pod-groups-validation

configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: k8-ldap-configmap
  name: user-gids-map
data:
  user-tdockendorf: '[5356, 5509]'

pod-groups-validation.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: pod-groups-validation
  namespace: kyverno
spec:
  background: false
  validationFailureAction: enforce
  rules:
  - name: pods-user-authorized-for-groups
    match:
      resources:
        kinds:
        - Pod
        namespaces:
        - "user-?*"
    preconditions:
    - key: "{{ request.operation }}"
      operator: In
      value: ["CREATE","UPDATE"]
    context:
    - name: userGIDMap
      configMap:
        name: user-gids-map
        namespace: k8-ldap-configmap
    validate:
      message: "{{ request.object.metadata.namespace }} not authorized to use those supplemental groups"
      deny:
        conditions:
        - key: "{{ request.object.spec.securityContext.supplementalGroups }}"
          operator: NotIn
          value: "{{ userGIDMap.data.\"{{ request.object.metadata.namespace }}\" }}"

resources.yaml

---
apiVersion: v1
kind: Pod
metadata:
  name: test-skip
  namespace: test
spec: 
  containers:
  - name: nginx
    image: nginx:1.12
---
apiVersion: v1
kind: Pod
metadata:
  name: test-skip-op
  namespace: user-test
  labels:
    account: PZS0001
spec: 
  containers:
  - name: nginx
    image: nginx:1.12
---
apiVersion: v1
kind: Pod
metadata:
  name: test-pass
  namespace: user-test
spec:
  securityContext:
    supplementalGroups:
      - 1000
      - 1001
  containers:
  - name: nginx
    image: nginx:1.12
---
apiVersion: v1
kind: Pod
metadata:
  name: test-fail
  namespace: user-test
spec:
  securityContext:
    supplementalGroups:
      - 1002
  containers:
  - name: nginx
    image: nginx:1.12

test.yaml

---
name: pod-groups-validation
policies:
  - ../../policies/pod-groups-validation.yaml
resources:
  - resources.yaml
variables: variables.yaml
results:
  - policy: pod-groups-validation
    rule: pods-user-authorized-for-groups
    resource: test-skip
    status: skip
  - policy: pod-groups-validation
    rule: pods-user-authorized-for-groups
    resource: test-skip-op
    status: skip
  - policy: pod-groups-validation
    rule: pods-user-authorized-for-groups
    resource: test-pass
    status: pass
  - policy: pod-groups-validation
    rule: pods-user-authorized-for-groups
    resource: test-fail
    status: fail

variables.yaml

policies:
  - name: pod-groups-validation
    rules:
      - name: pods-user-authorized-for-groups
        values:
          userGIDMap.data.user-test: '["1000", "1001"]'
    resources:
      - name: test-skip
        values:
          request.object.metadata.namespace: test
          request.operation: CREATE
      - name: test-skip-op
        values:
          request.object.metadata.namespace: user-test
          request.operation: DELETE
      - name: test-pass
        values:
          request.object.metadata.namespace: user-test
          request.object.spec.securityContext.supplementalGroups: '["1000", "1001"]'
          request.operation: CREATE
      - name: test-fail
        values:
          request.object.metadata.namespace: user-test
          request.object.spec.securityContext.supplementalGroups: '["1002"]'
          request.operation: CREATE