{"id":13787771,"url":"https://github.com/raspbernetes/k8s-security-policies","last_synced_at":"2025-05-12T01:31:37.211Z","repository":{"id":43337442,"uuid":"272838811","full_name":"raspbernetes/k8s-security-policies","owner":"raspbernetes","description":"This repository offers a comprehensive library of security policies designed to enhance the security of Kubernetes cluster configurations. The policies are developed in accordance with the CIS Kubernetes benchmark.","archived":false,"fork":false,"pushed_at":"2023-11-18T08:39:39.000Z","size":63,"stargazers_count":176,"open_issues_count":15,"forks_count":24,"subscribers_count":15,"default_branch":"main","last_synced_at":"2024-11-18T01:39:13.083Z","etag":null,"topics":["benchmark","cis","cis-kubernetes-benchmark","conftest","gatekeeper","kubernetes","kubernetes-clusters","kubesec","open-policy-agent","raspbernetes","rego-files","rego-policy","security","violation"],"latest_commit_sha":null,"homepage":"https://raspbernetes.github.io/","language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/raspbernetes.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["xUnholy"]}},"created_at":"2020-06-17T00:13:23.000Z","updated_at":"2024-08-10T22:39:14.000Z","dependencies_parsed_at":"2023-11-18T09:27:48.029Z","dependency_job_id":null,"html_url":"https://github.com/raspbernetes/k8s-security-policies","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raspbernetes%2Fk8s-security-policies","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raspbernetes%2Fk8s-security-policies/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raspbernetes%2Fk8s-security-policies/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/raspbernetes%2Fk8s-security-policies/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/raspbernetes","download_url":"https://codeload.github.com/raspbernetes/k8s-security-policies/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253659377,"owners_count":21943627,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["benchmark","cis","cis-kubernetes-benchmark","conftest","gatekeeper","kubernetes","kubernetes-clusters","kubesec","open-policy-agent","raspbernetes","rego-files","rego-policy","security","violation"],"created_at":"2024-08-03T21:00:30.594Z","updated_at":"2025-05-12T01:31:36.907Z","avatar_url":"https://github.com/raspbernetes.png","language":"Open Policy Agent","funding_links":["https://github.com/sponsors/xUnholy"],"categories":["Open Policy Agent (4)","Policy Packages","security","Open Policy Agent"],"sub_categories":["Blogs and Articles"],"readme":"\u003cdiv align=\"center\"\u003e\n\n  # Kubernetes Security Policies\n\n  A Comprehensive Library for Fortifying Cluster Configurations.\n\n\u003c/div\u003e\n\n## Introduction\n\nThis repository offers a comprehensive library of security policies designed to fortify Kubernetes cluster configurations. These security policies are derived from the [CIS Kubernetes benchmark]((https://cloud.google.com/kubernetes-engine/docs/concepts/cis-benchmarks)) and rules specified by [Kubesec.io](https://kubesec.io/). The policies are crafted in REGO, a high-level declarative language tailored for defining policies over intricate hierarchical data structures. For an in-depth understanding of REGO, refer to the [Policy Language](https://www.openpolicyagent.org/docs/latest/policy-language/) documentation.\n\n## Why use Kubernetes Security Policies?\n\nKubernetes Security Policies are crucial for:\n\n1. **Enhancing Security**: They protect clusters against threats, misconfigurations, and vulnerabilities by applying predefined rules and best practices.\n\n2. **Ensuring Consistency**: Policies enforce standardized configurations across clusters, simplifying management and reducing configuration drift.\n\n3. **Maintaining Compliance**: By implementing established benchmarks like CIS Kubernetes, policies help adhere to industry-specific regulatory requirements.\n\n4. **Automating Enforcement**: Policies automate the enforcement of security best practices, reducing human error and streamlining deployments.\n\n5. **Simplifying Auditing**: They provide a clear approach to defining and enforcing configurations, enabling easier auditing and monitoring of clusters.\n\nKubernetes Security Policies are essential for a robust security strategy and promoting a proactive security culture within organizations.\n\n## Repository Structure\n\nThe `policies` directory houses numerous folders, each representing a distinct policy. Folders are named according to the benchmark standard, followed by a number to ensure differentiation. For instance, the `1.2.1 Ensure that the --anonymous-auth argument is set to false` policy from the CIS benchmark is verified by REGO files located in the `CIS1.2.1` directory. To explore each policy further, consult the [Policy Inventory](policies/POLICIES.md).\n\nWithin each folder, you will find a `.rego` file and a unit test `.rego` file. Additionally, there is a separate `lib` folder containing two .rego files that feature general functions importable into other `.rego` files. The `kubernetes.rego` file encompasses functions and rules employed in security control `.rego` files, while the `test.rego` file houses functions that can be imported into unit test files.\n\n## Policy Implementation Process\n\n### Identifying Violations\n\nEach REGO policy examines the manifests of resources deployable in a Kubernetes cluster. The `violation` block in each policy file typically includes:\n\n* Identifying the resource object being examined and returning it.\n* Verifying if the object breaches the controls defined in the benchmark.\n* Displaying an error message if a violation is detected.\n\nHere's a simplified example of a violation:\n\n```rego\nviolation[msg] {\n    kubernetes.pods[pod]\n    not kubernetes.contains_element(params.allowedDeploymentsOrPods, kubernetes.name)\n    is_automount_serviceaccount_token_enabled(pod)\n    msg := kubernetes.format(sprintf(\"%v: %v - Automount Service account token must be set to false\", [kubernetes.kind, kubernetes.name]))\n}\n```\n\nThe `kubernetes.` prefix indicates a function call from `kubernetes.rego`, which contains general functions. Control-specific logic is written in the corresponding REGO file.\n\n### Configuring Parameters\n\nSecurity policies use parameters to evaluate resources. These parameters can be external (e.g., defined in Gatekeeper `constraints`) or embedded as default values within the file. Parameters are standardized by combining them:\n\n```rego\nparams = object.union(default_parameters, kubernetes.parameters)\n```\n\n### Testing Policies\n\nTo validate policy accuracy, the `OPA` testing [framework](https://www.openpolicyagent.org/docs/v0.12.2/how-do-i-test-policies/) is used. Each unit test includes functions prefixed with `test` in the name, enabling `opa test` to recognize them. Positive cases start with `test_no_violation` and negative cases with `test_violation`. Tests use `policy_input` formatted like the manifests:\n\n```rego\ntest_violation {\n    test.violations(violation) with input as policy_input(true)\n}\n\ntest_no_violation {\n    test.no_violations(violation) with input as policy_input(false)\n}\n```\n\nUnit test files share the same package as the REGO policy, ensuring the test verifies policy input against the violation block within the same package.\n\nThe `opa test` output displays whether all tests passed:\n\n```rego\n$ opa test policies -v\ndata.spec_volumes_hostpath_path_var_run_docker_sock.test_no_violation: PASS (318.786µs)\ndata.containers_image_tag.test_violation_1: PASS (512.689µs)\ndata.containers_image_tag.test_violation_2: PASS (515.964µs)\ndata.containers_image_tag.test_no_violation: PASS (389.822µs)\ndata.containers_securitycontext_allowprivilegedeescalation_true.test_violation: PASS (474.668µs)\ndata.containers_securitycontext_allowprivilegedeescalation_true.test_no_violation: PASS (361.12µs)\n--------------------------------------------------------------------------------\nPASS: 5/5\n```\n\n## Integration with Policy Enforcement Tools\n\nThis policy library is designed to be compatible with various tools, such as Conftest and Gatekeeper.\n\n### Gatekeeper\n\nRego policies can serve as a schema in Gatekeeper `ConstraintTemplate`. Based on the template, `constraints` can be deployed onto Kubernetes clusters to monitor `CREATE` and `UPDATE` operations against the API server. Gatekeeper also offers `AUDIT` functionality to evaluate existing resources against the `constraints`. To learn more about creating `constraints`, visit the [Gatekeeper](https://github.com/open-policy-agent/gatekeeper) repository.\n\n\n### Conftest\n\nConftest enables the evaluation of structured YAML manifest files intended for deployment to your clusters. To use Conftest, first install [Conftest](https://github.com/open-policy-agent/conftest) and then run `conftest test` on a YAML file against the policy library:\n\n\n```shell\n$ conftest test deployment.yaml -p policies/. --all-namespaces\n```\n\nThe output indicates whether the tests have passed. Here's an example:\n\n```log\nFAIL - deployment.yaml - Containers must not run as root\nFAIL - deployment.yaml - Deployments are not allowed\n\n2 tests, 0 passed, 0 warnings, 2 failure\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fraspbernetes%2Fk8s-security-policies","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fraspbernetes%2Fk8s-security-policies","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fraspbernetes%2Fk8s-security-policies/lists"}