https://github.com/kubewarden/allowed-proc-mount-types-psp-policy

Replacement for the Kubernetes Pod Security Policy that controls the usage of /proc mount types
https://github.com/kubewarden/allowed-proc-mount-types-psp-policy

hacktoberfest kubernetes kubernetes-security kubewarden-policy pod-security-policy policy-as-code webassembly

Last synced: 6 months ago
JSON representation

Replacement for the Kubernetes Pod Security Policy that controls the usage of /proc mount types

• Host: GitHub
• URL: https://github.com/kubewarden/allowed-proc-mount-types-psp-policy
• Owner: kubewarden
• License: apache-2.0
• Created: 2021-11-16T12:07:29.000Z (over 3 years ago)
• Default Branch: main
• Last Pushed: 2024-11-25T09:32:24.000Z (7 months ago)
• Last Synced: 2024-11-25T10:38:44.737Z (7 months ago)
• Topics: hacktoberfest, kubernetes, kubernetes-security, kubewarden-policy, pod-security-policy, policy-as-code, webassembly
• Language: Rust
• Homepage: https://kubewarden.io
• Size: 184 KB
• Stars: 7
• Watchers: 5
• Forks: 5
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • Contributing: CONTRIBUTING.md
  • License: LICENSE
  • Codeowners: CODEOWNERS

Awesome Lists containing this project

README

        
[![Kubewarden Policy Repository](https://github.com/kubewarden/community/blob/main/badges/kubewarden-policies.svg)](https://github.com/kubewarden/community/blob/main/REPOSITORIES.md#policy-scope)

[![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/kubewarden/community/blob/main/REPOSITORIES.md#stable)

# Kubewarden policy psp-allowed-proc-mount-types

## Description

Replacement for the Kubernetes Pod Security Policy that controls the

usage of proc mount types in containers within a pod.

## Settings

This policy works by defining what proc mount types are allowed in containers. They can be left

empty (defaulted by Kubernetes), `Default` or `Unmasked`. This policy protects against pods that

contain at least one container with `Unmasked` proc mount type, that can potentially expose host

information to the container.

The following setting keys are accepted for this policy:

* `allow_unmasked_proc_mount_type`: allows the containers, init containers or ephemeral containers

  within a pod to set `.spec.securityContext.procMount` to `Unmasked`. Otherwise, the pod or the

  ephemeral request subresource request will be rejected.

`allow_unmasked_proc_mount_type` is `false` by default.