Control: PodTemplate containers admission control plugin should be set to 'always pull images'
Description
This check ensures that the container in the PodTemplate has 'always pull images' configured for the admission control plugin.
Usage
Run the control in your terminal:
powerpipe control run kubernetes_compliance.control.pod_template_container_admission_control_plugin_always_pull_images
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run kubernetes_compliance.control.pod_template_container_admission_control_plugin_always_pull_images --share
SQL
This control uses a named query:
with container_list as ( select c ->> 'name' as container_name, trim( '"' from split_part(co :: text, '=', 2) ) as value, j.name as pod_template from kubernetes_pod_template as j, jsonb_array_elements(template -> 'spec' -> 'containers') as c, jsonb_array_elements(c -> 'command') as co where (co) :: text LIKE '%--enable-admission-plugins=%'),container_name_with_pod_template_name as ( select j.name as pod_template_name, j.uid as pod_template_uid, j.path as path, j.start_line as start_line, j.end_line as end_line, j.context_name as context_name, j.namespace as namespace, j.source_type as source_type, j.tags as tags, j._ctx as _ctx, c.* from kubernetes_pod_template as j, jsonb_array_elements(template -> 'spec' -> 'containers') as c)select coalesce( j.pod_template_uid, concat(j.path, ':', j.start_line) ) as resource, case when (j.value -> 'command') is null or not ((j.value -> 'command') @> '["kube-apiserver"]') then 'ok' when l.container_name is not null and (j.value -> 'command') @> '["kube-apiserver"]' and ((l.value) like '%AlwaysPullImages%') then 'ok' else 'alarm' end as status, case when (j.value -> 'command') is null then j.value ->> 'name' || ' command not defined.' when not ((j.value -> 'command') @> '["kube-apiserver"]') then j.value ->> 'name' || ' kube-apiserver not defined.' when l.container_name is not null and (j.value -> 'command') @> '["kube-apiserver"]' and ((l.value) like '%AlwaysPullImages%') then j.value ->> 'name' || ' admission control plugin set to always pull images.' else j.value ->> 'name' || ' admission control plugin not set to always pull images.' end as reason, j.pod_template_name as pod_template_name, coalesce(context_name, '') as context_name, namespace, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as pathfrom container_name_with_pod_template_name as j left join container_list as l on j.value ->> 'name' = l.container_name and j.pod_template_name = l.pod_template;