kubescape/regolibrary

Add rego rule to check for windows securityContext compliance

Open

#317 opened on Mar 6, 2023

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Open Policy Agent (69 forks)auto 404
enhancementgood first issue

Repository metrics

Stars
 (131 stars)
PR merge metrics
 (PR metrics pending)

Description

In order to support Windows system, we should add rego rules to check for securityContext parameters also for this OS. Reading from the official documentation, we should implement a control for each of the following listed fields: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#windowssecuritycontextoptions-v1-core So, the new checks to be added, are the following:

  • gmsaCredentialSpec
  • gmsaCredentialSpecName
  • hostProcess
  • runAsUserName

The equivalent rules should be named like so:

  • set-gmsacredentialspec-value
  • set-gmsacredentialspecname-value
  • set-hostprocess-true (checking also if WindowsHostProcessContainers feature flag is enabled in api-server)
  • runAsUserName

Contributor guide

Research direction
Study the Kubernetes Windows securityContext API and implement Rego rules for gmsaCredentialSpec, gmsaCredentialSpecName, hostProcess (with feature gate check), and runAsUserName following the naming convention in the issue.
Tech stack
None
Domain
backendsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
RegoKubernetes security context
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65