https://github.com/kubewarden/readonly-root-filesystem-psp-policy

A Kubewarden policy that enforces root filesystem to be readonly
https://github.com/kubewarden/readonly-root-filesystem-psp-policy

hacktoberfest kubernetes kubernetes-security kubewarden-policy pod-security-policy policy-as-code webassembly

Last synced: 6 months ago
JSON representation

A Kubewarden policy that enforces root filesystem to be readonly

• Host: GitHub
• URL: https://github.com/kubewarden/readonly-root-filesystem-psp-policy
• Owner: kubewarden
• License: apache-2.0
• Created: 2021-11-30T09:42:10.000Z (over 3 years ago)
• Default Branch: main
• Last Pushed: 2024-11-25T09:28:41.000Z (7 months ago)
• Last Synced: 2024-11-25T10:38:04.596Z (7 months ago)
• Topics: hacktoberfest, kubernetes, kubernetes-security, kubewarden-policy, pod-security-policy, policy-as-code, webassembly
• Language: Rust
• Homepage: https://kubewarden.io
• Size: 190 KB
• Stars: 2
• Watchers: 5
• Forks: 3
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • Contributing: CONTRIBUTING.md
  • License: LICENSE
  • Codeowners: CODEOWNERS

Awesome Lists containing this project

README

        
[![Kubewarden Policy Repository](https://github.com/kubewarden/community/blob/main/badges/kubewarden-policies.svg)](https://github.com/kubewarden/community/blob/main/REPOSITORIES.md#policy-scope)

[![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/kubewarden/community/blob/main/REPOSITORIES.md#stable)

This Kubewarden Policy is a replacement for the Kubernetes Pod Security Policy

that enforces the usage of [`ReadOnlyRootFilesystems`](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems).

# How the policy works

The policy inspects the `securityContext` of each container defined inside of

a Pod and ensures all the containers have the `readOnlyRootFilesystem` attribute

set to `true`.

The policy checks the both the `pod.spec.containers` and the init containers

too.

Containers that do not have a `securityContext` defined are rejected too.

That happens because, by default, the root filesystem of a container is

considered to be writable.

Ephemeral containers are not checked because, by Kubernetes definition, they

cannot have a `securityContext`.

# Configuration

The policy doesn't have any configuration.