turbot/steampipe-mod-kubernetes-compliance

Control: PodTemplate containers argument authorization mode should have RBAC

Description

This check ensures that the container in the PodTemplate has RBAC included in the argument authorization mode.

Usage

Run the control in your terminal:

powerpipe control run kubernetes_compliance.control.pod_template_container_argument_authorization_mode_rbac

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run kubernetes_compliance.control.pod_template_container_argument_authorization_mode_rbac --share

SQL

This control uses a named query:

with container_list as (
select
c ->> 'name' as container_name,
trim('"' from split_part(co::text, '=', 2)) as value,
j.name as pod_template
from
kubernetes_pod_template as j,
jsonb_array_elements(template -> 'spec' -> 'containers') as c,
jsonb_array_elements(c -> 'command') as co
where
(co)::text LIKE '%--authorization-mode=%'
), container_name_with_pod_template_name as (
select
j.name as pod_template_name,
j.uid as pod_template_uid,
j.path as path,
j.start_line as start_line,
j.end_line as end_line,
j.context_name as context_name,
j.namespace as namespace,
j.source_type as source_type,
j.tags as tags,
j._ctx as _ctx,
c.*
from
kubernetes_pod_template as j,
jsonb_array_elements(template -> 'spec' -> 'containers') as c
)
select
coalesce(j.pod_template_uid, concat(j.path, ':', j.start_line)) as resource,
case
when (j.value -> 'command') is null then 'ok'
when (j.value -> 'command') @> '["kube-apiserver"]' and l.container_name is null then 'alarm'
when l.container_name is not null and (j.value -> 'command') @> '["kube-apiserver"]' and not ((l.value) like '%RBAC%') then 'alarm'
when l.container_name is not null and (j.value -> 'command') @> '["kube-apiserver"]' and ((l.value) like '%RBAC%') then 'ok'
else 'ok'
end as status,
case
when (j.value -> 'command') is null then j.value ->> 'name' || ' command not defined.'
when (j.value -> 'command') @> '["kube-apiserver"]' and l.container_name is null then j.value ->> 'name' || ' authorization mode not set.'
when l.container_name is not null and (j.value -> 'command') @> '["kube-apiserver"]' and not ((l.value) like '%RBAC%') then j.value ->> 'name' || ' authorization mode not set to RBAC.'
when l.container_name is not null and (j.value -> 'command') @> '["kube-apiserver"]' and ((l.value) like '%RBAC%') then j.value ->> 'name' || ' authorization mode set to RBAC.'
else j.value ->> 'name' || ' kube-apiserver not defined.'
end as reason,
j.pod_template_name as pod_template_name
, coalesce(context_name, '') as context_name, namespace, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as path
from
container_name_with_pod_template_name as j
left join container_list as l on j.value ->> 'name' = l.container_name and j.pod_template_name = l.pod_template;

Tags