https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/#lock-down-mutual-tls-for-the-entire-mesh
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: PolicyStrictOnly
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
peerauthentication-strict-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: PolicyStrictOnly
metadata:
name: peerauthentication-strict-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- PeerAuthentication
namespaces:
- default
Zulässig
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mode-strict
namespace: default
spec:
mtls:
mode: STRICT
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mode-strict-port-level
namespace: default
spec:
mtls:
mode: STRICT
portLevelMtls:
"8080":
mode: STRICT
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mode-strict-port-unset
namespace: default
spec:
mtls:
mode: STRICT
portLevelMtls:
"8080":
mode: UNSET
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: empty-mtls
namespace: default
spec:
mtls: {}
apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: unspecified-mtls namespace: default
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mode-null
namespace: default
spec:
mtls:
mode: null
apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mtls-null namespace: default spec: mtls: null
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mode-permissive
namespace: default
spec:
mtls:
mode: PERMISSIVE
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mode-strict-port-permissive
namespace: default
spec:
mtls:
mode: STRICT
portLevelMtls:
"8080":
mode: PERMISSIVE
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: mode-strict-port-permissive
namespace: default
spec:
mtls:
mode: STRICT
portLevelMtls:
"8080":
mode: PERMISSIVE
"8081":
mode: STRICT
deprecated-policy-strict-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: PolicyStrictOnly
metadata:
name: deprecated-policy-strict-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- authentication.istio.io
kinds:
- Policy
namespaces:
- default
Zulässig
apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
name: default-mode-strict
namespace: default
spec:
peers:
- mtls:
mode: STRICT
Nicht zugelassen
apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
name: default-mtls-empty
namespace: default
spec:
peers:
- mtls: {}
apiVersion: authentication.istio.io/v1alpha1 kind: Policy metadata: name: default-mtls-null namespace: default spec: peers: - mtls: null
apiVersion: authentication.istio.io/v1alpha1 kind: Policy metadata: name: peers-empty namespace: default spec: peers: []
apiVersion: authentication.istio.io/v1alpha1 kind: Policy metadata: name: policy-no-peers namespace: default spec: targets: - name: httpbin
apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
name: policy-permissive
namespace: default
spec:
peers:
- mtls:
mode: PERMISSIVE
RestrictNetworkExclusions
Restrict Network Exclusions v1.0.2
Steuert, welche Eingangs-Ports, Ausgangs-Ports und Ausgangs-IP-Bereiche von der Istio-Netzwerkerfassung ausgeschlossen werden können. Ports und IP-Bereiche, die die Istio-Netzwerkerfassung umgehen, werden vom Istio-Proxy nicht verarbeitet und unterliegen nicht der Authentifizierung, der Autorisierungsrichtlinie und anderen Istio-Features von Istio mTLS. Mithilfe dieser Einschränkung können Einschränkungen auf die Verwendung der folgenden Annotationen angewendet werden:
traffic.sidecar.istio.io/excludeInboundPortstraffic.sidecar.istio.io/excludeOutboundPortstraffic.sidecar.istio.io/excludeOutboundIPRanges
Weitere Informationen finden Sie unter https://istio.io/latest/docs/reference/config/annotations/.
Beim Einschränken von Ausgangs-IP-Bereichen berechnet die Einschränkung, ob ausgeschlossene IP-Bereiche übereinstimmen oder ein Teil der zulässigen IP-Bereichsausschlüsse sind.
Wenn Sie diese Einschränkung verwenden, müssen alle Eingangs- und Ausgangs-IP-Bereiche immer einbezogen werden. Setzen Sie dazu entweder die entsprechenden "include"-Annotationen auf "*" oder legen Sie sie nicht fest. Das Festlegen einer der folgenden Anmerkungen auf etwas anderes als "*" ist nicht zulässig:
traffic.sidecar.istio.io/includeInboundPortstraffic.sidecar.istio.io/includeOutboundPortstraffic.sidecar.istio.io/includeOutboundIPRanges
Mit dieser Einschränkung kann Port 15020 immer ausgeschlossen werden, da der Istio-Sidecar-Injektor immer die Annotation traffic.sidecar.istio.io/excludeInboundPorts hinzufügt, damit er für Systemdiagnosen verwendet werden kann.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: RestrictNetworkExclusions
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedInboundPortExclusions <array>: A list of ports that this
# constraint will allow in the
# `traffic.sidecar.istio.io/excludeInboundPorts` annotation.
allowedInboundPortExclusions:
- <string>
# allowedOutboundIPRangeExclusions <array>: A list of IP ranges that this
# constraint will allow in the
# `traffic.sidecar.istio.io/excludeOutboundIPRanges` annotation. The
# constraint calculates whether excluded IP ranges match or are a subset of
# the ranges in this list.
allowedOutboundIPRangeExclusions:
- <string>
# allowedOutboundPortExclusions <array>: A list of ports that this
# constraint will allow in the
# `traffic.sidecar.istio.io/excludeOutboundPorts` annotation.
allowedOutboundPortExclusions:
- <string>
Beispiele
restrict-network-exclusions
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: RestrictNetworkExclusions
metadata:
name: restrict-network-exclusions
spec:
enforcementAction: deny
match:
kinds:
- apiGroups:
- ""
kinds:
- Pod
parameters:
allowedInboundPortExclusions:
- "80"
allowedOutboundIPRangeExclusions:
- 169.254.169.254/32
allowedOutboundPortExclusions:
- "8888"
Zulässig
apiVersion: v1
kind: Pod
metadata:
labels:
app: nginx
name: nothing-excluded
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
apiVersion: v1
kind: Pod
metadata:
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "80"
traffic.sidecar.istio.io/excludeOutboundIPRanges: 169.254.169.254/32
traffic.sidecar.istio.io/excludeOutboundPorts: "8888"
labels:
app: nginx
name: allowed-port-and-ip-exclusions
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
apiVersion: v1
kind: Pod
metadata:
annotations:
traffic.sidecar.istio.io/excludeOutboundIPRanges: 169.254.169.254/32
traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
labels:
app: nginx
name: all-ip-ranges-included-with-one-allowed-ip-excluded
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
apiVersion: v1
kind: Pod
metadata:
annotations:
traffic.sidecar.istio.io/includeInboundPorts: '*'
traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
traffic.sidecar.istio.io/includeOutboundPorts: '*'
labels:
app: nginx
name: everything-included-with-no-exclusions
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
Nicht zugelassen
apiVersion: v1
kind: Pod
metadata:
annotations:
traffic.sidecar.istio.io/excludeOutboundIPRanges: 1.1.2.0/24
labels:
app: nginx
name: disallowed-ip-range-exclusion
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
- containerPort: 443
apiVersion: v1
kind: Pod
metadata:
annotations:
traffic.sidecar.istio.io/excludeOutboundIPRanges: 169.254.169.254/32,1.1.2.0/24
labels:
app: nginx
name: one-disallowed-ip-exclusion-and-one-allowed-exclusion
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
- containerPort: 443
apiVersion: v1
kind: Pod
metadata:
annotations:
traffic.sidecar.istio.io/includeInboundPorts: 80,443
traffic.sidecar.istio.io/includeOutboundIPRanges: 169.254.169.254/32
traffic.sidecar.istio.io/includeOutboundPorts: "8888"
labels:
app: nginx
name: disallowed-specific-port-and-ip-inclusions
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 80
SourceNotAllAuthz
Istio AuthorizationPolicy-Quelle ist nicht für alle v1.0.1 erforderlich
Erfordert, dass die AuthorizationPolicy-Regeln von Istio Quellhauptkonten auf etwas anderes als "*" gesetzt haben. https://istio.io/latest/docs/reference/config/security/authorization-policy/
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: SourceNotAllAuthz
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Beispiele
sourcenotall-authz-constraint
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: SourceNotAllAuthz
metadata:
name: sourcenotall-authz-constraint
spec:
enforcementAction: dryrun
match:
kinds:
- apiGroups:
- security.istio.io
kinds:
- AuthorizationPolicy
Zulässig
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: source-principals-good
namespace: foo
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
version: v1
Nicht zugelassen
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: source-principals-dne
namespace: foo
spec:
rules:
- from:
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
version: v1
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: source-principals-all
namespace: foo
spec:
rules:
- from:
- source:
principals:
- '*'
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
version: v1
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: source-principals-someall
namespace: foo
spec:
rules:
- from:
- source:
principals:
- cluster.local/ns/default/sa/sleep
- '*'
- source:
namespaces:
- test
to:
- operation:
methods:
- GET
paths:
- /info*
- operation:
methods:
- POST
paths:
- /data
when:
- key: request.auth.claims[iss]
values:
- https://accounts.google.com
selector:
matchLabels:
app: httpbin
version: v1
VerifyDeprecatedAPI
Verworfene APIs Version 1.0.0 prüfen
Verifiziert verworfene Kubernetes APIs, um sicherzustellen, dass alle API-Versionen aktuell sind. Diese Vorlage gilt nicht für Audits, da Audits die Ressourcen betrachten, die bereits im Cluster mit nicht verworfenen API-Versionen vorhanden sind.
Einschränkungsschema
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: VerifyDeprecatedAPI
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# k8sVersion <number>: kubernetes version
k8sVersion: <number>
# kvs <array>: Deprecated api versions and corresponding kinds
kvs:
- # deprecatedAPI <string>: deprecated api
deprecatedAPI: <string>
# kinds <array>: impacted list of kinds
kinds:
- <string>
# targetAPI <string>: target api
targetAPI: <string>
Beispiele
verify-1.16
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: VerifyDeprecatedAPI
metadata:
name: verify-1.16
spec:
match:
kinds:
- apiGroups:
- apps
kinds:
- Deployment
- ReplicaSet
- StatefulSet
- DaemonSet
- apiGroups:
- extensions
kinds:
- PodSecurityPolicy
- ReplicaSet
- Deployment
- DaemonSet
- NetworkPolicy
parameters:
k8sVersion: 1.16
kvs:
- deprecatedAPI: apps/v1beta1
kinds:
- Deployment
- ReplicaSet
- StatefulSet
targetAPI: apps/v1
- deprecatedAPI: extensions/v1beta1
kinds:
- ReplicaSet
- Deployment
- DaemonSet
targetAPI: apps/v1
- deprecatedAPI: extensions/v1beta1
kinds:
- PodSecurityPolicy
targetAPI: policy/v1beta1
- deprecatedAPI: apps/v1beta2
kinds:
- ReplicaSet
- StatefulSet
- Deployment
- DaemonSet
targetAPI: apps/v1
- deprecatedAPI: extensions/v1beta1
kinds:
- NetworkPolicy
targetAPI: networking.k8s.io/v1
Zulässig
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: allowed-deployment
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
Nicht zugelassen
apiVersion: apps/v1beta1
kind: Deployment
metadata:
labels:
app: nginx
name: disallowed-deployment
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx:1.14.2
name: nginx
ports:
- containerPort: 80
verify-1.22
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: VerifyDeprecatedAPI
metadata:
name: verify-1.22
spec:
match:
kinds:
- apiGroups:
- admissionregistration.k8s.io
kinds:
- MutatingWebhookConfiguration
- ValidatingWebhookConfiguration
- apiGroups:
- apiextensions.k8s.io
kinds:
- CustomResourceDefinition
- apiGroups:
- apiregistration.k8s.io
kinds:
- APIService
- apiGroups:
- authentication.k8s.io
kinds:
- TokenReview
- apiGroups:
- authorization.k8s.io
kinds:
- SubjectAccessReview
- apiGroups:
- certificates.k8s.io
kinds:
- CertificateSigningRequest
- apiGroups:
- coordination.k8s.io
kinds:
- Lease
- apiGroups:
- extensions
- networking.k8s.io
kinds:
- Ingress
- apiGroups:
- networking.k8s.io
kinds:
- IngressClass
- apiGroups:
- rbac.authorization.k8s.io
kinds:
- ClusterRole
- ClusterRoleBinding
- Role
- RoleBinding
- apiGroups:
- scheduling.k8s.io
kinds:
- PriorityClass
- apiGroups:
- storage.k8s.io
kinds:
- CSIDriver
- CSINode
- StorageClass
- VolumeAttachment
parameters:
k8sVersion: 1.22
kvs:
- deprecatedAPI: admissionregistration.k8s.io/v1beta1
kinds:
- MutatingWebhookConfiguration
- ValidatingWebhookConfiguration
targetAPI: admissionregistration.k8s.io/v1
- deprecatedAPI: apiextensions.k8s.io/v1beta1
kinds:
- CustomResourceDefinition
targetAPI: apiextensions.k8s.io/v1
- deprecatedAPI: apiregistration.k8s.io/v1beta1
kinds:
- APIService
targetAPI: apiregistration.k8s.io/v1
- deprecatedAPI: authentication.k8s.io/v1beta1
kinds:
- TokenReview
targetAPI: authentication.k8s.io/v1
- deprecatedAPI: authorization.k8s.io/v1beta1
kinds:
- SubjectAccessReview
targetAPI: authorization.k8s.io/v1
- deprecatedAPI: certificates.k8s.io/v1beta1
kinds:
- CertificateSigningRequest
targetAPI: certificates.k8s.io/v1
- deprecatedAPI: coordination.k8s.io/v1beta1
kinds:
- Lease
targetAPI: coordination.k8s.io/v1
- deprecatedAPI: extensions/v1beta1
kinds:
- Ingress
targetAPI: networking.k8s.io/v1
- deprecatedAPI: networking.k8s.io/v1beta1
kinds:
- Ingress
- IngressClass
targetAPI: networking.k8s.io/v1
- deprecatedAPI: rbac.authorization.k8s.io/v1beta1
kinds:
- ClusterRole
- ClusterRoleBinding
- Role
- RoleBinding
targetAPI: rbac.authorization.k8s.io/v1
- deprecatedAPI: scheduling.k8s.io/v1beta1
kinds:
- PriorityClass
targetAPI: scheduling.k8s.io/v1
- deprecatedAPI: storage.k8s.io/v1beta1
kinds:
- CSIDriver
- CSINode
- StorageClass
- VolumeAttachment
targetAPI: storage.k8s.io/v1
Zulässig
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
name: allowed-ingress
spec:
ingressClassName: nginx-example
rules:
- http:
paths:
- backend:
service:
name: test
port:
number: 80
path: /testpath
pathType: Prefix
Nicht zugelassen
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
name: disallowed-ingress
spec:
ingressClassName: nginx-example
rules:
- http:
paths:
- backend:
service:
name: test
port:
number: 80
path: /testpath
pathType: Prefix
verify-1.25
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: VerifyDeprecatedAPI
metadata:
name: verify-1.25
spec:
match:
kinds:
- apiGroups:
- batch
kinds:
- CronJob
- apiGroups:
- discovery.k8s.io
kinds:
- EndpointSlice
- apiGroups:
- events.k8s.io
kinds:
- Event
- apiGroups:
- autoscaling
kinds:
- HorizontalPodAutoscaler
- apiGroups:
- policy
kinds:
- PodDisruptionBudget
- PodSecurityPolicy
- apiGroups:
- node.k8s.io
kinds:
- RuntimeClass
parameters:
k8sVersion: 1.25
kvs:
- deprecatedAPI: batch/v1beta1
kinds:
- CronJob
targetAPI: batch/v1
- deprecatedAPI: discovery.k8s.io/v1beta1
kinds:
- EndpointSlice
targetAPI: discovery.k8s.io/v1
- deprecatedAPI: events.k8s.io/v1beta1
kinds:
- Event
targetAPI: events.k8s.io/v1
- deprecatedAPI: autoscaling/v2beta1
kinds:
- HorizontalPodAutoscaler
targetAPI: autoscaling/v2
- deprecatedAPI: policy/v1beta1
kinds:
- PodDisruptionBudget
targetAPI: policy/v1
- deprecatedAPI: policy/v1beta1
kinds:
- PodSecurityPolicy
targetAPI: None
- deprecatedAPI: node.k8s.io/v1beta1
kinds:
- RuntimeClass
targetAPI: node.k8s.io/v1
Zulässig
apiVersion: batch/v1
kind: CronJob
metadata:
name: allowed-cronjob
namespace: default
spec:
jobTemplate:
spec:
template:
spec:
containers:
- command:
- /bin/sh
- -c
- date; echo Hello from the Kubernetes cluster
image: busybox:1.28
imagePullPolicy: IfNotPresent
name: hello
restartPolicy: OnFailure
schedule: '* * * * *'
Nicht zugelassen
apiVersion: batch/v1beta1
kind: CronJob
metadata:
name: disallowed-cronjob
namespace: default
spec:
jobTemplate:
spec:
template:
spec:
containers:
- command:
- /bin/sh
- -c
- date; echo Hello from the Kubernetes cluster
image: busybox:1.28
imagePullPolicy: IfNotPresent
name: hello
restartPolicy: OnFailure
schedule: '* * * * *'
verify-1.26
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: VerifyDeprecatedAPI
metadata:
name: verify-1.26
spec:
match:
kinds:
- apiGroups:
- flowcontrol.apiserver.k8s.io
kinds:
- FlowSchema
- PriorityLevelConfiguration
- apiGroups:
- autoscaling
kinds:
- HorizontalPodAutoscaler
parameters:
k8sVersion: 1.26
kvs:
- deprecatedAPI: flowcontrol.apiserver.k8s.io/v1beta1
kinds:
- FlowSchema
- PriorityLevelConfiguration
targetAPI: flowcontrol.apiserver.k8s.io/v1beta3
- deprecatedAPI: autoscaling/v2beta2
kinds:
- HorizontalPodAutoscaler
targetAPI: autoscaling/v2
Zulässig
apiVersion: flowcontrol.apiserver.k8s.io/v1beta3
kind: FlowSchema
metadata:
name: allowed-flowcontrol
namespace: default
spec:
matchingPrecedence: 1000
priorityLevelConfiguration:
name: exempt
rules:
- nonResourceRules:
- nonResourceURLs:
- /healthz
- /livez
- /readyz
verbs:
- '*'
subjects:
- group:
name: system:unauthenticated
kind: Group
Nicht zugelassen
apiVersion: flowcontrol.apiserver.k8s.io/v1beta1
kind: FlowSchema
metadata:
name: disallowed-flowcontrol
namespace: default
spec:
matchingPrecedence: 1000
priorityLevelConfiguration:
name: exempt
rules:
- nonResourceRules:
- nonResourceURLs:
- /healthz
- /livez
- /readyz
verbs:
- '*'
subjects:
- group:
name: system:unauthenticated
kind: Group
verify-1.27
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: VerifyDeprecatedAPI
metadata:
name: verify-1.27
spec:
match:
kinds:
- apiGroups:
- storage.k8s.io
kinds:
- CSIStorageCapacity
parameters:
k8sVersion: 1.27
kvs:
- deprecatedAPI: storage.k8s.io/v1beta1
kinds:
- CSIStorageCapacity
targetAPI: storage.k8s.io/v1
Zulässig
apiVersion: storage.k8s.io/v1 kind: CSIStorageCapacity metadata: name: allowed-csistoragecapacity storageClassName: standard
Nicht zugelassen
apiVersion: storage.k8s.io/v1beta1 kind: CSIStorageCapacity metadata: name: allowed-csistoragecapacity namespace: default storageClassName: standard
verify-1.29
Einschränkung
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: VerifyDeprecatedAPI
metadata:
name: verify-1.29
spec:
match:
kinds:
- apiGroups:
- flowcontrol.apiserver.k8s.io
kinds:
- FlowSchema
- PriorityLevelConfiguration
parameters:
k8sVersion: 1.29
kvs:
- deprecatedAPI: flowcontrol.apiserver.k8s.io/v1beta2
kinds:
- FlowSchema
- PriorityLevelConfiguration
targetAPI: flowcontrol.apiserver.k8s.io/v1beta3
Zulässig
apiVersion: flowcontrol.apiserver.k8s.io/v1beta3
kind: FlowSchema
metadata:
name: allowed-flowcontrol
namespace: default
spec:
matchingPrecedence: 1000
priorityLevelConfiguration:
name: exempt
rules:
- nonResourceRules:
- nonResourceURLs:
- /healthz
- /livez
- /readyz
verbs:
- '*'
subjects:
- group:
name: system:unauthenticated
kind: Group
Nicht zugelassen
apiVersion: flowcontrol.apiserver.k8s.io/v1beta2
kind: FlowSchema
metadata:
name: disallowed-flowcontrol
namespace: default
spec:
matchingPrecedence: 1000
priorityLevelConfiguration:
name: exempt
rules:
- nonResourceRules:
- nonResourceURLs:
- /healthz
- /livez
- /readyz
verbs:
- '*'
subjects:
- group:
name: system:unauthenticated
kind: Group
Nächste Schritte
- Mehr über Policy Controller erfahren
- Policy Controller installieren
- Einschränkungen anstelle von PodSecurityPolicies verwenden
- Open-Source-Bibliothek mit Einschränkungsvorlagen im gatekeeper-library-Repository aufrufen