Merge pull request #484 from kubescape/split-default-namespace-rules

Split default namespace rules

controls/C-0212-thedefaultnamespaceshouldnotbeused.json

@@ -14,13 +14,28 @@
     },
     "rulesNames": [
         "pods-in-default-namespace",
-        "resources-rbac-in-default-namespace",
-        "resources-core1-in-default-namespace",
-        "resources-core2-in-default-namespace",
-        "resources-other1-in-default-namespace",
-        "resources-other2-in-default-namespace",
+        "rolebinding-in-default-namespace",
+        "role-in-default-namespace",
+        "configmap-in-default-namespace",
+        "endpoints-in-default-namespace",
+        "limitrange-in-default-namespace",
+        "persistentvolumeclaim-in-default-namespace",
+        "podtemplate-in-default-namespace",
+        "replicationcontroller-in-default-namespace",
+        "resourcequota-in-default-namespace",
+        "service-in-default-namespace",
+        "serviceaccount-in-default-namespace",
+        "controllerrevision-in-default-namespace",
+        "endpointslice-in-default-namespace",
+        "horizontalpodautoscaler-in-default-namespace",
+        "lease-in-default-namespace",
+        "csistoragecapacity-in-default-namespace",
+        "ingress-in-default-namespace",
+        "networkpolicy-in-default-namespace",
+        "poddisruptionbudget-in-default-namespace",
         "resources-secret-in-default-namespace",
-        "resources-event-in-default-namespace"
+        "resources-event-1-in-default-namespace",
+        "resources-event-2-in-default-namespace"
     ],
     "baseScore": 4,
     "impact_statement": "None",

rules/configmap-in-default-namespace/rule.metadata.json

@@ -0,0 +1,25 @@
+{
+    "name": "configmap-in-default-namespace",
+    "attributes": {
+      "armoBuiltin": true
+    },
+    "ruleLanguage": "Rego",
+    "match": [
+      {
+        "apiGroups": [
+          ""
+        ],
+        "apiVersions": [
+          "v1"
+        ],
+        "resources": [
+          "ConfigMap"
+        ]
+      }
+    ],
+    "ruleDependencies": [
+    ],
+    "description": "",
+    "remediation": "",
+    "ruleQuery": "armo_builtins"
+}

rules/controllerrevision-in-default-namespace/rule.metadata.json

@@ -0,0 +1,25 @@
+{
+    "name": "controllerrevision-in-default-namespace",
+    "attributes": {
+      "armoBuiltin": true
+    },
+    "ruleLanguage": "Rego",
+    "match": [
+      {
+        "apiGroups": [
+          "apps"
+        ],
+        "apiVersions": [
+          "v1"
+        ],
+        "resources": [
+            "ControllerRevision"
+        ]
+      }
+    ],
+    "ruleDependencies": [
+    ],
+    "description": "",
+    "remediation": "",
+    "ruleQuery": "armo_builtins"
+}

rules/controllerrevision-in-default-namespace/test/controllerrevision/expected.json

@@ -0,0 +1,23 @@
+[
+    {
+        "alertMessage": "ControllerRevision: kubescape is in the 'default' namespace",
+        "failedPaths": [
+            "metadata.namespace"
+        ],
+        "fixPaths": [],
+        "ruleStatus": "",
+        "packagename": "armo_builtins",
+        "alertScore": 3,
+        "alertObject": {
+            "k8sApiObjects": [
+                {
+                    "apiVersion": "apps/v1",
+                    "kind": "ControllerRevision",
+                    "metadata": {
+                        "name": "kubescape"
+                    }
+                }
+            ]
+        }
+    }
+]

rules/controllerrevision-in-default-namespace/test/controllerrevision/input/controllerrevision.yaml

@@ -0,0 +1,8 @@
+apiVersion: apps/v1
+kind: ControllerRevision
+metadata:
+  name: kubescape
+  namespace: default
+revision: 1
+data:
+  raw: Serialized-Object

rules/csistoragecapacity-in-default-namespace/rule.metadata.json

@@ -0,0 +1,25 @@
+{
+    "name": "csistoragecapacity-in-default-namespace",
+    "attributes": {
+      "armoBuiltin": true
+    },
+    "ruleLanguage": "Rego",
+    "match": [
+      {
+        "apiGroups": [
+          "storage.k8s.io"
+        ],
+        "apiVersions": [
+          "v1beta1"
+        ],
+        "resources": [
+            "CSIStorageCapacity"
+        ]
+      }
+    ],
+    "ruleDependencies": [
+    ],
+    "description": "",
+    "remediation": "",
+    "ruleQuery": "armo_builtins"
+}

rules/csistoragecapacity-in-default-namespace/test/csistoragecapacity/expected.json

@@ -0,0 +1,23 @@
+[
+    {
+        "alertMessage": "CSIStorageCapacity: kubescape is in the 'default' namespace",
+        "failedPaths": [
+            "metadata.namespace"
+        ],
+        "fixPaths": [],
+        "ruleStatus": "",
+        "packagename": "armo_builtins",
+        "alertScore": 3,
+        "alertObject": {
+            "k8sApiObjects": [
+                {
+                    "apiVersion": "storage.k8s.io/v1beta1",
+                    "kind": "CSIStorageCapacity",
+                    "metadata": {
+                        "name": "kubescape"
+                    }
+                }
+            ]
+        }
+    }
+]

rules/csistoragecapacity-in-default-namespace/test/csistoragecapacity/input/csistoragecapacity.yaml

@@ -0,0 +1,9 @@
+apiVersion: storage.k8s.io/v1beta1
+kind: CSIStorageCapacity
+metadata:
+  name: kubescape
+  namespace: default
+topology:
+  segments:
+    topology.storage.k8s.io/zone: us-east-1a
+storageClassName: example-storageclass

rules/endpoints-in-default-namespace/rule.metadata.json

@@ -0,0 +1,25 @@
+{
+    "name": "endpoints-in-default-namespace",
+    "attributes": {
+      "armoBuiltin": true
+    },
+    "ruleLanguage": "Rego",
+    "match": [
+      {
+        "apiGroups": [
+          ""
+        ],
+        "apiVersions": [
+          "v1"
+        ],
+        "resources": [
+          "Endpoints"
+        ]
+      }
+    ],
+    "ruleDependencies": [
+    ],
+    "description": "",
+    "remediation": "",
+    "ruleQuery": "armo_builtins"
+}

rules/resources-core2-in-default-namespace/test/configmap/expected.json → rules/endpoints-in-default-namespace/test/endpoints/expected.json

@@ -1,6 +1,6 @@
 [
     {
-        "alertMessage": "ConfigMap: kubescape is in the 'default' namespace",
+        "alertMessage": "Endpoints: kubescape is in the 'default' namespace",
         "failedPaths": [
             "metadata.namespace"
         ],
@@ -12,7 +12,7 @@
             "k8sApiObjects": [
                 {
                     "apiVersion": "v1",
-                    "kind": "ConfigMap",
+                    "kind": "Endpoints",
                     "metadata": {
                         "name": "kubescape"
                     }

rules/endpoints-in-default-namespace/test/endpoints/input/endpoints.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: kubescape
+  namespace: default
+subsets:
+  - addresses:
+      - ip: 192.0.2.42
+    ports:
+      - port: 9376

rules/endpointslice-in-default-namespace/rule.metadata.json

@@ -0,0 +1,25 @@
+{
+    "name": "endpointslice-in-default-namespace",
+    "attributes": {
+      "armoBuiltin": true
+    },
+    "ruleLanguage": "Rego",
+    "match": [
+      {
+        "apiGroups": [
+          "discovery.k8s.io"
+        ],
+        "apiVersions": [
+          "v1"
+        ],
+        "resources": [
+            "EndpointSlice"
+        ]
+      }
+    ],
+    "ruleDependencies": [
+    ],
+    "description": "",
+    "remediation": "",
+    "ruleQuery": "armo_builtins"
+}

rules/endpointslice-in-default-namespace/test/endpointslice/expected.json

@@ -0,0 +1,23 @@
+[
+    {
+        "alertMessage": "EndpointSlice: kubescape is in the 'default' namespace",
+        "failedPaths": [
+            "metadata.namespace"
+        ],
+        "fixPaths": [],
+        "ruleStatus": "",
+        "packagename": "armo_builtins",
+        "alertScore": 3,
+        "alertObject": {
+            "k8sApiObjects": [
+                {
+                    "apiVersion": "discovery.k8s.io/v1",
+                    "kind": "EndpointSlice",
+                    "metadata": {
+                        "name": "kubescape"
+                    }
+                }
+            ]
+        }
+    }
+]

rules/endpointslice-in-default-namespace/test/endpointslice/input/endpointslice.yaml

@@ -0,0 +1,14 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: kubescape
+  namespace: default
+addressType: IPv4
+ports:
+  - name: http
+    protocol: TCP
+    port: 80
+endpoints:
+  - addresses: ["10.1.2.3"]
+    conditions:
+      ready: true

rules/horizontalpodautoscaler-in-default-namespace/rule.metadata.json

@@ -0,0 +1,25 @@
+{
+    "name": "horizontalpodautoscaler-in-default-namespace",
+    "attributes": {
+      "armoBuiltin": true
+    },
+    "ruleLanguage": "Rego",
+    "match": [
+      {
+        "apiGroups": [
+          "autoscaling"
+        ],
+        "apiVersions": [
+          "v2"
+        ],
+        "resources": [
+            "HorizontalPodAutoscaler"
+        ]
+      }
+    ],
+    "ruleDependencies": [
+    ],
+    "description": "",
+    "remediation": "",
+    "ruleQuery": "armo_builtins"
+}

rules/horizontalpodautoscaler-in-default-namespace/test/horizontalpodautoscaler/expected.json

@@ -0,0 +1,23 @@
+[
+    {
+        "alertMessage": "HorizontalPodAutoscaler: kubescape is in the 'default' namespace",
+        "failedPaths": [
+            "metadata.namespace"
+        ],
+        "fixPaths": [],
+        "ruleStatus": "",
+        "packagename": "armo_builtins",
+        "alertScore": 3,
+        "alertObject": {
+            "k8sApiObjects": [
+                {
+                    "apiVersion": "autoscaling/v2",
+                    "kind": "HorizontalPodAutoscaler",
+                    "metadata": {
+                        "name": "kubescape"
+                    }
+                }
+            ]
+        }
+    }
+]

rules/horizontalpodautoscaler-in-default-namespace/test/horizontalpodautoscaler/input/horizontalpodautoscaler.yaml

@@ -0,0 +1,13 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: kubescape
+  namespace: default
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: my-application
+  minReplicas: 1
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 50