I modelli di vincolo consentono di definire il funzionamento di un vincolo, ma delegano la definizione le specifiche del vincolo per un individuo o un gruppo oggetto dell'oggetto competenza. Oltre a separare le preoccupazioni, separa anche la logica il vincolo dalla sua definizione.
Tutti i vincoli contengono una sezione match, che definisce gli oggetti a cui si applica un vincolo. Per maggiori dettagli su come configurare la sezione, consulta
Sezione Corrispondenza vincolo.
Non tutti i modelli di vincoli sono disponibili per tutte le versioni di Policy Controller e i modelli possono variare da una versione all'altra. Utilizza i seguenti link per confrontare i vincoli delle versioni supportate:
Link alle versioni supportate di questa pagina
Per assicurarti di ricevere l'assistenza completa, ti consigliamo di utilizzare un vincolo modelli da un versione supportata di Policy Controller.
Per aiutarti a capire come funzionano i modelli di vincolo, ogni modello include un vincolo di esempio e una risorsa che viola il vincolo.
Modelli di vincolo disponibili
| Modello di vincolo | Descrizione | Referenziale |
|---|---|---|
| AllowedServicePortName | Richiede che i nomi delle porte dei servizi abbiano un prefisso di un elenco specificato. | No |
| AsmAuthzPolicyDefaultDeny | Applica il criterio AuthorizationPolicy di rifiuto predefinito a livello di mesh. Fai riferimento a https://istio.io/latest/docs/ops/best-practices/security/#use-default-deny-patterns. | Sì |
| AsmAuthzPolicyDisallowedPrefix | Richiede che i principali e gli spazi dei nomi nei criteri "AuthorizationPolicy" di Istio non abbiano un prefisso di un elenco specificato. https://istio.io/latest/docs/reference/config/security/authorization-policy/ | No |
| AsmAuthzPolicyEnforceSourcePrincipals | Richiede che il campo "from" di AuthorizationPolicy di Istio, se definito, abbia principi di origine, che devono essere impostati su un valore diverso da "*". https://istio.io/latest/docs/reference/config/security/authorization-policy/ | No |
| AsmAuthzPolicyNormalization | Applica la normalizzazione di AuthorizationPolicy. Riferimento a https://istio.io/latest/docs/reference/config/security/normalization/. | No |
| AsmAuthzPolicySafePattern | Applica i pattern sicuri di AuthorizationPolicy. Fai riferimento a https://istio.io/latest/docs/ops/best-practices/security/#safer-authorization-policy-patterns. | No |
| AsmIngressgatewayLabel | Applica l'utilizzo dell'etichetta Ingressgateway istio solo sui pod del gateway in entrata. | No |
| AsmPeerAuthnMeshStrictMtls | Applica il protocollo PeerAuthentication mtls restrittivo del livello mesh. Riferimento a https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls. | Sì |
| AsmPeerAuthnStrictMtls | L'applicazione di tutte le autenticazioni peer non può sovrascrivere mTLS restrittivo. Fai riferimento a https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls. | No |
| AsmRequestAuthnProhibitedOutputHeaders | In RequestAuthentication, applica il campo "jwtRules.outPayloadToHeader" in modo che non contenga intestazioni di richieste HTTP ben note o intestazioni personalizzate non consentite. Riferimento a https://istio.io/latest/docs/reference/config/security/jwt/#JWTRule. | No |
| AsmSidecarInjection | L'applicazione forzata del sidecar del proxy Istio è sempre stato inserito nei pod dei carichi di lavoro. | No |
| DestinationRuleTLSEnabled | Non è consentito disabilitare TLS per tutti gli host e i sottoinsiemi di host in destinationRules di Istio. | No |
| DisallowedAuthzPrefix | Richiede che le entità e gli spazi dei nomi nelle regole "AuthorizationPolicy" di Istio non abbiano un prefisso di un elenco specificato. https://istio.io/latest/docs/reference/config/security/authorization-policy/ | No |
| GCPStorageLocationConstraintV1 | Limita i "locations" consentiti per le risorse del connettore di configurazione StorageBucket all'elenco di località fornito nel vincolo. I nomi dei bucket nell'elenco "esenzioni" sono esenti. | No |
| GkeSpotVMTerminationGrace | Richiede che i pod e i modelli di pod con "nodeSelector" o "nodeAfffinty" di "gke-spot" abbiano un valore "terminationGracePeriodSeconds" di massimo 15 secondi. | Sì |
| K8sAllowedRepos | Richiede che le immagini container inizino con una stringa dell'elenco specificato. | No |
| K8sAvoidUseOfSystemMastersGroup | Non consente l'utilizzo del gruppo "system:masters". Non ha alcun effetto durante l'audit. | No |
| K8sBlockAllIngress | Non consente la creazione di oggetti Ingress (tipi "Ingress", "Gateway" e "Service" di "NodePort" e "LoadBalancer"). | No |
| K8sBlockCreationWithDefaultServiceAccount | Non consente la creazione di risorse utilizzando un account di servizio predefinito. Non ha alcun effetto durante l'audit. | No |
| K8sBlockEndpointEditDefaultRole | Molte installazioni di Kubernetes per impostazione predefinita hanno un sistema system:aggregate-to-edit ClusterRole che non limita correttamente l'accesso alla modifica degli endpoint. Questo ConstraintTemplate impedisce a system:aggregate-to-edit ClusterRole di concedere l'autorizzazione per creare/patch/aggiornare endpoint. ClusterRole/system:aggregate-to-edit non deve consentire le autorizzazioni di modifica degli endpoint a causa di CVE-2021-25740, le autorizzazioni Endpoint e EndpointSlice consentono il forwarding tra spazi dei nomi, https://github.com/kubernetes/kubernetes/issues/103675 | No |
| K8sBlockLoadBalancer | Non sono consentiti tutti i servizi di tipo LoadBalancer. https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer | No |
| K8sBlockNodePort | Non consente tutti i servizi di tipo NodePort. https://kubernetes.io/docs/concepts/services-networking/service/#nodeport | No |
| K8sBlockObjectsOfType | Non sono consentiti oggetti di tipi vietati. | No |
| K8sBlockProcessNamespaceSharing | Vieta le specifiche del pod con "shareProcessNamespace" impostato su "true". In questo modo vengono evitati scenari in cui tutti i container di un pod condividono uno spazio dei nomi PID e possono accedere al file system e alla memoria di ciascun altro container. | No |
| K8sBlockWildcardIngress | Gli utenti non devono essere in grado di creare risorse Ingress con un nome host vuoto o con carattere jolly (*), poiché ciò consentirebbe loro di intercettare il traffico per altri servizi nel cluster, anche se non hanno accesso a questi servizi. | No |
| K8sContainerEphemeralStorageLimit | Richiede l'impostazione di un limite di spazio di archiviazione temporaneo per i container e vincola il limite ai valori massimi specificati. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | No |
| K8sContainerLimits | Richiede che i container abbiano limiti di memoria e CPU impostati e limita i limiti in modo che rientrino nei valori massimi specificati. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | No |
| K8sContainerRatios | Imposta un rapporto massimo per i limiti delle risorse dei container rispetto alle richieste. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | No |
| K8sContainerRequests | Richiede che i container abbiano richieste di memoria e CPU impostate e limita le richieste a rientrare nei valori massimi specificati. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | No |
| K8sCronJobAllowedRepos | Richiede che le immagini container di CronJob inizino con una stringa dell'elenco specificato. | No |
| K8sDisallowAnonymous | Non consente l'associazione di risorse ClusterRole e Role all'utente system:anonymous e al gruppo system:unauthenticated. | No |
| K8sDisallowInteractiveTTY | Richiede che gli oggetti abbiano i campi "spec.tty" e "spec.stdin" impostati su false o non impostati. | No |
| K8sDisallowedRepos | Repository di container non consentiti che iniziano con una stringa dell'elenco specificato. | No |
| K8sDisallowedRoleBindingSubjects | Vieta i RoleBindings o ClusterRoleBinding con oggetti corrispondenti a qualsiasi tipo "disallowedSubjects" passato come parametri. | No |
| K8sDisallowedTags | Richiede che le immagini container abbiano un tag immagine diverso da quelli nell'elenco specificato. https://kubernetes.io/docs/concepts/containers/images/#image-names | No |
| K8sEmptyDirHasSizeLimit | Richiede che qualsiasi volume "emptyDir" specifichi un "sizeLimit". Facoltativamente, nel vincolo può essere fornito un parametro "maxSizeLimit" per specificare un limite di dimensioni massimo consentito. | No |
| K8sEnforceCloudArmorBackendConfig | Applica la configurazione di Cloud Armor alle risorse BackendConfig | No |
| K8sEnforceConfigManagement | Richiede la presenza e il funzionamento di Config Management. I vincoli che utilizzano questo "ConstraintTemplate" saranno solo di controllo, indipendentemente dal valore di "enforcementAction". | Sì |
| K8sExternalIP | Limita gli indirizzi IP esterni del servizio a un elenco consentito di indirizzi IP. https://kubernetes.io/docs/concepts/services-networking/service/#external-ips | No |
| K8sHorizontalPodAutoscaler | Non consentire i seguenti scenari durante il deployment di "HorizontalPodAutoscalers" 1. Deployment di HorizontalPodAutoscaler con ".spec.minReplicas" o ".spec.maxReplicas" al di fuori degli intervalli definiti nel vincolo 2. Deployment di HorizontalPodAutoscaler in cui la differenza tra ".spec.minReplicas" e ".spec.maxReplicas" è inferiore al valore "minimumReplicaSpread" configurato 3. Deployment di HorizontalPodAutoscaler che non fanno riferimento a un valore "scaleTargetRef" valido (ad es. Deployment, ReplicationController, ReplicaSet, StatefulSet). | Sì |
| K8sHttpsOnly | Richiede che le risorse Ingress siano solo HTTPS. Le risorse Ingress devono includere l'annotazione "kubernetes.io/ingress.allow-http", impostata su "false". Per impostazione predefinita è richiesta una configurazione TLS {} valida, che può essere resa facoltativa impostando il parametro "tlsOptional" su "true". https://kubernetes.io/docs/concepts/services-networking/ingress/#tls | No |
| K8sImageDigests | Richiede che le immagini container contengano un digest. https://kubernetes.io/docs/concepts/containers/images/ | No |
| K8sLocalStorageRequireSafeToEvict | I pod che utilizzano lo spazio di archiviazione locale ("emptyDir" o "hostPath") richiedono l'annotazione ""cluster-autoscaler.kubernetes.io/safe-to-evict": "true"". Cluster Autoscaler non eliminerà i pod senza questa annotazione. | No |
| K8sMemoryRequestEqualsLimit | Promuove la stabilità del pod richiedendo che la memoria richiesta di tutti i container corrisponda esattamente al limite di memoria, in modo che i pod non siano mai in uno stato in cui l'utilizzo della memoria superi la quantità richiesta. Altrimenti, Kubernetes può terminare i pod che richiedono memoria aggiuntiva se è necessaria memoria sul nodo. | No |
| K8sNoEnvVarSecrets | Proibisce i secret come variabili di ambiente nelle definizioni dei container dei pod. Utilizza invece i file secret montati nei volumi di dati: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod | No |
| K8sNoExternalServices | Proibisce la creazione di risorse note che espongono i carichi di lavoro a IP esterni. Sono incluse le risorse Istio Gateway e Kubernetes Ingress. Inoltre, i servizi Kubernetes non sono consentiti, a meno che non soddisfino i seguenti criteri: Qualsiasi servizio di tipo "LoadBalancer" in Google Cloud deve avere un'annotazione "networking.gke.io/load-balancer-type": "Internal". Qualsiasi servizio di tipo "LoadBalancer" in AWS deve avere un'annotazione "service.beta.kubernetes.io/aws-load-balancer-internal: "true". Qualsiasi "IP esterni" (esterni al cluster) associati al servizio devono essere membri di un intervallo di CIDR interni previsti dal vincolo. | No |
| K8sPSPAllowPrivilegeEscalationContainer | Controlla la limitazione dell'escalation ai privilegi di root. Corrisponde al campo "allowPrivilegeEscalation" in un PodSecurityPolicy. Per ulteriori informazioni, consulta https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation | No |
| K8sPSPAllowedUsers | Controlla gli ID utente e gruppo del contenitore e di alcuni volumi. Corrisponde ai campi "runAsUser", "runAsGroup", "supplementalGroups" e "fsGroup" in un PodSecurityPolicy. Per saperne di più, vedi https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups | No |
| K8sPSPAppArmor | Configura una lista consentita di profili AppArmor da utilizzare per i container. Corrisponde ad annotazioni specifiche applicate a un PodSecurityPolicy. Per informazioni su AppArmor, vedi https://kubernetes.io/docs/tutorials/clusters/apparmor/ | No |
| K8sPSPAutomountServiceAccountTokenPod | Controlla la capacità di qualsiasi pod di abilitare automountServiceAccountToken. | No |
| K8sPSPCapabilities | Controlla le funzionalità Linux sui container. Corrisponde ai campi "allowedCapabilities" e "requiredDropCapabilities" in un PodSecurityPolicy. Per ulteriori informazioni, vedi https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities | No |
| K8sPSPFSGroup | Controlla l'allocazione di un gruppo FS che possiede i volumi del pod. Corrisponde al campo "fsGroup" in un PodSecurityPolicy. Per ulteriori informazioni, consulta https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | No |
| K8sPSPFlexVolumes | Controlla la lista consentita dei driver FlexVolume. Corrisponde al campo "allowedFlexVolumes" in PodSecurityPolicy. Per saperne di più, consulta https://kubernetes.io/docs/concepts/policy/pod-security-policy/#flexvolume-drivers | No |
| K8sPSPForbiddenSysctls | Controlla il profilo "sysctl" utilizzato dai container. Corrisponde ai campi "allowedUnsafeSysctls" e "forbiddenSysctls" in un PodSecurityPolicy. Se specificato, qualsiasi sysctl non presente nel parametro "allowedSysctls" è considerato vietato. Il parametro "forbiddenSysctls" ha la precedenza sul parametro "allowedSysctls". Per ulteriori informazioni, vedi https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ | No |
| K8sPSPHostFilesystem | Consente di controllare l'utilizzo del file system host. Corrisponde al campo "allowedHostPaths" in un PodSecurityPolicy. Per ulteriori informazioni, vedi https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | No |
| Spazio dei nomihostK8sPSP | Non consente la condivisione degli spazi dei nomi PID e IPC dell'host da parte dei contenitori dei pod. Corrisponde ai campi "hostPID" e "hostIPC" in un PodSecurityPolicy. Per ulteriori informazioni, consulta https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces | No |
| K8sPSPHostNetworkingPorts | Controlla l'utilizzo dello spazio dei nomi di rete dell'host da parte dei container dei pod. È necessario specificare porte specifiche. Corrisponde ai campi "hostNetwork" e "hostPorts" in un PodSecurityPolicy. Per ulteriori informazioni, vedi https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces | No |
| K8sPSPPrivilegedContainer | Controlla la capacità di qualsiasi contenitore di attivare la modalità con privilegi. Corrisponde al campo "privileged" in un PodSecurityPolicy. Per ulteriori informazioni, consulta https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged | No |
| K8sPSPProcMount | Controlla i tipi di "procMount" consentiti per il contenitore. Corrisponde al campo "allowedProcMountTypes" in un PodSecurityPolicy. Per ulteriori informazioni, vedi https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes | No |
| K8sPSPReadOnlyRootFilesystem | Richiede l'utilizzo di un file system principale di sola lettura da parte dei container pod. Corrisponde al campo "readOnlyRootFilesystem" in un PodSecurityPolicy. Per ulteriori informazioni, vedi https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | No |
| K8sPSPSELinuxV2 | Definisce una lista consentita di configurazioni seLinuxOptions per i container di pod. Corrisponde a un PodSecurityPolicy che richiede configurazioni SELinux. Per ulteriori informazioni, consulta https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux | No |
| K8sPSPSeccomp | Controlla il profilo seccomp utilizzato dai container. Corrisponde all'annotazione "seccomp.security.alpha.kubernetes.io/allowedProfileNames" su un PodSecurityPolicy. Per ulteriori informazioni, vedi https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp | No |
| K8sPSPVolumeTypes | Limita i tipi di volumi montabili a quelli specificati dall'utente. Corrisponde al campo "volumes" in un PodSecurityPolicy. Per ulteriori informazioni, consulta https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems | No |
| K8sPSPProcesso dell'host Windows | Limita l'esecuzione di container/pod HostProcess Windows. Vedi https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/ per ulteriori informazioni. | No |
| K8sPSSRunAsNonRoot | Richiede l'esecuzione dei container come utenti non root. Per ulteriori informazioni, consulta https://kubernetes.io/docs/concepts/security/pod-security-standards/ | No |
| K8sPodDisruptionBudget | Non consentire i seguenti scenari durante il deployment di PodDisruptionBudget o risorse che implementano la risorsa secondaria di replica (ad es. Deployment, ReplicationController, ReplicaSet, StatefulSet): 1. Deployment di PodDisruptionBudget con .spec.maxUnavailable == 0 2. Deployment di PodDisruptionBudget con .spec.minAvailable == .spec.replicas della risorsa con la risorsa secondaria di replica. Ciò impedirà ai PodDisruptionBudget di bloccare interruzioni volontarie come lo svuotamento dei nodi. https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ | Sì |
| K8sPodResourcesBestPractices | Richiede che i container non seguano il criterio del "best effort" (impostando le richieste di CPU e memoria) e seguano le best practice per la burstaggio (la richiesta di memoria deve essere esattamente uguale al limite). Se vuoi, puoi configurare le chiavi di annotazione in modo da saltare le varie convalide. | No |
| K8sPodsRequireSecurityContext | Richiede tutti i pod per definire securityContext. Richiede che per tutti i container definiti nei pod sia definito un SecurityContext a livello di pod o container. | No |
| K8sProhibitRoleWildcardAccess | Richiede che Role e ClusterRoles non impostino l'accesso alle risorse su un carattere jolly ""*"' valore ad eccezione dei ruoli Role e ClusterRole esenti forniti come esenzioni. Non limita l'accesso con caratteri jolly alle risorse secondarie, ad esempio "*/status". | No |
| K8sReplicaLimits | Richiede che gli oggetti con il campo "spec.replicas" (Deployment, ReplicaSet e così via) specifichino un numero di repliche all'interno di intervalli definiti. | No |
| K8sRequireAdmissionController | Richiede l'ammissione in base ai criteri di sicurezza dei pod o un sistema di controllo dei criteri esterno | Sì |
| K8sRequestBinAuthZ | Richiede il webhook di convalida dell'ammissione di Autorizzazione binaria. I vincoli che utilizzano questo "ConstraintTemplate" verranno sottoposti a controllo solo indipendentemente dal valore di "enforcementAction". | Sì |
| K8sRequireCosNodeImage | Applica sui nodi l'utilizzo di Container-Optimized OS da Google. | No |
| K8sRequireDaemonsets | Richiede la presenza dell'elenco dei daemonset specificati. | Sì |
| K8sRequireDefaultDenyEgressPolicy | Richiede che ogni spazio dei nomi definito nel cluster abbia un criterio NetworkPolicy predefinito per il traffico in uscita. | Sì |
| K8sRequireNamespaceNetworkPolicies | Richiede che ogni spazio dei nomi definito nel cluster abbia un NetworkPolicy. | Sì |
| K8sRequireValidRangesForNetworks | Applica i blocchi CIDR consentiti per il traffico in entrata e in uscita dalla rete. | No |
| K8sRequiredAnnotations | Richiede che le risorse contengano annotazioni specificate, con valori corrispondenti alle espressioni regolari fornite. | No |
| K8sRequiredLabels | Richiede che le risorse contengano etichette specificate, con valori corrispondenti alle espressioni regolari fornite. | No |
| K8sRequiredProbes | Richiede i pod di avere probe di idoneità e/o di attività. | No |
| K8sRequiredResources | Richiede che i container abbiano risorse definite. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | No |
| K8sRestrictAdmissionController | Limita i controller di ammissione dinamica a quelli consentiti | No |
| K8sRestrictAutomountServiceAccountTokens | Limita l'utilizzo dei token degli account di servizio. | No |
| K8sRestrictLabels | Non consente alle risorse di contenere etichette specificate, a meno che non esista un'eccezione per la risorsa specifica. | No |
| K8sRestrictNamespaces | Impedisce alle risorse di utilizzare gli spazi dei nomi elencati sotto il parametro restrictedNamespaces. | No |
| K8sRestrictNfsUrls | Non consente alle risorse di contenere URL NFS, a meno che non sia specificato. | No |
| K8sRestrictRbacSubjects | Limita l'uso dei nomi nei soggetti RBAC ai valori consentiti. | No |
| K8sRestrictRoleBindings | Limita i soggetti specificati in ClusterRoleBindings e RoleBinding a un elenco di soggetti consentiti. | No |
| K8sRestrictRoleRules | Limita le regole che possono essere impostate sugli oggetti Role e ClusterRole. | No |
| K8sStorageClass | Richiede che le classi di archiviazione siano specificate quando utilizzate. Sono supportati solo i container Gatekeeper 3.9 e versioni successive e non temporanei. | Sì |
| K8sUniqueIngressHost | Richiede che tutti gli host delle regole di ingresso siano univoci. Non gestisce i caratteri jolly per i nomi host: https://kubernetes.io/docs/concepts/services-networking/ingress/ | Sì |
| K8sUniqueServiceSelector | Richiede che i servizi abbiano selettori univoci all'interno di uno spazio dei nomi. I selettori sono considerati uguali se hanno chiavi e valori identici. I selettori possono condividere una coppia chiave/valore purché esista almeno una coppia chiave/valore distinta tra di loro. https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service | Sì |
| NoUpdateServiceAccount | Blocca l'aggiornamento dell'account di servizio nelle risorse che eseguono l'astrazione dei pod. Questo criterio viene ignorato in modalità di controllo. | No |
| PolicyStrictOnly | Richiede che TLS reciproco Istio "STRICT" sia sempre specificato quando si utilizza [PeerAuthentication](https://istio.io/latest/docs/reference/config/security/peer_authentication/). Questo vincolo garantisce inoltre che le risorse [Policy](https://istio.io/v1.4/docs/reference/config/security/istio.authentication.v1alpha1/#Policy) e MeshPolicy deprecate applichino TLS reciproco "STRICT". Vedi: https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/#lock-down-mutual-tls-for-the-entire-mesh | No |
| RestrictNetworkExclusions | Controlla quali porte in entrata, porte in uscita e intervalli IP in uscita possono essere escluso dall'acquisizione della rete Istio. Porte e intervalli IP che ignorano Istio le acquisizioni di rete non sono gestite dal proxy Istio e non sono soggette alle Autenticazione, criterio di autorizzazione e altre funzionalità di Istio mTLS. Questo vincolo può essere utilizzato per applicare limitazioni all'uso del le seguenti annotazioni:
Vedi https://istio.io/latest/docs/reference/config/annotations/. Quando limiti gli intervalli di indirizzi IP in uscita, il vincolo calcola se gli intervalli di indirizzi IP esclusi corrispondono o sono un sottoinsieme delle esclusioni di intervalli di indirizzi IP consentite. Quando si utilizza questo vincolo, tutte le porte in entrata, le porte in uscita e gli IP in uscita devono essere sempre inclusi impostando il parametro "include" corrispondente annotazioni ""*"" o se non vengono impostate. L'impostazione di una delle seguenti opzioni annotazioni a elementi diversi da ""*"" non sono consentite:
Questo vincolo consente sempre di escludere la porta 15020 perché il file collaterale Istio
injector lo aggiunge sempre all' |
No |
| SourceNotAllAuthz | Richiede che le regole Istio AuthorizationPolicy abbiano entità di origine impostate su un valore diverso da "*". https://istio.io/latest/docs/reference/config/security/authorization-policy/ | No |
| VerifyDeprecatedAPI | Verifica le API Kubernetes deprecate per assicurarti che tutte le versioni dell'API siano aggiornate. Questo modello non si applica ai controlli perché l'audit esamina le risorse già presenti nel cluster con versioni API non deprecate. | No |
AllowedServicePortName
Nomi porte di servizio consentiti v1.0.1
Richiede che i nomi delle porte dei servizi abbiano un prefisso di un elenco specificato.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AllowedServicePortName
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# prefixes <array>: Prefixes of allowed service port names.
prefixes:
- <string>
Esempi
vincolo-nome-porta
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AllowedServicePortName metadata: name: port-name-constraint spec: enforcementAction: deny match: kinds: - apiGroups: - "" kinds: - Service parameters: prefixes: - http- - http2- - grpc- - mongo- - redis- - tcp-
Consentito
apiVersion: v1 kind: Service metadata: labels: app: helloworld name: port-name-http spec: ports: - name: http-helloport port: 5000 selector: app: helloworld
Operazione non consentita
apiVersion: v1 kind: Service metadata: labels: app: helloworld name: port-name-tcp spec: ports: - name: foo-helloport port: 5000 selector: app: helloworld
apiVersion: v1 kind: Service metadata: labels: app: helloworld name: port-name-bad spec: ports: - name: helloport port: 5000 selector: app: helloworld
AsmAuthzPolicyDefaultDeny
ASM AuthorizationPolicy Default Deny v1.0.4
Applica il criterio AuthorizationPolicy di rifiuto predefinito a livello di mesh. Riferimento a https://istio.io/latest/docs/ops/best-practices/security/#use-default-deny-patterns.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDefaultDeny
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# rootNamespace <string>: Anthos Service Mesh root namespace, default value
# is "istio-system" if not specified.
rootNamespace: <string>
# strictnessLevel <string>: Level of AuthorizationPolicy strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Vincolo referenziale
Questo vincolo è referenziale. Prima dell'utilizzo, devi abilitare le limitazioni referenziali e creare una configurazione che indichi a Policy Controller quali tipi di oggetti monitorare.
Il criterio Config di Policy Controller richiederà una voce syncOnly simile a:
spec:
sync:
syncOnly:
- group: "security.istio.io"
version: "v1beta1"
kind: "AuthorizationPolicy"
Esempi
asm-authz-policy-default-deny-with-input-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-with-input-constraint spec: enforcementAction: dryrun parameters: rootNamespace: istio-system strictnessLevel: High
Consentito
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-with-input-constraint spec: enforcementAction: dryrun parameters: rootNamespace: istio-system strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: default-deny-no-action namespace: istio-system spec: null
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-with-input-constraint spec: enforcementAction: dryrun parameters: rootNamespace: istio-system strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: default-deny-with-action namespace: istio-system spec: action: ALLOW
Operazione non consentita
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-with-input-constraint spec: enforcementAction: dryrun parameters: rootNamespace: istio-system strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: not-default-deny namespace: istio-system spec: action: DENY rules: - to: - operation: notMethods: - GET - POST
asm-authz-policy-default-deny-no-input-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-no-input-constraint spec: enforcementAction: dryrun parameters: strictnessLevel: High
Consentito
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-no-input-constraint spec: enforcementAction: dryrun parameters: strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: default-deny-no-action namespace: istio-system spec: null
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-no-input-constraint spec: enforcementAction: dryrun parameters: strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: default-deny-with-action namespace: istio-system spec: action: ALLOW
Operazione non consentita
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDefaultDeny metadata: name: asm-authz-policy-default-deny-no-input-constraint spec: enforcementAction: dryrun parameters: strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: not-default-deny namespace: istio-system spec: action: DENY rules: - to: - operation: notMethods: - GET - POST
AsmAuthzPolicyDisallowedPrefix
Prefissi non consentiti di ASM AuthorizationPolicy v1.0.2
Richiede che i principali e gli spazi dei nomi nelle regole AuthorizationPolicy di Istio non abbiano un prefisso di un elenco specificato.
https://istio.io/latest/docs/reference/config/security/authorization-policy/
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyDisallowedPrefix
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# disallowedNamespacePrefixes <array>: Disallowed prefixes for namespaces.
disallowedNamespacePrefixes:
- <string>
# disallowedPrincipalPrefixes <array>: Disallowed prefixes for principals.
disallowedPrincipalPrefixes:
- <string>
Esempi
asm-authz-policy-disallowed-prefix-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyDisallowedPrefix metadata: name: asm-authz-policy-disallowed-prefix-constraint spec: enforcementAction: dryrun match: kinds: - apiGroups: - security.istio.io kinds: - AuthorizationPolicy parameters: disallowedNamespacePrefixes: - bad-ns-prefix - worse-ns-prefix disallowedPrincipalPrefixes: - bad-principal-prefix - worse-principal-prefix
Consentito
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: valid-authz-policy spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/sleep - source: namespaces: - test selector: matchLabels: app: httpbin
Operazione non consentita
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: bad-source-principal spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/worse-principal-prefix-sleep - source: namespaces: - test selector: matchLabels: app: httpbin
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: bad-source-namespace spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/sleep - source: namespaces: - bad-ns-prefix-test selector: matchLabels: app: httpbin
AsmAuthzPolicyEnforceSourcePrincipals
Entità dell'applicazione di AuthorizationPolicy ASM v1.0.2
Richiede che il campo "from" di AuthorizationPolicy di Istio, se definito, abbia principi di origine, che devono essere impostati su un valore diverso da "*". https://istio.io/latest/docs/reference/config/security/authorization-policy/
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyEnforceSourcePrincipals
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
asm-authz-policy-enforce-source-principals-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyEnforceSourcePrincipals metadata: name: asm-authz-policy-enforce-source-principals-constraint spec: enforcementAction: dryrun match: kinds: - apiGroups: - security.istio.io kinds: - AuthorizationPolicy
Consentito
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: valid-authz-policy spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/sleep - source: namespaces: - test to: - operation: methods: - GET paths: - /info* - operation: methods: - POST paths: - /data when: - key: request.auth.claims[iss] values: - https://accounts.google.com selector: matchLabels: app: httpbin
Operazione non consentita
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: no-source-principals spec: rules: - from: - source: namespaces: - test to: - operation: methods: - GET paths: - /info* - operation: methods: - POST paths: - /data when: - key: request.auth.claims[iss] values: - https://accounts.google.com selector: matchLabels: app: httpbin
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: source-principals-wildcard spec: rules: - from: - source: principals: - '*' - source: namespaces: - test to: - operation: methods: - GET paths: - /info* - operation: methods: - POST paths: - /data when: - key: request.auth.claims[iss] values: - https://accounts.google.com selector: matchLabels: app: httpbin
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: source-principals-contains-wildcard spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/sleep - '*' - source: namespaces: - test to: - operation: methods: - GET paths: - /info* - operation: methods: - POST paths: - /data when: - key: request.auth.claims[iss] values: - https://accounts.google.com selector: matchLabels: app: httpbin
AsmAuthzPolicyNormalization
Normalizzazione di AuthorizationPolicy ASM v1.0.2
Applica la normalizzazione di AuthorizationPolicy. Riferimento a https://istio.io/latest/docs/reference/config/security/normalization/.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicyNormalization
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
asm-authz-policy-normalization-sample
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicyNormalization metadata: name: asm-authz-policy-normalization-sample spec: enforcementAction: dryrun match: kinds: - apiGroups: - security.istio.io kinds: - AuthorizationPolicy
Consentito
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: good-authz-policy spec: action: ALLOW rules: - to: - operation: methods: - GET paths: - /test/foo - when: - key: source.ip values: - 10.1.2.3 - 10.2.0.0/16 - key: request.headers[User-Agent] values: - Mozilla/* selector: matchLabels: app: httpbin
Operazione non consentita
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: bad-method-lowercase spec: action: ALLOW rules: - to: - operation: methods: - get selector: matchLabels: app: httpbin
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: bad-request-header-whitespace spec: action: ALLOW rules: - to: - operation: methods: - GET - when: - key: source.ip values: - 10.1.2.3 - 10.2.0.0/16 - key: request.headers[User-Ag ent] values: - Mozilla/* selector: matchLabels: app: httpbin
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: path-unnormalized spec: action: ALLOW rules: - to: - operation: methods: - GET paths: - /test\/foo - when: - key: source.ip values: - 10.1.2.3 - 10.2.0.0/16 - key: request.headers[User-Agent] values: - Mozilla/* selector: matchLabels: app: httpbin
AsmAuthzPolicySafePattern
Pattern sicuri di AuthorizationPolicy di ASM versione 1.0.4
Applica i pattern sicuri di AuthorizationPolicy. Fai riferimento a https://istio.io/latest/docs/ops/best-practices/security/#safer-authorization-policy-patterns.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmAuthzPolicySafePattern
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# strictnessLevel <string>: Level of AuthorizationPolicy strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Esempi
asm-authz-policy-safe-pattern-sample
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmAuthzPolicySafePattern metadata: name: asm-authz-policy-safe-pattern-sample spec: enforcementAction: dryrun match: kinds: - apiGroups: - security.istio.io kinds: - AuthorizationPolicy parameters: strictnessLevel: High
Consentito
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: good-authz-policy-istio-ingress spec: action: ALLOW rules: - to: - operation: hosts: - test.com - test.com:* methods: - GET selector: matchLabels: istio: ingressgateway
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: good-authz-policy-asm-ingress spec: action: ALLOW rules: - to: - operation: hosts: - test.com - test.com:* methods: - GET selector: matchLabels: asm: ingressgateway
Operazione non consentita
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: hosts-on-noningress spec: action: ALLOW rules: - to: - operation: hosts: - test.com - test.com:* methods: - GET
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: invalid-hosts spec: action: ALLOW rules: - to: - operation: hosts: - test.com methods: - GET selector: matchLabels: istio: ingressgateway
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: allow-negative-match spec: action: ALLOW rules: - to: - operation: hosts: - test.com - test.com:* notMethods: - GET selector: matchLabels: istio: ingressgateway
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: deny-positive-match spec: action: DENY rules: - to: - operation: hosts: - test.com - test.com:* methods: - GET selector: matchLabels: istio: ingressgateway
AsmIngressgatewayLabel
Etichetta gateway Ingress ASM v1.0.3
Applica l'utilizzo dell'etichetta istio ingressgateway solo ai pod ingressgateway.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmIngressgatewayLabel
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
asm-ingressgateway-label-sample
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmIngressgatewayLabel metadata: name: asm-ingressgateway-label-sample spec: enforcementAction: dryrun match: kinds: - apiGroups: - "" kinds: - Pod
Consentito
apiVersion: v1 kind: Pod metadata: labels: app: sleep istio: istio name: sleep spec: containers: - image: curlimages/curl name: sleep - image: gcr.io/gke-release/asm/proxyv2:release name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP
apiVersion: v1 kind: Pod metadata: labels: app: istio-ingressgateway istio: ingressgateway name: istio-ingressgateway spec: containers: - image: gcr.io/gke-release/asm/proxyv2:release name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP
apiVersion: v1 kind: Pod metadata: labels: app: asm-ingressgateway asm: ingressgateway name: asm-ingressgateway spec: containers: - image: gcr.io/gke-release/asm/proxyv2:release name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP
Operazione non consentita
apiVersion: v1 kind: Pod metadata: labels: app: sleep istio: ingressgateway name: sleep spec: containers: - image: curlimages/curl name: sleep
apiVersion: v1 kind: Pod metadata: labels: app: sleep asm: ingressgateway name: sleep spec: containers: - image: curlimages/curl name: sleep
apiVersion: v1 kind: Pod metadata: labels: app: sleep istio: ingressgateway name: sleep spec: containers: - image: curlimages/curl name: sleep - image: gcr.io/gke-release/asm/proxyv2:release name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP
AsmPeerAuthnMeshStrictMtls
ASM Peer Authentication Mesh Strict mTLS v1.0.4
Applica il protocollo PeerAuthentication mtls restrittivo del livello mesh. Riferimento a https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnMeshStrictMtls
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# rootNamespace <string>: Anthos Service Mesh root namespace, default value
# is "istio-system" if not specified.
rootNamespace: <string>
# strictnessLevel <string>: Level of PeerAuthentication strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Vincolo referenziale
Questo vincolo è referenziale. Prima dell'utilizzo, devi abilitare le limitazioni referenziali e creare una configurazione che indichi a Policy Controller quali tipi di oggetti monitorare.
Il criterio Config di Policy Controller richiederà una voce syncOnly simile a:
spec:
sync:
syncOnly:
- group: "security.istio.io"
version: "v1beta1"
kind: "PeerAuthentication"
Esempi
asm-peer-authn-mesh-strict-mtls-with-input-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmPeerAuthnMeshStrictMtls metadata: name: asm-peer-authn-mesh-strict-mtls-with-input-constraint spec: enforcementAction: dryrun parameters: rootNamespace: asm-root strictnessLevel: High
Consentito
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmPeerAuthnMeshStrictMtls metadata: name: asm-peer-authn-mesh-strict-mtls-with-input-constraint spec: enforcementAction: dryrun parameters: rootNamespace: asm-root strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mesh-strict-mtls namespace: asm-root spec: mtls: mode: STRICT
Operazione non consentita
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmPeerAuthnMeshStrictMtls metadata: name: asm-peer-authn-mesh-strict-mtls-with-input-constraint spec: enforcementAction: dryrun parameters: rootNamespace: asm-root strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mesh-permissive-mtls namespace: asm-root spec: mtls: mode: PERMISSIVE
asm-peer-authn-mesh-strict-mtls-no-input-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmPeerAuthnMeshStrictMtls metadata: name: asm-peer-authn-mesh-strict-mtls-no-input-constraint spec: enforcementAction: dryrun parameters: strictnessLevel: High
Consentito
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmPeerAuthnMeshStrictMtls metadata: name: asm-peer-authn-mesh-strict-mtls-no-input-constraint spec: enforcementAction: dryrun parameters: strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mesh-strict-mtls namespace: istio-system spec: mtls: mode: STRICT
Operazione non consentita
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmPeerAuthnMeshStrictMtls metadata: name: asm-peer-authn-mesh-strict-mtls-no-input-constraint spec: enforcementAction: dryrun parameters: strictnessLevel: High --- # Referential Data apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mesh-permissive-mtls namespace: istio-system spec: mtls: mode: PERMISSIVE
AsmPeerAuthnStrictMtls
ASM Peer Authentication Strict mTLS v1.0.3 Autenticazione peer ASM
L'applicazione di tutte le autenticazioni peer non può sovrascrivere mTLS restrittivo. Riferimento a https://istio.io/latest/docs/ops/best-practices/security/#mutual-tls.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmPeerAuthnStrictMtls
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# strictnessLevel <string>: Level of PeerAuthentication strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Esempi
asm-peer-authn-strict-mtls-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmPeerAuthnStrictMtls metadata: name: asm-peer-authn-strict-mtls-constraint spec: enforcementAction: dryrun match: kinds: - apiGroups: - security.istio.io kinds: - PeerAuthentication parameters: strictnessLevel: High
Consentito
apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: valid-strict-mtls-pa namespace: foo spec: mtls: mode: UNSET portLevelMtls: "80": mode: UNSET "443": mode: STRICT selector: matchLabels: app: bar
Operazione non consentita
apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: invalid-permissive-mtls-pa namespace: foo spec: mtls: mode: PERMISSIVE portLevelMtls: "80": mode: UNSET "443": mode: STRICT selector: matchLabels: app: bar
apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: invalid-port-disable-mtls-pa namespace: foo spec: mtls: mode: UNSET portLevelMtls: "80": mode: DISABLE "443": mode: STRICT selector: matchLabels: app: bar
AsmRequestAuthnProhibitedOutputHeaders
Intestazioni di output vietate ASM RequestAuthentication v1.0.2
In RequestAuthentication, fai in modo che il campo jwtRules.outPayloadToHeader non contenga intestazioni di richieste HTTP note o intestazioni personalizzate non consentite. Fai riferimento a https://istio.io/latest/docs/reference/config/security/jwt/#JWTRule.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmRequestAuthnProhibitedOutputHeaders
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# prohibitedHeaders <array>: User predefined prohibited headers.
prohibitedHeaders:
- <string>
Esempi
asm-request-authn-prohibited-output-headers-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmRequestAuthnProhibitedOutputHeaders metadata: name: asm-request-authn-prohibited-output-headers-constraint spec: enforcementAction: dryrun match: kinds: - apiGroups: - security.istio.io kinds: - RequestAuthentication parameters: prohibitedHeaders: - Bad-Header - X-Bad-Header
Consentito
apiVersion: security.istio.io/v1beta1 kind: RequestAuthentication metadata: name: valid-request-authn namespace: istio-system spec: jwtRules: - issuer: example.com outputPayloadToHeader: Good-Header selector: matchLabels: app: istio-ingressgateway
Operazione non consentita
apiVersion: security.istio.io/v1beta1 kind: RequestAuthentication metadata: name: deny-predefined-output-header namespace: istio-system spec: jwtRules: - issuer: example.com outputPayloadToHeader: Host selector: matchLabels: app: istio-ingressgateway
apiVersion: security.istio.io/v1beta1 kind: RequestAuthentication metadata: name: deny-predefined-output-header namespace: istio-system spec: jwtRules: - issuer: example.com outputPayloadToHeader: X-Bad-Header selector: matchLabels: app: istio-ingressgateway
AsmSidecarInjection
ASM Sidecar Injection v1.0.2
L'applicazione forzata del sidecar del proxy Istio è sempre stato inserito nei pod dei carichi di lavoro.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AsmSidecarInjection
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# strictnessLevel <string>: Level of sidecar injection strictness.
# Allowed Values: Low, High
strictnessLevel: <string>
Esempi
asm-sidecar-injection-sample
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: AsmSidecarInjection metadata: name: asm-sidecar-injection-sample spec: enforcementAction: dryrun match: kinds: - apiGroups: - "" kinds: - Pod parameters: strictnessLevel: High
Consentito
apiVersion: v1 kind: Pod metadata: annotations: sidecar.istio.io/inject: "true" name: sleep spec: containers: - image: curlimages/curl name: sleep - image: gcr.io/gke-release/asm/proxyv2:release name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP
apiVersion: v1 kind: Pod metadata: annotations: "false": "false" name: sleep spec: containers: - image: curlimages/curl name: sleep - image: gcr.io/gke-release/asm/proxyv2:release name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP
Operazione non consentita
apiVersion: v1 kind: Pod metadata: annotations: sidecar.istio.io/inject: "false" name: sleep spec: containers: - image: curlimages/curl name: sleep
DestinationRuleTLSEnabled
Regola di destinazione TLS abilitata v1.0.1
Non è consentito disabilitare TLS per tutti gli host e i sottoinsiemi di host in destinationRules di Istio.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DestinationRuleTLSEnabled
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
dr-tls-enabled
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: DestinationRuleTLSEnabled metadata: name: dr-tls-enabled spec: enforcementAction: dryrun match: kinds: - apiGroups: - networking.istio.io kinds: - DestinationRule
Operazione non consentita
apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: dr-subset-tls-disable namespace: default spec: host: myservice subsets: - name: v1 trafficPolicy: tls: mode: DISABLE - name: v2 trafficPolicy: tls: mode: SIMPLE
apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: dr-traffic-tls-disable namespace: default spec: host: myservice trafficPolicy: tls: mode: DISABLE
DisallowedAuthzPrefix
Disallow Istio AuthorizationPolicy Prefixes v1.0.2
Richiede che i principali e gli spazi dei nomi nelle regole AuthorizationPolicy di Istio non abbiano un prefisso di un elenco specificato.
https://istio.io/latest/docs/reference/config/security/authorization-policy/
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DisallowedAuthzPrefix
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# disallowedprefixes <array>: Disallowed prefixes of principals and
# namespaces.
disallowedprefixes:
- <string>
Esempi
disallowed-authz-prefix-constraint
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: DisallowedAuthzPrefix metadata: name: disallowed-authz-prefix-constraint spec: enforcementAction: dryrun match: kinds: - apiGroups: - security.istio.io kinds: - AuthorizationPolicy parameters: disallowedprefixes: - badprefix - reallybadprefix
Consentito
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: good namespace: foo spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/sleep - source: namespaces: - test to: - operation: methods: - GET paths: - /info* - operation: methods: - POST paths: - /data when: - key: request.auth.claims[iss] values: - https://accounts.google.com selector: matchLabels: app: httpbin version: v1
Operazione non consentita
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: bad-source-principal namespace: foo spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/badprefix-sleep - source: namespaces: - test to: - operation: methods: - GET paths: - /info* - operation: methods: - POST paths: - /data when: - key: request.auth.claims[iss] values: - https://accounts.google.com selector: matchLabels: app: httpbin version: v1
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: bad-source-namespace namespace: foo spec: rules: - from: - source: principals: - cluster.local/ns/default/sa/sleep - source: namespaces: - badprefix-test to: - operation: methods: - GET paths: - /info* - operation: methods: - POST paths: - /data when: - key: request.auth.claims[iss] values: - https://accounts.google.com selector: matchLabels: app: httpbin version: v1
GCPStorageLocationConstraintV1
Limitazione della posizione di archiviazione Google Cloud v1.0.3
Limita i valori locations consentiti per le risorse del connettore di configurazione StorageBucket all'elenco di posizioni fornito nel vincolo. I nomi dei bucket nell'elenco exemptions sono esenti.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: GCPStorageLocationConstraintV1
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptions <array>: A list of bucket names that are exempt from this
# constraint.
exemptions:
- <string>
# locations <array>: A list of locations that a bucket is permitted to
# have.
locations:
- <string>
Esempi
solo-singapore-e-jakarta
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: GCPStorageLocationConstraintV1 metadata: name: singapore-and-jakarta-only spec: enforcementAction: deny match: kinds: - apiGroups: - storage.cnrm.cloud.google.com kinds: - StorageBucket parameters: exemptions: - my_project_id_cloudbuild locations: - asia-southeast1 - asia-southeast2
Consentito
apiVersion: storage.cnrm.cloud.google.com/v1beta1 kind: StorageBucket metadata: name: bucket-in-permitted-location spec: location: asia-southeast1
Operazione non consentita
apiVersion: storage.cnrm.cloud.google.com/v1beta1 kind: StorageBucket metadata: name: bucket-in-disallowed-location spec: location: us-central1
apiVersion: storage.cnrm.cloud.google.com/v1beta1 kind: StorageBucket metadata: name: bucket-without-specific-location spec: null
GkeSpotVMTerminationGrace
Limita terminationGracePeriodSeconds per le VM GKE Spot v1.1.3
Richiede i pod e i modelli di pod con nodeSelector o nodeAfffinty di gke-spot per avere un valore terminationGracePeriodSeconds di 15 o inferiore.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: GkeSpotVMTerminationGrace
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# includePodOnSpotNodes <boolean>: Require `terminationGracePeriodSeconds`
# of 15s or less for all `Pod` on a `gke-spot` Node.
includePodOnSpotNodes: <boolean>
Vincolo referenziale
Questo vincolo è referenziale. Prima dell'uso, devi abilitare i vincoli referenziali e creare una configurazione che indichi a Policy Controller quali tipi di oggetti monitorare.
Il tuo Policy Controller Config richiederà una voce syncOnly simile alla seguente:
spec:
sync:
syncOnly:
- group: ""
version: "v1"
kind: "Node"
Esempi
spotvm-termination-grace
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: GkeSpotVMTerminationGrace metadata: name: spotvm-termination-grace spec: enforcementAction: dryrun match: kinds: - apiGroups: - "" kinds: - Pod parameters: includePodOnSpotNodes: true
Consentito
apiVersion: v1 kind: Pod metadata: name: example-allowed spec: containers: - image: nginx name: nginx nodeSelector: cloud.google.com/gke-spot: "true" terminationGracePeriodSeconds: 15
apiVersion: v1 kind: Pod metadata: name: example-allowed spec: containers: - image: nginx name: nginx nodeSelector: cloud.google.com/gke-spot: "true" terminationGracePeriodSeconds: 15
apiVersion: v1 kind: Pod metadata: name: example-with-termGrace spec: Nodename: default containers: - image: nginx name: nginx terminationGracePeriodSeconds: 15 --- # Referential Data apiVersion: v1 kind: Node metadata: labels: cloud.google.com/gke-spot: "true" name: default
apiVersion: v1 kind: Pod metadata: name: example-with-termGrace spec: Nodename: default containers: - image: nginx name: nginx terminationGracePeriodSeconds: 15 --- # Referential Data apiVersion: v1 kind: Node metadata: name: default
apiVersion: v1 kind: Pod metadata: name: example-without-termGrace spec: Nodename: default containers: - image: nginx name: nginx --- # Referential Data apiVersion: v1 kind: Node metadata: name: default
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: example-disallowed spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: cloud.google.com/gke-spot operator: In values: - "true" containers: - image: nginx name: nginx terminationGracePeriodSeconds: 30
apiVersion: v1 kind: Pod metadata: name: example-disallowed spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: cloud.google.com/gke-spot operator: In values: - "true" containers: - image: nginx name: nginx
apiVersion: v1 kind: Pod metadata: name: example-disallowed spec: containers: - image: nginx name: nginx nodeSelector: cloud.google.com/gke-spot: "true" terminationGracePeriodSeconds: 30
apiVersion: v1 kind: Pod metadata: name: example-disallowed spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: cloud.google.com/gke-spot operator: In values: - "true" containers: - image: nginx name: nginx
apiVersion: v1 kind: Pod metadata: name: example-without-termGrace spec: Nodename: default containers: - image: nginx name: nginx --- # Referential Data apiVersion: v1 kind: Node metadata: labels: cloud.google.com/gke-spot: "true" name: default
K8sAllowedRepos
Repository consentiti v1.0.1
Richiede che le immagini container inizino con una stringa dell'elenco specificato.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# repos <array>: The list of prefixes a container image is allowed to have.
repos:
- <string>
Esempi
repo-is-openpolicyagent
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sAllowedRepos metadata: name: repo-is-openpolicyagent spec: match: kinds: - apiGroups: - "" kinds: - Pod namespaces: - default parameters: repos: - openpolicyagent/
Consentito
apiVersion: v1 kind: Pod metadata: name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m memory: 30Mi
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: nginx-disallowed spec: containers: - image: nginx name: nginx resources: limits: cpu: 100m memory: 30Mi
apiVersion: v1 kind: Pod metadata: name: nginx-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m memory: 30Mi initContainers: - image: nginx name: nginxinit resources: limits: cpu: 100m memory: 30Mi
apiVersion: v1 kind: Pod metadata: name: nginx-disallowed spec: containers: - image: nginx name: nginx resources: limits: cpu: 100m memory: 30Mi initContainers: - image: nginx name: nginxinit resources: limits: cpu: 100m memory: 30Mi
apiVersion: v1 kind: Pod metadata: name: nginx-disallowed spec: containers: - image: nginx name: nginx resources: limits: cpu: 100m memory: 30Mi ephemeralContainers: - image: nginx name: nginx resources: limits: cpu: 100m memory: 30Mi initContainers: - image: nginx name: nginx resources: limits: cpu: 100m memory: 30Mi
K8sAvoidUseOfSystemMastersGroup
Non consentire l'uso di "system:masters" gruppo v1.0.0
Non consente l'utilizzo del gruppo "system:masters". Non ha alcun effetto durante il controllo.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAvoidUseOfSystemMastersGroup
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowlistedUsernames <array>: allowlistedUsernames is the list of
# usernames that are allowed to use system:masters group.
allowlistedUsernames:
- <string>
Esempi
avoid-use-of-system-masters-group
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sAvoidUseOfSystemMastersGroup metadata: name: avoid-use-of-system-masters-group
Consentito
apiVersion: v1 kind: Namespace metadata: name: example-namespace
K8sBlockAllIngress
Block all Ingress v1.0.4
Non consente la creazione di oggetti Ingress (tipi Ingress, Gateway e Service di NodePort e LoadBalancer).
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockAllIngress
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowList <array>: A list of regular expressions for the Ingress object
# names that are exempt from the constraint.
allowList:
- <string>
Esempi
block-all-ingress
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockAllIngress metadata: name: block-all-ingress spec: enforcementAction: dryrun parameters: allowList: - name1 - name2 - name3 - my-*
Consentito
apiVersion: v1 kind: Service metadata: name: my-service spec: ports: - port: 80 protocol: TCP targetPort: 9376 selector: app.kubernetes.io/name: MyApp type: LoadBalancer
apiVersion: v1 kind: Service metadata: name: allowed-clusterip-service-example spec: ports: - port: 80 protocol: TCP targetPort: 9376 selector: app.kubernetes.io/name: MyApp type: ClusterIP
Operazione non consentita
apiVersion: v1 kind: Service metadata: name: disallowed-service-example spec: ports: - port: 80 protocol: TCP targetPort: 9376 selector: app.kubernetes.io/name: MyApp type: LoadBalancer
apiVersion: v1 kind: Service metadata: name: disallowed-service-example spec: ports: - port: 80 protocol: TCP targetPort: 9376 selector: app.kubernetes.io/name: MyApp type: LoadBalancer
apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: disallowed-gateway-example spec: gatewayClassName: istio listeners: - allowedRoutes: namespaces: from: All hostname: '*.example.com' name: default port: 80 protocol: HTTP
K8sBlockCreationWithDefaultServiceAccount
Creazione del blocco con un account di servizio predefinito v1.0.2
Non consente la creazione di risorse utilizzando un account di servizio predefinito. Non ha alcun effetto durante il controllo.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockCreationWithDefaultServiceAccount
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
block-creation-with-default-serviceaccount
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockCreationWithDefaultServiceAccount metadata: name: block-creation-with-default-serviceaccount spec: enforcementAction: dryrun
Consentito
apiVersion: v1 kind: Namespace metadata: name: example-namespace
K8sBlockEndpointEditDefaultRole
Ruolo predefinito per la modifica degli endpoint di blocco v1.0.0
Molte installazioni di Kubernetes per impostazione predefinita hanno un sistema system:aggregate-to-edit ClusterRole che non limita correttamente l'accesso alla modifica degli endpoint. Questo modello di vincolo impedisce al ruolo ClusterRole system:aggregate-to-edit di concedere l'autorizzazione per creare/eseguire patch/aggiornare gli endpoint. ClusterRole/system:aggregate-to-edit non deve consentire le autorizzazioni di modifica degli endpoint a causa di CVE-2021-25740, le autorizzazioni Endpoint e EndpointSlice consentono il forwarding tra spazi dei nomi, https://github.com/kubernetes/kubernetes/issues/103675
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockEndpointEditDefaultRole
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
block-endpoint-edit-default-role
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockEndpointEditDefaultRole metadata: name: block-endpoint-edit-default-role spec: match: kinds: - apiGroups: - rbac.authorization.k8s.io kinds: - ClusterRole
Consentito
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: annotations: rbac.authorization.kubernetes.io/autoupdate: "true" labels: kubernetes.io/bootstrapping: rbac-defaults rbac.authorization.k8s.io/aggregate-to-edit: "true" name: system:aggregate-to-edit rules: - apiGroups: - "" resources: - pods/attach - pods/exec - pods/portforward - pods/proxy - secrets - services/proxy verbs: - get - list - watch - apiGroups: - "" resources: - serviceaccounts verbs: - impersonate - apiGroups: - "" resources: - pods - pods/attach - pods/exec - pods/portforward - pods/proxy verbs: - create - delete - deletecollection - patch - update - apiGroups: - "" resources: - configmaps - persistentvolumeclaims - replicationcontrollers - replicationcontrollers/scale - secrets - serviceaccounts - services - services/proxy verbs: - create - delete - deletecollection - patch - update - apiGroups: - apps resources: - daemonsets - deployments - deployments/rollback - deployments/scale - replicasets - replicasets/scale - statefulsets - statefulsets/scale verbs: - create - delete - deletecollection - patch - update - apiGroups: - autoscaling resources: - horizontalpodautoscalers verbs: - create - delete - deletecollection - patch - update - apiGroups: - batch resources: - cronjobs - jobs verbs: - create - delete - deletecollection - patch - update - apiGroups: - extensions resources: - daemonsets - deployments - deployments/rollback - deployments/scale - ingresses - networkpolicies - replicasets - replicasets/scale - replicationcontrollers/scale verbs: - create - delete - deletecollection - patch - update - apiGroups: - policy resources: - poddisruptionbudgets verbs: - create - delete - deletecollection - patch - update - apiGroups: - networking.k8s.io resources: - ingresses - networkpolicies verbs: - create - delete - deletecollection - patch - update
Operazione non consentita
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: annotations: rbac.authorization.kubernetes.io/autoupdate: "true" labels: kubernetes.io/bootstrapping: rbac-defaults rbac.authorization.k8s.io/aggregate-to-edit: "true" name: system:aggregate-to-edit rules: - apiGroups: - "" resources: - pods/attach - pods/exec - pods/portforward - pods/proxy - secrets - services/proxy verbs: - get - list - watch - apiGroups: - "" resources: - serviceaccounts verbs: - impersonate - apiGroups: - "" resources: - pods - pods/attach - pods/exec - pods/portforward - pods/proxy verbs: - create - delete - deletecollection - patch - update - apiGroups: - "" resources: - configmaps - persistentvolumeclaims - replicationcontrollers - replicationcontrollers/scale - secrets - serviceaccounts - services - services/proxy verbs: - create - delete - deletecollection - patch - update - apiGroups: - apps resources: - daemonsets - deployments - deployments/rollback - deployments/scale - endpoints - replicasets - replicasets/scale - statefulsets - statefulsets/scale verbs: - create - delete - deletecollection - patch - update
K8sBlockLoadBalancer
Blocca i servizi con il tipo LoadBalancer v1.0.0
Non sono consentiti tutti i servizi di tipo LoadBalancer. https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockLoadBalancer
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
block-load-balancer
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockLoadBalancer metadata: name: block-load-balancer spec: match: kinds: - apiGroups: - "" kinds: - Service
Consentito
apiVersion: v1 kind: Service metadata: name: my-service-allowed spec: ports: - port: 80 targetPort: 80 type: ClusterIP
Operazione non consentita
apiVersion: v1 kind: Service metadata: name: my-service-disallowed spec: ports: - nodePort: 30007 port: 80 targetPort: 80 type: LoadBalancer
K8sBlockNodePort
Block NodePort v1.0.0
Non sono consentiti tutti i servizi di tipo NodePort. https://kubernetes.io/docs/concepts/services-networking/service/#nodeport
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockNodePort
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
porta-nodo-blocco
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockNodePort metadata: name: block-node-port spec: match: kinds: - apiGroups: - "" kinds: - Service
Operazione non consentita
apiVersion: v1 kind: Service metadata: name: my-service-disallowed spec: ports: - nodePort: 30007 port: 80 targetPort: 80 type: NodePort
K8sBlockObjectsOfType
Oggetti blocco di tipo v1.0.1
Non ammette oggetti di tipi vietati.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockObjectsOfType
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
forbiddenTypes:
- <string>
Esempi
block-secrets-of-type-basic-auth
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockObjectsOfType metadata: name: block-secrets-of-type-basic-auth spec: match: kinds: - apiGroups: - "" kinds: - Secret parameters: forbiddenTypes: - kubernetes.io/basic-auth
Consentito
apiVersion: v1 data: password: ZHVtbXlwYXNz username: ZHVtbXl1c2Vy kind: Secret metadata: name: credentials namespace: default type: Opaque
Operazione non consentita
apiVersion: v1 data: password: YmFzaWMtcGFzc3dvcmQ= username: YmFzaWMtdXNlcm5hbWU= kind: Secret metadata: name: secret-basic-auth namespace: default type: kubernetes.io/basic-auth
K8sBlockProcessNamespaceSharing
Condivisione dello spazio dei nomi per processo di blocco v1.0.1
Vieta le specifiche dei pod con shareProcessNamespace impostato su true. Questo evita scenari in cui tutti i container in un pod condividono uno spazio dei nomi PID e possono accedere reciprocamente al file system e alla memoria degli altri.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockProcessNamespaceSharing
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
block-process-namespace-sharing
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockProcessNamespaceSharing metadata: name: block-process-namespace-sharing
Consentito
apiVersion: v1 kind: Pod metadata: name: good-pod namespace: default spec: containers: - image: nginx name: nginx
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: bad-pod namespace: default spec: containers: - image: nginx name: nginx shareProcessNamespace: true
K8sBlockWildcardIngress
Block Wildcard Ingress v1.0.1
Gli utenti non devono essere in grado di creare risorse Ingress con un nome host vuoto o con carattere jolly (*), poiché ciò consentirebbe loro di intercettare il traffico per altri servizi nel cluster, anche se non hanno accesso a questi servizi.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockWildcardIngress
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
block-wildcard-ingress
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockWildcardIngress metadata: name: block-wildcard-ingress spec: match: kinds: - apiGroups: - extensions - networking.k8s.io kinds: - Ingress
Consentito
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: non-wildcard-ingress spec: rules: - host: myservice.example.com http: paths: - backend: service: name: example port: number: 80 path: / pathType: Prefix
Operazione non consentita
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: wildcard-ingress spec: rules: - host: "" http: paths: - backend: service: name: example port: number: 80 path: / pathType: Prefix
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: wildcard-ingress spec: rules: - http: paths: - backend: service: name: example port: number: 80 path: / pathType: Prefix
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: wildcard-ingress spec: rules: - host: '*.example.com' http: paths: - backend: service: name: example port: number: 80 path: / pathType: Prefix - host: valid.example.com http: paths: - backend: service: name: example port: number: 80 path: / pathType: Prefix
K8sContainerEphemeralStorageLimit
Limite di spazio di archiviazione temporanea del container v1.0.2
Richiede l'impostazione di un limite di spazio di archiviazione temporaneo per i container e vincola il limite ai valori massimi specificati. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerEphemeralStorageLimit
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# ephemeral-storage <string>: The maximum allowed ephemeral storage limit
# on a Pod, exclusive.
ephemeral-storage: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Esempi
container-ephemeral-storage-limit
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sContainerEphemeralStorageLimit metadata: name: container-ephemeral-storage-limit spec: match: kinds: - apiGroups: - "" kinds: - Pod parameters: ephemeral-storage: 500Mi
Consentito
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m ephemeral-storage: 100Mi memory: 1Gi
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m ephemeral-storage: 100Mi memory: 1Gi initContainers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: init-opa resources: limits: cpu: 100m ephemeral-storage: 100Mi memory: 1Gi
Operazione non consentita
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m memory: 2Gi
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m ephemeral-storage: 1Pi memory: 1Gi
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m ephemeral-storage: 100Mi memory: 1Gi initContainers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: init-opa resources: limits: cpu: 100m ephemeral-storage: 1Pi memory: 1Gi
K8sContainerLimits
Limiti dei container v1.0.1
Richiede l'impostazione di limiti di memoria e CPU per i container e vincola i limiti in modo che rientrino nei valori massimi specificati. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerLimits
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cpu <string>: The maximum allowed cpu limit on a Pod, exclusive.
cpu: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# memory <string>: The maximum allowed memory limit on a Pod, exclusive.
memory: <string>
Esempi
container-must-have-limits
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sContainerLimits metadata: name: container-must-have-limits spec: match: kinds: - apiGroups: - "" kinds: - Pod parameters: cpu: 200m memory: 1Gi
Consentito
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m memory: 1Gi
Operazione non consentita
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 100m memory: 2Gi
K8sContainerRatios
Container Ratios v1.0.1
Imposta un rapporto massimo tra i limiti delle risorse dei container e le richieste. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerRatios
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cpuRatio <string>: The maximum allowed ratio of `resources.limits.cpu` to
# `resources.requests.cpu` on a container. If not specified, equal to
# `ratio`.
cpuRatio: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# ratio <string>: The maximum allowed ratio of `resources.limits` to
# `resources.requests` on a container.
ratio: <string>
Esempi
container-must-meet-ratio
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sContainerRatios metadata: name: container-must-meet-ratio spec: match: kinds: - apiGroups: - "" kinds: - Pod parameters: ratio: "2"
Consentito
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 200m memory: 200Mi requests: cpu: 100m memory: 100Mi
Operazione non consentita
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: 800m memory: 2Gi requests: cpu: 100m memory: 100Mi
container-must-meet-memory-and-cpu-ratio
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sContainerRatios metadata: name: container-must-meet-memory-and-cpu-ratio spec: match: kinds: - apiGroups: - "" kinds: - Pod parameters: cpuRatio: "10" ratio: "1"
Consentito
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: "4" memory: 2Gi requests: cpu: "1" memory: 2Gi
Operazione non consentita
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: limits: cpu: "4" memory: 2Gi requests: cpu: 100m memory: 2Gi
K8sContainerRequests
Richieste contenitore v1.0.1
Richiede che i container abbiano richieste di memoria e CPU impostate e limita le richieste a rientrare nei valori massimi specificati. https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerRequests
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cpu <string>: The maximum allowed cpu request on a Pod, exclusive.
cpu: <string>
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# memory <string>: The maximum allowed memory request on a Pod, exclusive.
memory: <string>
Esempi
container-must-have-requests
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sContainerRequests metadata: name: container-must-have-requests spec: match: kinds: - apiGroups: - "" kinds: - Pod parameters: cpu: 200m memory: 1Gi
Consentito
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: requests: cpu: 100m memory: 1Gi
Operazione non consentita
apiVersion: v1 kind: Pod metadata: labels: owner: me.agilebank.demo name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa resources: requests: cpu: 100m memory: 2Gi
K8sCronJobAllowedRepos
Repository consentiti per CronJob v1.0.1
Richiede che le immagini container di CronJob inizino con una stringa dell'elenco specificato.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sCronJobAllowedRepos
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# repos <array>: The list of prefixes a container image is allowed to have.
repos:
- <string>
Esempi
cronjob-restrict-repos
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sCronJobAllowedRepos metadata: name: cronjob-restrict-repos spec: match: kinds: - apiGroups: - batch kinds: - CronJob parameters: repos: - gke.gcr.io/
Consentito
apiVersion: batch/v1 kind: CronJob metadata: name: hello spec: jobTemplate: spec: template: spec: containers: - image: gke.gcr.io/busybox:1.28 name: hello schedule: '* * * * *'
Operazione non consentita
apiVersion: batch/v1 kind: CronJob metadata: name: hello spec: jobTemplate: spec: template: spec: containers: - image: busybox:1.28 name: hello schedule: '* * * * *'
K8sDisallowAnonymous
Non consentire accesso anonimo v1.0.0
Non consente l'associazione di risorse ClusterRole e Role all'utente system:anonymous e al gruppo system:unauthenticated.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowAnonymous
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedRoles <array>: The list of ClusterRoles and Roles that may be
# associated with the `system:unauthenticated` group and `system:anonymous`
# user.
allowedRoles:
- <string>
Esempi
no-anonymous
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sDisallowAnonymous metadata: name: no-anonymous spec: match: kinds: - apiGroups: - rbac.authorization.k8s.io kinds: - ClusterRoleBinding - apiGroups: - rbac.authorization.k8s.io kinds: - RoleBinding parameters: allowedRoles: - cluster-role-1
Consentito
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cluster-role-binding-1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-role-1 subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
Operazione non consentita
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cluster-role-binding-2 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-role-2 subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
K8sNon consentireInteractiveTTY
Non consentire i container TTY interattivi v1.0.0
Richiede che gli oggetti abbiano i campi spec.tty e spec.stdin impostati su false o non impostati.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowInteractiveTTY
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Esempi
no-interactive-tty-containers
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sDisallowInteractiveTTY metadata: name: no-interactive-tty-containers spec: match: kinds: - apiGroups: - "" kinds: - Pod
Consentito
apiVersion: v1 kind: Pod metadata: labels: app: nginx-interactive-tty name: nginx-interactive-tty-allowed spec: containers: - image: nginx name: nginx stdin: false tty: false
Operazione non consentita
apiVersion: v1 kind: Pod metadata: labels: app: nginx-privilege-escalation name: nginx-privilege-escalation-disallowed spec: containers: - image: nginx name: nginx stdin: true tty: true
K8sDisallowedRepos
Repository non consentiti versione 1.0.0
Repository di container non consentiti che iniziano con una stringa dell'elenco specificato.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedRepos
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# repos <array>: The list of prefixes a container image is not allowed to
# have.
repos:
- <string>
Esempi
repo-must-not-be-k8s-gcr-io
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sDisallowedRepos metadata: name: repo-must-not-be-k8s-gcr-io spec: match: kinds: - apiGroups: - "" kinds: - Pod parameters: repos: - k8s.gcr.io/
Consentito
apiVersion: v1 kind: Pod metadata: name: kustomize-allowed spec: containers: - image: registry.k8s.io/kustomize/kustomize:v3.8.9 name: kustomize
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: kustomize-disallowed spec: containers: - image: k8s.gcr.io/kustomize/kustomize:v3.8.9 name: kustomize
apiVersion: v1 kind: Pod metadata: name: kustomize-disallowed spec: containers: - image: registry.k8s.io/kustomize/kustomize:v3.8.9 name: kustomize initContainers: - image: k8s.gcr.io/kustomize/kustomize:v3.8.9 name: kustomizeinit
apiVersion: v1 kind: Pod metadata: name: kustomize-disallowed spec: containers: - image: k8s.gcr.io/kustomize/kustomize:v3.8.9 name: kustomize initContainers: - image: k8s.gcr.io/kustomize/kustomize:v3.8.9 name: kustomizeinit
apiVersion: v1 kind: Pod metadata: name: kustomize-disallowed spec: containers: - image: k8s.gcr.io/kustomize/kustomize:v3.8.9 name: kustomize ephemeralContainers: - image: k8s.gcr.io/kustomize/kustomize:v3.8.9 name: kustomize initContainers: - image: k8s.gcr.io/kustomize/kustomize:v3.8.9 name: kustomize
K8sDisallowedRoleBindingSubjects
Oggetti di associazione di ruoli non consentiti v1.0.1
Vieta RoleBinding o ClusterRoleBindings con soggetti corrispondenti a qualsiasi disallowedSubjects passato come parametro.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedRoleBindingSubjects
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# disallowedSubjects <array>: A list of subjects that cannot appear in a
# RoleBinding.
disallowedSubjects:
- # apiGroup <string>: The Kubernetes API group of the disallowed role
# binding subject. Currently ignored.
apiGroup: <string>
# kind <string>: The kind of the disallowed role binding subject.
kind: <string>
# name <string>: The name of the disallowed role binding subject.
name: <string>
Esempi
soggetti-associazione-di-ruolo-non-consentiti
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sDisallowedRoleBindingSubjects metadata: name: disallowed-rolebinding-subjects spec: parameters: disallowedSubjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
Consentito
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: good-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-role subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated
Operazione non consentita
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: bad-clusterrolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-role subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:unauthenticated
K8sDisallowedTags
Non consentire tag v1.0.1
Richiede che le immagini container abbiano un tag immagine diverso da quelli nell'elenco specificato. https://kubernetes.io/docs/concepts/containers/images/#image-names
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedTags
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
# tags <array>: Disallowed container image tags.
tags:
- <string>
Esempi
container-image-must-not-have-latest-tag
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sDisallowedTags metadata: name: container-image-must-not-have-latest-tag spec: match: kinds: - apiGroups: - "" kinds: - Pod namespaces: - default parameters: exemptImages: - openpolicyagent/opa-exp:latest - openpolicyagent/opa-exp2:latest tags: - latest
Consentito
apiVersion: v1 kind: Pod metadata: name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa
apiVersion: v1 kind: Pod metadata: name: opa-exempt-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa-exp:latest name: opa-exp - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/init:v1 name: opa-init - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa-exp2:latest name: opa-exp2
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa name: opa
apiVersion: v1 kind: Pod metadata: name: opa-disallowed-2 spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:latest name: opa
apiVersion: v1 kind: Pod metadata: name: opa-disallowed-ephemeral spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa ephemeralContainers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:latest name: opa
apiVersion: v1 kind: Pod metadata: name: opa-disallowed-3 spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa-exp:latest name: opa - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/init:latest name: opa-init - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa-exp2:latest name: opa-exp2 - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/monitor:latest name: opa-monitor
K8sEmptyDirHasSizeLimit
La directory vuota ha un limite di dimensioni v1.0.5
Richiede che tutti i volumi emptyDir specifichino un sizeLimit. Facoltativamente, è possibile fornire un parametro maxSizeLimit nel vincolo per specificare un limite di dimensioni massimo consentito.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEmptyDirHasSizeLimit
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptVolumesRegex <array>: Exempt Volume names as regex match.
exemptVolumesRegex:
- <string>
# maxSizeLimit <string>: When set, the declared size limit for each volume
# must be less than `maxSizeLimit`.
maxSizeLimit: <string>
Esempi
empty-dir-has-size-limit
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sEmptyDirHasSizeLimit metadata: name: empty-dir-has-size-limit spec: match: excludedNamespaces: - istio-system - kube-system - gatekeeper-system parameters: exemptVolumesRegex: - ^istio-[a-z]+$ maxSizeLimit: 4Gi
Consentito
apiVersion: v1 kind: Pod metadata: name: good-pod namespace: default spec: containers: - image: nginx name: nginx volumes: - emptyDir: sizeLimit: 2Gi name: good-pod-volume
apiVersion: v1 kind: Pod metadata: name: exempt-pod namespace: default spec: containers: - image: nginx name: nginx volumes: - emptyDir: {} name: istio-envoy
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: bad-pod namespace: default spec: containers: - image: nginx name: nginx volumes: - emptyDir: {} name: bad-pod-volume
K8sEnforceCloudArmorBackendConfig
Applicare Cloud Armor alle risorse BackendConfig v1.0.2
Applica la configurazione di Cloud Armor alle risorse BackendConfig
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEnforceCloudArmorBackendConfig
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
enforce-cloudarmor-backendconfig
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sEnforceCloudArmorBackendConfig metadata: name: enforce-cloudarmor-backendconfig spec: enforcementAction: dryrun
Consentito
apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: my-backendconfig namespace: examplenamespace spec: securityPolicy: name: example-security-policy
apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: second-backendconfig spec: securityPolicy: name: my-security-policy
Operazione non consentita
apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: my-backendconfig namespace: examplenamespace spec: securityPolicy: name: null
apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: my-backendconfig namespace: examplenamespace spec: securityPolicy: name: ""
apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: my-backendconfig spec: logging: enable: true sampleRate: 0.5
K8sEnforceConfigManagement
Applicazione di Config Management v1.1.6
Richiede la presenza e il funzionamento di Config Management. I vincoli che utilizzano questo ConstraintTemplate verranno sottoposti a controllo indipendentemente dal valore di enforcementAction.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sEnforceConfigManagement
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# requireDriftPrevention <boolean>: Require Config Sync drift prevention to
# prevent config drift.
requireDriftPrevention: <boolean>
# requireRootSync <boolean>: Require a Config Sync `RootSync` object for
# cluster config management.
requireRootSync: <boolean>
Vincolo referenziale
Questo vincolo è referenziale. Prima dell'utilizzo, devi abilitare le limitazioni referenziali e creare una configurazione che indichi a Policy Controller quali tipi di oggetti monitorare.
Il tuo Policy Controller Config richiederà una voce syncOnly simile alla seguente:
spec:
sync:
syncOnly:
- group: "configsync.gke.io"
version: "v1beta1"
kind: "RootSync"
Esempi
enforce-config-management
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sEnforceConfigManagement metadata: name: enforce-config-management spec: enforcementAction: dryrun match: kinds: - apiGroups: - configmanagement.gke.io kinds: - ConfigManagement
Consentito
apiVersion: configmanagement.gke.io/v1 kind: ConfigManagement metadata: annotations: configmanagement.gke.io/managed-by-hub: "true" configmanagement.gke.io/update-time: "1663586155" name: config-management spec: binauthz: enabled: true clusterName: tec6ea817b5b4bb2-cluster enableMultiRepo: true git: proxy: {} syncRepo: git@test-git-server.config-management-system-test:/git-server/repos/sot.git hierarchyController: {} policyController: auditIntervalSeconds: 60 enabled: true monitoring: backends: - prometheus - cloudmonitoring mutation: {} referentialRulesEnabled: true templateLibraryInstalled: true status: configManagementVersion: v1.12.2-rc.2 healthy: true
Operazione non consentita
apiVersion: configmanagement.gke.io/v1 kind: ConfigManagement metadata: annotations: configmanagement.gke.io/managed-by-hub: "true" configmanagement.gke.io/update-time: "1663586155" name: config-management spec: binauthz: enabled: true clusterName: tec6ea817b5b4bb2-cluster enableMultiRepo: true git: syncRepo: git@test-git-server.config-management-system-test:/git-server/repos/sot.git hierarchyController: {} policyController: auditIntervalSeconds: 60 enabled: true monitoring: backends: - prometheus - cloudmonitoring mutation: {} referentialRulesEnabled: true templateLibraryInstalled: true status: configManagementVersion: v1.12.2-rc.2
K8sExternalIPs
Indirizzi IP esterni v1.0.0
Limita gli indirizzi IP esterni del servizio a un elenco consentito di indirizzi IP. https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sExternalIPs
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# allowedIPs <array>: An allow-list of external IP addresses.
allowedIPs:
- <string>
Esempi
external-ips
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sExternalIPs metadata: name: external-ips spec: match: kinds: - apiGroups: - "" kinds: - Service parameters: allowedIPs: - 203.0.113.0
Consentito
apiVersion: v1 kind: Service metadata: name: allowed-external-ip spec: externalIPs: - 203.0.113.0 ports: - name: http port: 80 protocol: TCP targetPort: 8080 selector: app: MyApp
Operazione non consentita
apiVersion: v1 kind: Service metadata: name: disallowed-external-ip spec: externalIPs: - 1.1.1.1 ports: - name: http port: 80 protocol: TCP targetPort: 8080 selector: app: MyApp
K8sHorizontalPodAutoscaler
Horizontal Pod Autoscaler v1.0.1
Non consentire i seguenti scenari durante il deployment di HorizontalPodAutoscalers 1. Deployment di HorizontalPodAutoscaler con .spec.minReplicas o .spec.maxReplicas al di fuori degli intervalli definiti nel vincolo 2. Deployment di HorizontalPodAutoscaler in cui la differenza tra .spec.minReplicas e .spec.maxReplicas è inferiore al valore minimumReplicaSpread 3 configurato. Deployment di HorizontalPodAutoscaler che non fanno riferimento a un scaleTargetRef valido (ad es. Deployment, ReplicationController, ReplicaSet, StatefulSet).
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sHorizontalPodAutoscaler
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# enforceScaleTargetRef <boolean>: If set to true it validates the HPA
# scaleTargetRef exists
enforceScaleTargetRef: <boolean>
# minimumReplicaSpread <integer>: If configured it enforces the minReplicas
# and maxReplicas in an HPA must have a spread of at least this many
# replicas
minimumReplicaSpread: <integer>
# ranges <array>: Allowed ranges for numbers of replicas. Values are
# inclusive.
ranges:
# <list item: object>: A range of allowed replicas. Values are
# inclusive.
- # max_replicas <integer>: The maximum number of replicas allowed,
# inclusive.
max_replicas: <integer>
# min_replicas <integer>: The minimum number of replicas allowed,
# inclusive.
min_replicas: <integer>
Vincolo referenziale
Questo vincolo è referenziale. Prima dell'uso, devi abilitare i vincoli referenziali e creare una configurazione che indichi a Policy Controller quali tipi di oggetti monitorare.
Il tuo Policy Controller Config richiederà una voce syncOnly simile alla seguente:
spec:
sync:
syncOnly:
- group: "apps"
version: "v1"
kind: "Deployment"
OR
- group: "apps"
version: "v1"
kind: "StatefulSet"
Esempi
horizontal-pod-autoscaler
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sHorizontalPodAutoscaler metadata: name: horizontal-pod-autoscaler spec: enforcementAction: deny match: kinds: - apiGroups: - autoscaling kinds: - HorizontalPodAutoscaler parameters: enforceScaleTargetRef: true minimumReplicaSpread: 1 ranges: - max_replicas: 6 min_replicas: 3
Consentito
apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: nginx-hpa-allowed namespace: default spec: maxReplicas: 6 metrics: - resource: name: cpu target: averageUtilization: 900 type: Utilization type: Resource minReplicas: 3 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: nginx-deployment --- # Referential Data apiVersion: apps/v1 kind: Deployment metadata: labels: app: nginx name: nginx-deployment namespace: default spec: replicas: 3 selector: matchLabels: app: nginx example: allowed-deployment template: metadata: labels: app: nginx example: allowed-deployment spec: containers: - image: nginx:1.14.2 name: nginx ports: - containerPort: 80
Operazione non consentita
apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: nginx-hpa-disallowed-replicas namespace: default spec: maxReplicas: 7 metrics: - resource: name: cpu target: averageUtilization: 900 type: Utilization type: Resource minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: nginx-deployment --- # Referential Data apiVersion: apps/v1 kind: Deployment metadata: labels: app: nginx name: nginx-deployment namespace: default spec: replicas: 3 selector: matchLabels: app: nginx example: allowed-deployment template: metadata: labels: app: nginx example: allowed-deployment spec: containers: - image: nginx:1.14.2 name: nginx ports: - containerPort: 80
apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: nginx-hpa-disallowed-replicaspread namespace: default spec: maxReplicas: 4 metrics: - resource: name: cpu target: averageUtilization: 900 type: Utilization type: Resource minReplicas: 4 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: nginx-deployment --- # Referential Data apiVersion: apps/v1 kind: Deployment metadata: labels: app: nginx name: nginx-deployment namespace: default spec: replicas: 3 selector: matchLabels: app: nginx example: allowed-deployment template: metadata: labels: app: nginx example: allowed-deployment spec: containers: - image: nginx:1.14.2 name: nginx ports: - containerPort: 80
apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: nginx-hpa-disallowed-scaletarget namespace: default spec: maxReplicas: 6 metrics: - resource: name: cpu target: averageUtilization: 900 type: Utilization type: Resource minReplicas: 3 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: nginx-deployment-missing --- # Referential Data apiVersion: apps/v1 kind: Deployment metadata: labels: app: nginx name: nginx-deployment namespace: default spec: replicas: 3 selector: matchLabels: app: nginx example: allowed-deployment template: metadata: labels: app: nginx example: allowed-deployment spec: containers: - image: nginx:1.14.2 name: nginx ports: - containerPort: 80
K8sHttpsOnly
Solo HTTPS v1.0.2
Richiede che le risorse Ingress siano solo HTTPS. Le risorse Ingress devono includere l'annotazione kubernetes.io/ingress.allow-http, impostata su false. Per impostazione predefinita, è richiesta una configurazione TLS {} valida. Può essere resa facoltativa impostando il parametro tlsOptional su true.
https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sHttpsOnly
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# tlsOptional <boolean>: When set to `true` the TLS {} is optional,
# defaults to false.
tlsOptional: <boolean>
Esempi
ingress-https-only
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sHttpsOnly metadata: name: ingress-https-only spec: match: kinds: - apiGroups: - extensions - networking.k8s.io kinds: - Ingress
Consentito
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: kubernetes.io/ingress.allow-http: "false" name: ingress-demo-allowed spec: rules: - host: example-host.example.com http: paths: - backend: service: name: nginx port: number: 80 path: / pathType: Prefix tls: - {}
Operazione non consentita
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ingress-demo-disallowed spec: rules: - host: example-host.example.com http: paths: - backend: service: name: nginx port: number: 80 path: / pathType: Prefix
ingress-https-only-tls-optional
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sHttpsOnly metadata: name: ingress-https-only-tls-optional spec: match: kinds: - apiGroups: - extensions - networking.k8s.io kinds: - Ingress parameters: tlsOptional: true
Consentito
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: kubernetes.io/ingress.allow-http: "false" name: ingress-demo-allowed-tls-optional spec: rules: - host: example-host.example.com http: paths: - backend: service: name: nginx port: number: 80 path: / pathType: Prefix
Operazione non consentita
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ingress-demo-disallowed-tls-optional spec: rules: - host: example-host.example.com http: paths: - backend: service: name: nginx port: number: 80 path: / pathType: Prefix
K8sImageDigests
Digest delle immagini v1.0.1
Richiede che le immagini container contengano un digest. https://kubernetes.io/docs/concepts/containers/images/
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sImageDigests
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptImages <array>: Any container that uses an image that matches an
# entry in this list will be excluded from enforcement. Prefix-matching can
# be signified with `*`. For example: `my-image-*`. It is recommended that
# users use the fully-qualified Docker image name (e.g. start with a domain
# name) in order to avoid unexpectedly exempting images from an untrusted
# repository.
exemptImages:
- <string>
Esempi
container-image-must-have-digest
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sImageDigests metadata: name: container-image-must-have-digest spec: match: kinds: - apiGroups: - "" kinds: - Pod namespaces: - default
Consentito
apiVersion: v1 kind: Pod metadata: name: opa-allowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2@sha256:04ff8fce2afd1a3bc26260348e5b290e8d945b1fad4b4c16d22834c2f3a1814a name: opa
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa initContainers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opainit
apiVersion: v1 kind: Pod metadata: name: opa-disallowed spec: containers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa ephemeralContainers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opa initContainers: - args: - run - --server - --addr=localhost:8080 image: openpolicyagent/opa:0.9.2 name: opainit
K8sLocalStorageRequireSafeToEvict
L'archiviazione locale richiede la rimozione di dati sicuri v1.0.1
Richiede che i pod che utilizzano lo spazio di archiviazione locale (emptyDir o hostPath) abbiano l'annotazione "cluster-autoscaler.kubernetes.io/safe-to-evict": "true". Il gestore della scalabilità automatica dei cluster non eliminerà i pod senza questa annotazione.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sLocalStorageRequireSafeToEvict
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
local-storage-require-safe-to-evict
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sLocalStorageRequireSafeToEvict metadata: name: local-storage-require-safe-to-evict spec: match: excludedNamespaces: - kube-system - istio-system - gatekeeper-system
Consentito
apiVersion: v1 kind: Pod metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" name: good-pod namespace: default spec: containers: - image: redis name: redis volumeMounts: - mountPath: /data/redis name: redis-storage volumes: - emptyDir: {} name: redis-storage
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: bad-pod namespace: default spec: containers: - image: redis name: redis volumeMounts: - mountPath: /data/redis name: redis-storage volumes: - emptyDir: {} name: redis-storage
K8sMemoryRequestEqualsLimit
Richiesta di memoria uguale a limite v1.0.4
Promuove la stabilità del pod richiedendo che la memoria richiesta di tutti i container corrisponda esattamente al limite di memoria, in modo che i pod non siano mai in uno stato in cui l'utilizzo della memoria superi la quantità richiesta. Altrimenti, Kubernetes può terminare i pod che richiedono memoria aggiuntiva se è necessaria memoria sul nodo.
Schema del vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sMemoryRequestEqualsLimit
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# exemptContainersRegex <array>: Exempt Container names as regex match.
exemptContainersRegex:
- <string>
Esempi
container-must-request-limit
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sMemoryRequestEqualsLimit metadata: name: container-must-request-limit spec: match: excludedNamespaces: - kube-system - resource-group-system - asm-system - istio-system - config-management-system - config-management-monitoring parameters: exemptContainersRegex: - ^istio-[a-z]+$
Consentito
apiVersion: v1 kind: Pod metadata: name: good-pod namespace: default spec: containers: - image: nginx name: nginx resources: limits: cpu: 100m memory: 4Gi requests: cpu: 50m memory: 4Gi
apiVersion: v1 kind: Pod metadata: name: exempt-pod namespace: default spec: containers: - image: auto name: istio-proxy resources: limits: cpu: 100m memory: 4Gi requests: cpu: 50m memory: 2Gi
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: bad-pod namespace: default spec: containers: - image: nginx name: nginx resources: limits: cpu: 100m memory: 4Gi requests: cpu: 50m memory: 2Gi
K8sNoEnvVarSecrets
No Environment Variable Secrets v1.0.1
Proibisce i secret come variabili di ambiente nelle definizioni dei container dei pod. Utilizza invece i file secret montati nei volumi di dati: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoEnvVarSecrets
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
Esempi
no-secrets-as-env-vars-sample
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sNoEnvVarSecrets metadata: name: no-secrets-as-env-vars-sample spec: enforcementAction: dryrun
Consentito
apiVersion: v1 kind: Pod metadata: name: allowed-example spec: containers: - image: redis name: test volumeMounts: - mountPath: /etc/test name: test readOnly: true volumes: - name: test secret: secretName: mysecret
Operazione non consentita
apiVersion: v1 kind: Pod metadata: name: disallowed-example spec: containers: - env: - name: MY_PASSWORD valueFrom: secretKeyRef: key: password name: mysecret image: redis name: test
K8sNoExternalServices
Nessun servizio esterno v1.0.3
Proibisce la creazione di risorse note che espongono i carichi di lavoro a IP esterni. Sono incluse le risorse Istio Gateway e le risorse Kubernetes Ingress. Inoltre, i servizi Kubernetes non sono consentiti, a meno che non soddisfino i seguenti criteri:
Qualsiasi servizio di tipo LoadBalancer in Google Cloud deve avere un'annotazione "networking.gke.io/load-balancer-type": "Internal".
Qualsiasi servizio di tipo LoadBalancer in AWS deve avere un'annotazione service.beta.kubernetes.io/aws-load-balancer-internal: "true.
Qualsiasi "IP esterni" (esterni al cluster) associati al servizio devono essere membri di un intervallo di CIDR interni previsti dal vincolo.
Schema dei vincoli
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoExternalServices
metadata:
name: example
spec:
# match <object>: lets you configure which resources are in scope for this
# constraint. For more information, see the Policy Controller Constraint
# match documentation:
# https://cloud.google.com/anthos-config-management/docs/reference/match
match:
[match schema]
parameters:
# cloudPlatform <string>: The hosting cloud platform. Only `GCP` and `AWS`
# are supported currently.
cloudPlatform: <string>
# internalCIDRs <array>: A list of CIDRs that are only accessible
# internally, for example: `10.3.27.0/24`. Which IP ranges are
# internal-only is determined by the underlying network infrastructure.
internalCIDRs:
- <string>
Esempi
no-external
Vincolo
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sNoExternalServices metadata: name: no-external spec: parameters: internalCIDRs: - 10.0.0.1/32
Consentito
apiVersion: v1 kind: Service metadata: name: good-service namespace: default spec: externalIPs: - 10.0.0.1 ports: - port: 8888 protocol: TCP targetPort: 8888
apiVersion: v1 kind: Service metadata: annotations: networking.gke.io/load-balancer-type: Internal name: allowed-internal-load-balancer namespace: default spec: type: LoadBalancer
Operazione non consentita
apiVersion: v1 kind: Service metadata: name: bad-service namespace: default spec: externalIPs: - 10.0.0.2 ports: