-
Notifications
You must be signed in to change notification settings - Fork 48
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #492 from kubescape/fix-docker.io
use func image.parse_normalized_name to identify docker images
- Loading branch information
Showing
8 changed files
with
239 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package armo_builtins | ||
|
|
||
| untrustedImageRepo[msga] { | ||
| wl := input[_] | ||
| containers_path := get_containers_path(wl) | ||
| containers := object.get(wl, containers_path, []) | ||
| container := containers[i] | ||
| name := image.parse_normalized_name(container.image) | ||
| not image_in_allowed_list(name) | ||
| path := sprintf("%s[%d].image", [concat(".", containers_path), i]) | ||
|
|
||
| msga := { | ||
| "alertMessage": sprintf("image '%v' in container '%s' comes from untrusted registry", [name, container.name]), | ||
| "packagename": "armo_builtins", | ||
| "alertScore": 2, | ||
| "fixPaths": [], | ||
| "failedPaths": [path], | ||
| "alertObject": {"k8sApiObjects": [wl]}, | ||
| } | ||
| } | ||
|
|
||
| # image_in_allowed_list - rule to check if an image complies with imageRepositoryAllowList. | ||
| image_in_allowed_list(image){ | ||
| # see default-config-inputs.json for list values | ||
| allowedlist := data.postureControlInputs.imageRepositoryAllowList | ||
| registry := allowedlist[_] | ||
| startswith(image, registry) | ||
| } | ||
|
|
||
| # get_containers_path - get resource containers paths for {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"} | ||
| get_containers_path(resource) := result { | ||
| resource_kinds := {"Deployment", "ReplicaSet", "DaemonSet", "StatefulSet", "Job"} | ||
| resource_kinds[resource.kind] | ||
| result = ["spec", "template", "spec", "containers"] | ||
| } | ||
|
|
||
| # get_containers_path - get resource containers paths for "Pod" | ||
| get_containers_path(resource) := result { | ||
| resource.kind == "Pod" | ||
| result = ["spec", "containers"] | ||
| } | ||
|
|
||
| # get_containers_path - get resource containers paths for "CronJob" | ||
| get_containers_path(resource) := result { | ||
| resource.kind == "CronJob" | ||
| result = ["spec", "jobTemplate", "spec", "template", "spec", "containers"] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| { | ||
| "name": "container-image-repository-v1", | ||
| "attributes": { | ||
| "m$K8sThreatMatrix": "Collection::Images from private registry", | ||
| "armoBuiltin": true, | ||
| "useFromKubescapeVersion": "v2.9.0" | ||
| }, | ||
| "ruleLanguage": "Rego", | ||
| "match": [ | ||
| { | ||
| "apiGroups": [ | ||
| "" | ||
| ], | ||
| "apiVersions": [ | ||
| "v1" | ||
| ], | ||
| "resources": [ | ||
| "Pod" | ||
| ] | ||
| }, | ||
| { | ||
| "apiGroups": [ | ||
| "apps" | ||
| ], | ||
| "apiVersions": [ | ||
| "v1" | ||
| ], | ||
| "resources": [ | ||
| "Deployment", | ||
| "ReplicaSet", | ||
| "DaemonSet", | ||
| "StatefulSet" | ||
| ] | ||
| }, | ||
| { | ||
| "apiGroups": [ | ||
| "batch" | ||
| ], | ||
| "apiVersions": [ | ||
| "*" | ||
| ], | ||
| "resources": [ | ||
| "Job", | ||
| "CronJob" | ||
| ] | ||
| } | ||
| ], | ||
| "ruleDependencies": [], | ||
| "configInputs": [ | ||
| "settings.postureControlInputs.imageRepositoryAllowList" | ||
| ], | ||
| "controlConfigInputs": [ | ||
| { | ||
| "path": "settings.postureControlInputs.imageRepositoryAllowList", | ||
| "name": "Allowed image repositories", | ||
| "description": "Kubescape checks that all the containers are using images from the allowed repositories provided in the following list." | ||
| } | ||
| ], | ||
| "description": "Fails if image is not from allowed repository", | ||
| "remediation": "", | ||
| "ruleQuery": "" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
54 changes: 54 additions & 0 deletions
54
rules/rule-identify-blocklisted-image-registries-v1/raw.rego
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| package armo_builtins | ||
|
|
||
| untrustedImageRepo[msga] { | ||
| wl := input[_] | ||
| containers_path := get_containers_path(wl) | ||
| containers := object.get(wl, containers_path, []) | ||
| container := containers[i] | ||
| name := image.parse_normalized_name(container.image) | ||
| untrusted_or_public_registries(name) | ||
| path := sprintf("%s[%d].image", [concat(".", containers_path), i]) | ||
|
|
||
| msga := { | ||
| "alertMessage": sprintf("image '%v' in container '%s' comes from untrusted registry", [name, container.name]), | ||
| "packagename": "armo_builtins", | ||
| "alertScore": 2, | ||
| "fixPaths": [], | ||
| "failedPaths": [path], | ||
| "alertObject": {"k8sApiObjects": [wl]}, | ||
| } | ||
| } | ||
|
|
||
| untrusted_or_public_registries(image){ | ||
| # see default-config-inputs.json for list values | ||
| untrusted_registries := data.postureControlInputs.untrustedRegistries | ||
| registry := untrusted_registries[_] | ||
| startswith(image, registry) | ||
|
|
||
| } | ||
|
|
||
| untrusted_or_public_registries(image){ | ||
| # see default-config-inputs.json for list values | ||
| public_registries := data.postureControlInputs.publicRegistries | ||
| registry := public_registries[_] | ||
| startswith(image, registry) | ||
| } | ||
|
|
||
| # get_containers_path - get resource containers paths for {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"} | ||
| get_containers_path(resource) := result { | ||
| resource_kinds := {"Deployment", "ReplicaSet", "DaemonSet", "StatefulSet", "Job"} | ||
| resource_kinds[resource.kind] | ||
| result = ["spec", "template", "spec", "containers"] | ||
| } | ||
|
|
||
| # get_containers_path - get resource containers paths for "Pod" | ||
| get_containers_path(resource) := result { | ||
| resource.kind == "Pod" | ||
| result = ["spec", "containers"] | ||
| } | ||
|
|
||
| # get_containers_path - get resource containers paths for "CronJob" | ||
| get_containers_path(resource) := result { | ||
| resource.kind == "CronJob" | ||
| result = ["spec", "jobTemplate", "spec", "template", "spec", "containers"] | ||
| } |
68 changes: 68 additions & 0 deletions
68
rules/rule-identify-blocklisted-image-registries-v1/rule.metadata.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| { | ||
| "name": "rule-identify-blocklisted-image-registries-v1", | ||
| "attributes": { | ||
| "m$K8sThreatMatrix": "Initial Access::Compromised images in registry", | ||
| "armoBuiltin": true, | ||
| "useFromKubescapeVersion": "v2.9.0" | ||
| }, | ||
| "ruleLanguage": "Rego", | ||
| "match": [ | ||
| { | ||
| "apiGroups": [ | ||
| "" | ||
| ], | ||
| "apiVersions": [ | ||
| "v1" | ||
| ], | ||
| "resources": [ | ||
| "Pod" | ||
| ] | ||
| }, | ||
| { | ||
| "apiGroups": [ | ||
| "apps" | ||
| ], | ||
| "apiVersions": [ | ||
| "v1" | ||
| ], | ||
| "resources": [ | ||
| "Deployment", | ||
| "ReplicaSet", | ||
| "DaemonSet", | ||
| "StatefulSet" | ||
| ] | ||
| }, | ||
| { | ||
| "apiGroups": [ | ||
| "batch" | ||
| ], | ||
| "apiVersions": [ | ||
| "*" | ||
| ], | ||
| "resources": [ | ||
| "Job", | ||
| "CronJob" | ||
| ] | ||
| } | ||
| ], | ||
| "ruleDependencies": [], | ||
| "configInputs": [ | ||
| "settings.postureControlInputs.publicRegistries", | ||
| "settings.postureControlInputs.untrustedRegistries" | ||
| ], | ||
| "controlConfigInputs": [ | ||
| { | ||
| "path": "settings.postureControlInputs.publicRegistries", | ||
| "name": "Public registries", | ||
| "description": "Kubescape checks none of these public registries are in use." | ||
| }, | ||
| { | ||
| "path": "settings.postureControlInputs.untrustedRegistries", | ||
| "name": "Registries block list", | ||
| "description": "Kubescape checks none of the following registries are in use." | ||
| } | ||
| ], | ||
| "description": "Identifying if pod container images are from unallowed registries", | ||
| "remediation": "Use images from safe registry", | ||
| "ruleQuery": "" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters