-
Notifications
You must be signed in to change notification settings - Fork 321
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into forbidden-sysctls-cel
- Loading branch information
Showing
239 changed files
with
6,344 additions
and
764 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
22 changes: 22 additions & 0 deletions
22
artifacthub/library/general/disallowanonymous/1.0.1/artifacthub-pkg.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| version: 1.0.1 | ||
| name: k8sdisallowanonymous | ||
| displayName: Disallow Anonymous Access | ||
| createdAt: "2024-08-19T17:43:37Z" | ||
| description: Disallows associating ClusterRole and Role resources to the system:anonymous user and system:unauthenticated group. | ||
| digest: eef7a39c0a9dfa0ff63d357b5e0ce881b1acc388c1b991a6cf4ab3745feb3e4a | ||
| license: Apache-2.0 | ||
| homeURL: https://open-policy-agent.github.io/gatekeeper-library/website/disallowanonymous | ||
| keywords: | ||
| - gatekeeper | ||
| - open-policy-agent | ||
| - policies | ||
| readme: |- | ||
| # Disallow Anonymous Access | ||
| Disallows associating ClusterRole and Role resources to the system:anonymous user and system:unauthenticated group. | ||
| install: |- | ||
| ### Usage | ||
| ```shell | ||
| kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/artifacthub/library/general/disallowanonymous/1.0.1/template.yaml | ||
| ``` | ||
| provider: | ||
| name: Gatekeeper Library |
2 changes: 2 additions & 0 deletions
2
artifacthub/library/general/disallowanonymous/1.0.1/kustomization.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| resources: | ||
| - template.yaml |
14 changes: 14 additions & 0 deletions
14
...hub/library/general/disallowanonymous/1.0.1/samples/no-anonymous-bindings/constraint.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| apiVersion: constraints.gatekeeper.sh/v1beta1 | ||
| kind: K8sDisallowAnonymous | ||
| metadata: | ||
| name: no-anonymous | ||
| spec: | ||
| match: | ||
| kinds: | ||
| - apiGroups: ["rbac.authorization.k8s.io"] | ||
| kinds: ["ClusterRoleBinding"] | ||
| - apiGroups: ["rbac.authorization.k8s.io"] | ||
| kinds: ["RoleBinding"] | ||
| parameters: | ||
| allowedRoles: | ||
| - cluster-role-1 |
15 changes: 15 additions & 0 deletions
15
...ibrary/general/disallowanonymous/1.0.1/samples/no-anonymous-bindings/example_allowed.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: cluster-role-binding-1 | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: cluster-role-1 | ||
| subjects: | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:authenticated | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:unauthenticated |
15 changes: 15 additions & 0 deletions
15
...ary/general/disallowanonymous/1.0.1/samples/no-anonymous-bindings/example_disallowed.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: cluster-role-binding-2 | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: cluster-role-2 | ||
| subjects: | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:authenticated | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:unauthenticated |
17 changes: 17 additions & 0 deletions
17
artifacthub/library/general/disallowanonymous/1.0.1/suite.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| kind: Suite | ||
| apiVersion: test.gatekeeper.sh/v1alpha1 | ||
| metadata: | ||
| name: disallowanonymous | ||
| tests: | ||
| - name: disallow-anonymous | ||
| template: template.yaml | ||
| constraint: samples/no-anonymous-bindings/constraint.yaml | ||
| cases: | ||
| - name: example-allowed | ||
| object: samples/no-anonymous-bindings/example_allowed.yaml | ||
| assertions: | ||
| - violations: no | ||
| - name: example-disallowed | ||
| object: samples/no-anonymous-bindings/example_disallowed.yaml | ||
| assertions: | ||
| - violations: yes |
48 changes: 48 additions & 0 deletions
48
artifacthub/library/general/disallowanonymous/1.0.1/template.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| apiVersion: templates.gatekeeper.sh/v1 | ||
| kind: ConstraintTemplate | ||
| metadata: | ||
| name: k8sdisallowanonymous | ||
| annotations: | ||
| metadata.gatekeeper.sh/title: "Disallow Anonymous Access" | ||
| metadata.gatekeeper.sh/version: 1.0.1 | ||
| description: Disallows associating ClusterRole and Role resources to the system:anonymous user and system:unauthenticated group. | ||
| spec: | ||
| crd: | ||
| spec: | ||
| names: | ||
| kind: K8sDisallowAnonymous | ||
| validation: | ||
| # Schema for the `parameters` field | ||
| openAPIV3Schema: | ||
| type: object | ||
| properties: | ||
| allowedRoles: | ||
| description: >- | ||
| The list of ClusterRoles and Roles that may be associated | ||
| with the `system:unauthenticated` group and `system:anonymous` | ||
| user. | ||
| type: array | ||
| items: | ||
| type: string | ||
| targets: | ||
| - target: admission.k8s.gatekeeper.sh | ||
| rego: | | ||
| package k8sdisallowanonymous | ||
| violation[{"msg": msg}] { | ||
| not is_allowed(input.review.object.roleRef, object.get(input, ["parameters", "allowedRoles"], [])) | ||
| review(input.review.object.subjects[_]) | ||
| msg := sprintf("Unauthenticated user reference is not allowed in %v %v ", [input.review.object.kind, input.review.object.metadata.name]) | ||
| } | ||
| is_allowed(role, allowedRoles) { | ||
| role.name == allowedRoles[_] | ||
| } | ||
| review(subject) = true { | ||
| subject.name == "system:unauthenticated" | ||
| } | ||
| review(subject) = true { | ||
| subject.name == "system:anonymous" | ||
| } |
22 changes: 22 additions & 0 deletions
22
artifacthub/library/general/disallowanonymous/1.1.0/artifacthub-pkg.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| version: 1.1.0 | ||
| name: k8sdisallowanonymous | ||
| displayName: Disallow Anonymous Access | ||
| createdAt: "2024-08-21T21:13:49Z" | ||
| description: Disallows associating ClusterRole and Role resources to the system:anonymous user and system:unauthenticated group. | ||
| digest: 8de75985d7841ab683cf095d1b86934a3d3278b20816c0bb2a10680d25ddd740 | ||
| license: Apache-2.0 | ||
| homeURL: https://open-policy-agent.github.io/gatekeeper-library/website/disallowanonymous | ||
| keywords: | ||
| - gatekeeper | ||
| - open-policy-agent | ||
| - policies | ||
| readme: |- | ||
| # Disallow Anonymous Access | ||
| Disallows associating ClusterRole and Role resources to the system:anonymous user and system:unauthenticated group. | ||
| install: |- | ||
| ### Usage | ||
| ```shell | ||
| kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/artifacthub/library/general/disallowanonymous/1.1.0/template.yaml | ||
| ``` | ||
| provider: | ||
| name: Gatekeeper Library |
2 changes: 2 additions & 0 deletions
2
artifacthub/library/general/disallowanonymous/1.1.0/kustomization.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| resources: | ||
| - template.yaml |
14 changes: 14 additions & 0 deletions
14
...hub/library/general/disallowanonymous/1.1.0/samples/no-anonymous-bindings/constraint.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| apiVersion: constraints.gatekeeper.sh/v1beta1 | ||
| kind: K8sDisallowAnonymous | ||
| metadata: | ||
| name: no-anonymous | ||
| spec: | ||
| match: | ||
| kinds: | ||
| - apiGroups: ["rbac.authorization.k8s.io"] | ||
| kinds: ["ClusterRoleBinding"] | ||
| - apiGroups: ["rbac.authorization.k8s.io"] | ||
| kinds: ["RoleBinding"] | ||
| parameters: | ||
| allowedRoles: | ||
| - cluster-role-1 |
15 changes: 15 additions & 0 deletions
15
...ibrary/general/disallowanonymous/1.1.0/samples/no-anonymous-bindings/example_allowed.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: cluster-role-binding-1 | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: cluster-role-1 | ||
| subjects: | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:authenticated | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:unauthenticated |
18 changes: 18 additions & 0 deletions
18
...ary/general/disallowanonymous/1.1.0/samples/no-anonymous-bindings/example_disallowed.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: cluster-role-binding-2 | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: cluster-role-2 | ||
| subjects: | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:authenticated | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:unauthenticated | ||
| - apiGroup: rbac.authorization.k8s.io | ||
| kind: Group | ||
| name: system:anonymous |
Oops, something went wrong.