Query: pod_security_policy_security_services_hardening

select
  coalesce(uid, concat(path, ':', start_line)) as resource,
  case
    when se_linux -> 'rule' = '"MustRunAs"' then 'ok'
    when annotations -> 'apparmor.security.beta.kubernetes.io/defaultProfileName' = '"runtime/default"' then 'ok'
    when annotations -> 'seccomp.security.alpha.kubernetes.io/defaultProfileName' = '"runtime/default"' then 'ok'
    else 'alarm'
  end as status,
  case
    when se_linux -> 'rule' = '"MustRunAs"' then 'Applications using SELinux security service.'
    when annotations -> 'apparmor.security.beta.kubernetes.io/defaultProfileName' = '"runtime/default"' then 'Pod security policy ' || name || ' using AppArmor security service.'
    when annotations -> 'seccomp.security.alpha.kubernetes.io/defaultProfileName' = '"runtime/default"' then 'Pod security policy ' || name || ' using Seccomp security service.'
    else 'Pod security policy ' || name || ' not using securty services.'
  end as reason
  
  , coalesce(context_name, '') as context_name, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as path
from
  kubernetes_pod_security_policy;