-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Ved Ratan <[email protected]> updated adapter for namespaced policy Signed-off-by: Ved Ratan <[email protected]> added clusterpolicy logic Signed-off-by: Ved Ratan <[email protected]> minor fixes Signed-off-by: Ved Ratan <[email protected]>
- Loading branch information
Showing
22 changed files
with
3,441 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| apiVersion: intent.security.nimbus.com/v1 | ||
| kind: SecurityIntent | ||
| metadata: | ||
| name: escape-to-host | ||
| spec: | ||
| intent: | ||
| id: escapeToHost | ||
| description: "A attacker can breach container boundaries and can gain access to the host machine" | ||
| action: Block | ||
| --- | ||
| apiVersion: intent.security.nimbus.com/v1 | ||
| kind: ClusterSecurityIntentBinding | ||
| metadata: | ||
| name: escape-to-host-binding | ||
| spec: | ||
| intents: | ||
| - name: escape-to-host | ||
| selector: | ||
| resources: | ||
| - kind: Pod | ||
| name: pod1 | ||
| namespace: ns1 | ||
| matchLabels: | ||
| app: db | ||
| env: dev | ||
|
|
||
| - kind: Pod | ||
| name: pod1 | ||
| namespace: ns2 | ||
| matchLabels: | ||
| app: mongo | ||
| env: prod |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| apiVersion: intent.security.nimbus.com/v1 | ||
| kind: SecurityIntent | ||
| metadata: | ||
| name: escape-to-host | ||
| spec: | ||
| intent: | ||
| id: escapeToHost | ||
| description: "A attacker can breach container boundaries and can gain access to the host machine" | ||
| action: Block | ||
|
|
||
| --- | ||
|
|
||
| apiVersion: intent.security.nimbus.com/v1 | ||
| kind: SecurityIntentBinding | ||
| metadata: | ||
| name: escape-to-host-binding | ||
| spec: | ||
| intents: | ||
| - name: escape-to-host | ||
| selector: | ||
| any: | ||
| - resources: | ||
| kind: Pod | ||
| namespace: default | ||
| matchLabels: | ||
| app: nginx |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| bin/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # Copyright 2023 Authors of Nimbus | ||
|
|
||
| # Build the nimbus-kubearmor binary | ||
| FROM golang:1.21 as builder | ||
| ARG TARGETOS | ||
| ARG TARGETARCH | ||
|
|
||
| WORKDIR /workspace | ||
| # Copy the Go Modules manifests | ||
| COPY go.mod go.mod | ||
| COPY go.sum go.sum | ||
| # cache deps before building and copying source so that we don't need to re-download as much | ||
| # and so that source changes don't invalidate our downloaded layer | ||
| RUN go mod download | ||
|
|
||
| # Copy the go source | ||
| COPY main.go main.go | ||
| COPY manager/ manager/ | ||
| COPY processor/ processor/ | ||
| COPY watcher/ watcher/ | ||
|
|
||
| # Build | ||
| # the GOARCH has not a default value to allow the binary be built according to the host where the command | ||
| # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO | ||
| # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore, | ||
| # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform. | ||
| RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -ldflags="-w" -a -o nimbus-kubearmor main.go | ||
|
|
||
| FROM gcr.io/distroless/static:nonroot | ||
| WORKDIR / | ||
| COPY --from=builder /workspace/nimbus-kyverno . | ||
| USER 65532:65532 | ||
|
|
||
| ENTRYPOINT ["/nimbus-kyverno"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # Copyright 2023 Authors of Nimbus | ||
|
|
||
| # Image URL to use all building/pushing image targets | ||
| IMG ?= 5gsec/nimbus-kyverno | ||
| # Image Tag to use all building/pushing image targets | ||
| TAG ?= v0.1 | ||
|
|
||
| CONTAINER_TOOL ?= docker | ||
| BINARY ?= bin/nimbus-kyverno | ||
|
|
||
| build: | ||
| @go build -ldflags="-w" -o ${BINARY} main.go | ||
|
|
||
| run: build | ||
| @./${BINARY} | ||
|
|
||
| .PHONY: docker-build | ||
| docker-build: | ||
| $(CONTAINER_TOOL) build -t ${IMG}:${TAG} -t ${IMG}:latest --build-arg VERSION=${TAG} . | ||
|
|
||
| .PHONY: docker-push | ||
| docker-push: | ||
| $(CONTAINER_TOOL) push ${IMG}:${TAG} | ||
| $(CONTAINER_TOOL) push ${IMG}:latest | ||
|
|
||
| PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le | ||
| .PHONY: docker-buildx | ||
| docker-buildx: | ||
| # copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile | ||
| sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross | ||
| - $(CONTAINER_TOOL) buildx create --name project-v3-builder | ||
| $(CONTAINER_TOOL) buildx use project-v3-builder | ||
| - $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --build-arg VERSION=${TAG} --tag ${IMG}:${TAG} -f Dockerfile.cross . || { $(CONTAINER_TOOL) buildx rm project-v3-builder; rm Dockerfile.cross; exit 1; } | ||
| - $(CONTAINER_TOOL) buildx rm project-v3-builder | ||
| rm Dockerfile.cross |
Oops, something went wrong.