Container Service for Kubernetes:Ikhtisar Pustaka Aturan Kebijakan Keamanan Kontainer

Compliance

Infra

K8s-general

PSP

FinOps

ACKNoEnvVarSecrets

Membatasi pemasangan rahasia sebagai variabel lingkungan di pod aplikasi menggunakan secretKeyRef.

Tingkat keparahan: medium

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKNoEnvVarSecrets
metadata:
  name: no-env-var-secrets
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["test-gatekeeper"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: mypod
  namespace: test-gatekeeper
spec:
  containers:
  - name: mypod
    image: redis
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
  volumes:
  - name: foo
    secret:
      secretName: mysecret
      items:
      - key: username
        path: my-group/my-username

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir: {}

ACKPodsRequireSecurityContext

Mengharuskan semua kontainer dalam pod memiliki field securityContext yang dikonfigurasi.

Tingkat keparahan: rendah

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPodsRequireSecurityContext
metadata:
  name: pods-require-security-context
  annotations:
    description: "Requires that Pods must have a `securityContext` defined."
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["test-gatekeeper"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: test
  namespace: test-gatekeeper
spec:
  securityContext:
    runAsNonRoot: false
  containers:
  - image: test
    name: test
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Never
status: {}

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test

ACKRestrictNamespaces

Membatasi penerapan resource hanya pada namespace tertentu dalam kluster.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKRestrictNamespaces
metadata:
  name: restrict-default-namespace
  annotations:
    description: "Restricts resources from using the restricted namespace."
spec:
  match:
    kinds:
      - apiGroups: ['']
        kinds: ['Pod']
  parameters:
    restrictedNamespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: test
  namespace: non-test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Never
status: {}

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - name: mycontainer
    image: redis
  restartPolicy: Never

ACKRestrictRoleBindings

Membatasi RoleBinding dalam namespace tertentu hanya pada kumpulan peran atau ClusterRole tertentu.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKRestrictRoleBindings
metadata:
  name: restrict-clusteradmin-rolebindings
  annotations:
    description: "Restricts use of sensitive role in specific rolebinding."
spec:
  match:
    kinds:
      - apiGroups: ["rbac.authorization.k8s.io"]
        kinds: ["RoleBinding"]
  parameters:
    restrictedRole:
      apiGroup: "rbac.authorization.k8s.io"
      kind: "ClusterRole"
      name: "cluster-admin"
    allowedSubjects:
      - apiGroup: "rbac.authorization.k8s.io"
        kind: "Group"
        name: "system:masters"

Diizinkan:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: good-2
  namespace: test-gatekeeper
subjects:
  - kind: Group
    name: 'system:masters'
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

Dilarang:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: bad-1
  namespace: test-gatekeeper
subjects:
  - kind: ServiceAccount
    name: policy-template-controller
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

ACKNamespacesDeleteProtection

Mencegah penghapusan namespace tertentu secara tidak sengaja. Gunakan parameter protectionNamespaces untuk mengonfigurasi namespace yang dilindungi.

Tingkat keparahan: medium

Prasyarat: Komponen Gatekeeper v3.10.0.130-g0e79597d-aliyun atau lebih baru. Untuk informasi versi, lihat Gatekeeper.

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKNamespacesDeleteProtection
metadata:
  name: namespace-delete-protection
spec:
  match:
    kinds:
      - apiGroups: ['']
        kinds: ['Namespace']
  parameters:
    protectionNamespaces:
      - test-gatekeeper

Diizinkan:

apiVersion: v1
kind: Namespace
metadata:
  name: will-delete

Dilarang:

apiVersion: v1
kind: Namespace
metadata:
  name: test-gatekeeper

ACKServicesDeleteProtection

Mencegah penghapusan instans Service dalam namespace tertentu secara tidak sengaja. Gunakan parameter protectionServices untuk mengonfigurasi instans Service yang dilindungi.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKServicesDeleteProtection
metadata:
  name: service-delete-protection
  annotations:
    description: "Protect to delete specific service."
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ['']
        kinds: ['Service']
    namespaces: ["test-gatekeeper"]
  parameters:
    protectionServices:
      - test-svc

Diizinkan:

apiVersion: v1
kind: Service
metadata:
  name: good
  namespace: test-gatekeeper

Dilarang:

apiVersion: v1
kind: Service
metadata:
  name: test-svc

ACKProtectBoundingPV

Mencegah penghapusan volume persisten (PV) yang terikat pada klaim volume persisten (PVC) dalam kluster.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKProtectBoundingPV
metadata:
  name: protect-pv-deletion
spec:
  enforcementAction: deny
  match:
    kinds:
    - apiGroups:
      - ""
      kinds:
      - PersistentVolume

Diizinkan:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: test-pv-bound-should-be-blocked
spec:
  accessModes:
  - ReadWriteOnce
  capacity:
    storage: 1Gi
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual-sc
  hostPath:
    path: /tmp/data
    type: DirectoryOrCreate
status:
  phase: Released

Dilarang:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: test-pv-bound-should-be-blocked
spec:
  accessModes:
  - ReadWriteOnce
  capacity:
    storage: 1Gi
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual-sc
  hostPath:
    path: /tmp/data
    type: DirectoryOrCreate
status:
  phase: Bound

ACKBlockNodeDelete

Mencegah penghapusan node yang memiliki tag kustom dalam kluster. Sebuah node dilindungi jika cocok dengan salah satu pasangan kunci-nilai yang ditentukan. Beberapa pasangan dapat didefinisikan.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockNodeDelete
metadata:
  name: block-node-delete
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ["*"]
        kinds: ["Node"]
  parameters:
    protectedLabels:
    - labelName: policy.alibabacloud.vpc.com/node-delete-protection
      labelValue: "true"
    - labelName: policy.alibabacloud.com/node-delete-protection
      labelValue: "true"

Diizinkan:

apiVersion: v1
kind: Node
metadata:
  name: cn-hangzhou-1

Dilarang:

apiVersion: v1
kind: Node
metadata:
  labels:
    policy.alibabacloud.vpc.com/node-delete-protection: "true"
  name: cn-hangzhou-1
---
apiVersion: v1
kind: Node
metadata:
  labels:
    policy.alibabacloud.vpc.com/node-delete-protection: "true"
  name: cn-hangzhou-2
---
apiVersion: v1
kind: Node
metadata:
  labels:
    policy.alibabacloud.com/node-delete-protection: "true"
    policy.alibabacloud.vpc.com/node-delete-protection: "true"
  name: cn-hangzhou-3

ACKResourceDeletionProtection

Mencegah penghapusan resource yang memiliki tag kustom dalam kluster. Jenis resource yang didukung: Service, Namespace, Ingress, Deployment, StatefulSet, DaemonSet, Job, dan CronJob. Sebuah resource dilindungi jika cocok dengan salah satu pasangan kunci-nilai yang ditentukan. Beberapa pasangan dapat didefinisikan.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKResourceDeletionProtection
metadata:
  name: resource-deletion-protection
  annotations:
    description: "Protect resources from being accidentally deleted."
spec:
  enforcementAction: deny
  match:
    kinds:
    - apiGroups:
      - ""
      kinds:
      - Service
      - Namespace
    - apiGroups:
      - extensions
      - networking.k8s.io
      kinds:
      - Ingress
    - apiGroups:
      - apps
      kinds:
      - Deployment
      - StatefulSet
      - DaemonSet
    - apiGroups:
      - batch
      kinds:
      - Job
      - CronJob
  parameters:
    labels:
    - labelName: policy.alibabacloud.com/delete-protection
      labelValue: "true"

Diizinkan:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-deployment
  namespace: test-gatekeeper
spec:
  replicas: 2
  selector:
    matchLabels:
      app: test-app
  template:
    metadata:
      labels:
        app: test-app
    spec:
      containers:
        - name: nginx
          image: nginx:latest
          ports:
            - containerPort: 80

Dilarang:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-deployment
  namespace: test-gatekeeper
  labels:
    policy.alibabacloud.com/delete-protection: "true"
spec:
  replicas: 2
  selector:
    matchLabels:
      app: test-app
  template:
    metadata:
      labels:
        app: test-app
    spec:
      containers:
        - name: nginx
          image: nginx:latest
          ports:
            - containerPort: 80

ACKProtectCoreDNS

Mencegah penghapusan resource terkait CoreDNS dalam namespace kube-system, termasuk Deployment, Service, dan ConfigMap terkait.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKProtectCoreDNS
metadata:
  name: coredns-protect-rule
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ["*"]
        kinds: ["Deployment", "Service", "Scale", "ConfigMap"]
    scope: "Namespaced"
    namespaces: ["kube-system"]
  parameters:
    min_replicas: 2

Diizinkan:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coredns
  namespace: kube-system
spec:
  replicas: 3
  selector:
    matchLabels:
      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
    spec:
      containers:
        - name: coredns
          image: registry-cn-hangzhou-vpc.ack.aliyuncs.com/acs/coredns:latest
          imagePullPolicy: IfNotPresent

Dilarang:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coredns
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
    spec:
      containers:
        - name: coredns
          image: registry-cn-hangzhou-vpc.ack.aliyuncs.com/acs/coredns:latest
          imagePullPolicy: IfNotPresent
---
apiVersion: v1
data:
  Corefile: ""
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: kube-dns
    kubernetes.io/cluster-service: "true"
    kubernetes.io/name: KubeDNS
  name: kube-dns
  namespace: kube-system

ACKBlockCrdDeletion

Mencegah penghapusan CustomResourceDefinitions (CRD) yang masih memiliki resource kustom (CR) terkait.

Tingkat keparahan: medium

Parameter: Tidak ada

Prasyarat: Sebelum menerapkan kebijakan ini, instal dan konfigurasikan ack-policy-external-provider.

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockCrdDeletion
metadata:
  name: block-crd-deletion
spec:
  enforcementAction: deny
  match:
    kinds:
    - apiGroups:
      - '*'
      kinds:
      - CustomResourceDefinition

ACKBlockProcessNamespaceSharing

Membatasi penggunaan shareProcessNamespace dalam aplikasi yang diterapkan dalam cakupan tertentu di kluster.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockProcessNamespaceSharing
metadata:
  name: block-share-process-namespace
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["test-gatekeeper"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: test-3
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Never
status: {}

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  shareProcessNamespace: true
  containers:
  - image: test
    name: test
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Never
status: {}

ACKEmptyDirHasSizeLimit

Mengharuskan volume emptyDir menentukan sizeLimit.

Tingkat keparahan: rendah

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKEmptyDirHasSizeLimit
metadata:
  name: empty-dir-has-sizelimit
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["test-gatekeeper"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: test-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir:
      sizeLimit: "10Mi"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir: {}

ACKLocalStorageRequireSafeToEvict

Mengharuskan pod yang diterapkan dalam cakupan tertentu memiliki anotasi "cluster-autoscaler.kubernetes.io/safe-to-evict": "true". Selama autoscaling, autoscaler kluster tidak mengeluarkan (evict) pod yang tidak memiliki anotasi ini.

Tingkat keparahan: rendah

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKLocalStorageRequireSafeToEvict
metadata:
  name: local-storage-require-safe-to-evict
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["test-gatekeeper"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: test-1
  namespace: test-gatekeeper
  annotations:
    'cluster-autoscaler.kubernetes.io/safe-to-evict': 'true'
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /test-pd
      name: test-volume
  volumes:
  - name: test-volume
    hostPath:
      path: /data
      type: Directory

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir: {}

ACKOSSStorageLocationConstraint

Membatasi penerapan dalam namespace tertentu agar hanya menggunakan volume persisten (PV) Alibaba Cloud Object Storage Service (OSS) dari wilayah tertentu.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKOSSStorageLocationConstraint
metadata:
  name: restrict-oss-location
  annotations:
    description: "Restricts location of oss storage in cluster."
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["PersistentVolume", "Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    mode: "allowlist"
    regions:
      - "cn-beijing"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-oss-csi-good
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test
  volumes:
    - name: test
      csi:
        driver: ossplugin.csi.alibabacloud.com
        volumeAttributes:
          bucket: "oss"
          url: "oss-cn-beijing.aliyuncs.com"
          otherOpts: "-o max_stat_cache_size=0 -o allow_other"
          path: "/"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: pod-oss-csi
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: nginx:latest
  volumes:
    - name: test
      csi:
        driver: ossplugin.csi.alibabacloud.com
        nodePublishSecretRef:
          name: oss-secret
        volumeAttributes:
          bucket: "oss"
          url: "oss-cn-hangzhou.aliyuncs.com"
          otherOpts: "-o max_stat_cache_size=0 -o allow_other"
          path: "/"

ACKPVSizeConstraint

Membatasi kapasitas disk maksimum yang dapat diminta untuk instans PV yang dibuat dalam kluster.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPVSizeConstraint
metadata:
  name: limit-pv-size
  annotations:
    description: "Limit the pv storage capacity size within a specified maximum amount."
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["PersistentVolume"]
  parameters:
    maxSize: "50Gi"

Diizinkan:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-oss-csi
  labels:
    alicloud-pvname: pv-oss
spec:
  capacity:
    storage: 25Gi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  csi:
    driver: ossplugin.csi.alibabacloud.com
    volumeHandle: pv-oss
    nodePublishSecretRef:
      name: oss-secret
      namespace: default
    volumeAttributes:
      bucket: "oss"
      url: "oss-cn-beijing.aliyuncs.com"
      otherOpts: "-o max_stat_cache_size=0 -o allow_other"
      path: "/"

Dilarang:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-oss-csi-bad
  labels:
    alicloud-pvname: pv-oss
spec:
  capacity:
    storage: 500Gi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  csi:
    driver: ossplugin.csi.alibabacloud.com
    volumeHandle: pv-oss
    nodePublishSecretRef:
      name: oss-secret
      namespace: default
    volumeAttributes:
      bucket: "oss"
      url: "oss-cn-beijing.aliyuncs.com"
      otherOpts: "-o max_stat_cache_size=0 -o allow_other"
      path: "/"

ACKPVCConstraint

Membatasi penerapan instans klaim volume persisten (PVC) hanya pada daftar putih namespace dan membatasi kapasitas disk maksimum yang dapat diminta.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPVCConstraint
metadata:
  name: limit-pvc-size-and-ns
  annotations:
    description: "Limit the maximum pvc storage capacity size and the namespace whitelists that can be deployed."
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["PersistentVolumeClaim"]
  parameters:
    maxSize: "50Gi"
    allowNamespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: disk-pvc
  namespace: test-gatekeeper
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi

Dilarang:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: bad-disk-pvc
  namespace: test-gatekeeper
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 200Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: bad-namespace-pvc
  namespace: test-gatekeeper-bad
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi

ACKBlockVolumeTypes

Menolak jenis pemasangan volume tertentu untuk pod yang diterapkan dalam cakupan tertentu di kluster.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockVolumeTypes
metadata:
  name: block-volume-types
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["test-gatekeeper"]
  parameters:
    volumes:
      - "gitRepo"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: use-empty-dir
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test
  volumes:
  - name: emptydir-volume
    emptyDir: {}

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: use-git-repo
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test
  volumes:
  - name: git-volume
    gitRepo:
      repository: "git@***:***/my-git-repository.git"
      revision: "22f1d8406d464b0c08***"

ASMSidecarInjectionEnforced

Mengharuskan pod memiliki sidecar Alibaba Cloud Service Mesh (ASM) yang disuntikkan.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ASMSidecarInjectionEnforced
metadata:
  name: asm-sidecar-injectionen-forced
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["test-gatekeeper"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: sidecar-injection
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test
    - name: istio-proxy
      image: xxx/proxyv2:xxx

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: sidecar-injection
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test

ACKAllowedRepos

Mengharuskan pod aplikasi yang diterapkan dalam cakupan tertentu hanya menarik gambar dari repositori yang diizinkan.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKAllowedRepos
metadata:
  name: allowed-repos
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    repos:
      - "registry-vpc.cn-hangzhou.aliyuncs.com/acs/"
      - "registry.cn-hangzhou.aliyuncs.com/acs/"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-01
  namespace: test-gatekeeper
spec:
  containers:
  - image: registry.cn-hangzhou.aliyuncs.com/acs/test-webserver
    name: test-container-1
  initContainers:
  - image: registry.cn-hangzhou.aliyuncs.com/acs/test-webserver
    name: test-container

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
  initContainers:
  - image: k8s.gcr.io/test-webserver
    name: test-container-3

ACKBlockAutoinjectServiceEnv

Mengharuskan aplikasi menyetel enableServiceLinks: false untuk mencegah alamat IP layanan diekspos sebagai variabel lingkungan pod.

Tingkat keparahan: rendah

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockAutoinjectServiceEnv
metadata:
  name: block-auto-inject-service-env
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  enableServiceLinks: false
  containers:
  - image: openpolicyagent/test-webserver:1.0
    name: test-container

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container

ACKBlockAutomountToken

Mengharuskan aplikasi menyetel automountServiceAccountToken: false untuk mencegah pemasangan otomatis token ServiceAccount.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockAutomountToken
metadata:
  name: block-auto-mount-service-account-token
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  automountServiceAccountToken: false
  containers:
  - image: openpolicyagent/test-webserver:v1.0
    name: test-container

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
  initContainers:
  - image: k8s.gcr.io/test-webserver
    name: test-container2

ACKBlockEphemeralContainer

Mencegah kontainer sementara (ephemeral containers) dimulai dalam pod aplikasi dalam cakupan tertentu.

Tingkat keparahan: medium

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockEphemeralContainer
metadata:
  name: block-ephemeral-container
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: hello-pod
  namespace: test-gatekeeper
spec:
  containers:
  - name: hello-pod
    image: redis

Dilarang:

Jalankan kontainer sementara dalam pod yang sudah ada:

kubectl debug -it hello-pod -n test-gatekeeper --image=test --target=hello-pod

Output yang diharapkan:

Error from server (Forbidden): admission webhook "validation.gatekeeper.sh" denied the request: [block-ephemeral-container-w5c6n] Creating ephemeral containers is disallowed, pod: hello-pod

ACKBlockLoadBalancer

Mencegah penerapan Service bertipe LoadBalancer dalam cakupan tertentu di kluster.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockLoadBalancer
metadata:
  name: block-load-balancer
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Service"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Service
metadata:
  name: my-service-1
  namespace: test-gatekeeper
spec:
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376

Dilarang:

apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: test-gatekeeper
spec:
  type: LoadBalancer
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376

ACKBlockNodePort

Mencegah Service bertipe NodePort dalam cakupan tertentu di kluster.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockNodePort
metadata:
  name: block-node-port
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Service"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Service
metadata:
  name: my-service-1
  namespace: test-gatekeeper
spec:
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376

Dilarang:

apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: test-gatekeeper
spec:
  type: NodePort
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376

ACKContainerLimits

Mengharuskan pod aplikasi dalam cakupan tertentu memiliki limits resource yang dikonfigurasi.

Tingkat keparahan: rendah

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKContainerLimits
metadata:
  name: container-must-have-limits
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    cpu: "1000m"
    memory: "1Gi"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: openpolicyagent/test-webserver
    name: test-container
    resources:
      limits:
        memory: "100Mi"
        cpu: "500m"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: pod-2
  namespace: non-test-gatekeeper
spec:
  containers:
  - image: openpolicyagent/test-webserver
    name: test-container
    resources:
      limits:
        memory: "100Gi"
        cpu: "2000m"

ACKExternalIPs

Mengharuskan instans Service dalam cakupan tertentu hanya menggunakan externalIPs dari daftar putih.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKExternalIPs
metadata:
  name: external-ips
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Service"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    allowedIPs:
      - "192.168.0.5"

Diizinkan:

apiVersion: v1
kind: Service
metadata:
  name: my-service-3
  namespace: test-gatekeeper
spec:
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376

Dilarang:

apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: test-gatekeeper
spec:
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376
  externalIPs:
    - 80.11.XX.XX

ACKImageDigests

Mengharuskan gambar yang diterapkan dalam cakupan tertentu menggunakan format digest.

Tingkat keparahan: rendah

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKImageDigests
metadata:
  name: container-image-must-have-digest
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
    - image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
      name: test-container
      resources:
        requests:
          cpu: 10m
          memory: 512Mi
        limits:
          cpu: "1"
          memory: 1Gi

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
  initContainers:
  - image: k8s.gcr.io/test-webserver
    name: test-container2

ACKRequiredLabels

Memverifikasi bahwa pod berisi label tertentu dan nilai label sesuai dengan format yang ditentukan. Gunakan ekspresi reguler untuk memvalidasi setiap nilai label. Parameter optional mengontrol apakah label tersebut wajib.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKRequiredLabels
metadata:
  name: must-have-label-test
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    labels:
      - key: test
        allowedRegex: "^test.*$"
      - key: env
        allowedRegex: "^(dev|prod)$"
        optional: true

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  name: test
  namespace: test-gatekeeper
  labels:
    'test': 'test_233'
spec:
  containers:
  - name: mycontainer
    image: redis

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  name: bad2
  namespace: test-gatekeeper
  labels:
    'test': '233'
    'env': 'invalid'
spec:
  containers:
  - name: mycontainer
    image: redis

ACKRequiredProbes

Mengharuskan pod yang diterapkan dalam cakupan tertentu memiliki readinessProbe dan livenessProbe yang dikonfigurasi.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKRequiredProbes
metadata:
  name: must-have-probes
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    probes: ["readinessProbe", "livenessProbe"]
    probeTypes: ["tcpSocket", "httpGet", "exec"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: p4
  namespace: test-gatekeeper
spec:
  containers:
  - name: liveness
    image: k8s.gcr.io/busybox
    readinessProbe:
      exec:
        command:
          - cat
          - /tmp/healthy
      initialDelaySeconds: 5
      periodSeconds: 5
    livenessProbe:
      exec:
        command:
          - cat
          - /tmp/healthy
      initialDelaySeconds: 5
      periodSeconds: 5

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: p1
  namespace: test-gatekeeper
spec:
  containers:
  - name: liveness
    image: k8s.gcr.io/busybox

ACKCheckNginxPath

Mencegah konfigurasi berbahaya dalam field spec.rules[].http.paths[].path instans Ingress. Aktifkan kebijakan ini untuk versi Ingress-nginx sebelum 1.2.1.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKCheckNginxPath
metadata:
  name: block-nginx-path
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ["extensions", "networking.k8s.io"]
        kinds: ["Ingress"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: good-paths
  namespace: test-gatekeeper
spec:
  rules:
    - host: cafe.example.com
      http:
        paths:
          - path: /tea
            pathType: Prefix
            backend:
              service:
                name: tea-svc
                port:
                  number: 80
          - path: /coffee
            pathType: Prefix
            backend:
              service:
                name: coffee-svc
                port:
                  number: 80

Dilarang:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bad-path-secrets
  namespace: test-gatekeeper
spec:
  rules:
    - host: cafe.example.com
      http:
        paths:
          - path: /var/run/secrets
            pathType: Prefix
            backend:
              service:
                name: tea-svc
                port:
                  number: 80

ACKCheckNginxAnnotation

Mencegah konfigurasi berbahaya dalam field metadata.annotations instans Ingress. Aktifkan kebijakan ini untuk versi Ingress-nginx sebelum 1.2.1.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKCheckNginxAnnotation
metadata:
  name: block-nginx-annotation
spec:
  match:
    kinds:
      - apiGroups: ["extensions", "networking.k8s.io"]
        kinds: ["Ingress"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: good-annotations
  namespace: test-gatekeeper
  annotations:
    nginx.org/good: "value"
spec:
  rules:
    - host: cafe.example.com
      http:
        paths:
          - path: /tea
            pathType: Prefix
            backend:
              service:
                name: tea-svc
                port:
                  number: 80
          - path: /coffee
            pathType: Prefix
            backend:
              service:
                name: coffee-svc
                port:
                  number: 80

Dilarang:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: var-run-secrets
  namespace: test-gatekeeper
  annotations:
    nginx.org/bad: "/var/run/secrets"
spec:
  rules:
    - host: cafe.example.com
      http:
        paths:
          - path: /tea
            pathType: Prefix
            backend:
              service:
                name: tea-svc
                port:
                  number: 80
          - path: /coffee
            pathType: Prefix
            backend:
              service:
                name: coffee-svc
                port:
                  number: 80

ACKBlockInternetLoadBalancer

Mencegah pembuatan Service LoadBalancer yang menghadap internet.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKBlockInternetLoadBalancer
metadata:
  name: block-internet-load-balancer
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Service"]
    namespaces: ["test-gatekeeper"]

Diizinkan:

apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: non-test-gatekeeper
  annotations:
    'service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type': 'intranet'
spec:
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376
  type: LoadBalancer

Dilarang:

apiVersion: v1
kind: Service
metadata:
  name: bad-service-2
  namespace: test-gatekeeper
  annotations:
    'service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type': 'internet'
spec:
  type: LoadBalancer
  selector:
    app: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376

RatifyVerification

Setelah menginstal komponen Ratify dari pasar, gunakan kebijakan ini untuk memverifikasi metadata keamanan — seperti signature atau bill of materials (BOM) — untuk gambar pod yang diterapkan dalam cakupan tertentu.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: RatifyVerification
metadata:
  name: ratify-constraint
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["default"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: registry.cn-hangzhou.aliyuncs.com/acs/signed   # Terapkan gambar dengan signature yang valid.
    name: test-container

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: registry.cn-hangzhou.aliyuncs.com/acs/unsigned   # Terapkan gambar yang tidak valid karena gagal verifikasi signature Ratify.
    name: test-container

ACKPSPAllowedUsers

Membatasi user, group, supplementalGroups, dan fsGroup yang dapat dijalankan oleh pod dalam cakupan tertentu.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPAllowedUsers
metadata:
  name: psp-pods-allowed-user-ranges
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    runAsUser:
      rule: MustRunAs # MustRunAsNonRoot # RunAsAny
      ranges:
        - min: 100
          max: 200
    runAsGroup:
      rule: MustRunAs # MayRunAs # RunAsAny
      ranges:
        - min: 100
          max: 200
    supplementalGroups:
      rule: MustRunAs # MayRunAs # RunAsAny
      ranges:
        - min: 100
          max: 200
    fsGroup:
      rule: MustRunAs # MayRunAs # RunAsAny
      ranges:
        - min: 100
          max: 200

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good2
  namespace: test-gatekeeper
spec:
  securityContext:
    fsGroup: 150
    supplementalGroups:
      - 150
  containers:
  - image: test
    name: test
    securityContext:
      runAsUser: 150
      runAsGroup: 150

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test

ACKPSPAllowPrivilegeEscalationContainer

Membatasi konfigurasi allowPrivilegeEscalation untuk pod yang diterapkan dalam cakupan tertentu.

Tingkat keparahan: medium

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPAllowPrivilegeEscalationContainer
metadata:
  name: psp-allow-privilege-escalation-container
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      allowPrivilegeEscalation: false
  initContainers:
    - image: test
      name: test2
      securityContext:
        allowPrivilegeEscalation: false

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test

ACKPSPAppArmor

Membatasi konfigurasi AppArmor untuk pod yang diterapkan dalam cakupan tertentu.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPAppArmor
metadata:
  name: psp-apparmor
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    allowedProfiles:
      - runtime/default

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good
  namespace: test-gatekeeper
  annotations:
    'container.apparmor.security.beta.kubernetes.io/test': 'runtime/default'
    'container.apparmor.security.beta.kubernetes.io/test2': 'runtime/default'
spec:
  containers:
  - image: test
    name: test
  initContainers:
  - image: test
    name: test2

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test

ACKPSPCapabilities

Membatasi konfigurasi kemampuan Linux untuk pod yang diterapkan dalam cakupan tertentu.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPCapabilities
metadata:
  name: psp-capabilities
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    allowedCapabilities: ["CHOWN"]
    requiredDropCapabilities: ["NET_ADMIN", "SYS_ADMIN", "NET_RAW"]

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good-4
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      capabilities:
        add:
          - CHOWN
        drop:
         - "NET_ADMIN"
         - "SYS_ADMIN"
         - "NET_RAW"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test

ACKPSPFlexVolumes

Membatasi konfigurasi driver FlexVolume untuk pod yang diterapkan dalam cakupan tertentu.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPFlexVolumes
metadata:
  name: psp-flexvolume-drivers
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod", "PersistentVolume"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    allowedFlexVolumes:
      - driver: "alicloud/disk"
      - driver: "alicloud/nas"
      - driver: "alicloud/oss"
      - driver: "alicloud/cpfs"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pv-nas
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test
  volumes:
    - name: test
      flexVolume:
        driver: "alicloud/nas"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: pv-oss-flexvolume
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test
  volumes:
    - name: test
      flexVolume:
        driver: "alicloud/ossxx"

ACKPSPForbiddenSysctls

Membatasi sysctl yang dapat digunakan oleh pod dalam cakupan tertentu.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPForbiddenSysctls
metadata:
  name: psp-forbidden-sysctls
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    forbiddenSysctls:
      # - "*" # * may be used to forbid all sysctls
      - "kernel.*"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good-2
  namespace: test-gatekeeper
spec:
  securityContext:
    sysctls:
      - name: 'net.ipv4.tcp_syncookies'
        value: "65536"
  containers:
  - image: test
    name: test

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad-1
  namespace: test-gatekeeper
spec:
  securityContext:
    sysctls:
      - name: 'kernel.shm_rmid_forced'
        value: '1024'
  containers:
  - image: test
    name: test

ACKPSPFSGroup

Membatasi konfigurasi fsGroup untuk pod yang diterapkan dalam cakupan tertentu.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPFSGroup
metadata:
  name: psp-fsgroup
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    rule: "MayRunAs" #"MustRunAs" #"MayRunAs", "RunAsAny"
    ranges:
      - min: 1
        max: 1000

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good
  namespace: test-gatekeeper
spec:
  securityContext:
    fsGroup: 100
  containers:
  - image: test
    name: test

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad-1
  namespace: non-test-gatekeeper
spec:
  securityContext:
    fsGroup: 0
  shareProcessNamespace: true
  containers:
  - image: test
    name: test

ACKPSPHostFilesystem

Membatasi path direktori host yang dapat dipasang oleh pod dalam cakupan tertentu.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPHostFilesystem
metadata:
  name: psp-host-filesystem
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    allowedHostPaths:
      - readOnly: true
        pathPrefix: "/foo"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good1
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      readOnlyRootFilesystem: true

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
  volumes:
  - name: test-volume
    hostPath:
      path: /data
      type: File

ACKPSPHostNamespace

Membatasi apakah pod dalam cakupan tertentu dapat berbagi namespace host.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPHostNamespace
metadata:
  name: psp-host-namespace
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Never
status: {}

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  hostPID: true
  containers:
  - image: test
    name: test
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Never
status: {}

ACKPSPHostNetworkingPorts

Membatasi penggunaan jaringan host dan rentang port untuk pod dalam cakupan tertentu.

Tingkat keparahan: tinggi

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPHostNetworkingPorts
metadata:
  name: psp-host-network-ports
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    hostNetwork: true
    min: 80
    max: 9000

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: good-2
  namespace: test-gatekeeper
spec:
  hostNetwork: true
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    ports:
      - hostPort: 80
        containerPort: 80
  initContainers:
    - image: k8s.gcr.io/test-webserver
      name: test-container2
      ports:
        - hostPort: 8080
          containerPort: 8080

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: bad-1
  namespace: non-test-gatekeeper
spec:
  hostNetwork: true
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    ports:
      - hostPort: 22
        containerPort: 22

ACKPSPPrivilegedContainer

Mencegah kontainer istimewa (privileged) dimulai dalam pod yang diterapkan dalam cakupan tertentu.

Tingkat keparahan: tinggi

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPPrivilegedContainer
metadata:
  name: psp-privileged-container
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good1
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      privileged: true
  dnsPolicy: ClusterFirst
  restartPolicy: Never

ACKPSPProcMount

Membatasi tipe proc mount yang diizinkan untuk pod dalam cakupan tertentu. Nilai yang didukung: Default (menyembunyikan /proc) dan Unmasked (tidak menyembunyikan /proc). Untuk informasi lebih lanjut, lihat AllowedProcMountTypes.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPProcMount
metadata:
  name: psp-proc-mount
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    procMount: Default  # Default or Unmasked

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good1
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      procMount: "Default"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad3
  namespace: test-gatekeeper
spec:
  hostUsers: false
  containers:
  - image: test
    name: test
    securityContext:
      procMount: "Unmasked"
  initContainers:
  - image: test
    name: test2

ACKPSPReadOnlyRootFilesystem

Mengharuskan pod dalam cakupan tertentu menggunakan sistem file root read-only.

Tingkat keparahan: medium

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPReadOnlyRootFilesystem
metadata:
  name: psp-readonlyrootfilesystem
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good1
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      readOnlyRootFilesystem: true

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad2
  namespace: non-test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      readOnlyRootFilesystem: false
  initContainers:
  - image: test
    name: test2

ACKPSPSeccomp

Membatasi pod dalam cakupan tertentu agar hanya menggunakan profil Seccomp tertentu.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPSeccomp
metadata:
  name: psp-seccomp
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    allowedProfileTypes:
      # - Unconfined
      - RuntimeDefault
      - Localhost
    allowedProfiles:
      - runtime/default
      - docker/default
      - localhost/profiles/audit.json

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      seccompProfile:
        type: Localhost
        localhostProfile: profiles/audit.json
  initContainers:
  - image: test
    name: test2
    securityContext:
      seccompProfile:
        type: Localhost
        localhostProfile: profiles/audit.json

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test

ACKPSPSELinuxV2

Mengharuskan pod dalam cakupan tertentu menggunakan konfigurasi SELinux yang ditentukan dalam allowedSELinuxOptions. Untuk detail parameter, lihat SELinuxOptions v1 core.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPSELinuxV2
metadata:
  name: psp-selinux-v2
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    allowedSELinuxOptions:
      - level: s0:c123,c456
        role: object_r
        type: svirt_sandbox_file_t
        user: system_u

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: good
  namespace: test-gatekeeper
spec:
  securityContext:
    seLinuxOptions:
      level: "s0:c123,c456"
  containers:
  - image: test
    name: test

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
    securityContext:
      seLinuxOptions:
        level: "s0:c123,c455"

ACKPSPVolumeTypes

Membatasi pod dalam cakupan tertentu agar hanya menggunakan jenis pemasangan volume tertentu.

Tingkat keparahan: medium

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKPSPVolumeTypes
metadata:
  name: psp-volume-types
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    volumes:
      # - "*" # * may be used to allow all volume types
      - configMap
      # - emptyDir
      - projected
      - secret
      - downwardAPI
      - persistentVolumeClaim
      # - hostPath #required for allowedHostPaths
      - flexVolume #required for allowedFlexVolumes

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pv-oss
  namespace: test-gatekeeper
spec:
  containers:
    - name: test
      image: test
  volumes:
    - name: test
      flexVolume:
        driver: "alicloud/oss"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: test
  name: bad-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: test
    name: test
  volumes:
  - name: test-volume
    hostPath:
      path: /data

ACKContainerRequests

Mengharuskan pod aplikasi tertentu dalam kluster mendeklarasikan requests resource.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKContainerRequests
metadata:
  name: container-must-have-requests
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    cpu: "1000m"
    memory: "1Gi"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-1
  namespace: test-gatekeeper
spec:
  containers:
  - image: openpolicyagent/test-webserver
    name: test-container
    resources:
      requests:
        memory: "100Mi"
        cpu: "500m"

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
  - image: openpolicyagent/test-webserver
    name: test-container

ACKContainerResourcesWhitelist

Mengharuskan konfigurasi resource CPU dan memori pod aplikasi tertentu dipilih dari daftar opsi yang telah ditentukan.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKContainerResourcesWhitelist
metadata:
  name: container-resources-whitelist
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    cpuRequests:
      - "100m"
      - "500m"
      - "1"
    cpuLimits:
      - "2"
      - "4000m"
    memoryRequests:
      - "256Mi"
      - "512Mi"
    memoryLimits:
      - "1Gi"
      - "2048Mi"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
    - image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
      name: test-container
      resources:
        requests:
          cpu: 100m
          memory: 512Mi
        limits:
          cpu: "2"
          memory: 1Gi

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
    - image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
      name: test-container
      resources:
        requests:
          cpu: 10m
          memory: 512Mi
        limits:
          cpu: "1"
          memory: 1Gi

ACKContainerResourcesRange

Membatasi konfigurasi resource pod aplikasi tertentu dalam rentang tertentu.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKContainerResourcesRange
metadata:
  name: container-resources-range
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    cpuRequests:
      min: "100m"
      max: "1"
    cpuLimits:
      min: "500m"
      max: "2"
    memoryRequests:
      min: "256Mi"
      max: "512Mi"
    memoryLimits:
      min: "1Gi"
      max: "2048Mi"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
    - image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
      name: test-container
      resources:
        requests:
          cpu: 100m
          memory: 512Mi
        limits:
          cpu: "2"
          memory: 2Gi

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
    - image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
      name: test-container
      resources:
        requests:
          cpu: 10m
          memory: 5Mi
        limits:
          cpu: "3"
          memory: 128Mi

ACKRequiredNodeSelector

Mengharuskan pod aplikasi tertentu dalam kluster memiliki nodeSelector yang dikonfigurasi.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKRequiredNodeSelector
metadata:
  name: must-have-nodeselector
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    nodeSelector:
      - key: "node.alibabacloud.com/nodepool-id"
        allowedRegex: "^np.*$"
      - key: "kubernetes.io/os"
        allowedRegex: "^linux$"

Diizinkan:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
    - image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
      name: test-container
      resources:
        requests:
          cpu: 100m
          memory: 512Mi
        limits:
          cpu: "2"
          memory: 1Gi
  nodeSelector:
    node.alibabacloud.com/nodepool-id: npd37f0e64410c41328a6282dbe5d35cae
    kubernetes.io/os: linux

Dilarang:

apiVersion: v1
kind: Pod
metadata:
  name: pod-0
  namespace: test-gatekeeper
spec:
  containers:
    - image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
      name: test-container
      resources:
        requests:
          cpu: 100m
          memory: 512Mi
        limits:
          cpu: "2"
          memory: 1Gi
  nodeSelector:
    node.alibabacloud.com/nodepool-id: npd37f0e64410c41328a6282dbe5d35cae
    kubernetes.io/os: windows

ACKWorkloadReplicasRange

Membatasi jumlah replika untuk beban kerja dalam rentang tertentu.

Tingkat keparahan: rendah

Parameter:

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKWorkloadReplicasRange
metadata:
  name: replica-limiter
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ["*"]
        kinds: ["Deployment", "StatefulSet", "ReplicaSet", "Scale"]
    namespaces:
      - "test-gatekeeper"
  parameters:
    minReplicas: 2
    maxReplicas: 3

Diizinkan:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-basic
  namespace: test-gatekeeper
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
          ports:
            - containerPort: 80
          resources:
            limits:
              cpu: "500m"

Dilarang:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-basic-0
  namespace: test-gatekeeper
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
          ports:
            - containerPort: 80
          resources:
            limits:
              cpu: "500m"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-basic-1
  namespace: test-gatekeeper
  labels:
    app: nginx
spec:
  replicas: 4
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6
          ports:
            - containerPort: 80
          resources:
            limits:
              cpu: "500m"

ACKRestrictALBCreation

Menegakkan penggunaan ulang instans Application Load Balancer (ALB) yang ada dan melarang pembuatan instans ALB baru melalui AlbConfig.

Tingkat keparahan: rendah

Parameter: Tidak ada

Kendala:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: ACKRestrictALBCreation
metadata:
  name: restrict-alb-creation
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ["alibabacloud.com"]
        kinds: ["AlbConfig"]

Diizinkan:

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: reuse-alb
spec:
  config:
    id: 'abcdefghijklmnopqrstuvwxyz'
    forceOverride: false
    listenerForceOverride: false

Dilarang:

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    name: alb
    addressType: Internet
    zoneMappings:
    - vSwitchId: vsw-uf6ccg2a9g71hx8go****  # Ganti dengan ID vSwitch dari minimal dua vSwitch di zona berbeda dalam VPC tempat kluster berada.
      allocationId: eip-asdfas****          # Ganti dengan ID EIP. Opsi default adalah menetapkan alamat IP publik secara otomatis.
    - vSwitchId: vsw-uf6nun9tql5t8nh15****  # Ganti dengan ID vSwitch dari minimal dua vSwitch di zona berbeda dalam VPC tempat kluster berada.
      allocationId: eip-dpfmss****          # Ganti dengan ID EIP.
  listeners:
    - port: 80
      protocol: HTTP