Add ephemeral containers to policies

library/general/allowedrepos/samples/repo-must-be-openpolicyagent/disallowed_both.yaml

@@ -17,3 +17,10 @@ spec:
         limits:
           cpu: "100m"
           memory: "30Mi"
+  ephemeralContainers:
+    - name: nginx
+      image: nginx
+      resources:
+        limits:
+          cpu: "100m"
+          memory: "30Mi"

library/general/allowedrepos/suite.yaml

@@ -26,8 +26,10 @@ tests:
   - name: both-disallowed
     object: samples/repo-must-be-openpolicyagent/disallowed_both.yaml
     assertions:
-    - violations: 2
+    - violations: 3
     - message: initContainer
       violations: 1
     - message: container
       violations: 1
+    - message: ephemeralContainer
+      violations: 1

library/general/allowedrepos/template.yaml

@@ -38,3 +38,10 @@ spec:
           not any(satisfied)
           msg := sprintf("initContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
         }
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.ephemeralContainers[_]
+          satisfied := [good | repo = input.parameters.repos[_] ; good = startswith(container.image, repo)]
+          not any(satisfied)
+          msg := sprintf("ephemeralContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
+        }

library/general/automount-serviceaccount-token/template.yaml

@@ -45,6 +45,8 @@ spec:
             c := input.review.object.spec.initContainers[_]
         }
 
+        # Ephemeral containers not checked as it is not possible to set field.
+
         has_key(x, k) {
             _ = x[k]
         }

library/general/containerlimits/template.yaml

@@ -172,6 +172,8 @@ spec:
           general_violation[{"msg": msg, "field": "initContainers"}]
         }
 
+        # Ephemeral containers not checked as it is not possible to set field.
+
         general_violation[{"msg": msg, "field": field}] {
           container := input.review.object.spec[field][_]
           not is_exempt(container)

library/general/containerrequests/template.yaml

@@ -172,6 +172,8 @@ spec:
           general_violation[{"msg": msg, "field": "initContainers"}]
         }
 
+        # Ephemeral containers not checked as it is not possible to set field.
+
         general_violation[{"msg": msg, "field": field}] {
           container := input.review.object.spec[field][_]
           not is_exempt(container)

library/general/containerresourceratios/template.yaml

@@ -182,6 +182,8 @@ spec:
           general_violation[{"msg": msg, "field": "initContainers"}]
         }
 
+        # Ephemeral containers not checked as it is not possible to set field.
+
         general_violation[{"msg": msg, "field": field}] {
           container := input.review.object.spec[field][_]
           not is_exempt(container)

library/general/disallowedtags/samples/container-image-must-not-have-latest-tag/example_disallowed_tag_ephemeral.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: opa-disallowed-ephemeral
+spec:
+  containers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"
+  ephemeralContainers:
+    - name: opa
+      image: openpolicyagent/opa:latest
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"

library/general/disallowedtags/suite.yaml

@@ -23,6 +23,10 @@ tests:
     object: samples/container-image-must-not-have-latest-tag/example_disallowed_tag.yaml
     assertions:
     - violations: yes
+  - name: single-disallowed-tag-ephemeral
+    object: samples/container-image-must-not-have-latest-tag/example_disallowed_tag_ephemeral.yaml
+    assertions:
+    - violations: yes
   - name: some-disallow-tags
     object: samples/container-image-must-not-have-latest-tag/example_some_disallowed_tags.yaml
     assertions:

library/general/disallowedtags/template.yaml

@@ -61,6 +61,9 @@ spec:
         input_containers[c] {
             c := input.review.object.spec.initContainers[_]
         }
+        input_containers[c] {
+            c := input.review.object.spec.ephemeralContainers[_]
+        }
       libs:
         - |
           package lib.exempt_container

library/general/imagedigests/samples/container-image-must-have-digest/example_disallowed.yaml

@@ -3,10 +3,24 @@ kind: Pod
 metadata:
   name: opa-disallowed
 spec:
+  initContainers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"
   containers:
     - name: opa
       image: openpolicyagent/opa:0.9.2
       args:
         - "run"
         - "--server"
         - "--addr=localhost:8080"
+  ephemeralContainers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"

library/general/imagedigests/suite.yaml

@@ -14,4 +14,10 @@ tests:
   - name: example-disallowed
     object: samples/container-image-must-have-digest/example_disallowed.yaml
     assertions:
-    - violations: yes
+    - violations: 3
+    - message: initContainer
+      violations: 1
+    - message: container
+      violations: 1
+    - message: ephemeralContainer
+      violations: 1

library/general/imagedigests/template.yaml

@@ -52,6 +52,14 @@ spec:
           not all(satisfied)
           msg := sprintf("initContainer <%v> uses an image without a digest <%v>", [container.name, container.image])
         }
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.ephemeralContainers[_]
+          not is_exempt(container)
+          satisfied := [re_match("@[a-z0-9]+([+._-][a-z0-9]+)*:[a-zA-Z0-9=_-]+", container.image)]
+          not all(satisfied)
+          msg := sprintf("ephemeralContainer <%v> uses an image without a digest <%v>", [container.name, container.image])
+        }
       libs:
         - |
           package lib.exempt_container

library/pod-security-policy/allow-privilege-escalation/samples/psp-allow-privilege-escalation-container/example_disallowed_ephemeral.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-privilege-escalation-disallowed
+  labels:
+    app: nginx-privilege-escalation
+spec:
+  ephemeralContainers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      allowPrivilegeEscalation: true

library/pod-security-policy/allow-privilege-escalation/suite.yaml

@@ -15,3 +15,7 @@ tests:
         object: samples/psp-allow-privilege-escalation-container/example_disallowed.yaml
         assertions:
           - violations: yes
+      - name: example-disallowed-ephemeral
+        object: samples/psp-allow-privilege-escalation-container/example_disallowed_ephemeral.yaml
+        assertions:
+          - violations: yes

library/pod-security-policy/allow-privilege-escalation/template.yaml

@@ -58,6 +58,9 @@ spec:
         input_containers[c] {
             c := input.review.object.spec.initContainers[_]
         }
+        input_containers[c] {
+            c := input.review.object.spec.ephemeralContainers[_]
+        }
         # has_field returns whether an object has a field
         has_field(object, field) = true {
             object[field]

library/pod-security-policy/apparmor/samples/psp-apparmor/example_disallowed_ephemeral.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-apparmor-disallowed
+  annotations:
+    # apparmor.security.beta.kubernetes.io/pod: unconfined # runtime/default
+    container.apparmor.security.beta.kubernetes.io/nginx: unconfined
+  labels:
+    app: nginx-apparmor
+spec:
+  ephemeralContainers:
+  - name: nginx
+    image: nginx

library/pod-security-policy/apparmor/suite.yaml

@@ -15,3 +15,7 @@ tests:
         object: samples/psp-apparmor/example_disallowed.yaml
         assertions:
           - violations: yes
+      - name: example-disallowed-ephemeral
+        object: samples/psp-apparmor/example_disallowed_ephemeral.yaml
+        assertions:
+          - violations: yes

library/pod-security-policy/apparmor/template.yaml

@@ -63,6 +63,9 @@ spec:
         input_containers[c] {
             c := input.review.object.spec.initContainers[_]
         }
+        input_containers[c] {
+            c := input.review.object.spec.ephemeralContainers[_]
+        }
 
         get_annotation_for(container, metadata) = out {
             out = metadata.annotations[sprintf("container.apparmor.security.beta.kubernetes.io/%v", [container.name])]

library/pod-security-policy/capabilities/samples/capabilities-demo/example_disallowed_ephemeral.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: opa-disallowed
+  labels:
+    owner: me.agilebank.demo
+spec:
+  ephemeralContainers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"
+      securityContext:
+        capabilities:
+          add: ["disallowedcapability"]
+      resources:
+        limits:
+          cpu: "100m"
+          memory: "30Mi"

library/pod-security-policy/capabilities/suite.yaml

@@ -15,3 +15,7 @@ tests:
         object: samples/capabilities-demo/example_allowed.yaml
         assertions:
           - violations: no
+      - name: example-disallowed-ephemeral
+        object: samples/capabilities-demo/example_disallowed_ephemeral.yaml
+        assertions:
+          - violations: yes

library/pod-security-policy/capabilities/template.yaml

@@ -81,6 +81,22 @@ spec:
         }
 
 
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.ephemeralContainers[_]
+          not is_exempt(container)
+          has_disallowed_capabilities(container)
+          msg := sprintf("ephemeral container <%v> has a disallowed capability. Allowed capabilities are %v", [container.name, get_default(input.parameters, "allowedCapabilities", "NONE")])
+        }
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.ephemeralContainers[_]
+          not is_exempt(container)
+          missing_drop_capabilities(container)
+          msg := sprintf("ephemeral container <%v> is not dropping all required capabilities. Container must drop all of %v or \"ALL\"", [container.name, input.parameters.requiredDropCapabilities])
+        }
+
+
         has_disallowed_capabilities(container) {
           allowed := {c | c := lower(input.parameters.allowedCapabilities[_])}
           not allowed["*"]

library/pod-security-policy/host-filesystem/samples/psp-host-filesystem/example_disallowed_ephemeral.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-host-filesystem
+  labels:
+    app: nginx-host-filesystem-disallowed
+spec:
+  ephemeralContainers:
+  - name: nginx
+    image: nginx
+    volumeMounts:
+    - mountPath: /cache
+      name: cache-volume
+      readOnly: true
+  volumes:
+  - name: cache-volume
+    hostPath:
+      path: /tmp # directory location on host

library/pod-security-policy/host-filesystem/suite.yaml

@@ -15,3 +15,7 @@ tests:
         object: samples/psp-host-filesystem/example_allowed.yaml
         assertions:
           - violations: no
+      - name: example-disallowed-ephemeral
+        object: samples/psp-host-filesystem/example_disallowed_ephemeral.yaml
+        assertions:
+          - violations: yes

library/pod-security-policy/host-filesystem/template.yaml

@@ -128,3 +128,7 @@ spec:
         input_containers[c] {
             c := input.review.object.spec.initContainers[_]
         }
+
+        input_containers[c] {
+            c := input.review.object.spec.ephemeralContainers[_]
+        }

library/pod-security-policy/host-network-ports/samples/psp-host-network-ports/example_disallowed_ephemeral.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-host-networking-ports-disallowed
+  labels:
+    app: nginx-host-networking-ports
+spec:
+  hostNetwork: true
+  ephemeralContainers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 9001
+      hostPort: 9001

library/pod-security-policy/host-network-ports/suite.yaml

@@ -15,3 +15,7 @@ tests:
     object: samples/psp-host-network-ports/example_allowed.yaml
     assertions:
     - violations: no
+  - name: example-disallowed-ephemeral
+    object: samples/psp-host-network-ports/example_disallowed_ephemeral.yaml
+    assertions:
+    - violations: yes

library/pod-security-policy/host-network-ports/template.yaml

@@ -78,6 +78,11 @@ spec:
             c := input.review.object.spec.initContainers[_]
             not is_exempt(c)
         }
+
+        input_containers[c] {
+            c := input.review.object.spec.ephemeralContainers[_]
+            not is_exempt(c)
+        }
       libs:
         - |
           package lib.exempt_container

library/pod-security-policy/privileged-containers/samples/psp-privileged-container/example_disallowed_ephemeral.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-privileged-disallowed
+  labels:
+    app: nginx-privileged
+spec:
+  ephemeralContainers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      privileged: true

library/pod-security-policy/privileged-containers/suite.yaml

@@ -15,3 +15,7 @@ tests:
     object: samples/psp-privileged-container/example_allowed.yaml
     assertions:
     - violations: no
+  - name: example-disallowed-ephemeral
+    object: samples/psp-privileged-container/example_disallowed_ephemeral.yaml
+    assertions:
+    - violations: yes

library/pod-security-policy/privileged-containers/template.yaml

@@ -53,6 +53,10 @@ spec:
         input_containers[c] {
             c := input.review.object.spec.initContainers[_]
         }
+
+        input_containers[c] {
+            c := input.review.object.spec.ephemeralContainers[_]
+        }
       libs:
         - |
           package lib.exempt_container

library/pod-security-policy/proc-mount/samples/psp-proc-mount/example_disallowed_ephemeral.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-proc-mount-disallowed
+  labels:
+    app: nginx-proc-mount
+spec:
+  ephemeralContainers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      procMount: Unmasked #Default