Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Simplify Restrict sysctls in CEL expressions #1106

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Simplify Restrict sysctls in CEL expressions #1106

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fb850d5
Upgrade the digest value.
lavishpal Aug 2, 2024
2f0c4c5
Update the Artifact hub
lavishpal Aug 2, 2024
e6ba06e
Merge branch 'main' into simplify-cel-sysctls-policy
chipzoller Aug 14, 2024
66f6331
Merge branch 'main' into simplify-cel-sysctls-policy
lavishpal Aug 27, 2024
53cba3c
Merge branch 'main' into simplify-cel-sysctls-policy
realshuting Aug 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions pod-security-cel/baseline/restrict-sysctls/artifacthub-pkg.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,5 +19,8 @@ annotations:
kyverno/category: "Pod Security Standards (Baseline) in CEL"
kyverno/kubernetesVersion: "1.26-1.27"
kyverno/subject: "Pod"
digest: 451731aeba70f3c37f7a58cc1ba47b7fed8ffc8971e4a664c81406004f93b61c
createdAt: "2024-08-21T00:22:33Z"

digest: c9b480f97695316999bec53d4d9ee9b79d726eeb3038b941f64590bf98cb2486
createdAt: "2023-12-03T00:22:33Z"


16 changes: 14 additions & 2 deletions pod-security-cel/baseline/restrict-sysctls/restrict-sysctls.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,20 @@ spec:
expression: "['kernel.shm_rmid_forced','net.ipv4.ip_local_port_range','net.ipv4.ip_unprivileged_port_start','net.ipv4.tcp_syncookies','net.ipv4.ping_group_range']"
expressions:
- expression: >-
object.spec.?securityContext.?sysctls.orValue([]).all(sysctl, sysctl == '' ||
has(sysctl.name) && sysctl.name in variables.allowedSysctls)

!has(object.spec.securityContext) ||
!has(object.spec.securityContext.sysctls) ||
object.spec.securityContext.sysctls.all(sysctl,
!has(sysctl.name) ||
[
'kernel.shm_rmid_forced',
'net.ipv4.ip_local_port_range',
'net.ipv4.ip_unprivileged_port_start',
'net.ipv4.tcp_syncookies',
'net.ipv4.ping_group_range'
].exists(allowedName, allowedName == (sysctl.name)


message: >-
Setting additional sysctls above the allowed type is disallowed.
The field spec.securityContext.sysctls must be unset or not use any other names
Expand Down
Loading