fixed lint error
parent
7ae624e9d8
commit
623251bba4
|
@ -37,7 +37,7 @@ javascript:
|
||||||
- code: |
|
- code: |
|
||||||
deployment = JSON.parse(template.deployment);
|
deployment = JSON.parse(template.deployment);
|
||||||
deployment.spec.template.spec.containers.forEach(container => {
|
deployment.spec.template.spec.containers.forEach(container => {
|
||||||
if (container.securityContext && container.securityContext.seccompProfile &&
|
if (container.securityContext && container.securityContext.seccompProfile &&
|
||||||
(container.securityContext.seccompProfile.type === 'RuntimeDefault' || container.securityContext.seccompProfile.type === 'DockerDefault')) {
|
(container.securityContext.seccompProfile.type === 'RuntimeDefault' || container.securityContext.seccompProfile.type === 'DockerDefault')) {
|
||||||
// No action needed, configured properly
|
// No action needed, configured properly
|
||||||
} else {
|
} else {
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
id: netpol-egress-rules
|
id: k8s-netpol-egress-rules
|
||||||
|
|
||||||
info:
|
info:
|
||||||
name: Network policies define egress rules
|
name: Network policies define egress rules
|
||||||
|
@ -34,7 +34,7 @@ code:
|
||||||
|
|
||||||
javascript:
|
javascript:
|
||||||
- code: |
|
- code: |
|
||||||
let policyData = JSON.parse(template.policy);
|
let policyData = JSON.parse(template.policy);
|
||||||
if (!policyData.egress || policyData.egress.length === 0) {
|
if (!policyData.egress || policyData.egress.length === 0) {
|
||||||
let result = (`Network policy '${policyData.policy}' does not define egress rules.`);
|
let result = (`Network policy '${policyData.policy}' does not define egress rules.`);
|
||||||
Export(result);
|
Export(result);
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
id: k8s-ingress-rules
|
id: k8s-network-ingress-rules
|
||||||
|
|
||||||
info:
|
info:
|
||||||
name: Define network ingress rules
|
name: Define network ingress rules
|
||||||
|
@ -35,7 +35,7 @@ code:
|
||||||
|
|
||||||
javascript:
|
javascript:
|
||||||
- code: |
|
- code: |
|
||||||
let policyData = JSON.parse(template.policy);
|
let policyData = JSON.parse(template.policy);
|
||||||
if (!policyData.ingress || policyData.ingress.length === 0) {
|
if (!policyData.ingress || policyData.ingress.length === 0) {
|
||||||
let result = `Network policy '${policyData.policy}' does not define any ingress rules.`;
|
let result = `Network policy '${policyData.policy}' does not define any ingress rules.`;
|
||||||
Export(result);
|
Export(result);
|
||||||
|
|
|
@ -34,7 +34,7 @@ code:
|
||||||
|
|
||||||
javascript:
|
javascript:
|
||||||
- code: |
|
- code: |
|
||||||
let podData = JSON.parse(template.container);
|
let podData = JSON.parse(template.container);
|
||||||
podData.containers.forEach(container => {
|
podData.containers.forEach(container => {
|
||||||
if (container.securityContext && container.securityContext.allowPrivilegeEscalation === true) {
|
if (container.securityContext && container.securityContext.allowPrivilegeEscalation === true) {
|
||||||
let result = (`Container '${container.name}' in pod '${podData.pod}' running with allowPrivilegeEscalation enabled.`);
|
let result = (`Container '${container.name}' in pod '${podData.pod}' running with allowPrivilegeEscalation enabled.`);
|
||||||
|
|
|
@ -35,7 +35,7 @@ code:
|
||||||
|
|
||||||
javascript:
|
javascript:
|
||||||
- code: |
|
- code: |
|
||||||
let podData = JSON.parse(template.pod);
|
let podData = JSON.parse(template.pod);
|
||||||
podData.containers.forEach(container => {
|
podData.containers.forEach(container => {
|
||||||
if (container.securityContext && container.securityContext.readOnlyRootFilesystem !== true) {
|
if (container.securityContext && container.securityContext.readOnlyRootFilesystem !== true) {
|
||||||
let result = (`Container '${container.name}' in pod '${podData.pod}' is not running with a read-only root filesystem.`);
|
let result = (`Container '${container.name}' in pod '${podData.pod}' is not running with a read-only root filesystem.`);
|
||||||
|
|
|
@ -34,7 +34,7 @@ code:
|
||||||
|
|
||||||
javascript:
|
javascript:
|
||||||
- code: |
|
- code: |
|
||||||
let podData = JSON.parse(template.pod);
|
let podData = JSON.parse(template.pod);
|
||||||
podData.containers.forEach(container => {
|
podData.containers.forEach(container => {
|
||||||
if (container.securityContext && container.securityContext.runAsUser === 0) {
|
if (container.securityContext && container.securityContext.runAsUser === 0) {
|
||||||
let result = (`Container '${container.name}' in pod '${podData.pod}' is running with root user ID.`);
|
let result = (`Container '${container.name}' in pod '${podData.pod}' is running with root user ID.`);
|
||||||
|
|
|
@ -23,13 +23,13 @@ code:
|
||||||
- bash
|
- bash
|
||||||
source: |
|
source: |
|
||||||
kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
|
kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
|
||||||
|
|
||||||
matchers-condition: and
|
matchers-condition: and
|
||||||
matchers:
|
matchers:
|
||||||
- type: word
|
- type: word
|
||||||
words:
|
words:
|
||||||
- 'kube-apiserver'
|
- 'kube-apiserver'
|
||||||
|
|
||||||
- type: word
|
- type: word
|
||||||
words:
|
words:
|
||||||
- "service-account-issuer"
|
- "service-account-issuer"
|
||||||
|
|
Loading…
Reference in New Issue