Skip to content

Instantly share code, notes, and snippets.

@smarthall
Last active April 10, 2024 02:36
Show Gist options
  • Save smarthall/e30477c4d726430f913adb72bd2ecc40 to your computer and use it in GitHub Desktop.
Save smarthall/e30477c4d726430f913adb72bd2ecc40 to your computer and use it in GitHub Desktop.
This script will tell you the most restrictive policy to apply to each namespace in your cluster based on curently running pods.
#!/bin/bash
set -euo pipefail
function checknspolicy() {
ns=$1
policy=$2
out=$(kubectl label --dry-run=server --overwrite ns $ns pod-security.kubernetes.io/enforce=${policy} 2>&1 > /dev/null)
if [ -z "$out" ]; then
echo "true"
else
echo "false"
fi
}
function findbestpolicy() {
POLICYLIST="restricted baseline privileged"
ns=$1
for policy in $POLICYLIST; do
if [ $(checknspolicy $ns $policy) == "true" ]; then
echo $policy
break
fi
done
}
for n in $(kubectl get namespaces -o jsonpath="{.items[*].metadata.name}"); do
echo -n "$n: "
findbestpolicy $n
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment