feat(lab7): trivy + PSS restricted + conftest gate

labs/lab7/k8s/deployment.yaml

@@ -0,0 +1,125 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: juice-shop
+  namespace: juice-shop
+  labels:
+    app: juice-shop
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: juice-shop
+  template:
+    metadata:
+      labels:
+        app: juice-shop
+    spec:
+      serviceAccountName: juice-shop
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: copy-shop
+          image: bkimminich/juice-shop@sha256:fd58bdc9745416afce8184ee0666278a436574633ea7880365153a63bfd418b0
+          command:
+            - /nodejs/bin/node
+            - -e
+            - |
+              const fs = require("fs");
+              function cp(src, dest) {
+                fs.mkdirSync(dest, { recursive: true });
+                for (const e of fs.readdirSync(src)) {
+                  const s = src + "/" + e;
+                  const d = dest + "/" + e;
+                  const st = fs.statSync(s);
+                  if (st.isDirectory()) {
+                    if (e !== "node_modules") cp(s, d);
+                  } else {
+                    fs.copyFileSync(s, d);
+                  }
+                }
+              }
+              cp("/juice-shop", "/shared/juice-shop");
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            runAsUser: 1000
+          volumeMounts:
+            - name: shop
+              mountPath: /shared
+        - name: restore-modules
+          image: bkimminich/juice-shop@sha256:fd58bdc9745416afce8184ee0666278a436574633ea7880365153a63bfd418b0
+          command:
+            - /nodejs/bin/node
+            - -e
+            - |
+              const fs = require("fs");
+              function cp(src, dest) {
+                fs.mkdirSync(dest, { recursive: true });
+                for (const e of fs.readdirSync(src)) {
+                  const s = src + "/" + e;
+                  const d = dest + "/" + e;
+                  if (fs.statSync(s).isDirectory()) {
+                    cp(s, d);
+                  } else {
+                    fs.copyFileSync(s, d);
+                  }
+                }
+              }
+              cp("/juice-shop/node_modules", "/modules/node_modules");
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            runAsUser: 1000
+          volumeMounts:
+            - name: modules
+              mountPath: /modules
+      containers:
+        - name: juice-shop
+          image: bkimminich/juice-shop@sha256:fd58bdc9745416afce8184ee0666278a436574633ea7880365153a63bfd418b0
+          ports:
+            - containerPort: 3000
+              name: http
+          env:
+            - name: NODE_ENV
+              value: production
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          volumeMounts:
+            - name: shop
+              mountPath: /juice-shop
+              subPath: juice-shop
+            - name: modules
+              mountPath: /juice-shop/node_modules
+              subPath: node_modules
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: shop
+          emptyDir: {}
+        - name: modules
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}

labs/lab7/k8s/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: juice-shop
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/audit: restricted

labs/lab7/k8s/networkpolicy.yaml

@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: juice-shop-default-deny
+  namespace: juice-shop
+spec:
+  podSelector:
+    matchLabels:
+      app: juice-shop
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector: {}
+      ports:
+        - port: 3000
+          protocol: TCP
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - port: 443
+          protocol: TCP

labs/lab7/k8s/serviceaccount.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: juice-shop
+  namespace: juice-shop
+automountServiceAccountToken: false

labs/lab7/policies/pod-hardening.rego

@@ -0,0 +1,42 @@
+package main
+
+deny contains msg if {
+    input.kind == "Deployment"
+    not input.spec.template.spec.securityContext.runAsNonRoot == true
+    msg := "Pod must set runAsNonRoot: true in pod-level securityContext"
+}
+
+deny contains msg if {
+    input.kind == "Deployment"
+    some container
+    c := input.spec.template.spec.containers[container]
+    not c.securityContext.readOnlyRootFilesystem == true
+    msg := sprintf("Container %v must set readOnlyRootFilesystem: true", [c.name])
+}
+
+deny contains msg if {
+    input.kind == "Deployment"
+    some container
+    c := input.spec.template.spec.containers[container]
+    not c.securityContext.allowPrivilegeEscalation == false
+    msg := sprintf("Container %v must set allowPrivilegeEscalation: false", [c.name])
+}
+
+deny contains msg if {
+    input.kind == "Deployment"
+    some container
+    c := input.spec.template.spec.containers[container]
+    not c.securityContext.capabilities
+    msg := sprintf("Container %v must define capabilities.drop (missing entirely)", [c.name])
+}
+
+deny contains msg if {
+    input.kind == "Deployment"
+    some container
+    c := input.spec.template.spec.containers[container]
+    c.securityContext.capabilities
+    every cap in c.securityContext.capabilities.drop {
+        cap != "ALL"
+    }
+    msg := sprintf("Container %v must drop ALL capabilities", [c.name])
+}