diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index 49b2f4d..314f61c 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -19,9 +19,7 @@ jobs: id: minikube uses: slashben/setup-minikube@master with: - feature-gates: 'ValidatingAdmissionPolicy=true' - extra-config: 'apiserver.runtime-config=admissionregistration.k8s.io/v1beta1' - kubernetes-version: v1.28.0-rc.1 + kubernetes-version: v1.30.0 container-runtime: containerd - uses: actions/setup-python@v4 with: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 39cd379..b56a54c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -7,30 +7,6 @@ on: - "v*" jobs: - - test-all-policies: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - name: start minikube - id: minikube - uses: slashben/setup-minikube@master - with: - feature-gates: 'ValidatingAdmissionPolicy=true' - extra-config: 'apiserver.runtime-config=admissionregistration.k8s.io/v1beta1' - kubernetes-version: v1.28.0-rc.1 - container-runtime: containerd - - uses: actions/setup-python@v4 - with: - python-version: '3.10' - - uses: azure/setup-kubectl@v3 - - name: Running all control policy tests - run: | - kubectl version - pip install --upgrade pip - pip install -r requirements.txt - ./scripts/run-all-control-tests.sh - release: needs: test-all-policies runs-on: ubuntu-latest @@ -49,11 +25,12 @@ jobs: - name: Create release artifacts run: | mkdir release + kubectl kustomize apis/k8s-v1/ > release/kubescape-validating-admission-policies-v1.yaml kubectl kustomize apis/k8s-v1beta1/ > release/kubescape-validating-admission-policies-v1beta1.yaml kubectl kustomize apis/x-k8s-v1alpha1/ > release/kubescape-validating-admission-policies-x-v1alpha1.yaml kubectl kustomize apis/k8s-v1alpha1/ > release/kubescape-validating-admission-policies-v1alpha1.yaml - # Making a copy of the v1beta1 file to be used as the default policy release artifact - cp release/kubescape-validating-admission-policies-v1beta1.yaml release/kubescape-validating-admission-policies.yaml + # Making a copy of the v1 file to be used as the default policy release artifact + cp release/kubescape-validating-admission-policies-v1.yaml release/kubescape-validating-admission-policies.yaml - name: Create a GitHub release uses: softprops/action-gh-release@v1 @@ -61,6 +38,7 @@ jobs: with: files: | release/kubescape-validating-admission-policies.yaml + release/kubescape-validating-admission-policies-v1.yaml release/kubescape-validating-admission-policies-v1beta1.yaml release/kubescape-validating-admission-policies-x-v1alpha1.yaml release/kubescape-validating-admission-policies-v1alpha1.yaml diff --git a/README.md b/README.md index b0c01ed..ceb1890 100644 --- a/README.md +++ b/README.md @@ -4,11 +4,9 @@ This is a library of policies based on [Kubescape controls](https://hub.armosec. ## Using the library -*Note: Kubernetes Validating Admission Policy feature _is _still in _its_ early phase_. -It has been released as an betav1 feature in Kubernetes 1.28, and is stable from kubernetes 1.30. Therefore if you are not using kubernetes version 1.30+ you need to enable its feature gate to be able to use it. Look [here](docs/validating-admission-policies/README.md) for _how to _set up_ a playground_.* +Kubernetes Validating Admission Policy (or *VAP*) feature was released as a GA feature in version 1.30 and it is a releatively new feature (this library supports alpha and beta versions as well). Before you start playing with it, make sure you have a cluster that supports this feature. Look [here](docs/validating-admission-policies/README.md) for _how to _set up_ a playground_ even for pre-1.30 versions.* - -Install latest the release of the library: +Install latest the release of the library (`v1` version of *VAP*): ```bash # Install configuration CRD kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/policy-configuration-definition.yaml @@ -25,7 +23,7 @@ You can apply policies to objects, for example, to apply control [C-0016](https: ```bash # Creating a binding kubectl apply -f - < ['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, params.settings.insecureCapabilities.all(insecureCapability, @@ -37,7 +36,6 @@ spec: container.securityContext.capabilities.add.all(capability, capability != insecureCapability) )) message: "Workload has one or more containers with insecure capabilities! (see more at https://hub.armosec.io/docs/c-0046)" - reason: "High" - expression: > object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, params.settings.insecureCapabilities.all(insecureCapability, @@ -45,4 +43,3 @@ spec: container.securityContext.capabilities.add.all(capability, capability != insecureCapability) )) message: "CronJob has one or more containers with insecure capabilities! (see more at https://hub.armosec.io/docs/c-0046)" - reason: "High" diff --git a/runtime-policies/portforward/policy.yaml b/runtime-policies/portforward/policy.yaml index 4672c2f..efb3c71 100644 --- a/runtime-policies/portforward/policy.yaml +++ b/runtime-policies/portforward/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: admissionregistration.k8s.io/v1beta1 +apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: cluster-policy-deny-portforward @@ -7,10 +7,9 @@ spec: resourceRules: - apiGroups: [""] apiVersions: ["v1"] - operations: ["UPDATE", "PATCH", "CONNECT"] + operations: ["UPDATE", "CONNECT"] resources: ["pods/portforward"] failurePolicy: Fail validations: - expression: "false" message: "portforward is not allowed" - reason: "High" diff --git a/runtime-policies/privileged/policy.yaml b/runtime-policies/privileged/policy.yaml index e67fd22..8f94d50 100644 --- a/runtime-policies/privileged/policy.yaml +++ b/runtime-policies/privileged/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: admissionregistration.k8s.io/v1beta1 +apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: cluster-policy-deny-priviliged-flag diff --git a/test-resources/policy-binding.yaml b/test-resources/policy-binding.yaml index 4dd6716..ed38306 100644 --- a/test-resources/policy-binding.yaml +++ b/test-resources/policy-binding.yaml @@ -1,4 +1,4 @@ -apiVersion: admissionregistration.k8s.io/v1beta1 +apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: placeholder