Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add rego rule to check for windows securityContext compliance #317

Open
alegrey91 opened this issue Mar 6, 2023 · 2 comments
Open

Add rego rule to check for windows securityContext compliance #317

alegrey91 opened this issue Mar 6, 2023 · 2 comments
Labels
enhancement New feature or request good first issue Good for newcomers

Comments

@alegrey91
Copy link
Contributor

In order to support Windows system, we should add rego rules to check for securityContext parameters also for this OS.
Reading from the official documentation, we should implement a control for each of the following listed fields: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#windowssecuritycontextoptions-v1-core
So, the new checks to be added, are the following:

  • gmsaCredentialSpec
  • gmsaCredentialSpecName
  • hostProcess
  • runAsUserName

The equivalent rules should be named like so:

  • set-gmsacredentialspec-value
  • set-gmsacredentialspecname-value
  • set-hostprocess-true (checking also if WindowsHostProcessContainers feature flag is enabled in api-server)
  • runAsUserName
@alegrey91
Copy link
Contributor Author

@0xquark can this issue be of your interest?

@alegrey91 alegrey91 added enhancement New feature or request good first issue Good for newcomers labels Mar 6, 2023
@0xquark
Copy link

0xquark commented Mar 6, 2023

Yes! Seems like a good addition

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

2 participants