https://github.com/stlaz/psachecker

A tool to determine restrictive level for Kubernetes workloads
https://github.com/stlaz/psachecker

kubernetes pod-security pod-security-admission

Last synced: 3 months ago
JSON representation

A tool to determine restrictive level for Kubernetes workloads

• Host: GitHub
• URL: https://github.com/stlaz/psachecker
• Owner: stlaz
• Created: 2021-11-12T15:11:52.000Z (about 3 years ago)
• Default Branch: master
• Last Pushed: 2023-06-01T08:37:51.000Z (over 1 year ago)
• Last Synced: 2024-06-19T04:22:03.738Z (7 months ago)
• Topics: kubernetes, pod-security, pod-security-admission
• Language: Go
• Homepage:
• Size: 156 KB
• Stars: 14
• Watchers: 3
• Forks: 5
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# What this does

The psachecker is a tool that allows you to assess a workload/all workloads in a namespace

and based on their security requirements decide what should be the lowest possible PodSecurity

privilege level that would still keep them running.

## Compiling and usage

To compile the binary, run `make build` in the repo namespace. You can then install it to

your $GOBIN by running `make install` or use it directly as `./kubectl-psachecker`

### Usage

`./kubectl-psachecker inspect-workloads -f  [-f  ...] [opts]`

Returns the restrictive level for workloads present in the files specified by the `-f` flag (can be set multiple times).

`./kubectl-psachecker inspect-cluster [-n namespace] [--updates-only]`

Returns the restrictive level for [the selected namespace or] all namespaces in the cluster.

## The state of this repository

This is an experimental repository. Bug reports and feature requests are appreciated.

## TODO

- allow setting/discovering the current cluster PSa configuration

- assess the whole cluster in order to decide the default config

    - allow setting desired config levels and then assess which namespaces would have to set

      less restrictive labels in order for the current workloads to still run