From 17c43fd3664987b3e8340e698cdccec2b43e712c Mon Sep 17 00:00:00 2001 From: YiscahLevySilas1 <80635572+YiscahLevySilas1@users.noreply.github.com> Date: Thu, 20 Jul 2023 15:23:58 +0200 Subject: [PATCH] support related objects (#1272) * support related objects Signed-off-by: YiscahLevySilas1 * update pkg versions Signed-off-by: YiscahLevySilas1 * update go mod Signed-off-by: YiscahLevySilas1 * fix test Signed-off-by: YiscahLevySilas1 * fix test Signed-off-by: YiscahLevySilas1 * only add ids of related resource Signed-off-by: YiscahLevySilas1 * fixes following review Signed-off-by: YiscahLevySilas1 * add test for processRule Signed-off-by: YiscahLevySilas1 --------- Signed-off-by: YiscahLevySilas1 --- core/pkg/opaprocessor/processorhandler.go | 9 + .../pkg/opaprocessor/processorhandler_test.go | 95 +- .../testdata/opaSessionObjMock1.json | 40651 ++++++++++++++++ .../opaprocessor/testdata/resourcesMock1.json | 220 + .../prioritizationhandler_test.go | 11 +- go.mod | 11 +- go.sum | 17 +- httphandler/go.mod | 8 +- httphandler/go.sum | 17 +- 9 files changed, 41005 insertions(+), 34 deletions(-) create mode 100644 core/pkg/opaprocessor/testdata/opaSessionObjMock1.json create mode 100644 core/pkg/opaprocessor/testdata/resourcesMock1.json diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index 637d7e47..3f95512a 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -332,6 +332,15 @@ func (opap *OPAProcessor) processRule(ctx context.Context, rule *reporthandling. if ruleResponse.FixCommand != "" { ruleResult.Paths = append(ruleResult.Paths, armotypes.PosturePaths{FixCommand: ruleResponse.FixCommand}) } + // if ruleResponse has relatedObjects, add it to ruleResult + if len(ruleResponse.RelatedObjects) > 0 { + for _, relatedObject := range ruleResponse.RelatedObjects { + wl := objectsenvelopes.NewObject(relatedObject.Object) + if wl != nil { + ruleResult.RelatedResourcesIDs = append(ruleResult.RelatedResourcesIDs, wl.GetID()) + } + } + } resources[failedResource.GetID()] = ruleResult } diff --git a/core/pkg/opaprocessor/processorhandler_test.go b/core/pkg/opaprocessor/processorhandler_test.go index 0e396dee..5305ba4a 100644 --- a/core/pkg/opaprocessor/processorhandler_test.go +++ b/core/pkg/opaprocessor/processorhandler_test.go @@ -16,6 +16,7 @@ import ( "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/mocks" "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" "github.com/kubescape/opa-utils/resources" "github.com/stretchr/testify/assert" @@ -25,10 +26,14 @@ import ( var ( //go:embed testdata/opaSessionObjMock.json opaSessionObjMockData string + //go:embed testdata/opaSessionObjMock1.json + opaSessionObjMockData1 string //go:embed testdata/regoDependenciesDataMock.json regoDependenciesData string allResourcesMockData []byte + //go:embed testdata/resourcesMock1.json + resourcesMock1 []byte ) func unzipAllResourcesTestDataAndSetVar(zipFilePath, destFilePath string) error { @@ -73,17 +78,17 @@ func unzipAllResourcesTestDataAndSetVar(zipFilePath, destFilePath string) error return nil } -func NewOPAProcessorMock() *OPAProcessor { +func NewOPAProcessorMock(opaSessionObjMock string, resourcesMock []byte) *OPAProcessor { opap := &OPAProcessor{} if err := json.Unmarshal([]byte(regoDependenciesData), &opap.regoDependenciesData); err != nil { panic(err) } // no err check because Unmarshal will fail on AllResources field (expected) - json.Unmarshal([]byte(opaSessionObjMockData), &opap.OPASessionObj) + json.Unmarshal([]byte(opaSessionObjMock), &opap.OPASessionObj) opap.AllResources = make(map[string]workloadinterface.IMetadata) allResources := make(map[string]map[string]interface{}) - if err := json.Unmarshal(allResourcesMockData, &allResources); err != nil { + if err := json.Unmarshal(resourcesMock, &allResources); err != nil { panic(err) } for i := range allResources { @@ -149,7 +154,7 @@ func BenchmarkProcess(b *testing.B) { testName := fmt.Sprintf("opaprocessor.Process_%d", maxGoRoutines) b.Run(testName, func(b *testing.B) { // setup - opap := NewOPAProcessorMock() + opap := NewOPAProcessorMock(opaSessionObjMockData, allResourcesMockData) b.ResetTimer() var maxHeap uint64 quitChan := make(chan bool) @@ -245,3 +250,85 @@ func TestProcessResourcesResult(t *testing.T) { assert.Equal(t, 0, summaryDetails.ListResourcesIDs(nil).Passed()) assert.Equal(t, 0, summaryDetails.ListResourcesIDs(nil).Skipped()) } + +// don't parallelize this test because it uses a global variable - allResourcesMockData +func TestProcessRule(t *testing.T) { + testCases := []struct { + name string + rule reporthandling.PolicyRule + resourcesMock []byte + opaSessionObjMock string + expectedResult map[string]*resourcesresults.ResourceAssociatedRule + }{ + { + name: "TestRelatedResourcesIDs", + rule: reporthandling.PolicyRule{ + PortalBase: armotypes.PortalBase{ + Name: "exposure-to-internet", + Attributes: map[string]interface{}{ + "armoBuiltin": true, + }, + }, + Rule: "package armo_builtins\n\n# Checks if NodePort or LoadBalancer is connected to a workload to expose something\ndeny[msga] {\n service := input[_]\n service.kind == \"Service\"\n is_exposed_service(service)\n \n wl := input[_]\n spec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Pod\", \"Job\", \"CronJob\"}\n spec_template_spec_patterns[wl.kind]\n wl_connected_to_service(wl, service)\n failPath := [\"spec.type\"]\n msga := {\n \"alertMessage\": sprintf(\"workload '%v' is exposed through service '%v'\", [wl.metadata.name, service.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 7,\n \"fixPaths\": [],\n \"failedPaths\": [],\n \"alertObject\": {\n \"k8sApiObjects\": [wl]\n },\n \"relatedObjects\": [{\n \"object\": service,\n \"failedPaths\": failPath,\n }]\n }\n}\n\n# Checks if Ingress is connected to a service and a workload to expose something\ndeny[msga] {\n ingress := input[_]\n ingress.kind == \"Ingress\"\n \n svc := input[_]\n svc.kind == \"Service\"\n # avoid duplicate alerts\n # if service is already exposed through NodePort or LoadBalancer workload will fail on that\n not is_exposed_service(svc)\n\n wl := input[_]\n spec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Pod\", \"Job\", \"CronJob\"}\n spec_template_spec_patterns[wl.kind]\n wl_connected_to_service(wl, svc)\n\n result := svc_connected_to_ingress(svc, ingress)\n \n msga := {\n \"alertMessage\": sprintf(\"workload '%v' is exposed through ingress '%v'\", [wl.metadata.name, ingress.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"failedPaths\": [],\n \"fixPaths\": [],\n \"alertScore\": 7,\n \"alertObject\": {\n \"k8sApiObjects\": [wl]\n },\n \"relatedObjects\": [{\n \"object\": ingress,\n \"failedPaths\": result,\n }]\n }\n} \n\n# ====================================================================================\n\nis_exposed_service(svc) {\n svc.spec.type == \"NodePort\"\n}\n\nis_exposed_service(svc) {\n svc.spec.type == \"LoadBalancer\"\n}\n\nwl_connected_to_service(wl, svc) {\n count({x | svc.spec.selector[x] == wl.metadata.labels[x]}) == count(svc.spec.selector)\n}\n\nwl_connected_to_service(wl, svc) {\n wl.spec.selector.matchLabels == svc.spec.selector\n}\n\n# check if service is connected to ingress\nsvc_connected_to_ingress(svc, ingress) = result {\n rule := ingress.spec.rules[i]\n paths := rule.http.paths[j]\n svc.metadata.name == paths.backend.service.name\n result := [sprintf(\"ingress.spec.rules[%d].http.paths[%d].backend.service.name\", [i,j])]\n}\n\n", + Match: []reporthandling.RuleMatchObjects{ + { + APIGroups: []string{""}, + APIVersions: []string{"v1"}, + Resources: []string{"Pod", "Service"}, + }, + { + APIGroups: []string{"apps"}, + APIVersions: []string{"v1"}, + Resources: []string{"Deployment", "ReplicaSet", "DaemonSet", "StatefulSet"}, + }, + { + APIGroups: []string{"batch"}, + APIVersions: []string{"*"}, + Resources: []string{"Job", "CronJob"}, + }, + { + APIGroups: []string{"extensions", "networking.k8s.io"}, + APIVersions: []string{"v1beta1", "v1"}, + Resources: []string{"Ingress"}, + }, + }, + Description: "fails in case the running workload has binded Service or Ingress that are exposing it on Internet.", + Remediation: "", + RuleQuery: "armo_builtins", + RuleLanguage: reporthandling.RegoLanguage, + }, + resourcesMock: resourcesMock1, + opaSessionObjMock: opaSessionObjMockData1, + expectedResult: map[string]*resourcesresults.ResourceAssociatedRule{ + "/v1/default/Pod/fake-pod-1-22gck": { + Name: "exposure-to-internet", + ControlConfigurations: map[string][]string{}, + Status: "failed", + SubStatus: "", + Paths: nil, + Exception: nil, + RelatedResourcesIDs: []string{ + "/v1/default/Service/fake-service-1", + }, + }, + "/v1/default/Service/fake-service-1": { + Name: "exposure-to-internet", + ControlConfigurations: map[string][]string{}, + Status: "passed", + SubStatus: "", + Paths: nil, + Exception: nil, + RelatedResourcesIDs: nil, + }, + }, + }, + } + for _, tc := range testCases { + // since all resources JSON is a large file, we need to unzip it and set the variable before running the benchmark + unzipAllResourcesTestDataAndSetVar("testdata/allResourcesMock.json.zip", "testdata/allResourcesMock.json") + opap := NewOPAProcessorMock(tc.opaSessionObjMock, tc.resourcesMock) + resources, _, err := opap.processRule(context.Background(), &tc.rule, nil) + assert.NoError(t, err) + assert.Equal(t, tc.expectedResult, resources) + } +} diff --git a/core/pkg/opaprocessor/testdata/opaSessionObjMock1.json b/core/pkg/opaprocessor/testdata/opaSessionObjMock1.json new file mode 100644 index 00000000..d12a6868 --- /dev/null +++ b/core/pkg/opaprocessor/testdata/opaSessionObjMock1.json @@ -0,0 +1,40651 @@ +{ + "K8SResources": { + + "/v1/pods": ["/v1/default/Pod/fake-pod-1-22gck"], + "/v1/services": ["/v1/default/Service/fake-service-1"] + }, + "ArmoResource": { + "armo.vuln.images/v1/ImageVulnerabilities": null, + "container.googleapis.com/v1/ClusterDescribe": null, + "eks.amazonaws.com/v1/ClusterDescribe": null, + "hostdata.kubescape.cloud/v1beta0/KubeletCommandLine": null, + "hostdata.kubescape.cloud/v1beta0/KubeletConfiguration": null, + "hostdata.kubescape.cloud/v1beta0/KubeletInfo": null, + "hostdata.kubescape.cloud/v1beta0/LinuxKernelVariables": null, + "hostdata.kubescape.cloud/v1beta0/cloudProviderInfo": null, + "image.vulnscan.com/v1/ImageVulnerabilities": null, + "management.azure.com/v1/ClusterDescribe": null + }, + "AllPolicies": { + "Controls": { + "C-0001": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Forbidden Container Registries", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Initial Access" + ] + }, + "controlID": "C-0001", + "creationTime": "", + "description": "In cases where the Kubernetes cluster is provided by a CSP (e.g., AKS in Azure, GKE in GCP, or EKS in AWS), compromised cloud credential can lead to the cluster takeover. Attackers may abuse cloud account credentials or IAM mechanism to the cluster’s management layer.", + "remediation": "Limit the registries from which you pull container images from", + "rules": [ + { + "guid": "", + "name": "rule-identify-blocklisted-image-registries", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Initial Access::Compromised images in registry" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\n# Check for images from blocklisted repos\n\nuntrustedImageRepo[msga] {\n\tpod := input[_]\n\tk := pod.kind\n\tk == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tpath := sprintf(\"spec.containers[%v].image\", [format_int(i, 10)])\n\timage := container.image\n untrusted_or_public_registries(image)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\nuntrustedImageRepo[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\timage := container.image\n untrusted_or_public_registries(image)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\nuntrustedImageRepo[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\timage := container.image\n untrusted_or_public_registries(image)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\nuntrusted_or_public_registries(image){\n\t# see default-config-inputs.json for list values\n\tuntrusted_registries := data.postureControlInputs.untrustedRegistries\n\trepo_prefix := untrusted_registries[_]\n\tstartswith(image, repo_prefix)\n}\n\nuntrusted_or_public_registries(image){\n\t# see default-config-inputs.json for list values\n\tpublic_registries := data.postureControlInputs.publicRegistries\n\trepo_prefix := public_registries[_]\n\tstartswith(image, repo_prefix)\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Pod", + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet", + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.publicRegistries", + "settings.postureControlInputs.untrustedRegistries" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.publicRegistries", + "name": "Public registries", + "description": "Kubescape checks none of these public registries are in use." + }, + { + "path": "settings.postureControlInputs.untrustedRegistries", + "name": "Registries block list", + "description": "Kubescape checks none of the following registries are in use." + } + ], + "description": "Identifying if pod container images are from unallowed registries", + "remediation": "Use images from safe registry", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0002": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Exec into container", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Execution" + ], + "rbacQuery": "Show who can access into pods" + }, + "controlID": "C-0002", + "creationTime": "", + "description": "Attackers with relevant permissions can run malicious commands in the context of legitimate containers in the cluster using “kubectl exec” command. This control determines which subjects have permissions to use this command.", + "remediation": "It is recommended to prohibit “kubectl exec” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.", + "rules": [ + { + "guid": "", + "name": "exec-into-container-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Exec into container", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# input: regoResponseVectorObject\n# returns subjects that can exec into container\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"create\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"pods/exec\", \"pods/*\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can exec into containers\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "rbac.authorization.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "RoleBinding", + "ClusterRoleBinding", + "Role", + "ClusterRole" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have permissions to exec into pods", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + "C-0004": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Resources memory limit and request", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - service destruction" + ] + } + ], + "controlTypeTags": [ + "compliance", + "devops" + ] + }, + "controlID": "C-0004", + "creationTime": "", + "description": "This control identifies all Pods for which the memory limit is not set.", + "remediation": "Set the memory limit or use exception mechanism to avoid unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "resources-memory-limit-and-request", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if pod does not have container with memory-limit or request\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tnot request_or_limit_memory(container)\n\tfixPaths := [\n\t\t{\"path\": sprintf(\"spec.containers[%v].resources.limits.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t\t{\"path\": sprintf(\"spec.containers[%v].resources.requests.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have memory-limit or request\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPaths,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [pod]},\n\t}\n}\n\n# Fails if workload does not have container with memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tnot request_or_limit_memory(container)\n\tfixPaths := [\n\t\t{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.limits.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t\t{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.requests.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPaths,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\n# Fails if cronjob does not have container with memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tnot request_or_limit_memory(container)\n\tfixPaths := [\n\t\t{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.limits.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t\t{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.requests.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPaths,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\nrequest_or_limit_memory(container) {\n\tcontainer.resources.limits.memory\n\tcontainer.resources.requests.memory\n}\n\n######################################################################################################\n\n# Fails if pod exceeds memory-limit or request\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\trequest_or_limit_memory(container)\n\tresource := is_min_max_exceeded_memory(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v exceeds memory-limit or request\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [pod]},\n\t}\n}\n\n# Fails if workload exceeds memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\n\trequest_or_limit_memory(container)\n\tresource := is_min_max_exceeded_memory(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\n# Fails if cronjob exceeds memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\n\trequest_or_limit_memory(container)\n\tresource := is_min_max_exceeded_memory(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\n######################################################################################################\n\nis_min_max_exceeded_memory(container) = \"resources.limits.memory\" {\n\tmemory_limit := container.resources.limits.memory\n\tis_limit_exceeded_memory(memory_limit)\n} else = \"resouces.requests.memory\" {\n\tmemory_req := container.resources.requests.memory\n\tis_req_exceeded_memory(memory_req)\n} else = \"\" {\n\ttrue\n}\n\nis_limit_exceeded_memory(memory_limit) {\n\tis_min_limit_exceeded_memory(memory_limit)\n}\n\nis_limit_exceeded_memory(memory_limit) {\n\tis_max_limit_exceeded_memory(memory_limit)\n}\n\nis_req_exceeded_memory(memory_req) {\n\tis_max_request_exceeded_memory(memory_req)\n}\n\nis_req_exceeded_memory(memory_req) {\n\tis_min_request_exceeded_memory(memory_req)\n}\n\n# helpers\n\nis_max_limit_exceeded_memory(memory_limit) {\n\tmemory_limit_max :=data.postureControlInputs.memory_limit_max[_]\n\tcompare_max(memory_limit_max, memory_limit)\n}\n\nis_min_limit_exceeded_memory(memory_limit) {\n\tmemory_limit_min := data.postureControlInputs.memory_limit_min[_]\n\tcompare_min(memory_limit_min, memory_limit)\n}\n\nis_max_request_exceeded_memory(memory_req) {\n\tmemory_req_max := data.postureControlInputs.memory_request_max[_]\n\tcompare_max(memory_req_max, memory_req)\n}\n\nis_min_request_exceeded_memory(memory_req) {\n\tmemory_req_min := data.postureControlInputs.memory_request_min[_]\n\tcompare_min(memory_req_min, memory_req)\n}\n\n##############\n# helpers\n\n# Compare according to unit - max\ncompare_max(max, given) {\n\tendswith(max, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_max := split(max, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"M\")\n\tendswith(given, \"M\")\n\tsplit_max := split(max, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"m\")\n\tendswith(given, \"m\")\n\tsplit_max := split(max, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tnot is_special_measure(max)\n\tnot is_special_measure(given)\n\tgiven \u003e max\n}\n\n\n\n################\n# Compare according to unit - min\ncompare_min(min, given) {\n\tendswith(min, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_min := split(min, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"M\")\n\tendswith(given, \"M\")\n\tsplit_min := split(min, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"m\")\n\tendswith(given, \"m\")\n\tsplit_min := split(min, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tnot is_special_measure(min)\n\tnot is_special_measure(given)\n\tgiven \u003c min\n}\n\n\n# Check that is same unit\nis_special_measure(unit) {\n\tendswith(unit, \"m\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"M\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"Mi\")\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet", + "Job", + "Pod", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.memory_request_max", + "settings.postureControlInputs.memory_request_min", + "settings.postureControlInputs.memory_limit_max", + "settings.postureControlInputs.memory_limit_min" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.memory_request_max", + "name": "memory_request_max", + "description": "Ensure memory max requests are set" + }, + { + "path": "settings.postureControlInputs.memory_request_min", + "name": "memory_request_min", + "description": "Ensure memory min requests are set" + }, + { + "path": "settings.postureControlInputs.memory_limit_max", + "name": "memory_limit_max", + "description": "Ensure memory max limits are set" + }, + { + "path": "settings.postureControlInputs.memory_limit_min", + "name": "memory_limit_min", + "description": "Ensure memory min limits are set" + } + ], + "description": "memory limits and requests are not set.", + "remediation": "Ensure memory limits and requests are set.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0005": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "API server insecure port is enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0005", + "creationTime": "", + "description": "Kubernetes control plane API is running with non-secure port enabled which allows attackers to gain unprotected access to the cluster.", + "remediation": "Set the insecure-port flag of the API server to zero.", + "rules": [ + { + "guid": "", + "name": "insecure-port-flag", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Fails if pod has insecure-port flag enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontains(pod.metadata.name, \"kube-apiserver\")\n container := pod.spec.containers[i]\n\tpath = is_insecure_port_flag(container, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"The API server container: %v has insecure-port flag enabled\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\t\nis_insecure_port_flag(container, i) = path {\n\tcommand := container.command[j]\n\tcontains(command, \"--insecure-port=1\")\n\tpath := sprintf(\"spec.containers[%v].command[%v]\", [format_int(i, 10), format_int(j, 10)])\n}", + "resourceEnumerator": "package armo_builtins\nimport data.cautils as cautils\n\n# Fails if pod has insecure-port flag enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontains(pod.metadata.name, \"kube-apiserver\")\n container := pod.spec.containers[_]\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"The API server container: %v has insecure-port flag enabled\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if the api server has insecure-port enabled", + "remediation": "Make sure that the insecure-port flag of the api server is set to 0", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + }, + "C-0007": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Data Destruction", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Impact" + ], + "rbacQuery": "Data destruction" + }, + "controlID": "C-0007", + "creationTime": "", + "description": "Attackers may attempt to destroy data and resources in the cluster. This includes deleting deployments, configurations, storage, and compute resources. This control identifies all subjects that can delete resources.", + "remediation": "You should follow the least privilege principle and minimize the number of subjects that can delete resources.", + "rules": [ + { + "guid": "", + "name": "rule-excessive-delete-rights-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Impact::Data Destruction", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can can delete important resources\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"delete\", \"deletecollection\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\", \"apps\", \"batch\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"secrets\", \"pods\", \"services\", \"deployments\", \"replicasets\", \"daemonsets\", \"statefulsets\", \"jobs\", \"cronjobs\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can delete important resources\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if user can delete important resources", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + "C-0009": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Resource limits", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - service destruction" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0009", + "creationTime": "", + "description": "CPU and memory resources should have a limit set for every container or a namespace to prevent resource exhaustion. This control identifies all the Pods without resource limit definitions by checking their yaml definition file as well as their namespace LimitRange objects. It is also recommended to use ResourceQuota object to restrict overall namespace resources, but this is not verified by this control.", + "remediation": "Define LimitRange and Resource Limits in the namespace or in the deployment/POD yamls.", + "rules": [ + { + "guid": "", + "name": "resource-policies", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if container has limits\ndeny[msga] {\n \tpods := [pod | pod = input[_]; pod.kind == \"Pod\"]\n pod := pods[_]\n\tcontainer := pod.spec.containers[i]\n\t\n\t\n\tbeggining_of_path := \"spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Check if container has limits - for workloads\n# If there is no limits specified in the workload, we check the namespace, since if limits are only specified for namespace\n# and not in workload, it won't be on the yaml\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\t\n\tbeggining_of_path\t:= \"spec.template.spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\t\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n\t\n}\n\n# Check if container has limits - for cronjobs\n# If there is no limits specified in the cronjob, we check the namespace, since if limits are only specified for namespace\n# and not in cronjob, it won't be on the yaml\ndeny [msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\t\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# no limits at all\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tnot container.resources.limits\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}, {\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}\n\n# only memory limit\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.cpu\n\tcontainer.resources.limits.memory\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}\n\n# only cpu limit\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) =fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.memory\n\tcontainer.resources.limits.cpu\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n\tfailed_path = \"\"\n}\n# limits but without capu and memory \nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.memory\n\tnot container.resources.limits.cpu\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}, {\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if namespace has no resource policies defined", + "remediation": "Make sure that you definy resource policies (LimitRange or ResourceQuota) which limit the usage of resources for all the namespaces", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0012": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Applications credentials in configuration files", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Credential access" + ] + }, + { + "attackTrack": "container", + "categories": [ + "Credential access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Credential access", + "Lateral Movement" + ] + }, + "controlID": "C-0012", + "creationTime": "", + "description": "Attackers who have access to configuration files can steal the stored secrets and use them. This control checks if ConfigMaps or pod specifications have sensitive information in their configuration.", + "remediation": "Use Kubernetes secrets or Key Management Systems to store credentials.", + "rules": [ + { + "guid": "", + "name": "rule-credentials-in-env-var", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "\tpackage armo_builtins\n\t# import data.cautils as cautils\n\t# import data.kubernetes.api.client as client\n\timport data\n\n\tdeny[msga] {\n\t\tpod := input[_]\n\t\tpod.kind == \"Pod\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := pod.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Pod: %v has sensitive information in environment variables\", [pod.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [pod]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\t\tspec_template_spec_patterns[wl.kind]\n\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\t\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"%v: %v has sensitive information in environment variables\", [wl.kind, wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\twl.kind == \"CronJob\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\t\t\n\t\tis_not_reference(env)\n\t\t\n\t\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Cronjob: %v has sensitive information in environment variables\", [wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\n\nis_not_reference(env)\n{\n\tnot env.valueFrom.secretKeyRef\n\tnot env.valueFrom.configMapKeyRef\n}\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if Pods have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + }, + { + "guid": "", + "name": "rule-credentials-configmap", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "package armo_builtins\n# import data.cautils as cautils\n# import data.kubernetes.api.client as client\nimport data\n\n# fails if config map has keys with suspicious name\ndeny[msga] {\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n # see default-config-inputs.json for list values\n sensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n key_name := sensitive_key_names[_]\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n \n contains(lower(map_key), lower(key_name))\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n \n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - not base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n regex.match(value , map_secret)\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n decoded_secret := base64.decode(map_secret)\n \n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n regex.match(value , decoded_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveValues", + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveValues", + "name": "Values", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Below you can find some examples of popular value phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if ConfigMaps have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0013": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Non-root containers", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0013", + "creationTime": "", + "description": "Potential attackers may gain access to a container and leverage its existing privileges to conduct an attack. Therefore, it is not recommended to deploy containers with root privileges unless it is absolutely necessary. This control identifies all the Pods running as root or can escalate to root.", + "remediation": "If your application does not need root privileges, make sure to define the runAsUser or runAsGroup under the PodSecurityContext and use user ID 1000 or higher. Do not turn on allowPrivlegeEscalation bit and make sure runAsNonRoot is true.", + "rules": [ + { + "guid": "", + "name": "non-root-containers", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n################################################################################\n# Rules\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\n\tbeggining_of_path := \"spec\"\n\talertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v may run as root\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\n\tbeggining_of_path := \"spec.template.spec\"\n\talertInfo := evaluate_workload_non_root_container(container, wl.spec.template, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v may run as root\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has a container configured to run as root\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec\"\n\talertInfo := evaluate_workload_non_root_container(container, wl.spec.jobTemplate.spec.template, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\t\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v may run as root\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nget_failed_path(alertInfo, i) = [replace(alertInfo.failed_path,\"container_ndx\",format_int(i,10))] {\n\talertInfo.failed_path != \"\"\n} else = []\n\n\nget_fixed_path(alertInfo, i) = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}, {\"path\":replace(alertInfo.fixPath[1].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[1].value}]{\n\tcount(alertInfo.fixPath) == 2\n} else = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}] {\n\tcount(alertInfo.fixPath) == 1\n} else = []\n\n#################################################################################\n# Workload evaluation \n\nevaluate_workload_non_root_container(container, pod, beggining_of_path) = alertInfo {\n\trunAsNonRootValue := get_run_as_non_root_value(container, pod, beggining_of_path)\n\trunAsNonRootValue.value == false\n\t\n\trunAsUserValue := get_run_as_user_value(container, pod, beggining_of_path)\n\trunAsUserValue.value == 0\n\n\talertInfo := choose_first_if_defined(runAsUserValue, runAsNonRootValue)\n} else = alertInfo {\n allowPrivilegeEscalationValue := get_allow_privilege_escalation(container, pod, beggining_of_path)\n allowPrivilegeEscalationValue.value == true\n\n alertInfo := allowPrivilegeEscalationValue\n}\n\n\n#################################################################################\n# Value resolution functions\n\n\nget_run_as_non_root_value(container, pod, beggining_of_path) = runAsNonRoot {\n failed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : container.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [] ,\"defined\" : true}\n} else = runAsNonRoot {\n\tfailed_path := sprintf(\"%v.securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : pod.spec.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}], \"defined\" : false} {\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) , \"value\":\"true\"}, {\"path\":sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nget_run_as_user_value(container, pod, beggining_of_path) = runAsUser {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : container.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = runAsUser {\n\tfailed_path := sprintf(\"%v.securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : pod.spec.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}],\"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n\t\"defined\" : false}\n\nget_run_as_group_value(container, pod, beggining_of_path) = runAsGroup {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : container.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = runAsGroup {\n\tfailed_path := sprintf(\"%v.securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : pod.spec.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\":[], \"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}], \"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n \t\"defined\" : false\n}\n\nget_allow_privilege_escalation(container, pod, beggining_of_path) = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : container.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : pod.spec.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : true, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nchoose_first_if_defined(l1, l2) = c {\n l1.defined\n c := l1\n} else = l2\n\n\nis_allow_privilege_escalation_field(container, pod) {\n\tcontainer.securityContext.allowPrivilegeEscalation == false\n}\n\nis_allow_privilege_escalation_field(container, pod) {\n\tpod.spec.securityContext.allowPrivilegeEscalation == false\n}\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container can run as root", + "remediation": "Make sure that the user/group in the securityContext of pod/container is set to an id less than 1000, or the runAsNonRoot flag is set to true. Also make sure that the allowPrivilegeEscalation field is set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0014": { + "rulesIDs": [ + "", + "", + "" + ], + "guid": "", + "name": "Access Kubernetes dashboard", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery", + "Lateral Movement" + ], + "rbacQuery": "Access k8s Dashboard" + }, + "controlID": "C-0014", + "creationTime": "", + "description": "Attackers who gain access to the dashboard service account or have its RBAC permissions can use its network access to retrieve information about resources in the cluster or change them. This control checks if a subject that is not dashboard service account is bound to dashboard role/clusterrole, or - if anyone that is not the dashboard pod is associated with dashboard service account.", + "remediation": "Make sure that the “Kubernetes Dashboard” service account is only bound to the Kubernetes dashboard following the least privilege principle.", + "rules": [ + { + "guid": "", + "name": "rule-access-dashboard-subject-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Access Kubernetes dashboard, Discovery::Access Kubernetes dashboard", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: regoResponseVectorObject\n# fails if a subject that is not dashboard service account is bound to dashboard role\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(subjectVector.relatedObjects[i].kind, \"Role\")\n\tendswith(subjectVector.relatedObjects[j].kind, \"Binding\")\n\n\trole.metadata.name == \"kubernetes-dashboard\"\n\tsubjectVector.name != \"kubernetes-dashboard\"\n\n\tsubject := rolebinding.subjects[k]\n path := [sprintf(\"relatedObjects[%v].subjects[%v]\", [format_int(j, 10), format_int(k, 10)])]\n\tfinalpath := array.concat(path, [sprintf(\"relatedObjects[%v].roleRef.name\", [format_int(j, 10)])])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %v-%v is bound to dashboard role/clusterrole\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if subject that is not dashboard service account is bound to dashboard role/clusterrole, or- if anyone that is not dashboard pod is associated with its service account.", + "remediation": "", + "ruleQuery": "", + "relevantCloudProviders": null + }, + { + "guid": "", + "name": "rule-access-dashboard-wl-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Access Kubernetes dashboard, Discovery::Access Kubernetes dashboard", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: \n# apiversion: \n# fails if pod that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n pod := input[_]\n pod.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(pod.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following pods: %s are associated with dashboard service account\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [\"spec.serviceaccountname\"],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# input: \n# apiversion: \n# fails if workload that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n wl.spec.template.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(wl.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is associated with dashboard service account\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"spec.template.spec.serviceaccountname\"],\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# input: \n# apiversion: \n# fails if CronJob that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n wl.spec.jobTemplate.spec.template.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(wl.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjob: %s is associated with dashboard service account\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [\"spec.jobTemplate.spec.template.spec.serviceaccountname\"],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if subject that is not dashboard service account is bound to dashboard role/clusterrole, or- if anyone that is not dashboard pod is associated with its service account.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + "C-0015": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "List Kubernetes secrets", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Credential access" + ] + } + ], + "controlTypeTags": [ + "security-impact", + "compliance" + ], + "microsoftMitreColumns": [ + "Credential access" + ], + "rbacQuery": "Show who can access secrets" + }, + "controlID": "C-0015", + "creationTime": "", + "description": "Attackers who have permissions to access secrets can access sensitive information that might include credentials to various services. This control determines which user, group or service account can list/get secrets.", + "remediation": "Monitor and approve list of users, groups and service accounts that can access secrets. Use exception mechanism to prevent repetitive the notifications.", + "rules": [ + { + "guid": "", + "name": "rule-can-list-get-secrets-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Discovery::Access the K8s API server", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can list/get secrets \ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"get\", \"list\", \"watch\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"secrets\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can read secrets\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can list/get secrets", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0016": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Allow privilege escalation", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0016", + "creationTime": "", + "description": "Attackers may gain access to a container and uplift its privilege to enable excessive capabilities.", + "remediation": "If your application does not need it, make sure the allowPrivilegeEscalation field of the securityContext is set to false.", + "rules": [ + { + "guid": "", + "name": "rule-allow-privilege-escalation", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has container that allow privilege escalation\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v allow privilege escalation\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has a container that allow privilege escalation\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v allow privilege escalation\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has a container that allow privilege escalation\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v allow privilege escalation\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n not container.securityContext.allowPrivilegeEscalation == false\n\tnot container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) == 0\n\tfailed_path = \"\"\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)]), \"value\":\"false\"} \n}\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n not container.securityContext.allowPrivilegeEscalation == false\n\tnot container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) \u003e 0\n\tpsp := psps[_]\n\tnot psp.spec.allowPrivilegeEscalation == false\n\tfailed_path = \"\"\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)]), \"value\":\"false\"} \n}\n\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) == 0\n\tfixPath = \"\"\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)])\n}\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path)= [failed_path, fixPath] {\n container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) \u003e 0\n\tpsp := psps[_]\n\tnot psp.spec.allowPrivilegeEscalation == false\n\tfixPath = \"\"\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)])\n}\n\n get_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + }, + { + "apiGroups": [ + "policy" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "PodSecurityPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container allows privilege escalation", + "remediation": "Make sure that the allowPrivilegeEscalation field in the securityContext of pod/container is set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0017": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Immutable container filesystem", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Execution", + "Persistence" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0017", + "creationTime": "", + "description": "Mutable container filesystem can be abused to inject malicious code or data into containers. Use immutable (read-only) filesystem to limit potential attacks.", + "remediation": "Set the filesystem of the container to read-only when possible (POD securityContext, readOnlyRootFilesystem: true). If containers application needs to write into the filesystem, it is recommended to mount secondary filesystems for specific directories where application require write access.", + "rules": [ + { + "guid": "", + "name": "immutable-container-filesystem", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pods has container with mutable filesystem\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v has mutable filesystem\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has container with mutable filesystem \ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v has mutable filesystem\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has container with mutable filesystem \ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v has mutable filesystem\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Default of readOnlyRootFilesystem is false. This field is only in container spec and not pod spec\nis_mutable_filesystem(container, beggining_of_path, i) = [failed_path, fixPath] {\n\tcontainer.securityContext.readOnlyRootFilesystem == false\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.readOnlyRootFilesystem\", [beggining_of_path, format_int(i, 10)])\n\tfixPath = \"\"\n }\n\n is_mutable_filesystem(container, beggining_of_path, i) = [failed_path, fixPath] {\n\tnot container.securityContext.readOnlyRootFilesystem == false\n not container.securityContext.readOnlyRootFilesystem == true\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.readOnlyRootFilesystem\", [beggining_of_path, format_int(i, 10)]), \"value\": \"true\"}\n\tfailed_path = \"\"\n }\n\n\n get_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container has mutable filesystem", + "remediation": "Make sure that the securityContext.readOnlyRootFilesystem field in the container/pod spec is set to true", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + "C-0018": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Configured readiness probe", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0018", + "creationTime": "", + "description": "Readiness probe is intended to ensure that workload is ready to process network traffic. It is highly recommended to define readiness probe for every worker container. This control finds all the PODs where the readiness probe is not configured.", + "remediation": "Ensure Readiness probes are configured wherever possible.", + "rules": [ + { + "guid": "", + "name": "configured-readiness-probe", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod does not have container with readinessProbe\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tnot container.readinessProbe\n\tfix_path := {\"path\": sprintf(\"spec.containers[%v].readinessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have readinessProbe\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload does not have container with readinessProbe\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n not container.readinessProbe\n\tfix_path := {\"path\": sprintf(\"spec.template.spec.containers[%v].readinessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have readinessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob does not have container with readinessProbe\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n not container.readinessProbe\n\tfix_path := {\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].readinessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have readinessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Readiness probe is not configured", + "remediation": "Ensure Readiness probe is configured", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + "C-0020": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Mount service principal", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Credential Access" + ] + }, + "controlID": "C-0020", + "creationTime": "", + "description": "When a cluster is deployed in the cloud, in some cases attackers can leverage their access to a container in the cluster to gain cloud credentials. This control determines if any workload contains a volume with potential access to cloud credential.", + "remediation": "Refrain from using path mount to known cloud credentials folders or files .", + "rules": [ + { + "guid": "", + "name": "alert-mount-potential-credentials-paths", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport future.keywords.if\n\n\ndeny[msga] {\n\tprovider := data.dataControlInputs.cloudProvider\n\tprovider != \"\"\n\tresources := input[_]\n\tvolumes_data := get_volumes(resources)\n volumes := volumes_data[\"volumes\"]\n volume := volumes[i]\n\tbeggining_of_path := volumes_data[\"beggining_of_path\"]\n result := is_unsafe_paths(volume, beggining_of_path, provider,i)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as volume with potential credentials access.\", [resources.kind, resources.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [resources]\n\t\t}\n\t}\t\n}\n\n\t\n# get_volume - get resource volumes paths for {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\nget_volumes(resources) := result {\n\tresources_kinds := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tresources_kinds[resources.kind]\n\tresult = {\"volumes\": resources.spec.template.spec.volumes, \"beggining_of_path\": \"spec.template.spec.\"}\n}\n\n# get_volume - get resource volumes paths for \"Pod\"\nget_volumes(resources) := result {\n\tresources.kind == \"Pod\"\n\tresult = {\"volumes\": resources.spec.volumes, \"beggining_of_path\": \"spec.\"}\n}\n\n# get_volume - get resource volumes paths for \"CronJob\"\nget_volumes(resources) := result {\n\tresources.kind == \"CronJob\"\n\tresult = {\"volumes\": resources.spec.jobTemplate.spec.template.spec.volumes, \"beggining_of_path\": \"spec.jobTemplate.spec.template.spec.\"}\n}\n\n\n# is_unsafe_paths - looking for cloud provider (eks/gke/aks) paths that have the potential of accessing credentials\nis_unsafe_paths(volume, beggining_of_path, provider, i) = result {\n\tunsafe := unsafe_paths(provider)\n\tunsafe[_] == fix_path(volume.hostPath.path)\n\tresult= sprintf(\"%vvolumes[%d].hostPath.path\", [beggining_of_path, i])\n}\n\n\n# fix_path - adding \"/\" at the end of the path if doesn't exist and if not a file path.\nfix_path(path) := result if {\n\n\t# filter file path\n not regex.match(`[\\\\w-]+\\\\.`, path)\n\n\t# filter path that doesn't end with \"/\"\n not endswith(path, \"/\")\n\n\t# adding \"/\" to the end of the path\n result = sprintf(\"%v/\", [path])\n} else := path\n\n\n\n# eks unsafe paths\nunsafe_paths(x) := [\"/.aws/\", \n\t\t\t\t\t\"/.aws/config/\", \n\t\t\t\t\t\"/.aws/credentials/\"] if {x==\"eks\"}\n\n# aks unsafe paths\nunsafe_paths(x) := [\"/etc/\",\n\t\t\t\t\t\"/etc/kubernetes/\",\n\t\t\t\t\t\"/etc/kubernetes/azure.json\", \n\t\t\t\t\t\"/.azure/\",\n\t\t\t\t\t\"/.azure/credentials/\", \n\t\t\t\t\t\"/etc/kubernetes/azure.json\"] if {x==\"aks\"}\n\n# gke unsafe paths\nunsafe_paths(x) := [\"/.config/gcloud/\", \n\t\t\t\t\t\"/.config/\", \n\t\t\t\t\t\"/gcloud/\", \n\t\t\t\t\t\"/.config/gcloud/application_default_credentials.json\",\n\t\t\t\t\t\"/gcloud/application_default_credentials.json\"] if {x==\"gke\"}\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume", + "remediation": "Try to refrain from using hostPath mounts", + "ruleQuery": "", + "relevantCloudProviders": [ + "EKS", + "GKE", + "AKS" + ] + } + ], + "baseScore": 4 + }, + "C-0021": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Exposed sensitive interfaces", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Initial access" + ] + }, + "controlID": "C-0021", + "creationTime": "", + "description": "Exposing a sensitive interface to the internet poses a security risk. It might enable attackers to run malicious code or deploy containers in the cluster. This control checks if known components (e.g. Kubeflow, Argo Workflows, etc.) are deployed and exposed services externally.", + "remediation": "Consider blocking external interfaces or protect them with appropriate security tools.", + "rules": [ + { + "guid": "", + "name": "exposed-sensitive-interfaces-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Initial access::Exposed sensitive interfaces", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.kubernetes.api.client as client\nimport data\n\n# loadbalancer\ndeny[msga] {\n\twl := input[_]\n\tworkload_types = {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"Pod\", \"CronJob\"}\n\tworkload_types[wl.kind]\n\n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"LoadBalancer\"\n\n\tresult := wl_connectedto_service(wl, service)\n \n # externalIP := service.spec.externalIPs[_]\n\texternalIP := service.status.loadBalancer.ingress[0].ip\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\n\n# nodePort\n# get a pod connected to that service, get nodeIP (hostIP?)\n# use ip + nodeport\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"Pod\"\n \n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n \n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"NodePort\"\n\n\tresult := wl_connectedto_service(wl, service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n} \n\n# nodePort\n# get a workload connected to that service, get nodeIP (hostIP?)\n# use ip + nodeport\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"CronJob\"}\n\tspec_template_spec_patterns[wl.kind]\n \n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n \n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"NodePort\"\n\n\tresult := wl_connectedto_service(wl, service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\n# ====================================================================================\n\nwl_connectedto_service(wl, service) = paths{\n\tcount({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)\n\tpaths = [\"spec.selector.matchLabels\", \"service.spec.selector\"]\n}\n\nwl_connectedto_service(wl, service) = paths {\n\twl.spec.selector.matchLabels == service.spec.selector\n\tpaths = [\"spec.selector.matchLabels\", \"service.spec.selector\"]\n}", + "resourceEnumerator": "package armo_builtins\nimport data.kubernetes.api.client as client\nimport data\n\ndeny[msga] {\n\twl := input[_]\n\tworkload_types = {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"Pod\", \"CronJob\"}\n\tworkload_types[wl.kind]\n\n\t# see default-config-inputs.json for list values\n\twl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n\n\tsrvc := get_wl_connectedto_service(wl)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": srvc}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"wl: %v is in the cluster\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\nget_wl_connectedto_service(wl) = s {\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\twl_connectedto_service(wl, service)\n\ts = [service]\n}\n\nget_wl_connectedto_service(wl) = s {\n\tservices := [service | service = input[_]; service.kind == \"Service\"]\n\tcount({i | services[i]; wl_connectedto_service(wl, services[i])}) == 0\n\ts = []\n}\n\nwl_connectedto_service(wl, service){\n\tcount({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Service" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": [ + "settings.postureControlInputs.sensitiveInterfaces" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveInterfaces", + "name": "Sensitive interfaces", + "description": "The following interfaces were seen exploited. Kubescape checks it they are externally exposed." + } + ], + "description": "fails if known interfaces have exposed services", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0026": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Kubernetes CronJob", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Persistence" + ] + }, + "controlID": "C-0026", + "creationTime": "", + "description": "Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a POD in the cluster. This control lists all the CronJobs that exist in the cluster for the user to approve.", + "remediation": "Watch Kubernetes CronJobs and make sure they are legitimate.", + "rules": [ + { + "guid": "", + "name": "rule-deny-cronjobs", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Kubernetes Cronjob" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# alert cronjobs\n\n#handles cronjob\ndeny[msga] {\n\n\twl := input[_]\n\twl.kind == \"CronJob\"\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined: %v\", [wl.metadata.name]),\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if it's cronjob", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 1 + }, + "C-0030": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Ingress and Egress blocked", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ] + }, + "controlID": "C-0030", + "creationTime": "", + "description": "Disable Ingress and Egress traffic on all pods wherever possible. It is recommended to define restrictive network policy on all new PODs, and then enable sources/destinations that this POD must communicate with.", + "remediation": "Define a network policy that restricts ingress and egress connections.", + "rules": [ + { + "guid": "", + "name": "ingress-and-egress-blocked", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# For pods\ndeny[msga] {\n \t\tpods := [pod | pod= input[_]; pod.kind == \"Pod\"]\n\t\tnetworkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\t\tpod := pods[_]\n\t\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; pod_connected_to_network_policy(pod, networkpolicie)]\n\t\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\t\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v does not have ingress/egress defined\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n\n}\n\n# For pods\ndeny[msga] {\n \t\tpods := [pod | pod= input[_]; pod.kind == \"Pod\"]\n\t\tnetworkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\t\tpod := pods[_]\n\t\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; pod_connected_to_network_policy(pod, networkpolicie)]\n\t\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v does not have ingress/egress defined\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n\n}\n\n# For workloads\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; wlConnectedToNetworkPolicy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# For workloads\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; wlConnectedToNetworkPolicy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# For Cronjobs\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; cronjob_connected_to_network_policy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# For Cronjobs\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; cronjob_connected_to_network_policy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tmetadata1.namespace == metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tnot metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata2.namespace\n\tmetadata1.namespace == \"default\"\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tmetadata2.namespace == \"default\"\n}\n\npod_connected_to_network_policy(pod, networkpolicie){\n\tis_same_namespace(networkpolicie.metadata, pod.metadata)\n count(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == pod.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\npod_connected_to_network_policy(pod, networkpolicie){\n\tis_same_namespace(networkpolicie.metadata ,pod.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\nwlConnectedToNetworkPolicy(wl, networkpolicie){\n\tis_same_namespace(wl.metadata , networkpolicie.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\n\nwlConnectedToNetworkPolicy(wl, networkpolicie){\n\tis_same_namespace(wl.metadata, networkpolicie.metadata)\n\tcount(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == wl.spec.template.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\n\ncronjob_connected_to_network_policy(cj, networkpolicie){\n\tis_same_namespace(cj.metadata , networkpolicie.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\ncronjob_connected_to_network_policy(cj, networkpolicie){\n\tis_same_namespace(cj.metadata , networkpolicie.metadata)\n\tcount(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == cj.spec.jobTemplate.spec.template.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\nis_ingerss_egress_policy(networkpolicie) {\n list_contains(networkpolicie.spec.policyTypes, \"Ingress\")\n list_contains(networkpolicie.spec.policyTypes, \"Egress\")\n }\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if there are no ingress and egress defined for pod", + "remediation": "Make sure you define ingress and egress policies for all your Pods", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0031": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Delete Kubernetes events", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Defense evasion" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Defense evasion" + ], + "rbacQuery": "Show who can delete k8s events" + }, + "controlID": "C-0031", + "creationTime": "", + "description": "Attackers may delete Kubernetes events to avoid detection of their activity in the cluster. This control identifies all the subjects that can delete Kubernetes events.", + "remediation": "You should follow the least privilege principle. Minimize the number of subjects who can delete Kubernetes events. Avoid using these subjects in the daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-can-delete-k8s-events-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Defense Evasion::Delete K8S events", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can delete events\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"delete\", \"deletecollection\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"events\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can delete events\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can delete events", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0034": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Automatic mapping of service account", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Impact - K8s API access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0034", + "creationTime": "", + "description": "Potential attacker may gain access to a POD and steal its service account token. Therefore, it is recommended to disable automatic mapping of the service account tokens in service account configuration and enable it only for PODs that need to use them.", + "remediation": "Disable automatic mounting of service account tokens to PODs either at the service account level or at the individual POD level, by specifying the automountServiceAccountToken: false. Note that POD level takes precedence.", + "rules": [ + { + "guid": "", + "name": "automount-service-account", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if user account mount tokens in pod by default\ndeny [msga]{\n service_accounts := [service_account | service_account= input[_]; service_account.kind == \"ServiceAccount\"]\n service_account := service_accounts[_]\n result := is_auto_mount(service_account)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t \"alertMessage\": sprintf(\"the following service account: %v in the following namespace: %v mounts service account tokens in pods by default\", [service_account.metadata.name, service_account.metadata.namespace]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [service_account]\n\t\t}\n\t}\n} \n\n\n # -- ---- For workloads -- ---- \n# Fails if pod mount tokens by default (either by its config or by its SA config)\n\n # POD \ndeny [msga]{\n pod := input[_]\n\tpod.kind == \"Pod\"\n\n\tbeggining_of_path := \"spec.\"\n\twl_namespace := pod.metadata.namespace\n\tresult := is_sa_auto_mounted(pod.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t \"alertMessage\": sprintf(\"Pod: %v in the following namespace: %v mounts service account tokens by default\", [pod.metadata.name, pod.metadata.namespace]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n} \n\n# WORKLOADS\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tbeggining_of_path := \"spec.template.spec.\"\n\n\twl_namespace := wl.metadata.namespace\n\tresult := is_sa_auto_mounted(wl.spec.template.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v in the following namespace: %v mounts service account tokens by default\", [wl.kind, wl.metadata.name, wl.metadata.namespace]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# CRONJOB\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n \n\twl_namespace := wl.metadata.namespace\n\tresult := is_sa_auto_mounted(wl.spec.jobTemplate.spec.template.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v in the following namespace: %v mounts service account tokens by default\", [wl.kind, wl.metadata.name, wl.metadata.namespace]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n # -- ---- For workloads -- ---- \nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken not in pod spec\n\tnot spec.automountServiceAccountToken == false\n\tnot spec.automountServiceAccountToken == true\n\n\t# check if SA automount by default\n\tsa := input[_]\n\tis_same_sa(spec, sa.metadata.name)\n\tis_same_namespace(sa.metadata.namespace , wl_namespace)\n\tnot sa.automountServiceAccountToken == false\n\n\t# path is pod spec\n\tfix_path = { \"path\": sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path]), \"value\": \"false\"}\n\tfailed_path = \"\"\n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken set to true in pod spec\n\tspec.automountServiceAccountToken == true\n\t\n\t# SA automount by default\n\tservice_accounts := [service_account | service_account = input[_]; service_account.kind == \"ServiceAccount\"]\n\tcount(service_accounts) \u003e 0\n\tsa := service_accounts[_]\n\tis_same_sa(spec, sa.metadata.name)\n\tis_same_namespace(sa.metadata.namespace , wl_namespace)\n\tnot sa.automountServiceAccountToken == false\n\n\tfailed_path = sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path])\n\tfix_path = \"\"\n}\n\nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken set to true in pod spec\n\tspec.automountServiceAccountToken == true\n\t\n\t# No SA (yaml scan)\n\tservice_accounts := [service_account | service_account = input[_]; service_account.kind == \"ServiceAccount\"]\n\tcount(service_accounts) == 0\n\tfailed_path = sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path])\n\tfix_path = \"\"\n}\n\n\n\n # -- ---- For SAs -- ---- \nis_auto_mount(service_account) = [failed_path, fix_path] {\n\tservice_account.automountServiceAccountToken == true\n\tfailed_path = \"automountServiceAccountToken\"\n\tfix_path = \"\"\n}\n\nis_auto_mount(service_account)= [failed_path, fix_path] {\n\tnot service_account.automountServiceAccountToken == false\n\tnot service_account.automountServiceAccountToken == true\n\tfix_path = {\"path\": \"automountServiceAccountToken\", \"value\": \"false\"}\n\tfailed_path = \"\"\n}\n\nis_same_sa(spec, serviceAccountName) {\n\tspec.serviceAccountName == serviceAccountName\n}\n\nis_same_sa(spec, serviceAccountName) {\n\tnot spec.serviceAccountName \n\tserviceAccountName == \"default\"\n}\n\n\nis_same_namespace(metadata1, metadata2) {\n\tmetadata1.namespace == metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tnot metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata2.namespace\n\tmetadata1.namespace == \"default\"\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tmetadata2.namespace == \"default\"\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "ServiceAccount" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if service account and workloads mount service account token by default", + "remediation": "Make sure that the automountServiceAccountToken field on the service account spec if set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0035": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Cluster-admin binding", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ], + "rbacQuery": "Show cluster_admin" + }, + "controlID": "C-0035", + "creationTime": "", + "description": "Attackers who have cluster admin permissions (can perform any action on any resource), can take advantage of their privileges for malicious activities. This control determines which subjects have cluster admin permissions.", + "remediation": "You should apply least privilege principle. Make sure cluster admin permissions are granted only when it is absolutely necessary. Don't use subjects with such high permissions for daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-list-all-cluster-admins-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Cluster-admin binding", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# returns subjects with cluster admin permissions\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"*\", \"\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s have high privileges, such as cluster-admin\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have cluster admin permissions", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0036": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Malicious admission controller (validating)", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Credential access" + ] + }, + "controlID": "C-0036", + "creationTime": "", + "description": "Attackers can use validating webhooks to intercept and discover all the resources in the cluster. This control lists all the validating webhook configurations that must be verified.", + "remediation": "Ensure all the webhooks are necessary. Use exception mechanism to prevent repititive notifications.", + "rules": [ + { + "guid": "", + "name": "list-all-validating-webhooks", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential Access::Malicious admission controller" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny [msga] {\n admissionwebhooks := [admissionwebhook | admissionwebhook = input[_]; admissionwebhook.kind == \"ValidatingWebhookConfiguration\"]\n admissionwebhook := admissionwebhooks[_]\n\n \tmsga := {\n\t\t\"alertMessage\": sprintf(\"The following validating webhook configuration should be checked %v.\", [admissionwebhook.metadata.name]),\n\t\t\"alertScore\": 6,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [admissionwebhook]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "admissionregistration.k8s.io" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "ValidatingWebhookConfiguration" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Returns validating webhook configurations to be verified", + "remediation": "Analyze webhook for malicious behavior", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + "C-0037": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "CoreDNS poisoning", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Lateral Movement" + ] + }, + "controlID": "C-0037", + "creationTime": "", + "description": "If attackers have permissions to modify the coredns ConfigMap they can change the behavior of the cluster’s DNS, poison it, and override the network identity of other services. This control identifies all subjects allowed to update the 'coredns' configmap.", + "remediation": "You should follow the least privilege principle. Monitor and approve all the subjects allowed to modify the 'coredns' configmap. It is also recommended to remove this permission from the users/service accounts used in the daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-can-update-configmap-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Lateral Movement::CoreDNS poisoning", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# Fails if user can modify all configmaps\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"update\", \"patch\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"configmaps\", \"*\"]\n\tnot rule.resourceNames\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can modify 'coredns' configmap\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# Fails if user can modify the 'coredns' configmap (default for coredns)\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"update\", \"patch\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"configmaps\", \"*\"]\n\t\"coredns\" in rule.resourceNames\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can modify 'coredns' configmap\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can update/patch the 'coredns' configmap", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0038": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Host PID/IPC privileges", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0038", + "creationTime": "", + "description": "Containers should be isolated from the host machine as much as possible. The hostPID and hostIPC fields in deployment yaml may allow cross-container influence and may expose the host itself to potentially malicious or destructive actions. This control identifies all PODs using hostPID or hostIPC privileges.", + "remediation": "Remove hostPID and hostIPC from the yaml file(s) privileges unless they are absolutely necessary.", + "rules": [ + { + "guid": "", + "name": "host-pid-ipc-privileges", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has hostPID enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tis_host_pid(pod.spec)\n\tpath := \"spec.hostPID\"\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v has hostPID enabled\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if pod has hostIPC enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tis_host_ipc(pod.spec)\n\tpath := \"spec.hostIPC\"\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v has hostIPC enabled\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has hostPID enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_pid(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostPID\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod with hostPID enabled\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has hostIPC enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_ipc(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostIPC\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod with hostIPC enabled\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has hostPID enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_pid(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostPID\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod with hostPID enabled\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has hostIPC enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_ipc(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostIPC\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod with hostIPC enabled\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Check that hostPID and hostIPC are set to false. Default is false. Only in pod spec\n\n\nis_host_pid(podspec){\n podspec.hostPID == true\n}\n\nis_host_ipc(podspec){\n podspec.hostIPC == true\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Containers should be as isolated as possible from the host machine. The hostPID and hostIPC fields in Kubernetes may excessively expose the host to potentially malicious actions.", + "remediation": "Make sure that the fields hostIPC and hostPID in the pod spec are not set to true (set to false or not present)", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0039": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Malicious admission controller (mutating)", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Persistence" + ] + }, + "controlID": "C-0039", + "creationTime": "", + "description": "Attackers may use mutating webhooks to intercept and modify all the resources in the cluster. This control lists all mutating webhook configurations that must be verified.", + "remediation": "Ensure all the webhooks are necessary. Use exception mechanism to prevent repititive notifications.", + "rules": [ + { + "guid": "", + "name": "list-all-mutating-webhooks", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Malicious admission controller" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny [msga] {\n mutatingwebhooks := [mutatingwebhook | mutatingwebhook = input[_]; mutatingwebhook.kind == \"MutatingWebhookConfiguration\"]\n mutatingwebhook := mutatingwebhooks[_]\n\n \tmsga := {\n\t\t\"alertMessage\": sprintf(\"The following mutating webhook configuration should be checked %v.\", [mutatingwebhook.metadata.name]),\n\t\t\"alertScore\": 6,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [mutatingwebhook]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "admissionregistration.k8s.io" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "MutatingWebhookConfiguration" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Returns mutating webhook configurations to be verified", + "remediation": "Analyze webhook for malicious behavior", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0041": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "HostNetwork access", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery", + "Lateral movement", + "Impact - service access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0041", + "creationTime": "", + "description": "Potential attackers may gain access to a POD and inherit access to the entire host network. For example, in AWS case, they will have access to the entire VPC. This control identifies all the PODs with host network access enabled.", + "remediation": "Only connect PODs to host network when it is necessary. If not, set the hostNetwork field of the pod spec to false, or completely remove it (false is the default). Whitelist only those PODs that must have access to host network by design.", + "rules": [ + { + "guid": "", + "name": "host-network-access", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if pod has hostNetwork enabled\ndeny[msga] {\n pods := [ pod | pod = input[_] ; pod.kind == \"Pod\"]\n pod := pods[_]\n\n\tis_host_network(pod.spec)\n\tpath := \"spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"Pod: %v is connected to the host network\", [pod.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has hostNetwork enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_network(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod connected to the host network\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has hostNetwork enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_network(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod connected to the host network\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_host_network(podspec) {\n podspec.hostNetwork == true\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if pod has hostNetwork enabled", + "remediation": "Make sure that the hostNetwork field of the pod spec is not set to true (set to false or not present)", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0042": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "SSH server running inside container", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Execution" + ] + }, + "controlID": "C-0042", + "creationTime": "", + "description": "An SSH server that is running inside a container may be used by attackers to get remote access to the container. This control checks if pods have an open SSH port (22/2222).", + "remediation": "Remove SSH from the container image or limit the access to the SSH server using network policies.", + "rules": [ + { + "guid": "", + "name": "rule-can-ssh-to-pod-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Execution::SSH server running inside container", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: pod\n# apiversion: v1\n# does:\treturns the external facing services of that pod\n\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tpodns := pod.metadata.namespace\n\tpodname := pod.metadata.name\n\tlabels := pod.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n path := \"metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == podns\n\tservice.spec.selector == filtered_labels\n \n\thasSSHPorts(service)\n\n\twlvector = {\"name\": pod.metadata.name,\n\t\t\t\t\"namespace\": pod.metadata.namespace,\n\t\t\t\t\"kind\": pod.kind,\n\t\t\t\t\"relatedObjects\": service}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed by SSH services: %v\", [podns, podname, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tlabels := wl.spec.template.metadata.labels\n path := \"spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\thasSSHPorts(service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tlabels := wl.spec.jobTemplate.spec.template.metadata.labels\n path := \"spec.jobTemplate.spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\thasSSHPorts(service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 2222\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 2222\n}\n", + "resourceEnumerator": "package armo_builtins\n\n# input: pod\n# apiversion: v1\n# does:\treturns the external facing services of that pod\n\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tpodns := pod.metadata.namespace\n\tpodname := pod.metadata.name\n\tlabels := pod.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n path := \"metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == podns\n\tservice.spec.selector == filtered_labels\n\n\n\twlvector = {\"name\": pod.metadata.name,\n\t\t\t\t\"namespace\": pod.metadata.namespace,\n\t\t\t\t\"kind\": pod.kind,\n\t\t\t\t\"relatedObjects\": service}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed by SSH services: %v\", [podns, podname, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tlabels := wl.spec.template.metadata.labels\n path := \"spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tlabels := wl.spec.jobTemplate.spec.template.metadata.labels\n path := \"spec.jobTemplate.spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Service" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "denies pods with SSH ports opened(22/222)", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + "C-0044": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Container hostPort", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "devops" + ] + }, + "controlID": "C-0044", + "creationTime": "", + "description": "Configuring hostPort requires a particular port number. If two objects specify the same HostPort, they could not be deployed to the same node. It may prevent the second object from starting, even if Kubernetes will try reschedule it on another node, provided there are available nodes with sufficient amount of resources. Also, if the number of replicas of such workload is higher than the number of nodes, the deployment will consistently fail.", + "remediation": "Avoid usage of hostPort unless it is absolutely necessary, in which case define appropriate exception. Use NodePort / ClusterIP instead.", + "rules": [ + { + "guid": "", + "name": "container-hostPort", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has container with hostPort\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n\tpath := is_host_port(container, i, beggining_of_path)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v has Host-port\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has container with hostPort\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n path := is_host_port(container, i, beggining_of_path)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v has Host-port\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has container with hostPort\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n path := is_host_port(container, i, beggining_of_path)\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v has Host-port\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_host_port(container, i, beggining_of_path) = path {\n\tpath = [sprintf(\"%vcontainers[%v].ports[%v].hostPort\", [beggining_of_path, format_int(i, 10), format_int(j, 10)]) | port = container.ports[j]; port.hostPort]\n\tcount(path) \u003e 0\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container has hostPort", + "remediation": "Make sure you do not configure hostPort for the container, if necessary use NodePort / ClusterIP", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0045": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Writable hostPath mount", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Persistence", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "devops", + "security-impact" + ], + "microsoftMitreColumns": [ + "Persistence", + "Lateral Movement" + ] + }, + "controlID": "C-0045", + "creationTime": "", + "description": "Mounting host directory to the container can be used by attackers to get access to the underlying host and gain persistence.", + "remediation": "Refrain from using the hostPath mount or use the exception mechanism to remove unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "alert-rw-hostpath", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Writable hostPath mount, Lateral Movement::Writable volume mounts on the host" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if container has a hostPath volume which is not readOnly\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := pod.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n podname := pod.metadata.name\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has: %v as hostPath volume\", [podname, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := wl.spec.template.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.template.spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t\n\t}\n}\n\n#handles CronJobs\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n volumes := wl.spec.jobTemplate.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k) \n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\n\tmsga := {\n\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\"packagename\": \"armo_builtins\",\n\t\"alertScore\": 7,\n\t\"fixPaths\": fixed_path,\n\t\"failedPaths\": failed_path,\n\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n\nis_rw_mount(mount, beggining_of_path, i, k) = [failed_path, fix_path] {\n\tnot mount.readOnly == true\n \tnot mount.readOnly == false\n\tfailed_path = \"\"\n fix_path = {\"path\": sprintf(\"%vcontainers[%v].volumeMounts[%v].readOnly\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]), \"value\":\"true\"}\n}\n\nis_rw_mount(mount, beggining_of_path, i, k) = [failed_path, fix_path] {\n \tmount.readOnly == false\n \tfailed_path = sprintf(\"%vcontainers[%v].volumeMounts[%v].readOnly\", [beggining_of_path, format_int(i, 10), format_int(k, 10)])\n fix_path = \"\"\n} ", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "cautils" + }, + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume with rw permissions", + "remediation": "Set the readOnly field of the mount to true", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0046": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Insecure capabilities", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0046", + "creationTime": "", + "description": "Giving insecure or excessive capabilities to a container can increase the impact of the container compromise. This control identifies all the PODs with dangerous capabilities (see documentation pages for details).", + "remediation": "Remove all insecure capabilities which are not necessary for the container.", + "rules": [ + { + "guid": "", + "name": "insecure-capabilities", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\nimport data.cautils as cautils\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v have dangerous capabilities\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in workload: %v have dangerous capabilities\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in cronjob: %v have dangerous capabilities\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_dangerous_capabilities(container, beggining_of_path, i) = path {\n\t# see default-config-inputs.json for list values\n insecureCapabilities := data.postureControlInputs.insecureCapabilities\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capability = container.securityContext.capabilities.add[k]; cautils.list_contains(insecureCapabilities, capability)]\n\tcount(path) \u003e 0\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.insecureCapabilities" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.insecureCapabilities", + "name": "Insecure capabilities", + "description": "You can see the list of capabilities in https://man7.org/linux/man-pages/man7/capabilities.7.html. Kubescape looks for the following capabilities in containers which might lead to attackers getting high privileges in your system." + } + ], + "description": "fails if container has insecure capabilities", + "remediation": "Remove all insecure capabilities which aren’t necessary for the container.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0048": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "HostPath mount", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ] + }, + "controlID": "C-0048", + "creationTime": "", + "description": "Mounting host directory to the container can be used by attackers to get access to the underlying host. This control identifies all the PODs using hostPath mount.", + "remediation": "Remove hostPath mounts unless they are absolutely necessary and use exception mechanism to remove notifications.", + "rules": [ + { + "guid": "", + "name": "alert-any-hostpath", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::hostPath mount" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.\"\n\tresult := is_dangerous_host_path(volume, beggining_of_path, i)\n podname := pod.metadata.name\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has: %v as hostPath volume\", [podname, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_dangerous_host_path(volume, beggining_of_path, i)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n#handles CronJobs\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n volumes := wl.spec.jobTemplate.spec.template.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n result := is_dangerous_host_path(volume, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_dangerous_host_path(volume, beggining_of_path, i) = path {\n startswith(volume.hostPath.path, \"/etc\")\n\tpath = sprintf(\"%vvolumes[%v].hostPath.path\", [beggining_of_path, format_int(i, 10)])\n}\n\nis_dangerous_host_path(volume, beggining_of_path, i) = path {\n startswith(volume.hostPath.path, \"/var\")\n\tpath = sprintf(\"%vvolumes[%v].hostPath.path\", [beggining_of_path, format_int(i, 10)])\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume", + "remediation": "Try to refrain from using hostPath mounts", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0049": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Network mapping", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery" + ] + }, + "controlID": "C-0049", + "creationTime": "", + "description": "If no network policy is defined, attackers who gain access to a single container may use it to probe the network. This control lists all namespaces in which no network policies are defined.", + "remediation": "Define network policies or use similar network protection mechanisms.", + "rules": [ + { + "guid": "", + "name": "internal-networking", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Container internal networking, Discovery::Network mapping" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: network policies\n# apiversion: networking.k8s.io/v1\n# fails if no network policies are defined in a certain namespace\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\tpolicy_names := [policy.metadata.namespace | policy = input[_]; policy.kind == \"NetworkPolicy\"]\n\tnot list_contains(policy_names, namespace.metadata.name)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "package armo_builtins\n\n# input: network policies + namespaces\n# apiversion: networking.k8s.io/v1\n# returns all namespaces\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Namespace" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "lists namespaces in which no network policies are defined", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + "C-0050": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Resources CPU limit and request", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "devops" + ] + }, + "controlID": "C-0050", + "creationTime": "", + "description": "This control identifies all Pods for which the CPU limit is not set.", + "remediation": "Set the CPU limit or use exception mechanism to avoid unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "resources-cpu-limit-and-request", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\n\n# Fails if pod does not have container with CPU-limit or request\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tnot request_or_limit_cpu(container)\n\n\tfixPaths := [{\"path\": sprintf(\"spec.containers[%v].resources.limits.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}, \n\t\t\t\t{\"path\": sprintf(\"spec.containers[%v].resources.requests.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have CPU-limit or request\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPaths,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload does not have container with CPU-limit or request\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n not request_or_limit_cpu(container)\n\n\tfixPaths := [{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.limits.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}, \n\t\t\t\t{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.requests.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPaths,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob does not have container with CPU-limit or request\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n not request_or_limit_cpu(container)\n\n\tfixPaths := [{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.limits.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}, \n\t\t\t\t{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.requests.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}]\n\t\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPaths,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n\n###################################################################################################################\n\n# Fails if pod exceeds CPU-limit or request\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\trequest_or_limit_cpu(container)\n\tresource := is_min_max_exceeded_cpu(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v exceeds CPU-limit or request\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload exceeds CPU-limit or request\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\n\trequest_or_limit_cpu(container)\n\tresource := is_min_max_exceeded_cpu(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob doas exceeds CPU-limit or request\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\n\trequest_or_limit_cpu(container)\n \tresource := is_min_max_exceeded_cpu(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\t\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n\n#################################################################################################################3\n\nrequest_or_limit_cpu(container) {\n\tcontainer.resources.limits.cpu\n\tcontainer.resources.requests.cpu\n}\n\n\nis_min_max_exceeded_cpu(container) = \"resources.limits.cpu\" {\n\tcpu_limit := container.resources.limits.cpu\n\tis_limit_exceeded_cpu(cpu_limit)\n} else = \"resouces.requests.cpu\" {\n\tcpu_req := container.resources.requests.cpu\n\tis_req_exceeded_cpu(cpu_req)\n} else = \"\"\n\n\nis_limit_exceeded_cpu(cpu_limit) {\n\tis_min_limit_exceeded_cpu(cpu_limit)\n}\n\nis_limit_exceeded_cpu(cpu_limit) {\n\tis_max_limit_exceeded_cpu(cpu_limit)\n}\n\nis_req_exceeded_cpu(cpu_req) {\n\tis_max_request_exceeded_cpu(cpu_req)\n}\n\nis_req_exceeded_cpu(cpu_req) {\n\tis_min_request_exceeded_cpu(cpu_req)\n}\n\nis_max_limit_exceeded_cpu(cpu_limit) {\n\tcpu_limit_max := data.postureControlInputs.cpu_limit_max[_]\n\tcompare_max(cpu_limit_max, cpu_limit)\n}\n\nis_min_limit_exceeded_cpu(cpu_limit) {\n\tcpu_limit_min := data.postureControlInputs.cpu_limit_min[_]\n\tcompare_min(cpu_limit_min, cpu_limit) \n}\n\nis_max_request_exceeded_cpu(cpu_req) {\n\tcpu_req_max := data.postureControlInputs.cpu_request_max[_]\n\tcompare_max(cpu_req_max, cpu_req)\n}\n\nis_min_request_exceeded_cpu(cpu_req) {\n\tcpu_req_min := data.postureControlInputs.cpu_request_min[_]\n\tcompare_min(cpu_req_min, cpu_req) \n}\n\n##############\n# helpers\n\n# Compare according to unit - max\ncompare_max(max, given) {\n\tendswith(max, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_max := split(max, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"M\")\n\tendswith(given, \"M\")\n\tsplit_max := split(max, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"m\")\n\tendswith(given, \"m\")\n\tsplit_max := split(max, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tnot is_special_measure(max)\n\tnot is_special_measure(given)\n\tgiven \u003e max\n}\n\n\n\n################\n# Compare according to unit - min\ncompare_min(min, given) {\n\tendswith(min, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_min := split(min, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"M\")\n\tendswith(given, \"M\")\n\tsplit_min := split(min, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"m\")\n\tendswith(given, \"m\")\n\tsplit_min := split(min, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tnot is_special_measure(min)\n\tnot is_special_measure(given)\n\tgiven \u003c min\n}\n\n\n# Check that is same unit\nis_special_measure(unit) {\n\tendswith(unit, \"m\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"M\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"Mi\")\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.cpu_request_max", + "settings.postureControlInputs.cpu_request_min", + "settings.postureControlInputs.cpu_limit_min", + "settings.postureControlInputs.cpu_limit_max" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.cpu_request_max", + "name": "cpu_request_max", + "description": "Ensure CPU max requests are set" + }, + { + "path": "settings.postureControlInputs.cpu_request_min", + "name": "cpu_request_min", + "description": "Ensure CPU min requests are set" + }, + { + "path": "settings.postureControlInputs.cpu_limit_max", + "name": "cpu_limit_max", + "description": "Ensure CPU max limits are set" + }, + { + "path": "settings.postureControlInputs.cpu_limit_min", + "name": "cpu_limit_min", + "description": "Ensure CPU min limits are set" + } + ], + "description": "CPU limits and requests are not set.", + "remediation": "Ensure CPU limits and requests are set.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0052": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Instance Metadata API", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Discovery", + "Impact - service access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery" + ] + }, + "controlID": "C-0052", + "creationTime": "", + "description": "Attackers who gain access to a container, may query the metadata API service for getting information about the underlying node. This control checks if there is access from the nodes to cloud providers instance metadata services.", + "remediation": "Disable metadata services for pods in cloud provider settings.", + "rules": [ + { + "guid": "", + "name": "instance-metadata-api-access", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true", + "m$K8sThreatMatrix": "Credential Access::Instance Metadata API" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msg] {\n\tobj = input[_]\n\tis_cloud_provider_info(obj)\n\n\tobj.data.providerMetaDataAPIAccess == true\n\n\n\tmsg := {\n\t\t\"alertMessage\": sprintf(\"Node '%s' has access to Instance Metadata Services of cloud provider.\", [obj.metadata.name]),\n\t\t\"alert\": true,\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"externalObjects\": obj\n\t\t},\n\t\t\"packagename\": \"armo_builtins\"\n\t}\n\n}\n\n\n\nis_cloud_provider_info(obj) {\n\tobj.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\tobj.kind == \"cloudProviderInfo\"\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "cloudProviderInfo" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Checks if there is access from the nodes to cloud prividers instance metadata services", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0053": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Access container service account", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Impact - K8s API access" + ] + } + ], + "controlTypeTags": [ + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Credential access" + ], + "rbacQuery": "Container service account mapping" + }, + "controlID": "C-0053", + "creationTime": "", + "description": "Attackers who obtain access to a pod can use its SA token to communicate with KubeAPI server. All PODs with SA token mounted (if such token has a Role or a ClusterRole binding) are considerred potentially dangerous.", + "remediation": "Verify that RBAC is enabled. Follow the least privilege principle and ensure that only necessary PODs have SA token mounted into them.", + "rules": [ + { + "guid": "", + "name": "access-container-service-account-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential Access::Access container service account, Lateral Movement::Container service account", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Returns the rbac permission of each service account\ndeny[msga] {\n subjectVector := input[_]\n subjectVector.kind == \"ServiceAccount\"\n \n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n subject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service account: %v has the following permissions in the cluster\", [subjectVector.name]),\n\t\t\"packagename\": \"armo_builtins\",\n \"failedPaths\": [],\n \"fixPaths\":[],\n\t\t\"alertScore\": 7,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": subjectVector\n\t\t}\n\t}\n}\n\n# ===============================================================\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}", + "resourceEnumerator": "package armo_builtins\n\n\n# Returns the rbac permission of each service account\ndeny[msga] {\n subjectVector := input[_]\n subjectVector.kind == \"ServiceAccount\"\n \n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n subject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service account: %v has the following permissions in the cluster\", [subjectVector.name]),\n\t\t\"packagename\": \"armo_builtins\",\n \"failedPaths\": [],\n \"fixPaths\":[],\n\t\t\"alertScore\": 7,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": subjectVector\n\t\t}\n\t}\n}\n\n# ===============================================================\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "rbac.authorization.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "RoleBinding", + "ClusterRoleBinding", + "Role", + "ClusterRole" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which service accounts can be used to access other resources in the cluster", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0054": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Cluster internal networking", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery", + "Lateral movement" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Lateral movement" + ] + }, + "controlID": "C-0054", + "creationTime": "", + "description": "If no network policy is defined, attackers who gain access to a container may use it to move laterally in the cluster. This control lists namespaces in which no network policy is defined.", + "remediation": "Define Kubernetes network policies or use alternative products to protect cluster network.", + "rules": [ + { + "guid": "", + "name": "internal-networking", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Container internal networking, Discovery::Network mapping" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: network policies\n# apiversion: networking.k8s.io/v1\n# fails if no network policies are defined in a certain namespace\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\tpolicy_names := [policy.metadata.namespace | policy = input[_]; policy.kind == \"NetworkPolicy\"]\n\tnot list_contains(policy_names, namespace.metadata.name)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "package armo_builtins\n\n# input: network policies + namespaces\n# apiversion: networking.k8s.io/v1\n# returns all namespaces\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Namespace" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "lists namespaces in which no network policies are defined", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0055": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Linux hardening", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0055", + "creationTime": "", + "description": "Containers may be given more privileges than they actually need. This can increase the potential impact of a container compromise.", + "remediation": "You can use AppArmor, Seccomp, SELinux and Linux Capabilities mechanisms to restrict containers abilities to utilize unwanted privileges.", + "rules": [ + { + "guid": "", + "name": "linux-hardening", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# Fails if pod does not define linux security hardening \ndeny[msga] {\n\tobj := input[_]\n\tfix_paths := is_unsafe_obj(obj)\n\tcount(fix_paths) \u003e 0\n\n\t# final_fix_pathes := array.concat(fix_paths) # -\u003e produce only one failed result\n\tfinal_fix_pathes := fix_paths[_] # -\u003e produce failed result for each container\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%s: %s does not define any linux security hardening\", [obj.kind, obj.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": final_fix_pathes,\n\t\t\"alertObject\": {\"k8sApiObjects\": [obj]},\n\t}\n}\n\nis_unsafe_obj(obj) := fix_paths {\n\tobj.kind == \"Pod\"\n\tfix_paths := are_unsafe_specs(obj, [\"spec\"], [\"metadata\", \"annotations\"])\n} else := fix_paths {\n\tobj.kind == \"CronJob\"\n\tfix_paths := are_unsafe_specs(obj, [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"spec\"], [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"metadata\", \"annotations\"])\n} else := fix_paths {\n\tobj.kind in [\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\"]\n\tfix_paths := are_unsafe_specs(obj, [\"spec\", \"template\", \"spec\"], [\"spec\", \"template\", \"metadata\", \"annotations\"])\n}\n\nare_unsafe_specs(obj, specs_path, anotation_path) := paths {\n\t# spec\n\tspecs := object.get(obj, specs_path, null)\n\tspecs != null\n\tare_seccomp_and_selinux_disabled(specs)\n\n\t# annotation\n\tannotations := object.get(obj, anotation_path, [])\n\tapp_armor_annotations := [annotations[i] | annotation = i; startswith(i, \"container.apparmor.security.beta.kubernetes.io\")]\n\tcount(app_armor_annotations) == 0\n\n\t# container\n\tcontainers_path := array.concat(specs_path, [\"containers\"])\n\tcontainers := object.get(obj, containers_path, [])\n\n\t# Psuedo code explanation:\n\t# for i, container in containers\n\t# \t\tif is_unsafe_container:\n\t# \t\t\tfix_paths += [(containers_path[i] + field) for j, field in fix_fields]\n\t# \n\t# At the end we get [[\u003ccontainer1_path1\u003e, \u003ccontainer1_path2\u003e, ...], ...]\n\tcontainers_fix_path := concat(\".\", containers_path)\n\tfix_fields := [\"seccompProfile\", \"seLinuxOptions\", \"capabilities.drop[0]\"]\n\tpaths := [[{\n\t\t\"path\": sprintf(\"%s[%d].securityContext.%s\", [containers_fix_path, i, field]),\n\t\t\"value\": \"YOUR_VALUE\",\n\t} |\n\t\tfield := fix_fields[j]\n\t] |\n\t\tcontainer = containers[i]\n\t\tis_unsafe_container(container)\n\t]\n\n\tcount(paths) \u003e 0\n}\n\nare_seccomp_and_selinux_disabled(obj) {\n\tnot obj.securityContext.seccompProfile\n\tnot obj.securityContext.seLinuxOptions\n}\n\nis_unsafe_container(container) {\n\tare_seccomp_and_selinux_disabled(container)\n\tnot container.securityContext.capabilities.drop\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container does not define any linux security hardening", + "remediation": "Make sure you define at least one linux security hardening property out of Seccomp, SELinux or Capabilities.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0056": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Configured liveness probe", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0056", + "creationTime": "", + "description": "Liveness probe is intended to ensure that workload remains healthy during its entire execution lifecycle, or otherwise restrat the container. It is highly recommended to define liveness probe for every worker container. This control finds all the PODs where the Liveness probe is not configured.", + "remediation": "Ensure Liveness probes are configured wherever possible.", + "rules": [ + { + "guid": "", + "name": "configured-liveness-probe", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if container does not have livenessProbe - for pod\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tnot container.livenessProbe\n\tfix_path := {\"path\": sprintf(\"spec.containers[%v].livenessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have livenessProbe\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if container does not have livenessProbe - for wl\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n not container.livenessProbe\n\tfix_path := {\"path\": sprintf(\"spec.template.spec.containers[%v].livenessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have livenessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if container does not have livenessProbe - for cronjob\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n not container.livenessProbe\n\tfix_path := {\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].livenessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have livenessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Liveness probe is not configured", + "remediation": "Ensure Liveness probe is configured", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0057": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Privileged container", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ] + }, + "controlID": "C-0057", + "creationTime": "", + "description": "Potential attackers may gain access to privileged containers and inherit access to the host resources. Therefore, it is not recommended to deploy privileged containers unless it is absolutely necessary. This control identifies all the privileged Pods.", + "remediation": "Remove privileged capabilities by setting the securityContext.privileged to false. If you must deploy a Pod as privileged, add other restriction to it, such as network policy, Seccomp etc and still remove all unnecessary capabilities. Use the exception mechanism to remove unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "rule-privilege-escalation", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::privileged container", + "mitre": "Privilege Escalation", + "mitreCode": "TA0004" + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n#privileged pods\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following pods are defined as privileged: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is defined as privileged:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined as privileged: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n\n# Only SYS_ADMIN capabilite\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tnot container.securityContext.privileged == true\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path) \u003e 0\n}\n\n# Only securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tcontainer.securityContext.privileged == true\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003c 1\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])]\n}\n\n# SYS_ADMIN capabilite \u0026\u0026 securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003e 0\n\tcontainer.securityContext.privileged == true\n\tpath = array.concat(path1, [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])])\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if pods/deployments defined as privileged true", + "remediation": "avoid defining pods as privilleged", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0058": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Persistence", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0058", + "creationTime": "", + "description": "A user may be able to create a container with subPath or subPathExpr volume mounts to access files \u0026 directories anywhere on the host filesystem. Following Kubernetes versions are affected: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. This control checks the vulnerable versions and the actual usage of the subPath feature in all Pods in the cluster. If you want to learn more about the CVE, please refer to the CVE link: https://nvd.nist.gov/vuln/detail/CVE-2021-25741", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, or remove any existing Pods using subPath or subPathExpr feature.", + "rules": [ + { + "guid": "", + "name": "Symlink-Exchange-Can-Allow-Host-Filesystem-Access", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in pod : %v with subPath/subPathExpr\", [container.name, pod.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\nis_sub_path_container(container, i, beggining_of_path) = path {\n\tpath = [sprintf(\"%vcontainers[%v].volumeMounts[%v].subPath\" ,[beggining_of_path, format_int(i, 10), format_int(j, 10)]) | volume_mount = container.volumeMounts[j]; volume_mount.subPath]\n\tcount(path) \u003e 0\n}\n\nis_vulnerable_version(version) {\n version \u003c= \"v1.19.14\"\n}\n\nis_vulnerable_version(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nis_vulnerable_version(version){\n\tversion == \"v1.20.10\"\n}\n\n\n", + "resourceEnumerator": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n pod := input[_]\n pod.kind == \"Pod\"\n\n\tmsga := {\n\t\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n \n\tmsga := {\n\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\twl.kind == \"CronJob\"\n \n\tmsga := {\n\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\nisVulnerableVersion(version) {\n version \u003c= \"v1.19.14\"\n}\n\nisVulnerableVersion(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nisVulnerableVersion(version){\n\tversion == \"v1.20.10\"\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Node" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "A user may be able to create a container with subPath volume mounts to access files \u0026 directories outside of the volume, including on the host filesystem. This was affected at the following versions: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. ", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, and remove any existing Pods making use of the feature.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0059": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0059", + "creationTime": "", + "description": "Security issue in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster (see more at https://github.com/kubernetes/ingress-nginx/issues/7837)", + "remediation": "To mitigate this vulnerability: 1. Upgrade to a version that allows mitigation (\u003e= v0.49.1 or \u003e= v1.0.1), 2. Set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx", + "rules": [ + { + "guid": "", + "name": "nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tis_nginx_image(image)\n\tis_tag_image(image)\n\n\t# Extracting version from image tag\n\ttag_version_match := regex.find_all_string_submatch_n(\"[0-9]+\\\\.[0-9]+\\\\.[0-9]+\", image, -1)[0][0]\n image_version_str_arr := split(tag_version_match,\".\")\n\timage_version_arr := [to_number(image_version_str_arr[0]),to_number(image_version_str_arr[1]),to_number(image_version_str_arr[2])]\n\n\t# Check if vulnerable \n\tis_vulnerable(image_version_arr, deployment.metadata.namespace)\n\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. Deployment %v\", [deployment.metadata.name]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nis_nginx_image(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nis_allow_snippet_annotation_on(namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmap_on_ingress_namespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfig_maps_with_snippet := [configmap | configmap= configmap_on_ingress_namespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(config_maps_with_snippet) \u003c 1\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] \u003c 49\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] == 49\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\t\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 1\n\timage_version[1] == 0\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tisNginxImage(image)\n\tis_tag_image(image)\n\tisVulnerable(image, deployment.metadata.namespace)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. %v\", [deployment]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nisNginxImage(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag \u003c= \"v0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag == \"v1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag \u003c= \"v0.49\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag == \"v1.0.0\"\n}\n\n###### without 'v'\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag \u003c= \"0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag \u003c= \"0.49\"\n}\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmapOnIngressNamespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfigMapsWithSnippet := [configmap | configmap= configmapOnIngressNamespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(configMapsWithSnippet) \u003c 1\n}\n\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Deployment", + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0061": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Pods in default namespace", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "devops" + ] + }, + "controlID": "C-0061", + "creationTime": "", + "description": "It is recommended to avoid running PODs in cluster without explicit namespace assignment. This control identifies all the PODs running in the default namespace.", + "remediation": "Create necessary namespaces and move all the PODs from default namespace there.", + "rules": [ + { + "guid": "", + "name": "pods-in-default-namespace", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\", \"Job\", \"CronJob\", \"Pod\"}\n\tspec_template_spec_patterns[wl.kind]\n\tresult := is_default_namespace(wl.metadata)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has pods running in the 'default' namespace\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_default_namespace(metadata) = [failed_path, fixPath] {\n\tmetadata.namespace == \"default\"\n\tfailed_path = \"metadata.namespace\"\n\tfixPath = \"\" \n}\n\nis_default_namespace(metadata) = [failed_path, fixPath] {\n\tnot metadata.namespace\n\tfailed_path = \"\"\n\tfixPath = {\"path\": \"metadata.namespace\", \"value\": \"YOUR_NAMESPACE\"} \n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + "C-0062": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Sudo in container entrypoint", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0062", + "creationTime": "", + "description": "Adding sudo to a container entry point command may escalate process privileges and allow access to forbidden resources. This control checks all the entry point commands in all containers in the POD to find those that have sudo command.", + "remediation": "Remove sudo from the command line and use Kubernetes native root and capabilities controls to provide necessary privileges where they are required.", + "rules": [ + { + "guid": "", + "name": "sudo-in-container-entrypoint", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_sudo_entrypoint(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v have sudo in entrypoint\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": result,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_sudo_entrypoint(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in %v: %v have sudo in entrypoint\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": result,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_sudo_entrypoint(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in cronjob: %v have sudo in entrypoint\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": result,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_sudo_entrypoint(container, beggining_of_path, i) = path {\n\tpath = [sprintf(\"%vcontainers[%v].command[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | command = container.command[k]; contains(command, \"sudo\")]\n\tcount(path) \u003e 0\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + "C-0063": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Portforwarding privileges", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Discovery", + "Lateral movement" + ] + } + ], + "controlTypeTags": [ + "security-impact", + "compliance" + ], + "rbacQuery": "Port Forwarding" + }, + "controlID": "C-0063", + "creationTime": "", + "description": "Attackers with relevant RBAC permission can use “kubectl portforward” command to establish direct communication with PODs from within the cluster or even remotely. Such communication will most likely bypass existing security measures in the cluster. This control determines which subjects have permissions to use this command.", + "remediation": "It is recommended to prohibit “kubectl portforward” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.", + "rules": [ + { + "guid": "", + "name": "rule-can-portforward-v1", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"create\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"pods/portforward\", \"pods/*\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can do port forwarding\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + "C-0065": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "No impersonation", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "rbacQuery": "Impersonation" + }, + "controlID": "C-0065", + "creationTime": "", + "description": "Impersonation is an explicit RBAC permission to use other roles rather than the one assigned to a user, group or service account. This is sometimes needed for testing purposes. However, it is highly recommended not to use this capability in the production environments for daily operations. This control identifies all subjects whose roles include impersonate verb.", + "remediation": "Either remove the impersonate verb from the role where it was found or make sure that this role is not bound to users, groups or service accounts used for ongoing cluster operations. If necessary, bind this role to a subject only for specific needs for limited time period.", + "rules": [ + { + "guid": "", + "name": "rule-can-impersonate-users-groups-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Discovery::Access the K8s API server", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"impersonate\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"users\", \"serviceaccounts\", \"groups\", \"uids\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can impersonate users\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can impersonate users/groups", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0066": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Secret/ETCD encryption enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Impact" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0066", + "creationTime": "", + "description": "All Kubernetes Secrets are stored primarily in etcd therefore it is important to encrypt it.", + "remediation": "Turn on the etcd encryption in your cluster, for more see the vendor documentation.", + "rules": [ + { + "guid": "", + "name": "secret-etcd-encryption-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Check if encryption in etcd in enabled for AKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"management.azure.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"aks\"\t\n\tconfig = cluster_config.data\n\n\tnot isEncryptedAKS(config)\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"az aks nodepool add --name hostencrypt --cluster-name \u003cmyAKSCluster\u003e --resource-group \u003cmyResourceGroup\u003e -s Standard_DS2_v2 -l \u003cmyRegion\u003e --enable-encryption-at-host\",\n\t\t\"alertObject\": {\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n# Check if encryption in etcd in enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"eks\"\t\n\tconfig = cluster_config.data\n\n\tis_not_encrypted_EKS(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"eksctl utils enable-secrets-encryption --cluster=\u003ccluster\u003e --key-arn=arn:aws:kms:\u003ccluster_region\u003e:\u003caccount\u003e:key/\u003ckey\u003e --region=\u003cregion\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n\n# Check if encryption in etcd in enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n\n\tnot is_encrypted_GKE(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"data.database_encryption.state\"],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud container clusters update \u003ccluster_name\u003e --region=\u003ccompute_region\u003e --database-encryption-key=\u003ckey_project_id\u003e/locations/\u003clocation\u003e/keyRings/\u003cring_name\u003e/cryptoKeys/\u003ckey_name\u003e --project=\u003ccluster_project_id\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"1\"\n}\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"ENCRYPTED\"\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n goodResources := [resource | resource = cluster_config.Cluster.EncryptionConfig.Resources[_]; resource == \"secrets\"]\n\tcount(goodResources) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcluster_config.Cluster.EncryptionConfig == null\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcount(cluster_config.Cluster.EncryptionConfig) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n count(encryptionConfig.Resources) == 0\n}\n\nisEncryptedAKS(cluster_config) {\n\tcluster_config.properties.agentPoolProfiles.enableEncryptionAtHost == true\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "management.azure.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "container.googleapis.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "AKS", + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "etcd-encryption-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport data.cautils as cautils\n\n# Check if encryption in etcd is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n\tcmd := apiserverpod.spec.containers[0].command\n\tenc_command := [command | command := cmd[_]; contains(command, \"--encryption-provider-config=\")]\n\tcount(enc_command) \u003c 1\n\tfixpath := {\"path\":sprintf(\"spec.containers[0].command[%d]\", [count(cmd)]), \"value\": \"--encryption-provider-config=YOUR_VALUE\"}\n\n\tmsga := {\n\t\t\"alertMessage\": \"etcd encryption is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [fixpath],\n\t\t\"alertObject\": {\"k8sApiObjects\": [apiserverpod]},\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0067": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Audit logs enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Defense evasion - KubeAPI" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0067", + "creationTime": "", + "description": "Audit logging is an important security feature in Kubernetes, it enables the operator to track requests to the cluster. It is important to use it so the operator has a record of events happened in Kubernetes", + "remediation": "Turn on audit logging for your cluster. Look at the vendor guidelines for more details", + "rules": [ + { + "guid": "", + "name": "k8s-audit-logs-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.every\n\n# =============================== GKE ===============================\n# Check if audit logs is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"gke\"\n\tconfig := cluster_config.data\n\n\t# If enableComponents is empty, it will disable logging\n\t# https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#loggingcomponentconfig\n\tis_logging_disabled(config)\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nis_logging_disabled(cluster_config) {\n\tnot cluster_config.logging_config.component_config.enable_components\n}\n\nis_logging_disabled(cluster_config) {\n\tcluster_config.logging_config.component_config.enable_components\n\tcount(cluster_config.logging_config.component_config.enable_components) == 0\n}\n\n# =============================== EKS ===============================\n# Check if audit logs is enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"eks\"\n\tconfig := cluster_config.data\n\n\t# logSetup is an object representing the enabled or disabled Kubernetes control plane logs for your cluster.\n\t# types - available cluster control plane log types\n\t# https://docs.aws.amazon.com/eks/latest/APIReference/API_LogSetup.html\n\tlogging_types := {\"api\", \"audit\", \"authenticator\", \"controllerManager\", \"scheduler\"}\n\tlogSetups = config.Cluster.Logging.ClusterLogging\n\tnot all_auditlogs_enabled(logSetups, logging_types)\n\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixCommand\": \"aws eks update-cluster-config --region '${REGION_CODE}' --name '${CLUSTER_NAME}' --logging '{'clusterLogging':[{'types':['api','audit','authenticator','controllerManager','scheduler'],'enabled':true}]}'\",\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nall_auditlogs_enabled(logSetups, types) {\n\tevery type in types {\n\t\tauditlogs_enabled(logSetups, type)\n\t}\n}\n\nauditlogs_enabled(logSetups, type) {\n\tlogSetup := logSetups[_]\n\tlogSetup.Enabled == true\n\tlogSetup.Types[_] == type\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "k8s-audit-logs-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command\n\taudit_policy := [ command |command := cmd[_] ; contains(command, \"--audit-policy-file=\")]\n count(audit_policy) \u003c 1\n\tpath := \"spec.containers[0].command\"\t\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + "C-0068": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "PSP enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0068", + "creationTime": "", + "description": "PSP enable fine-grained authorization of pod creation and it is important to enable it", + "remediation": "Turn Pod Security Policies on in your cluster, if you use other admission controllers to control the behavior that PSP controls, exclude this control from your scans", + "rules": [ + { + "guid": "", + "name": "psp-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if PSP is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n not config.pod_security_policy_config.enabled == true\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"pod security policy configuration is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud beta container clusters update \u003ccluster_name\u003e --enable-pod-security-policy\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "psp-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command[j]\n contains(cmd, \"--enable-admission-plugins=\")\n output := split(cmd, \"=\")\n not contains(output[1], \"PodSecurityPolicy\")\n\tpath := sprintf(\"spec.containers[0].command[%v]\", [format_int(j, 10)])\t\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"PodSecurityPolicy is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 1 + }, + "C-0069": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Disable anonymous access to Kubelet service", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0069", + "creationTime": "", + "description": "By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.", + "remediation": "Start the kubelet with the --anonymous-auth=false flag.", + "rules": [ + { + "guid": "", + "name": "anonymous-requests-to-kubelet-service-updated", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n#CIS 4.2.1 https://workbench.cisecurity.org/sections/1126668/recommendations/1838638\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tcontains(command, \"--anonymous-auth\")\n\tcontains(command, \"--anonymous-auth=true\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tnot contains(command, \"--config\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tdecodedConfigContent := base64.decode(obj.data.configFile.content)\n\tyamlConfig := yaml.unmarshal(decodedConfigContent)\n\tnot yamlConfig.authentication.anonymous.enabled == false\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [\"authentication.anonymous.enabled\"],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"metadata\": obj.metadata,\n\t\t\t\"data\": {\"configFile\": {\"content\": decodedConfigContent}},\n\t\t}},\n\t}\n}\n\n## Host sensor failed to get config file content\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tnot obj.data.configFile.content\n\n\tmsga := {\n\t\t\"alertMessage\": \"Failed to analyze config file\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"data\": obj.data,\n\t\t}},\n\t}\n}\n\nis_kubelet_info(obj) {\n\tobj.kind == \"KubeletInfo\"\n\tobj.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletInfo" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if anonymous requests to the kubelet service are allowed.", + "remediation": "Disable anonymous requests by setting the anonymous-auth flag to false, or using the kubelet configuration file.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 10 + }, + "C-0070": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Enforce Kubelet client TLS authentication", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0070", + "creationTime": "", + "description": "Kubelets are the node level orchestrator in Kubernetes control plane. They are publishing service port 10250 where they accept commands from API server. Operator must make sure that only API server is allowed to submit commands to Kubelet. This is done through client certificate verification, must configure Kubelet with client CA file to use for this purpose.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "rules": [ + { + "guid": "", + "name": "enforce-kubelet-client-tls-authentication", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.kubernetes.api.client as client\n\n# Both config and cli present\ndeny[msga] {\n\t\tkubelet_config := input[_]\n\t\tkubelet_config.kind == \"KubeletConfiguration\"\n\t\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\t\tkubelet_cli := input[_] \n\t\tkubelet_cli.kind == \"KubeletCommandLine\"\n\t\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\t\tkubelet_cli_data := kubelet_cli.data\n\n\t\tresult := is_client_tls_disabled_both(kubelet_config, kubelet_cli_data)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [kubelet_config, kubelet_cli]\n\t\t\t},\n\t\t}\n\t}\n\n\n# Only of them present\ndeny[msga] {\n\t\tresult := is_client_tls_disabled_single(input)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [external_obj]\n\t\t\t},\n\t\t}\n\t}\n\n# CLI overrides config\nis_client_tls_disabled_both(kubelet_config, kubelet_cli_data) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n not kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\n# Only cli\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": []} {\n\tkubelet_cli := resources[_] \n\tkubelet_cli.kind == \"KubeletCommandLine\"\n\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_config := [config | config = resources[_]; config.kind == \"KubeletConfiguration\"]\n\tcount(kubelet_config) == 0\n\n\tobj = isClientTlsDisabledCli(kubelet_cli)\n\t\n}\n\n# Only config\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tkubelet_config := resources[_] \n\tkubelet_config.kind == \"KubeletConfiguration\"\n\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_cmd := [cmd | cmd = resources[_]; cmd.kind == \"KubeletCommandLine\"]\n\tcount(kubelet_cmd) == 0\n\n\tobj = is_Client_tls_disabled_config(kubelet_config)\n}\n\n\nis_Client_tls_disabled_config(kubelet_config) = obj {\n\tnot kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\nisClientTlsDisabledCli(kubelet_cli) = obj {\n\tkubelet_cli_data = kubelet_cli.data\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n\tobj = kubelet_cli\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletConfiguration", + "KubeletCommandLine" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "cautils" + }, + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if kubelet client tls authentication is enabled.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + }, + "C-0073": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Naked PODs", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0073", + "creationTime": "", + "description": "It is not recommended to create PODs without parental Deployment, ReplicaSet, StatefulSet etc.Manual creation if PODs may lead to a configuration drifts and other untracked changes in the system. Such PODs won't be automatically rescheduled by Kubernetes in case of a crash or infrastructure failure. This control identifies every POD that does not have corresponding parental object.", + "remediation": "Create necessary Deployment object for every POD making any POD a first class citizen in your IaC architecture.", + "rules": [ + { + "guid": "", + "name": "naked-pods", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if workload is Pod\ndeny[msga] {\n pod := input[_]\n\tpod.kind == \"Pod\"\n\tnot pod.metadata.ownerReferences\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v not associated with ReplicaSet or Deployment\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [{\"path\": \"metadata.ownerReferences\", \"value\": \"YOUR_VALUE\"}],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Don't use naked Pods (that is, Pods not bound to a ReplicaSet or Deployment) if you can avoid it. Naked Pods will not be rescheduled in the event of a node failure.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + "C-0074": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Containers mounting Docker socket", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0074", + "creationTime": "", + "description": "Mounting Docker socket (Unix socket) enables container to access Docker internals, retrieve sensitive information and execute Docker commands, if Docker runtime is available. This control identifies PODs that attempt to mount Docker socket for accessing Docker runtime.", + "remediation": "Remove docker socket mount request or define an exception.", + "rules": [ + { + "guid": "", + "name": "containers-mounting-docker-socket", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volume := pod.spec.volumes[i]\n\thost_path := volume.hostPath\n is_docker_mounting(host_path)\n\tpath := sprintf(\"spec.volumes[%v].hostPath.path\", [format_int(i, 10)])\n msga := {\n\t\t\"alertMessage\": sprintf(\"volume: %v in pod: %v has mounting to Docker internals.\", [volume.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertScore\": 5,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\t\n}\n\n\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volume := wl.spec.template.spec.volumes[i]\n\thost_path := volume.hostPath\n is_docker_mounting(host_path)\n\tpath := sprintf(\"spec.template.spec.volumes[%v].hostPath.path\", [format_int(i, 10)])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"volume: %v in %v: %v has mounting to Docker internals.\", [ volume.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertScore\": 5,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tvolume = wl.spec.jobTemplate.spec.template.spec.volumes[i]\n host_path := volume.hostPath\n is_docker_mounting(host_path)\n\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.volumes[%v].hostPath.path\", [format_int(i, 10)])\n msga := {\n\t\t\"alertMessage\": sprintf(\"volume: %v in %v: %v has mounting to Docker internals.\", [ volume.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertScore\": 5,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\nis_docker_mounting(host_path) {\n\thost_path.path == \"/var/run/docker.sock\"\n}\n\nis_docker_mounting(host_path) {\n\thost_path.path == \"/var/run/docker\"\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Check hostpath. If the path is set to /var/run/docker.sock or /var/lib/docker , the container has access to Docker internals - fail.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + "C-0075": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Image pull policy on latest tag", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0075", + "creationTime": "", + "description": "While usage of the latest tag is not generally recommended, in some cases this is necessary. If it is, the ImagePullPolicy must be set to Always, otherwise Kubernetes may run an older image with the same name that happens to be present in the node cache. Note that using Always will not cause additional image downloads because Kubernetes will check the image hash of the local local against the registry and only pull the image if this hash has changed, which is exactly what users want when use the latest tag. This control will identify all PODs with latest tag that have ImagePullSecret not set to Always.", + "remediation": "Set ImagePullPolicy to Always in all PODs found by this control.", + "rules": [ + { + "guid": "", + "name": "image-pull-policy-is-not-set-to-always", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n is_bad_container(container)\n\tpaths = [sprintf(\"spec.containers[%v].image\", [format_int(i, 10)]), sprintf(\"spec.containers[%v].imagePullPolicy\", [format_int(i, 10)])]\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v has 'latest' tag on image but imagePullPolicy is not set to 'Always'\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": paths,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tpaths = [sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)]), sprintf(\"spec.template.spec.containers[%v].imagePullPolicy\", [format_int(i, 10)])]\n is_bad_container(container)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in %v: %v has 'latest' tag on image but imagePullPolicy is not set to 'Always'\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": paths,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tpaths = [sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].image\", [format_int(i, 10)]), sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].imagePullPolicy\", [format_int(i, 10)])]\n is_bad_container(container)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in cronjob: %v has 'latest' tag on image but imagePullPolicy is not set to 'Always'\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": paths,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# image tag is latest\nis_bad_container(container){\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, container.image, -1)\n v := version[_]\n img := v[_]\n img == \":latest\"\n not_image_pull_policy(container)\n}\n\n# No image tag or digest (== latest)\nis_bad_container(container){\n not is_tag_image(container.image)\n not_image_pull_policy(container)\n}\n\n# image tag is only letters (== latest)\nis_bad_container(container){\n is_tag_image_only_letters(container.image)\n not_image_pull_policy(container)\n}\n\nnot_image_pull_policy(container) {\n container.imagePullPolicy == \"Never\"\n}\n\n\nnot_image_pull_policy(container) {\n container.imagePullPolicy == \"IfNotPresent\"\n}\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}\n\n# The image has a tag, and contains only letters\nis_tag_image_only_letters(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n\treg1 := \"^:[a-zA-Z]{1,127}$\"\n\tre_match(reg1, img)\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "check imagePullPolicy filed, if imagePullPolicy = always pass, else fail.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + "C-0076": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Label usage for resources", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0076", + "creationTime": "", + "description": "It is recommended to set labels that identify semantic attributes of your application or deployment. For example, { app: myapp, tier: frontend, phase: test, deployment: v3 }. These labels can used to assign policies to logical groups of the deployments as well as for presentation and tracking purposes. This control helps you find deployments without any of the expected labels.", + "remediation": "Define labels that are most suitable to your needs of use the exceptions to prevent further notifications.", + "rules": [ + { + "guid": "", + "name": "label-usage-for-resources", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tfixPath := no_label_or_no_label_usage(pod, \"\")\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"in the following pods a certain set of labels is not defined: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tpodSpec := wl.spec.template\n\tbeggining_of_pod_path := \"spec.template.\"\n\tfixPath := no_label_usage(wl, podSpec, beggining_of_pod_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v a certain set of labels is not defined:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tpodSpec := wl.spec.jobTemplate.spec.template\n\tbeggining_of_pod_path := \"spec.jobTemplate.spec.template.\"\n\tfixPath := no_label_usage(wl, podSpec, beggining_of_pod_path)\n\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs a certain set of labels is not defined: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n# There is no label-usage in WL and also for his Pod\nno_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tpath1 := no_label_or_no_label_usage(wl, \"\")\n\tpath2 := no_label_or_no_label_usage(podSpec, beggining_of_pod_path)\n\tpath = array.concat(path1, path2)\n}\n \n# There is label-usage for WL but not for his Pod\nno_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_label_or_no_label_usage(wl, \"\")\n\tpath := no_label_or_no_label_usage(podSpec, beggining_of_pod_path)\n}\n\n# There is no label-usage for WL but there is for his Pod\nno_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_label_or_no_label_usage(podSpec, beggining_of_pod_path)\n\tpath := no_label_or_no_label_usage(wl, \"\")\n}\n\nno_label_or_no_label_usage(wl, beggining_of_path) = path{\n\tnot wl.metadata\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_label_or_no_label_usage(wl, beggining_of_path) = path{\n\tmetadata := wl.metadata\n\tnot metadata.labels\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_label_or_no_label_usage(wl, beggining_of_path) = path{\n\tlabels := wl.metadata.labels\n\tnot is_desired_label(labels)\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nis_desired_label(labels) {\n\trecommended_labels := data.postureControlInputs.recommendedLabels\n\trecommended_label := recommended_labels[_]\n\tlabels[recommended_label]\n}\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Pod", + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet", + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.recommendedLabels" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.recommendedLabels", + "name": "Recommended Labels", + "description": "Kubescape checks that workloads have at least one of the following labels." + } + ], + "description": "check if a certain set of labels is defined, this is a configurable control. Initial list: app, tier, phase, version, owner, env.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + "C-0077": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "K8s common labels usage", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0077", + "creationTime": "", + "description": "Kubernetes common labels help manage and monitor Kubernetes cluster using different tools such as kubectl, dashboard and others in an interoperable way. Refer to https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ for more information. This control helps you find objects that don't have any of these labels defined.", + "remediation": "Define applicable labels or use the exception mechanism to prevent further notifications.", + "rules": [ + { + "guid": "", + "name": "K8s common labels usage", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tfixPath := no_K8s_label_or_no_K8s_label_usage(pod, \"\")\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"in the following pod the kubernetes common labels are not defined: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tpodSpec := wl.spec.template\n\tbeggining_of_pod_path := \"spec.template.\"\n\tfixPath := no_K8s_label_usage(wl, podSpec, beggining_of_pod_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v the kubernetes common labels are is not defined:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tpodSpec := wl.spec.jobTemplate.spec.template\n\tbeggining_of_pod_path := \"spec.jobTemplate.spec.template.\"\n\tfixPath := no_K8s_label_usage(wl, podSpec, beggining_of_pod_path)\n\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs the kubernetes common labels are not defined: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n\n\n# There is no label-usage in WL and also for his Pod\nno_K8s_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tpath1 := no_K8s_label_or_no_K8s_label_usage(wl, \"\")\n\tpath2 := no_K8s_label_or_no_K8s_label_usage(podSpec, beggining_of_pod_path)\n\tpath = array.concat(path1, path2)\n}\n\n# There is label-usage for WL but not for his Pod\nno_K8s_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_K8s_label_or_no_K8s_label_usage(wl, \"\")\n\tpath := no_K8s_label_or_no_K8s_label_usage(podSpec, beggining_of_pod_path)\n}\n\n# There is no label-usage for WL but there is for his Pod\nno_K8s_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_K8s_label_or_no_K8s_label_usage(podSpec, beggining_of_pod_path)\n\tpath := no_K8s_label_or_no_K8s_label_usage(wl, \"\")\n}\n\nno_K8s_label_or_no_K8s_label_usage(wl, beggining_of_path) = path{\n\tnot wl.metadata.labels\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_K8s_label_or_no_K8s_label_usage(wl, beggining_of_path) = path{\n\tmetadata := wl.metadata\n\tnot metadata.labels\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_K8s_label_or_no_K8s_label_usage(wl, beggining_of_path) = path{\n\tlabels := wl.metadata.labels\n\tnot all_kubernetes_labels(labels)\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nall_kubernetes_labels(labels){\n\trecommended_labels := data.postureControlInputs.k8sRecommendedLabels\n\trecommended_label := recommended_labels[_]\n\tlabels[recommended_label]\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.k8sRecommendedLabels" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.k8sRecommendedLabels", + "name": "Kubernetes Recommended Labels", + "description": "Kubescape checks that workloads have at least one of the following kubernetes recommended labels." + } + ], + "description": "Check if the list of label that start with app.kubernetes.io/ are defined.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + "C-0078": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Images from allowed registry", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Collection" + ] + }, + "controlID": "C-0078", + "creationTime": "", + "description": "This control is intended to ensure that all the used container images are taken from the authorized repositories. It allows user to list all the approved repositories and will fail all the images taken from any repository outside of this list.", + "remediation": "You should enable all trusted repositories in the parameters of this control.", + "rules": [ + { + "guid": "", + "name": "container-image-repository", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Collection::Images from private registry" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\nimport future.keywords.if\n# import data.kubernetes.api.client as client\n\nuntrusted_image_repo[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\timage := container.image\n\tnot image_in_allowed_list(image)\n\tpath := sprintf(\"spec.containers[%v].image\", [format_int(i, 10)])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"alertScore\": 2,\n \"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\nuntrusted_image_repo[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\timage := container.image\n not image_in_allowed_list(image)\n\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"alertScore\": 2,\n \"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nuntrusted_image_repo[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\timage := container.image\n not image_in_allowed_list(image)\n\n\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"alertScore\": 2,\n \"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# image_in_allowed_list - rule to check if an image complies with imageRepositoryAllowList.\nimage_in_allowed_list(image){\n\n\t# see default-config-inputs.json for list values\n\tallowedlist := data.postureControlInputs.imageRepositoryAllowList\n\tregistry := allowedlist[_]\n\n\tregex.match(regexify(registry), docker_host_wrapper(image))\n}\n\n\n# docker_host_wrapper - wrap an image without a host with a docker hub host 'docker.io'. \n# An image that doesn't contain '/' is assumed to not having a host and therefore associated with docker hub.\ndocker_host_wrapper(image) := result if {\n\tnot contains(image, \"/\")\n\tresult := sprintf(\"docker.io/%s\", [image])\n} else := image\n\n\n# regexify - returns a registry regex to be searched only for the image host.\nregexify(registry) := result {\n\tendswith(registry, \"/\")\n\tresult = sprintf(\"^%s.*$\", [registry])\n} else := sprintf(\"^%s\\/.*$\", [registry])\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.imageRepositoryAllowList" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.imageRepositoryAllowList", + "name": "Allowed image repositories", + "description": "Kubescape checks that all the containers are using images from the allowed repositories provided in the following list." + } + ], + "description": "Fails if image is not from allowed repository", + "remediation": "", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + "C-0079": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-0185-linux-kernel-container-escape", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0079", + "creationTime": "", + "description": "CVE-2022-0185 is a kernel vulnerability enabling privilege escalation and it can lead attackers to escape containers and take control over nodes. This control alerts on vulnerable kernel versions of Kubernetes nodes", + "remediation": "Patch Linux kernel version to 5.16.2 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-0185", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tnode := input[_]\n node.kind == \"Node\"\n kernel_version_match := regex.find_all_string_submatch_n(\"[0-9]+\\\\.[0-9]+\\\\.[0-9]+\", node.status.nodeInfo.kernelVersion, -1)\n kernelVersion := kernel_version_match[0][0]\n \n kernel_version_arr := split(kernelVersion, \".\")\n to_number(kernel_version_arr[0]) == 5\n to_number(kernel_version_arr[1]) \u003e= 1\n to_number(kernel_version_arr[1]) \u003c= 16\n to_number(kernel_version_arr[2]) \u003c 2 \n \n node.status.nodeInfo.operatingSystem == \"linux\"\n path := \"status.nodeInfo.kernelVersion\"\n\n linux_kernel_vars := [linux_kernel_var | linux_kernel_var = input[_]; linux_kernel_var.kind == \"LinuxKernelVariables\"]\n linux_kernel_vars_for_node := [linux_kernel_var | linux_kernel_var = linux_kernel_vars[_]; linux_kernel_var.metadata.name == node.metadata.name]\n data_userns_clones := [linux_kernel_var | linux_kernel_var = linux_kernel_vars_for_node[_].data[_]; is_unprivileged_userns_clone_enabled(linux_kernel_var)]\n count(data_userns_clones) \u003e 0\n\n external_vector := {\n \"name\": node.metadata.name,\n\t\t\"namespace\": \"\",\n\t\t\"kind\": node.kind,\n\t\t\"relatedObjects\": linux_kernel_vars_for_node,\n \"kernelVersion\": node.status.nodeInfo.kernelVersion\n }\n\n\n \tmsga := {\n\t\t\t\"alertMessage\": \"You are vulnerable to CVE-2022-0185\",\n \t\t\"alertObject\": {\n \"externalObjects\": external_vector\n },\n\t\t\t\"failedPaths\": [\"kernelVersion\"],\n \"fixPaths\":[],\n\t}\n}\n\nis_unprivileged_userns_clone_enabled(linux_kernel_var) {\n\tlinux_kernel_var.key == \"unprivileged_userns_clone\"\n linux_kernel_var.value == \"1\\n\"\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tnode := input[_]\n node.kind == \"Node\"\n \n node.status.nodeInfo.operatingSystem == \"linux\"\n\n linux_kernel_vars := [linux_kernel_var | linux_kernel_var = input[_]; linux_kernel_var.kind == \"LinuxKernelVariables\"]\n linux_kernel_vars_for_node := [linux_kernel_var | linux_kernel_var = linux_kernel_vars[_]; linux_kernel_var.metadata.name == node.metadata.name]\n\n external_vector := {\n \"name\": node.metadata.name,\n\t\t\"namespace\": \"\",\n\t\t\"kind\": node.kind,\n\t\t\"relatedObjects\": linux_kernel_vars_for_node,\n \"kernelVersion\": node.status.nodeInfo.kernelVersion\n }\n\n \tmsga := {\n\t\t\t\"alertMessage\": \"You are vulnerable to CVE-2022-0185\",\n \t\t\"alertObject\": {\n \"externalObjects\": external_vector\n },\n\t\t\t\"failedPaths\": [],\n \"fixPaths\":[],\n\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Node" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "LinuxKernelVariables" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0081": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-24348-argocddirtraversal", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0081", + "creationTime": "", + "description": "CVE-2022-24348 is a major software supply chain 0-day vulnerability in the popular open source CD platform Argo CD which can lead to privilege escalation and information disclosure.", + "remediation": "Update your ArgoCD deployment to fixed versions (v2.1.9,v2.2.4 or v2.3.0)", + "rules": [ + { + "guid": "", + "name": "CVE-2022-24348", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"argocd:v\")\n\tis_vulnerable_image(image)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-24348\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n\nis_vulnerable_image(image) {\n\tversion := split(image, \":v\")[1]\n\tversionTriplet := split(version, \".\")\n\tcount(versionTriplet) == 3\n\tmajor_version := to_number(versionTriplet[0])\n\tminorVersion := to_number(versionTriplet[1])\n\tsubVersion := to_number(versionTriplet[2]) \n\tisVulnerableVersion(major_version,minorVersion,subVersion)\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 1\n} \n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 2\n\tminorVersion == 0\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 2\n\tminorVersion == 1\n\tsubVersion \u003c 9\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 2\n\tminorVersion == 2\n\tsubVersion \u003c 4\n}\t\n\n", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"argocd:v\")\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-24348\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "a", + "remediation": "a", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0083": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Workloads with Critical vulnerabilities exposed to external traffic", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0083", + "creationTime": "", + "description": "Container images with known critical vulnerabilities pose elevated risk if they are exposed to the external traffic. This control lists all images with such vulnerabilities if either LoadBalancer or NodePort service is assigned to them.", + "remediation": "Either update the container image to fix the vulnerabilities (if such fix is available) or reassess if this workload must be exposed to the outseide traffic. If no fix is available, consider periodic restart of the POD to minimize the risk of persistant intrusion. Use exception mechanism if you don't want to see this report again.", + "rules": [ + { + "guid": "", + "name": "exposed-critical-pods", + "attributes": { + "armoBuiltin": true, + "imageScanRelated": true, + "m$K8sThreatMatrix": "exposed-critical-pods" + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n \n container.image == vuln.metadata.name\n\n # At least one critical vulnerabilities\n filter_critical_vulnerabilities(vuln)\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 7,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_critical_vulnerabilities(vuln) {\n data := vuln.data[_]\n data.severity == \"Critical\"\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 7,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Service", + "Pod" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "armo.vuln.images", + "image.vulnscan.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ImageVulnerabilities" + ] + } + ], + "ruleDependencies": null, + "configInputs": null, + "controlConfigInputs": null, + "description": "Fails if pods have exposed services as well as critical vulnerabilities", + "remediation": "The image of the listed pods might have a fix in a newer version. Alternatively, the pod service might not need to be external facing", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0084": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Workloads with RCE vulnerabilities exposed to external traffic", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0084", + "creationTime": "", + "description": "Container images with known Remote Code Execution (RCE) vulnerabilities pose significantly higher risk if they are exposed to the external traffic. This control lists all images with such vulnerabilities if their POD has either LoadBalancer or NodePort service.", + "remediation": "Either update the container image to fix the vulnerabilities (if such fix is available) or reassess if this workload must be exposed to the outseide traffic. If no fix is available, consider periodic restart of the POD to minimize the risk of persistant intrusion. Use exception mechanism if you don't want to see this report again.", + "rules": [ + { + "guid": "", + "name": "exposed-rce-pods", + "attributes": { + "armoBuiltin": true, + "imageScanRelated": true, + "m$K8sThreatMatrix": "exposed-rce-pods", + "useFromKubescapeVersion": "v2.0.150" + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\" ]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n # At least one rce vulnerability\n filter_rce_vulnerabilities(vuln)\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with rce vulnerability\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 8,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_rce_vulnerabilities(vuln) {\n data := vuln.data[_]\n data.categories.isRce == true\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "resourceEnumerator": "package armo_builtins\n \ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ; x.apiVersion == \"v1\"]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ; x.apiVersion == \"v1\"]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"] # TODO: x.apiVersion == \"--input--\" || x.apiVersion == \"--input--\" ]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with rce vulnerability\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 8,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Service", + "Pod" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "armo.vuln.images", + "image.vulnscan.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ImageVulnerabilities" + ] + } + ], + "ruleDependencies": null, + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if known pods have exposed services and known vulnerabilities with remote code execution", + "remediation": "The image of the listed pods might have a fix in a newer version. Alternatively, the pod service might not need to be external facing", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + "C-0085": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Workloads with excessive amount of vulnerabilities", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0085", + "creationTime": "", + "description": "Container images with multiple Critical and High sevirity vulnerabilities increase the risk of potential exploit. This control lists all such images according to the threashold provided by the customer.", + "remediation": "Update your workload images as soon as possible when fixes become available.", + "rules": [ + { + "guid": "", + "name": "excessive_amount_of_vulnerabilities_pods", + "attributes": { + "armoBuiltin": true, + "imageScanRelated": true, + "microsoftK8sThreatMatrix": "Initial access::Exposed critical vulnerable pods", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\n\ndeny[msga] {\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n \n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n # Has ^ amount of vulnerabilities\n check_num_vulnerabilities(vuln)\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \t\"name\": pod.metadata.name,\n \t\"namespace\": pod.metadata.namespace\n }\n\n external_objects = {\n \t\"apiVersion\": \"result.vulnscan.com/v1\",\n \t\"kind\": pod.kind,\n \t\"metadata\": metadata,\n \t\"relatedObjects\": related_objects\n }\n\n msga := {\n \t\"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \t\"packagename\": \"armo_builtins\",\n \t\"alertScore\": 7,\n \t\"failedPaths\": [path],\n \t\"fixPaths\": [],\n \t\"alertObject\": {\n \"externalObjects\": external_objects\n \t}\n }\n}\n\ncheck_num_vulnerabilities(vuln) {\n exists := count([ x | x = vuln.data[_]; x.severity == \"Critical\" ])\n\n str_max := data.postureControlInputs.max_critical_vulnerabilities[_]\n exists \u003e to_number(str_max)\n}\n\ncheck_num_vulnerabilities(vuln) {\n exists := count([ x | x = vuln.data[_]; x.severity == \"High\" ])\n \n str_max := data.postureControlInputs.max_high_vulnerabilities[_]\n exists \u003e to_number(str_max)\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n \n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \t\"name\": pod.metadata.name,\n \t\"namespace\": pod.metadata.namespace\n }\n\n external_objects = {\n \t\"apiVersion\": \"result.vulnscan.com/v1\",\n \t\"kind\": pod.kind,\n \t\"metadata\": metadata,\n \t\"relatedObjects\": related_objects\n }\n\n msga := {\n \t\"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \t\"packagename\": \"armo_builtins\",\n \t\"alertScore\": 7,\n \t\"failedPaths\": [path],\n \t\"fixPaths\": [],\n \t\"alertObject\": {\n \"externalObjects\": external_objects\n \t}\n }\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "armo.vuln.images", + "image.vulnscan.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ImageVulnerabilities" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": [ + "settings.postureControlInputs.max_critical_vulnerabilities", + "settings.postureControlInputs.max_high_vulnerabilities" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.max_critical_vulnerabilities", + "name": "Max critical vulnerabilities", + "description": "Maximum amount of allowed critical risk vulnerabilities" + }, + { + "path": "settings.postureControlInputs.max_high_vulnerabilities", + "name": "Max high vulnerabilities", + "description": "Maximum amount of allowed high risk vulnerabilities" + } + ], + "description": "determines which users have permissions to exec into pods", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + "C-0086": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-0492-cgroups-container-escape", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0086", + "creationTime": "", + "description": "Linux Kernel vulnerability CVE-2022-0492 may allow malicious code running inside container to escape container isolation and gain root privileges on the entire node. When fixed Kernel version numbers will become available, this control will be modified to verify them and avoid false positive detections. This control identifies all the resources that don't deploy neither AppArmor nor SELinux, run as root or allow privileged escalation or have corresponding dangerous capabilities.", + "remediation": "Activate AppArmor or SELinux. Follow the least privilege principle and remove root privileges or privilege escalation option and CAP_DAC_OVERRIDE capability. Make sure you don't allow container images from potentially dangerous sources and that containers that must have high privileges are taken from protected repositories.", + "rules": [ + { + "guid": "", + "name": "CVE-2022-0492", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Case 1: \n# -\tContainer runs as root OR allows privilege escalation (allowPrivilegeEscalation = true or not present), AND\n# -\tNo AppArmor , AND\n# -\tNo SELinux, AND\n# -\tNo Seccomp\n# If container is privileged or has CAP_SYS_ADMIN, don't fail\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\t\n\t# Path to send\n\tbeggining_of_path := \"spec\"\n\t\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\t\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_seccomp_pod(pod)\n\n is_no_SELinux_container(container)\n is_no_Seccomp_Container(container)\n\n\t# Check if is running as root\n alertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\n\t# CAP_DAC_OVERRIDE will fail on second check\n\tnot isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n # Get paths\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tbeggining_of_path := \"spec.template.spec\"\n\n pod := wl.spec.template\n container := pod.spec.containers[i]\n\n # If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\t\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_seccomp_pod(pod)\n\n is_no_SELinux_container(container)\n is_no_Seccomp_Container(container)\n\n\t# Check if is running as root\n alertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\n\t# CAP_DAC_OVERRIDE will fail on second check\n\tnot isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n # Get paths\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i)\n\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec\"\n\n\tpod := wl.spec.jobTemplate.spec.template\n container = pod.spec.containers[i]\n \n \t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\t\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_seccomp_pod(pod)\n\n is_no_SELinux_container(container)\n is_no_Seccomp_Container(container)\n\n\t# Check if is running as root\n alertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\n\t# CAP_DAC_OVERRIDE will fail on second check\n\tnot isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n # Get paths\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i)\n\n msga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n#################################################################################\n# Case 2: \n# - Container has CAP_DAC_OVERRIDE capability, AND\n# - No AppArmor, AND\n# - No SELinux\n# If container is privileged or has CAP_SYS_ADMIN, don't fail\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\n\tbeggining_of_path := \"spec.\"\n\t\n result := isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_SELinux_container(container)\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": [result],\n \"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\n pod := wl.spec.template\n container := pod.spec.containers[i]\n\n\tbeggining_of_path := \"spec.template.spec.\"\n\n result := isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_SELinux_container(container)\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": [result],\n \"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n \n pod := wl.spec.jobTemplate.spec.template\n container = pod.spec.containers[i]\n\t\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\n \tresult := isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_SELinux_container(container)\n\n msga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": [result],\n \"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n\nis_cap_sys_admin(container, beggining_of_path) {\n\tcapability = container.securityContext.capabilities.add[k]\n capability == \"SYS_ADMIN\"\n}\n\nisCAP_DAC_OVERRIDE(container, beggining_of_path, i) = path {\n\tcapability = container.securityContext.capabilities.add[k]\n capability == \"DAC_OVERRIDE\"\n path = sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) \n}\n\n\n\n#################################################################################\n\nget_failed_path(alertInfo, i) = [replace(alertInfo.failed_path,\"container_ndx\",format_int(i,10))] {\n\talertInfo.failed_path != \"\"\n} else = []\n\n\nget_fixed_path(alertInfo, i) = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}, {\"path\":replace(alertInfo.fixPath[1].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[1].value}]{\n\tcount(alertInfo.fixPath) == 2\n} else = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}] {\n\tcount(alertInfo.fixPath) == 1\n} else = []\n\n\n\n\n\n#################################################################################\n\n# Check if appArmor or SELinux or seccompProfile is used\n# Fails if none of them is used\nis_no_SELinux_No_AppArmor_Pod(pod){\n not pod.spec.securityContext.seLinuxOptions\n\tannotations := [pod.metadata.annotations[i] | annotaion = i; startswith(i, \"container.apparmor.security.beta.kubernetes.io\")]\n\tnot count(annotations) \u003e 0\n}\n\nis_no_SELinux_container(container){\n not container.securityContext.seLinuxOptions\n}\n\nis_no_seccomp_pod(pod) {\n not pod.spec.securityContext.seccompProfile\n}\n\nis_no_Seccomp_Container(container) {\n not container.securityContext.seccompProfile\n}\n\n\n\n\n\n\n#################################################################################\n# Workload evaluation \n\nevaluate_workload_non_root_container(container, pod, beggining_of_path) = alertInfo {\n\trunAsNonRootValue := get_run_as_non_root_value(container, pod, beggining_of_path)\n\trunAsNonRootValue.value == false\n\t\n\trunAsUserValue := get_run_as_user_value(container, pod, beggining_of_path)\n\trunAsUserValue.value == 0\n\n\talertInfo := choose_first_if_defined(runAsUserValue, runAsNonRootValue)\n} else = alertInfo {\n allowPrivilegeEscalationValue := get_allow_privilege_escalation(container, pod, beggining_of_path)\n allowPrivilegeEscalationValue.value == true\n\n alertInfo := allowPrivilegeEscalationValue\n}\n\n\n#################################################################################\n\n# Checking for non-root and allowPrivilegeEscalation enabled\nget_run_as_non_root_value(container, pod, beggining_of_path) = runAsNonRoot {\n failed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : container.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [] ,\"defined\" : true}\n} else = runAsNonRoot {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : pod.spec.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": \"spec.securityContext.runAsNonRoot\", \"value\":\"true\"}], \"defined\" : false} {\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) , \"value\":\"true\"}, {\"path\":sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nget_run_as_user_value(container, pod, beggining_of_path) = runAsUser {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : container.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = runAsUser {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : pod.spec.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}],\"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.securityContext.containers[container_ndx].runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n\t\"defined\" : false}\n\nget_run_as_group_value(container, pod, beggining_of_path) = runAsGroup {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : container.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = runAsGroup {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : pod.spec.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\":[], \"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": \"spec.securityContext.runAsNonRoot\", \"value\":\"true\"}], \"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n \t\"defined\" : false\n}\n\nget_allow_privilege_escalation(container, pod, beggining_of_path) = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : container.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : pod.spec.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : true, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nchoose_first_if_defined(l1, l2) = c {\n l1.defined\n c := l1\n} else = l2\n\n\nis_allow_privilege_escalation_field(container, pod) {\n\tcontainer.securityContext.allowPrivilegeEscalation == false\n}\n\nis_allow_privilege_escalation_field(container, pod) {\n\tpod.spec.securityContext.allowPrivilegeEscalation == false\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + "C-0087": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-23648-containerd-fs-escape", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0087", + "creationTime": "", + "description": "CVE-2022-23648 is a vulnerability of containerd enabling attacker to gain access to read-only copies of arbitrary files from the host using aspecially-crafted POD configuration yamls", + "remediation": "Patch containerd to 1.6.1, 1.5.10, 1.4.12 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-23648", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tnode := input[_]\n node.kind == \"Node\"\n \n startswith(node.status.nodeInfo.containerRuntimeVersion,\"containerd://\")\n containerd_version := substring(node.status.nodeInfo.containerRuntimeVersion,13,-1)\n containerd_version_arr := split(containerd_version, \".\")\n major_version := to_number(containerd_version_arr[0]) \n minor_version := to_number(containerd_version_arr[1]) \n subVersion := to_number(containerd_version_arr[2]) \n \n is_vulnerable_version(major_version,minor_version,subVersion)\n\n path := \"status.nodeInfo.containerRuntimeVersion\"\n\n \tmsga := {\n\t\t\t\"alertMessage\": \"You are vulnerable to CVE-2022-23648\",\n \t\t\"alertObject\": {\n \"k8SApiObjects\": [node]\n },\n\t\t\t\"failedPaths\": [path],\n \"fixPaths\":[],\n\t}\n}\n\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 0\n} \n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version \u003c 4\n}\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version == 4\n\tsubVersion \u003c 12\n}\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version == 5\n\tsubVersion \u003c 10\n}\t\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version == 6\n\tsubVersion \u003c 1\n}\t\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Node" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0088": { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "RBAC enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access", + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0088", + "creationTime": "", + "description": "RBAC is the most advanced and well accepted mode of authorizing users of the Kubernetes API", + "remediation": "Enable RBAC either in the API server configuration or with the Kubernetes provider API", + "rules": [ + { + "guid": "", + "name": "rbac-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"management.azure.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"aks\"\n\tconfig := cluster_config.data\n\tnot config.properties.enableRBAC == true\n\n\tmsga := {\n\t\t\"alertMessage\": \"rbac is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"data.properties.enableRBAC\"],\n\t\t\"fixCommand\": \"\",\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n \t\t\"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "management.azure.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "container.googleapis.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "AKS", + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "rbac-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command[j]\n contains(cmd, \"--authorization-mode=\")\n output := split(cmd, \"=\")\n not contains(output[1], \"RBAC\")\n\tpath := sprintf(\"spec.containers[0].command[%v]\", [format_int(j, 10)])\t\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"RBAC is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + "C-0090": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-39328-grafana-auth-bypass", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0090", + "creationTime": "", + "description": "CVE-2022-39328 is a critical vulnerability in Grafana, it might enable attacker to access unauthorized endpoints under heavy load.", + "remediation": "Update your Grafana to 9.2.4 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-39328", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"grafana:\")\n\tis_vulnerable_image(image)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-39328\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n\nis_vulnerable_image(image) {\n\tclean_image := replace(image,\"-ubuntu\",\"\")\n\tversion := split(clean_image, \":\")[1]\n\tversionTriplet := split(version, \".\")\n\tcount(versionTriplet) == 3\n\tmajor_version := to_number(versionTriplet[0])\n\tminorVersion := to_number(versionTriplet[1])\n\tsubVersion := to_number(versionTriplet[2]) \n\tisVulnerableVersion(major_version,minorVersion,subVersion)\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 9\n\tminorVersion == 2\n\tsubVersion \u003c 4\n}\n", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"grafana:\")\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-39328\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "a", + "remediation": "a", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + }, + "C-0091": { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-47633-kyverno-signature-bypass", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0091", + "creationTime": "", + "description": "CVE-2022-47633 is a high severity vulnerability in Kyverno, it enables attackers to bypass the image signature validation of policies using a malicious image repository or MITM proxy", + "remediation": "Update your Grafana to 9.2.4 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-47633", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"kyverno:\")\n\tis_vulnerable_image(image)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-47633\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n\nis_vulnerable_image(image) {\n\tversion := split(image, \":v\")[1]\n\tversionTriplet := split(version, \".\")\n\tcount(versionTriplet) == 3\n\tmajor_version := to_number(versionTriplet[0])\n\tminorVersion := to_number(versionTriplet[1])\n\tsubVersion := to_number(versionTriplet[2]) \n\tisVulnerableVersion(major_version,minorVersion,subVersion)\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 1\n\tminorVersion == 8\n\t3 \u003c= subVersion\n\tsubVersion \u003c 5\n}\n", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"kyverno:\")\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-47633\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "a", + "remediation": "a", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + } + }, + "Frameworks": [ + "AllControls", + "NSA", + "MITRE" + ] + }, + "AllResources": { + "/v1//Namespace/default": {}, + "/v1//Namespace/kube-node-lease": {}, + "/v1//Namespace/kube-public": {}, + "/v1//Namespace/kube-system": {}, + "/v1//Node/kwok-node-1": {}, + "/v1//Node/kwok-node-10": {}, + "/v1//Node/kwok-node-100": {}, + "/v1//Node/kwok-node-101": {}, + "/v1//Node/kwok-node-102": {}, + "/v1//Node/kwok-node-103": {}, + "/v1//Node/kwok-node-104": {}, + "/v1//Node/kwok-node-105": {}, + "/v1//Node/kwok-node-106": {}, + "/v1//Node/kwok-node-107": {}, + "/v1//Node/kwok-node-108": {}, + "/v1//Node/kwok-node-109": {}, + "/v1//Node/kwok-node-11": {}, + "/v1//Node/kwok-node-110": {}, + "/v1//Node/kwok-node-111": {}, + "/v1//Node/kwok-node-112": {}, + "/v1//Node/kwok-node-113": {}, + "/v1//Node/kwok-node-114": {}, + "/v1//Node/kwok-node-115": {}, + "/v1//Node/kwok-node-116": {}, + "/v1//Node/kwok-node-117": {}, + "/v1//Node/kwok-node-118": {}, + "/v1//Node/kwok-node-119": {}, + "/v1//Node/kwok-node-12": {}, + "/v1//Node/kwok-node-120": {}, + "/v1//Node/kwok-node-121": {}, + "/v1//Node/kwok-node-122": {}, + "/v1//Node/kwok-node-123": {}, + "/v1//Node/kwok-node-124": {}, + "/v1//Node/kwok-node-125": {}, + "/v1//Node/kwok-node-126": {}, + "/v1//Node/kwok-node-127": {}, + "/v1//Node/kwok-node-128": {}, + "/v1//Node/kwok-node-129": {}, + "/v1//Node/kwok-node-13": {}, + "/v1//Node/kwok-node-130": {}, + "/v1//Node/kwok-node-131": {}, + "/v1//Node/kwok-node-132": {}, + "/v1//Node/kwok-node-133": {}, + "/v1//Node/kwok-node-134": {}, + "/v1//Node/kwok-node-135": {}, + "/v1//Node/kwok-node-136": {}, + "/v1//Node/kwok-node-137": {}, + "/v1//Node/kwok-node-138": {}, + "/v1//Node/kwok-node-139": {}, + "/v1//Node/kwok-node-14": {}, + "/v1//Node/kwok-node-140": {}, + "/v1//Node/kwok-node-141": {}, + "/v1//Node/kwok-node-142": {}, + "/v1//Node/kwok-node-143": {}, + "/v1//Node/kwok-node-144": {}, + "/v1//Node/kwok-node-145": {}, + "/v1//Node/kwok-node-146": {}, + "/v1//Node/kwok-node-147": {}, + "/v1//Node/kwok-node-148": {}, + "/v1//Node/kwok-node-149": {}, + "/v1//Node/kwok-node-15": {}, + "/v1//Node/kwok-node-150": {}, + "/v1//Node/kwok-node-151": {}, + "/v1//Node/kwok-node-152": {}, + "/v1//Node/kwok-node-153": {}, + "/v1//Node/kwok-node-154": {}, + "/v1//Node/kwok-node-155": {}, + "/v1//Node/kwok-node-156": {}, + "/v1//Node/kwok-node-157": {}, + "/v1//Node/kwok-node-158": {}, + "/v1//Node/kwok-node-159": {}, + "/v1//Node/kwok-node-16": {}, + "/v1//Node/kwok-node-160": {}, + "/v1//Node/kwok-node-161": {}, + "/v1//Node/kwok-node-162": {}, + "/v1//Node/kwok-node-163": {}, + "/v1//Node/kwok-node-164": {}, + "/v1//Node/kwok-node-165": {}, + "/v1//Node/kwok-node-166": {}, + "/v1//Node/kwok-node-167": {}, + "/v1//Node/kwok-node-168": {}, + "/v1//Node/kwok-node-169": {}, + "/v1//Node/kwok-node-17": {}, + "/v1//Node/kwok-node-170": {}, + "/v1//Node/kwok-node-171": {}, + "/v1//Node/kwok-node-172": {}, + "/v1//Node/kwok-node-173": {}, + "/v1//Node/kwok-node-174": {}, + "/v1//Node/kwok-node-175": {}, + "/v1//Node/kwok-node-176": {}, + "/v1//Node/kwok-node-177": {}, + "/v1//Node/kwok-node-178": {}, + "/v1//Node/kwok-node-179": {}, + "/v1//Node/kwok-node-18": {}, + "/v1//Node/kwok-node-180": {}, + "/v1//Node/kwok-node-181": {}, + "/v1//Node/kwok-node-182": {}, + "/v1//Node/kwok-node-183": {}, + "/v1//Node/kwok-node-184": {}, + "/v1//Node/kwok-node-185": {}, + "/v1//Node/kwok-node-186": {}, + "/v1//Node/kwok-node-187": {}, + "/v1//Node/kwok-node-188": {}, + "/v1//Node/kwok-node-189": {}, + "/v1//Node/kwok-node-19": {}, + "/v1//Node/kwok-node-190": {}, + "/v1//Node/kwok-node-191": {}, + "/v1//Node/kwok-node-192": {}, + "/v1//Node/kwok-node-193": {}, + "/v1//Node/kwok-node-194": {}, + "/v1//Node/kwok-node-195": {}, + "/v1//Node/kwok-node-196": {}, + "/v1//Node/kwok-node-197": {}, + "/v1//Node/kwok-node-198": {}, + "/v1//Node/kwok-node-199": {}, + "/v1//Node/kwok-node-2": {}, + "/v1//Node/kwok-node-20": {}, + "/v1//Node/kwok-node-200": {}, + "/v1//Node/kwok-node-201": {}, + "/v1//Node/kwok-node-202": {}, + "/v1//Node/kwok-node-203": {}, + "/v1//Node/kwok-node-204": {}, + "/v1//Node/kwok-node-205": {}, + "/v1//Node/kwok-node-206": {}, + "/v1//Node/kwok-node-207": {}, + "/v1//Node/kwok-node-208": {}, + "/v1//Node/kwok-node-209": {}, + "/v1//Node/kwok-node-21": {}, + "/v1//Node/kwok-node-210": {}, + "/v1//Node/kwok-node-211": {}, + "/v1//Node/kwok-node-212": {}, + "/v1//Node/kwok-node-213": {}, + "/v1//Node/kwok-node-214": {}, + "/v1//Node/kwok-node-215": {}, + "/v1//Node/kwok-node-216": {}, + "/v1//Node/kwok-node-217": {}, + "/v1//Node/kwok-node-218": {}, + "/v1//Node/kwok-node-219": {}, + "/v1//Node/kwok-node-22": {}, + "/v1//Node/kwok-node-220": {}, + "/v1//Node/kwok-node-221": {}, + "/v1//Node/kwok-node-222": {}, + "/v1//Node/kwok-node-223": {}, + "/v1//Node/kwok-node-224": {}, + "/v1//Node/kwok-node-225": {}, + "/v1//Node/kwok-node-226": {}, + "/v1//Node/kwok-node-227": {}, + "/v1//Node/kwok-node-228": {}, + "/v1//Node/kwok-node-229": {}, + "/v1//Node/kwok-node-23": {}, + "/v1//Node/kwok-node-230": {}, + "/v1//Node/kwok-node-231": {}, + "/v1//Node/kwok-node-232": {}, + "/v1//Node/kwok-node-233": {}, + "/v1//Node/kwok-node-234": {}, + "/v1//Node/kwok-node-235": {}, + "/v1//Node/kwok-node-236": {}, + "/v1//Node/kwok-node-237": {}, + "/v1//Node/kwok-node-238": {}, + "/v1//Node/kwok-node-239": {}, + "/v1//Node/kwok-node-24": {}, + "/v1//Node/kwok-node-240": {}, + "/v1//Node/kwok-node-241": {}, + "/v1//Node/kwok-node-242": {}, + "/v1//Node/kwok-node-243": {}, + "/v1//Node/kwok-node-244": {}, + "/v1//Node/kwok-node-245": {}, + "/v1//Node/kwok-node-246": {}, + "/v1//Node/kwok-node-247": {}, + "/v1//Node/kwok-node-248": {}, + "/v1//Node/kwok-node-249": {}, + "/v1//Node/kwok-node-25": {}, + "/v1//Node/kwok-node-250": {}, + "/v1//Node/kwok-node-251": {}, + "/v1//Node/kwok-node-252": {}, + "/v1//Node/kwok-node-253": {}, + "/v1//Node/kwok-node-254": {}, + "/v1//Node/kwok-node-255": {}, + "/v1//Node/kwok-node-256": {}, + "/v1//Node/kwok-node-257": {}, + "/v1//Node/kwok-node-258": {}, + "/v1//Node/kwok-node-259": {}, + "/v1//Node/kwok-node-26": {}, + "/v1//Node/kwok-node-260": {}, + "/v1//Node/kwok-node-261": {}, + "/v1//Node/kwok-node-262": {}, + "/v1//Node/kwok-node-263": {}, + "/v1//Node/kwok-node-264": {}, + "/v1//Node/kwok-node-265": {}, + "/v1//Node/kwok-node-266": {}, + "/v1//Node/kwok-node-267": {}, + "/v1//Node/kwok-node-268": {}, + "/v1//Node/kwok-node-269": {}, + "/v1//Node/kwok-node-27": {}, + "/v1//Node/kwok-node-270": {}, + "/v1//Node/kwok-node-271": {}, + "/v1//Node/kwok-node-272": {}, + "/v1//Node/kwok-node-273": {}, + "/v1//Node/kwok-node-274": {}, + "/v1//Node/kwok-node-275": {}, + "/v1//Node/kwok-node-276": {}, + "/v1//Node/kwok-node-277": {}, + "/v1//Node/kwok-node-278": {}, + "/v1//Node/kwok-node-279": {}, + "/v1//Node/kwok-node-28": {}, + "/v1//Node/kwok-node-280": {}, + "/v1//Node/kwok-node-281": {}, + "/v1//Node/kwok-node-282": {}, + "/v1//Node/kwok-node-283": {}, + "/v1//Node/kwok-node-284": {}, + "/v1//Node/kwok-node-285": {}, + "/v1//Node/kwok-node-286": {}, + "/v1//Node/kwok-node-287": {}, + "/v1//Node/kwok-node-288": {}, + "/v1//Node/kwok-node-289": {}, + "/v1//Node/kwok-node-29": {}, + "/v1//Node/kwok-node-290": {}, + "/v1//Node/kwok-node-291": {}, + "/v1//Node/kwok-node-292": {}, + "/v1//Node/kwok-node-293": {}, + "/v1//Node/kwok-node-294": {}, + "/v1//Node/kwok-node-295": {}, + "/v1//Node/kwok-node-296": {}, + "/v1//Node/kwok-node-297": {}, + "/v1//Node/kwok-node-298": {}, + "/v1//Node/kwok-node-299": {}, + "/v1//Node/kwok-node-3": {}, + "/v1//Node/kwok-node-30": {}, + "/v1//Node/kwok-node-31": {}, + "/v1//Node/kwok-node-32": {}, + "/v1//Node/kwok-node-33": {}, + "/v1//Node/kwok-node-34": {}, + "/v1//Node/kwok-node-35": {}, + "/v1//Node/kwok-node-36": {}, + "/v1//Node/kwok-node-37": {}, + "/v1//Node/kwok-node-38": {}, + "/v1//Node/kwok-node-39": {}, + "/v1//Node/kwok-node-4": {}, + "/v1//Node/kwok-node-40": {}, + "/v1//Node/kwok-node-41": {}, + "/v1//Node/kwok-node-42": {}, + "/v1//Node/kwok-node-43": {}, + "/v1//Node/kwok-node-44": {}, + "/v1//Node/kwok-node-45": {}, + "/v1//Node/kwok-node-46": {}, + "/v1//Node/kwok-node-47": {}, + "/v1//Node/kwok-node-48": {}, + "/v1//Node/kwok-node-49": {}, + "/v1//Node/kwok-node-5": {}, + "/v1//Node/kwok-node-50": {}, + "/v1//Node/kwok-node-51": {}, + "/v1//Node/kwok-node-52": {}, + "/v1//Node/kwok-node-53": {}, + "/v1//Node/kwok-node-54": {}, + "/v1//Node/kwok-node-55": {}, + "/v1//Node/kwok-node-56": {}, + "/v1//Node/kwok-node-57": {}, + "/v1//Node/kwok-node-58": {}, + "/v1//Node/kwok-node-59": {}, + "/v1//Node/kwok-node-6": {}, + "/v1//Node/kwok-node-60": {}, + "/v1//Node/kwok-node-61": {}, + "/v1//Node/kwok-node-62": {}, + "/v1//Node/kwok-node-63": {}, + "/v1//Node/kwok-node-64": {}, + "/v1//Node/kwok-node-65": {}, + "/v1//Node/kwok-node-66": {}, + "/v1//Node/kwok-node-67": {}, + "/v1//Node/kwok-node-68": {}, + "/v1//Node/kwok-node-69": {}, + "/v1//Node/kwok-node-7": {}, + "/v1//Node/kwok-node-70": {}, + "/v1//Node/kwok-node-71": {}, + "/v1//Node/kwok-node-72": {}, + "/v1//Node/kwok-node-73": {}, + "/v1//Node/kwok-node-74": {}, + "/v1//Node/kwok-node-75": {}, + "/v1//Node/kwok-node-76": {}, + "/v1//Node/kwok-node-77": {}, + "/v1//Node/kwok-node-78": {}, + "/v1//Node/kwok-node-79": {}, + "/v1//Node/kwok-node-8": {}, + "/v1//Node/kwok-node-80": {}, + "/v1//Node/kwok-node-81": {}, + "/v1//Node/kwok-node-82": {}, + "/v1//Node/kwok-node-83": {}, + "/v1//Node/kwok-node-84": {}, + "/v1//Node/kwok-node-85": {}, + "/v1//Node/kwok-node-86": {}, + "/v1//Node/kwok-node-87": {}, + "/v1//Node/kwok-node-88": {}, + "/v1//Node/kwok-node-89": {}, + "/v1//Node/kwok-node-9": {}, + "/v1//Node/kwok-node-90": {}, + "/v1//Node/kwok-node-91": {}, + "/v1//Node/kwok-node-92": {}, + "/v1//Node/kwok-node-93": {}, + "/v1//Node/kwok-node-94": {}, + "/v1//Node/kwok-node-95": {}, + "/v1//Node/kwok-node-96": {}, + "/v1//Node/kwok-node-97": {}, + "/v1//Node/kwok-node-98": {}, + "/v1//Node/kwok-node-99": {}, + "/v1/default/ConfigMap/kube-root-ca.crt": {}, + "/v1/default/Pod/fake-pod-1-22gck": {}, + "/v1/default/Pod/fake-pod-1-2648b": {}, + "/v1/default/Pod/fake-pod-1-29dj6": {}, + "/v1/default/Pod/fake-pod-1-29kmj": {}, + "/v1/default/Pod/fake-pod-1-2gvgf": {}, + "/v1/default/Pod/fake-pod-1-2h4dr": {}, + "/v1/default/Pod/fake-pod-1-2hc7l": {}, + "/v1/default/Pod/fake-pod-1-2jwgl": {}, + "/v1/default/Pod/fake-pod-1-2l75m": {}, + "/v1/default/Pod/fake-pod-1-2l8rd": {}, + "/v1/default/Pod/fake-pod-1-2zl94": {}, + "/v1/default/Pod/fake-pod-1-44hrt": {}, + "/v1/default/Pod/fake-pod-1-44v5w": {}, + "/v1/default/Pod/fake-pod-1-45bxc": {}, + "/v1/default/Pod/fake-pod-1-47m8r": {}, + "/v1/default/Pod/fake-pod-1-4hxqj": {}, + "/v1/default/Pod/fake-pod-1-4hzfc": {}, + "/v1/default/Pod/fake-pod-1-4l428": {}, + "/v1/default/Pod/fake-pod-1-4mzxr": {}, + "/v1/default/Pod/fake-pod-1-4ndw2": {}, + "/v1/default/Pod/fake-pod-1-4pnz6": {}, + "/v1/default/Pod/fake-pod-1-4t6pn": {}, + "/v1/default/Pod/fake-pod-1-4trh8": {}, + "/v1/default/Pod/fake-pod-1-52cjc": {}, + "/v1/default/Pod/fake-pod-1-5gq8p": {}, + "/v1/default/Pod/fake-pod-1-5j7xl": {}, + "/v1/default/Pod/fake-pod-1-5l66v": {}, + "/v1/default/Pod/fake-pod-1-5qrw4": {}, + "/v1/default/Pod/fake-pod-1-65qdw": {}, + "/v1/default/Pod/fake-pod-1-665lr": {}, + "/v1/default/Pod/fake-pod-1-6gz7d": {}, + "/v1/default/Pod/fake-pod-1-6nw8q": {}, + "/v1/default/Pod/fake-pod-1-6xdz5": {}, + "/v1/default/Pod/fake-pod-1-6xwx9": {}, + "/v1/default/Pod/fake-pod-1-727np": {}, + "/v1/default/Pod/fake-pod-1-76dxs": {}, + "/v1/default/Pod/fake-pod-1-7bn4w": {}, + "/v1/default/Pod/fake-pod-1-7f5fz": {}, + "/v1/default/Pod/fake-pod-1-7jjgp": {}, + "/v1/default/Pod/fake-pod-1-7mz4k": {}, + "/v1/default/Pod/fake-pod-1-7pq6w": {}, + "/v1/default/Pod/fake-pod-1-7qtvl": {}, + "/v1/default/Pod/fake-pod-1-7t5r5": {}, + "/v1/default/Pod/fake-pod-1-7xmqb": {}, + "/v1/default/Pod/fake-pod-1-82xj2": {}, + "/v1/default/Pod/fake-pod-1-88n6g": {}, + "/v1/default/Pod/fake-pod-1-8dn49": {}, + "/v1/default/Pod/fake-pod-1-8frhs": {}, + "/v1/default/Pod/fake-pod-1-8h7sg": {}, + "/v1/default/Pod/fake-pod-1-8nsjq": {}, + "/v1/default/Pod/fake-pod-1-8nwvn": {}, + "/v1/default/Pod/fake-pod-1-8plcc": {}, + "/v1/default/Pod/fake-pod-1-8pvpf": {}, + "/v1/default/Pod/fake-pod-1-8rsdq": {}, + "/v1/default/Pod/fake-pod-1-8rx5p": {}, + "/v1/default/Pod/fake-pod-1-8smbp": {}, + "/v1/default/Pod/fake-pod-1-8xj5t": {}, + "/v1/default/Pod/fake-pod-1-8zwnn": {}, + "/v1/default/Pod/fake-pod-1-92dgv": {}, + "/v1/default/Pod/fake-pod-1-98jfg": {}, + "/v1/default/Pod/fake-pod-1-9bn2q": {}, + "/v1/default/Pod/fake-pod-1-9bvqh": {}, + "/v1/default/Pod/fake-pod-1-9dp2n": {}, + "/v1/default/Pod/fake-pod-1-9fpw5": {}, + "/v1/default/Pod/fake-pod-1-9h482": {}, + "/v1/default/Pod/fake-pod-1-9hjw2": {}, + "/v1/default/Pod/fake-pod-1-9jbqt": {}, + "/v1/default/Pod/fake-pod-1-9t2p8": {}, + "/v1/default/Pod/fake-pod-1-9wpch": {}, + "/v1/default/Pod/fake-pod-1-b676t": {}, + "/v1/default/Pod/fake-pod-1-b76lj": {}, + "/v1/default/Pod/fake-pod-1-b8xl2": {}, + "/v1/default/Pod/fake-pod-1-b9g75": {}, + "/v1/default/Pod/fake-pod-1-b9nf7": {}, + "/v1/default/Pod/fake-pod-1-bds64": {}, + "/v1/default/Pod/fake-pod-1-bfkft": {}, + "/v1/default/Pod/fake-pod-1-bfwq5": {}, + "/v1/default/Pod/fake-pod-1-bmc8l": {}, + "/v1/default/Pod/fake-pod-1-bppt6": {}, + "/v1/default/Pod/fake-pod-1-bq4f6": {}, + "/v1/default/Pod/fake-pod-1-bqvr2": {}, + "/v1/default/Pod/fake-pod-1-bwtnq": {}, + "/v1/default/Pod/fake-pod-1-bz2mq": {}, + "/v1/default/Pod/fake-pod-1-bz5hk": {}, + "/v1/default/Pod/fake-pod-1-bzwn5": {}, + "/v1/default/Pod/fake-pod-1-c42l5": {}, + "/v1/default/Pod/fake-pod-1-c6rzf": {}, + "/v1/default/Pod/fake-pod-1-ccfkr": {}, + "/v1/default/Pod/fake-pod-1-ccfmd": {}, + "/v1/default/Pod/fake-pod-1-cfxkk": {}, + "/v1/default/Pod/fake-pod-1-chp9l": {}, + "/v1/default/Pod/fake-pod-1-cphw4": {}, + "/v1/default/Pod/fake-pod-1-cs8qt": {}, + "/v1/default/Pod/fake-pod-1-czwxz": {}, + "/v1/default/Pod/fake-pod-1-db8pm": {}, + "/v1/default/Pod/fake-pod-1-dbm5p": {}, + "/v1/default/Pod/fake-pod-1-dhrp8": {}, + "/v1/default/Pod/fake-pod-1-djjkf": {}, + "/v1/default/Pod/fake-pod-1-dlf7t": {}, + "/v1/default/Pod/fake-pod-1-ds8vr": {}, + "/v1/default/Pod/fake-pod-1-dsbzg": {}, + "/v1/default/Pod/fake-pod-1-dtmp5": {}, + "/v1/default/Pod/fake-pod-1-dxmdj": {}, + "/v1/default/Pod/fake-pod-1-f7kw9": {}, + "/v1/default/Pod/fake-pod-1-fc9fr": {}, + "/v1/default/Pod/fake-pod-1-fd97w": {}, + "/v1/default/Pod/fake-pod-1-fj75q": {}, + "/v1/default/Pod/fake-pod-1-flqp8": {}, + "/v1/default/Pod/fake-pod-1-fp9fm": {}, + "/v1/default/Pod/fake-pod-1-frs97": {}, + "/v1/default/Pod/fake-pod-1-fwgcf": {}, + "/v1/default/Pod/fake-pod-1-fzzbw": {}, + "/v1/default/Pod/fake-pod-1-g5tdr": {}, + "/v1/default/Pod/fake-pod-1-g6zdd": {}, + "/v1/default/Pod/fake-pod-1-g7pr5": {}, + "/v1/default/Pod/fake-pod-1-g8cp8": {}, + "/v1/default/Pod/fake-pod-1-gh7q2": {}, + "/v1/default/Pod/fake-pod-1-glxwn": {}, + "/v1/default/Pod/fake-pod-1-gpqsd": {}, + "/v1/default/Pod/fake-pod-1-grn6m": {}, + "/v1/default/Pod/fake-pod-1-gtj7h": {}, + "/v1/default/Pod/fake-pod-1-h2ttn": {}, + "/v1/default/Pod/fake-pod-1-hb255": {}, + "/v1/default/Pod/fake-pod-1-hdcvv": {}, + "/v1/default/Pod/fake-pod-1-hdpxl": {}, + "/v1/default/Pod/fake-pod-1-hgpd6": {}, + "/v1/default/Pod/fake-pod-1-hgsd8": {}, + "/v1/default/Pod/fake-pod-1-hj8xz": {}, + "/v1/default/Pod/fake-pod-1-hk2lr": {}, + "/v1/default/Pod/fake-pod-1-hmzn9": {}, + "/v1/default/Pod/fake-pod-1-hqrst": {}, + "/v1/default/Pod/fake-pod-1-hw6x5": {}, + "/v1/default/Pod/fake-pod-1-hwntp": {}, + "/v1/default/Pod/fake-pod-1-hxx2m": {}, + "/v1/default/Pod/fake-pod-1-j2hh7": {}, + "/v1/default/Pod/fake-pod-1-j4fsh": {}, + "/v1/default/Pod/fake-pod-1-j5lgz": {}, + "/v1/default/Pod/fake-pod-1-j5txw": {}, + "/v1/default/Pod/fake-pod-1-j6fg5": {}, + "/v1/default/Pod/fake-pod-1-j7t8j": {}, + "/v1/default/Pod/fake-pod-1-j9268": {}, + "/v1/default/Pod/fake-pod-1-j9gwg": {}, + "/v1/default/Pod/fake-pod-1-jbrl7": {}, + "/v1/default/Pod/fake-pod-1-jc9p9": {}, + "/v1/default/Pod/fake-pod-1-jcb8c": {}, + "/v1/default/Pod/fake-pod-1-jd8xb": {}, + "/v1/default/Pod/fake-pod-1-jkj6m": {}, + "/v1/default/Pod/fake-pod-1-jkjqf": {}, + "/v1/default/Pod/fake-pod-1-jm5kx": {}, + "/v1/default/Pod/fake-pod-1-jrvrm": {}, + "/v1/default/Pod/fake-pod-1-js74p": {}, + "/v1/default/Pod/fake-pod-1-jtkj4": {}, + "/v1/default/Pod/fake-pod-1-jwhqk": {}, + "/v1/default/Pod/fake-pod-1-jwvfw": {}, + "/v1/default/Pod/fake-pod-1-jwzzg": {}, + "/v1/default/Pod/fake-pod-1-jzksj": {}, + "/v1/default/Pod/fake-pod-1-k4tk5": {}, + "/v1/default/Pod/fake-pod-1-kc5m7": {}, + "/v1/default/Pod/fake-pod-1-kfxzc": {}, + "/v1/default/Pod/fake-pod-1-klmxn": {}, + "/v1/default/Pod/fake-pod-1-kmhqk": {}, + "/v1/default/Pod/fake-pod-1-kqlqk": {}, + "/v1/default/Pod/fake-pod-1-ktd77": {}, + "/v1/default/Pod/fake-pod-1-ktv26": {}, + "/v1/default/Pod/fake-pod-1-l2tbv": {}, + "/v1/default/Pod/fake-pod-1-l9gf9": {}, + "/v1/default/Pod/fake-pod-1-lchds": {}, + "/v1/default/Pod/fake-pod-1-lhjxj": {}, + "/v1/default/Pod/fake-pod-1-lj8pl": {}, + "/v1/default/Pod/fake-pod-1-ljgz5": {}, + "/v1/default/Pod/fake-pod-1-lkznj": {}, + "/v1/default/Pod/fake-pod-1-lmqpx": {}, + "/v1/default/Pod/fake-pod-1-lpvjg": {}, + "/v1/default/Pod/fake-pod-1-lrfjp": {}, + "/v1/default/Pod/fake-pod-1-lzmhl": {}, + "/v1/default/Pod/fake-pod-1-lzxbl": {}, + "/v1/default/Pod/fake-pod-1-m44jg": {}, + "/v1/default/Pod/fake-pod-1-m46qq": {}, + "/v1/default/Pod/fake-pod-1-m4pkm": {}, + "/v1/default/Pod/fake-pod-1-m864g": {}, + "/v1/default/Pod/fake-pod-1-mgjpv": {}, + "/v1/default/Pod/fake-pod-1-mnclm": {}, + "/v1/default/Pod/fake-pod-1-mqckm": {}, + "/v1/default/Pod/fake-pod-1-msd5n": {}, + "/v1/default/Pod/fake-pod-1-mtzmj": {}, + "/v1/default/Pod/fake-pod-1-mwqqn": {}, + "/v1/default/Pod/fake-pod-1-n7mt9": {}, + "/v1/default/Pod/fake-pod-1-n8kgw": {}, + "/v1/default/Pod/fake-pod-1-n9jgk": {}, + "/v1/default/Pod/fake-pod-1-nbxjt": {}, + "/v1/default/Pod/fake-pod-1-ndj69": {}, + "/v1/default/Pod/fake-pod-1-ndvjm": {}, + "/v1/default/Pod/fake-pod-1-nf96j": {}, + "/v1/default/Pod/fake-pod-1-nfk92": {}, + "/v1/default/Pod/fake-pod-1-nft4p": {}, + "/v1/default/Pod/fake-pod-1-ng4d8": {}, + "/v1/default/Pod/fake-pod-1-nh4ft": {}, + "/v1/default/Pod/fake-pod-1-nrp7q": {}, + "/v1/default/Pod/fake-pod-1-nt2sj": {}, + "/v1/default/Pod/fake-pod-1-p76kb": {}, + "/v1/default/Pod/fake-pod-1-p8hfs": {}, + "/v1/default/Pod/fake-pod-1-pckhj": {}, + "/v1/default/Pod/fake-pod-1-pfjk8": {}, + "/v1/default/Pod/fake-pod-1-pgcdn": {}, + "/v1/default/Pod/fake-pod-1-phz5v": {}, + "/v1/default/Pod/fake-pod-1-pls9r": {}, + "/v1/default/Pod/fake-pod-1-pnbmp": {}, + "/v1/default/Pod/fake-pod-1-ppldn": {}, + "/v1/default/Pod/fake-pod-1-ppqpk": {}, + "/v1/default/Pod/fake-pod-1-ps86p": {}, + "/v1/default/Pod/fake-pod-1-pspxw": {}, + "/v1/default/Pod/fake-pod-1-pt7cz": {}, + "/v1/default/Pod/fake-pod-1-pttrn": {}, + "/v1/default/Pod/fake-pod-1-pz6wj": {}, + "/v1/default/Pod/fake-pod-1-q26tw": {}, + "/v1/default/Pod/fake-pod-1-q27h5": {}, + "/v1/default/Pod/fake-pod-1-q5kzg": {}, + "/v1/default/Pod/fake-pod-1-qbj8q": {}, + "/v1/default/Pod/fake-pod-1-qcf47": {}, + "/v1/default/Pod/fake-pod-1-qcnv9": {}, + "/v1/default/Pod/fake-pod-1-qd49p": {}, + "/v1/default/Pod/fake-pod-1-qfnkj": {}, + "/v1/default/Pod/fake-pod-1-qgd5x": {}, + "/v1/default/Pod/fake-pod-1-qgp2l": {}, + "/v1/default/Pod/fake-pod-1-qgz56": {}, + "/v1/default/Pod/fake-pod-1-qgzmj": {}, + "/v1/default/Pod/fake-pod-1-qskl5": {}, + "/v1/default/Pod/fake-pod-1-r4nlm": {}, + "/v1/default/Pod/fake-pod-1-r6fdt": {}, + "/v1/default/Pod/fake-pod-1-r6gr8": {}, + "/v1/default/Pod/fake-pod-1-rklkv": {}, + "/v1/default/Pod/fake-pod-1-rkpq2": {}, + "/v1/default/Pod/fake-pod-1-rrndj": {}, + "/v1/default/Pod/fake-pod-1-rt4mp": {}, + "/v1/default/Pod/fake-pod-1-rtbjm": {}, + "/v1/default/Pod/fake-pod-1-rvbfl": {}, + "/v1/default/Pod/fake-pod-1-rw6zg": {}, + "/v1/default/Pod/fake-pod-1-rxmmh": {}, + "/v1/default/Pod/fake-pod-1-rzhmj": {}, + "/v1/default/Pod/fake-pod-1-rzkbf": {}, + "/v1/default/Pod/fake-pod-1-s25x7": {}, + "/v1/default/Pod/fake-pod-1-s7dc7": {}, + "/v1/default/Pod/fake-pod-1-s7kdd": {}, + "/v1/default/Pod/fake-pod-1-s9jj6": {}, + "/v1/default/Pod/fake-pod-1-s9sfh": {}, + "/v1/default/Pod/fake-pod-1-sct9p": {}, + "/v1/default/Pod/fake-pod-1-sdw4t": {}, + "/v1/default/Pod/fake-pod-1-sjvmf": {}, + "/v1/default/Pod/fake-pod-1-sjxrc": {}, + "/v1/default/Pod/fake-pod-1-sn7cg": {}, + "/v1/default/Pod/fake-pod-1-srsq2": {}, + "/v1/default/Pod/fake-pod-1-t7228": {}, + "/v1/default/Pod/fake-pod-1-t75qz": {}, + "/v1/default/Pod/fake-pod-1-t7hkt": {}, + "/v1/default/Pod/fake-pod-1-tbv8x": {}, + "/v1/default/Pod/fake-pod-1-tbw64": {}, + "/v1/default/Pod/fake-pod-1-tc966": {}, + "/v1/default/Pod/fake-pod-1-tfcg5": {}, + "/v1/default/Pod/fake-pod-1-tmksd": {}, + "/v1/default/Pod/fake-pod-1-twppd": {}, + "/v1/default/Pod/fake-pod-1-twtlw": {}, + "/v1/default/Pod/fake-pod-1-v67lh": {}, + "/v1/default/Pod/fake-pod-1-v8xvv": {}, + "/v1/default/Pod/fake-pod-1-vbtv9": {}, + "/v1/default/Pod/fake-pod-1-vj7tr": {}, + "/v1/default/Pod/fake-pod-1-vjvq8": {}, + "/v1/default/Pod/fake-pod-1-vlbnr": {}, + "/v1/default/Pod/fake-pod-1-vm8xs": {}, + "/v1/default/Pod/fake-pod-1-vt7t4": {}, + "/v1/default/Pod/fake-pod-1-w88xl": {}, + "/v1/default/Pod/fake-pod-1-wcfsk": {}, + "/v1/default/Pod/fake-pod-1-wcvbt": {}, + "/v1/default/Pod/fake-pod-1-wff62": {}, + "/v1/default/Pod/fake-pod-1-wj2cc": {}, + "/v1/default/Pod/fake-pod-1-wp655": {}, + "/v1/default/Pod/fake-pod-1-wplg7": {}, + "/v1/default/Pod/fake-pod-1-wqct7": {}, + "/v1/default/Pod/fake-pod-1-wtc5t": {}, + "/v1/default/Pod/fake-pod-1-wtdj8": {}, + "/v1/default/Pod/fake-pod-1-wz9pk": {}, + "/v1/default/Pod/fake-pod-1-x5wvb": {}, + "/v1/default/Pod/fake-pod-1-x62t6": {}, + "/v1/default/Pod/fake-pod-1-xctfh": {}, + "/v1/default/Pod/fake-pod-1-xp48x": {}, + "/v1/default/Pod/fake-pod-1-xw6vw": {}, + "/v1/default/Pod/fake-pod-1-xxzg5": {}, + "/v1/default/Pod/fake-pod-1-z2jlw": {}, + "/v1/default/Pod/fake-pod-1-z5w6w": {}, + "/v1/default/Pod/fake-pod-1-z65qw": {}, + "/v1/default/Pod/fake-pod-1-z6gxl": {}, + "/v1/default/Pod/fake-pod-1-z79g5": {}, + "/v1/default/Pod/fake-pod-1-z8h5p": {}, + "/v1/default/Pod/fake-pod-1-zfwhn": {}, + "/v1/default/Pod/fake-pod-1-znbrk": {}, + "/v1/default/Pod/fake-pod-1-zptqb": {}, + "/v1/default/Pod/fake-pod-1-zr9tz": {}, + "/v1/default/Pod/fake-pod-1-zsmkl": {}, + "/v1/default/Pod/fake-pod-1-ztm9w": {}, + "/v1/default/Pod/fake-pod-1-zwtdd": {}, + "/v1/default/Pod/fake-pod-10-2jbmt": {}, + "/v1/default/Pod/fake-pod-10-2qr4n": {}, + "/v1/default/Pod/fake-pod-10-2rfvb": {}, + "/v1/default/Pod/fake-pod-10-2szll": {}, + "/v1/default/Pod/fake-pod-10-2wtrp": {}, + "/v1/default/Pod/fake-pod-10-2xpdd": {}, + "/v1/default/Pod/fake-pod-10-2zzln": {}, + "/v1/default/Pod/fake-pod-10-42s4f": {}, + "/v1/default/Pod/fake-pod-10-445nr": {}, + "/v1/default/Pod/fake-pod-10-44hf6": {}, + "/v1/default/Pod/fake-pod-10-469qx": {}, + "/v1/default/Pod/fake-pod-10-487wm": {}, + "/v1/default/Pod/fake-pod-10-4c7r6": {}, + "/v1/default/Pod/fake-pod-10-4gmrs": {}, + "/v1/default/Pod/fake-pod-10-4jdm5": {}, + "/v1/default/Pod/fake-pod-10-4k27c": {}, + "/v1/default/Pod/fake-pod-10-4kh8x": {}, + "/v1/default/Pod/fake-pod-10-4lgbj": {}, + "/v1/default/Pod/fake-pod-10-4mc6h": {}, + "/v1/default/Pod/fake-pod-10-4n26q": {}, + "/v1/default/Pod/fake-pod-10-4z8rx": {}, + "/v1/default/Pod/fake-pod-10-52d96": {}, + "/v1/default/Pod/fake-pod-10-56vt5": {}, + "/v1/default/Pod/fake-pod-10-57nhk": {}, + "/v1/default/Pod/fake-pod-10-5gdjb": {}, + "/v1/default/Pod/fake-pod-10-5hp8q": {}, + "/v1/default/Pod/fake-pod-10-5j2ck": {}, + "/v1/default/Pod/fake-pod-10-5lgcs": {}, + "/v1/default/Pod/fake-pod-10-5q6b9": {}, + "/v1/default/Pod/fake-pod-10-5q9mw": {}, + "/v1/default/Pod/fake-pod-10-5tv5w": {}, + "/v1/default/Pod/fake-pod-10-5xfgq": {}, + "/v1/default/Pod/fake-pod-10-629fh": {}, + "/v1/default/Pod/fake-pod-10-64frc": {}, + "/v1/default/Pod/fake-pod-10-65b9s": {}, + "/v1/default/Pod/fake-pod-10-66nwv": {}, + "/v1/default/Pod/fake-pod-10-679t2": {}, + "/v1/default/Pod/fake-pod-10-6fdzc": {}, + "/v1/default/Pod/fake-pod-10-6qzds": {}, + "/v1/default/Pod/fake-pod-10-6t5qc": {}, + "/v1/default/Pod/fake-pod-10-6tth5": {}, + "/v1/default/Pod/fake-pod-10-6tzl2": {}, + "/v1/default/Pod/fake-pod-10-6vhz4": {}, + "/v1/default/Pod/fake-pod-10-6wc2z": {}, + "/v1/default/Pod/fake-pod-10-6wd8z": {}, + "/v1/default/Pod/fake-pod-10-72x7t": {}, + "/v1/default/Pod/fake-pod-10-74fql": {}, + "/v1/default/Pod/fake-pod-10-77mtf": {}, + "/v1/default/Pod/fake-pod-10-7b4lv": {}, + "/v1/default/Pod/fake-pod-10-7hz2p": {}, + "/v1/default/Pod/fake-pod-10-7qcqp": {}, + "/v1/default/Pod/fake-pod-10-7r5fp": {}, + "/v1/default/Pod/fake-pod-10-7rr99": {}, + "/v1/default/Pod/fake-pod-10-7xrqp": {}, + "/v1/default/Pod/fake-pod-10-842rk": {}, + "/v1/default/Pod/fake-pod-10-85z7l": {}, + "/v1/default/Pod/fake-pod-10-86r67": {}, + "/v1/default/Pod/fake-pod-10-87ghc": {}, + "/v1/default/Pod/fake-pod-10-87mwm": {}, + "/v1/default/Pod/fake-pod-10-8ccr7": {}, + "/v1/default/Pod/fake-pod-10-8gffb": {}, + "/v1/default/Pod/fake-pod-10-8l4kk": {}, + "/v1/default/Pod/fake-pod-10-8pnh2": {}, + "/v1/default/Pod/fake-pod-10-8qtkc": {}, + "/v1/default/Pod/fake-pod-10-8zh4t": {}, + "/v1/default/Pod/fake-pod-10-96svb": {}, + "/v1/default/Pod/fake-pod-10-97kjv": {}, + "/v1/default/Pod/fake-pod-10-97kmt": {}, + "/v1/default/Pod/fake-pod-10-9fg6l": {}, + "/v1/default/Pod/fake-pod-10-9k8h7": {}, + "/v1/default/Pod/fake-pod-10-9kn2t": {}, + "/v1/default/Pod/fake-pod-10-9lcf2": {}, + "/v1/default/Pod/fake-pod-10-9mwcj": {}, + "/v1/default/Pod/fake-pod-10-9nls2": {}, + "/v1/default/Pod/fake-pod-10-9nqtr": {}, + "/v1/default/Pod/fake-pod-10-9nv2t": {}, + "/v1/default/Pod/fake-pod-10-9pkm7": {}, + "/v1/default/Pod/fake-pod-10-9sdsh": {}, + "/v1/default/Pod/fake-pod-10-9swxf": {}, + "/v1/default/Pod/fake-pod-10-9wn66": {}, + "/v1/default/Pod/fake-pod-10-b54c4": {}, + "/v1/default/Pod/fake-pod-10-b5vbl": {}, + "/v1/default/Pod/fake-pod-10-b8frx": {}, + "/v1/default/Pod/fake-pod-10-bbx2h": {}, + "/v1/default/Pod/fake-pod-10-bdtxv": {}, + "/v1/default/Pod/fake-pod-10-bh94d": {}, + "/v1/default/Pod/fake-pod-10-bhhpt": {}, + "/v1/default/Pod/fake-pod-10-bhjdx": {}, + "/v1/default/Pod/fake-pod-10-bjgq5": {}, + "/v1/default/Pod/fake-pod-10-bkgmv": {}, + "/v1/default/Pod/fake-pod-10-blbnj": {}, + "/v1/default/Pod/fake-pod-10-bljqj": {}, + "/v1/default/Pod/fake-pod-10-bq2cz": {}, + "/v1/default/Pod/fake-pod-10-btt7d": {}, + "/v1/default/Pod/fake-pod-10-bxtdb": {}, + "/v1/default/Pod/fake-pod-10-c58w8": {}, + "/v1/default/Pod/fake-pod-10-c5k6g": {}, + "/v1/default/Pod/fake-pod-10-c68wx": {}, + "/v1/default/Pod/fake-pod-10-cdfg9": {}, + "/v1/default/Pod/fake-pod-10-cdjgj": {}, + "/v1/default/Pod/fake-pod-10-cjp8s": {}, + "/v1/default/Pod/fake-pod-10-cnss4": {}, + "/v1/default/Pod/fake-pod-10-cr7ch": {}, + "/v1/default/Pod/fake-pod-10-cvwcg": {}, + "/v1/default/Pod/fake-pod-10-cxnfl": {}, + "/v1/default/Pod/fake-pod-10-cz66m": {}, + "/v1/default/Pod/fake-pod-10-d47mf": {}, + "/v1/default/Pod/fake-pod-10-d4q6p": {}, + "/v1/default/Pod/fake-pod-10-d7cjv": {}, + "/v1/default/Pod/fake-pod-10-d8qqx": {}, + "/v1/default/Pod/fake-pod-10-db9g6": {}, + "/v1/default/Pod/fake-pod-10-dc7xh": {}, + "/v1/default/Pod/fake-pod-10-ddfq5": {}, + "/v1/default/Pod/fake-pod-10-ddtsm": {}, + "/v1/default/Pod/fake-pod-10-dnzs2": {}, + "/v1/default/Pod/fake-pod-10-dq4fl": {}, + "/v1/default/Pod/fake-pod-10-dsl4h": {}, + "/v1/default/Pod/fake-pod-10-dtqmh": {}, + "/v1/default/Pod/fake-pod-10-dxl9d": {}, + "/v1/default/Pod/fake-pod-10-dzzq9": {}, + "/v1/default/Pod/fake-pod-10-f7gtx": {}, + "/v1/default/Pod/fake-pod-10-fdfx2": {}, + "/v1/default/Pod/fake-pod-10-fm8tg": {}, + "/v1/default/Pod/fake-pod-10-fqdx2": {}, + "/v1/default/Pod/fake-pod-10-fqmrv": {}, + "/v1/default/Pod/fake-pod-10-fr2ds": {}, + "/v1/default/Pod/fake-pod-10-fzt8f": {}, + "/v1/default/Pod/fake-pod-10-g5m4p": {}, + "/v1/default/Pod/fake-pod-10-gjprr": {}, + "/v1/default/Pod/fake-pod-10-gk6jk": {}, + "/v1/default/Pod/fake-pod-10-gkk89": {}, + "/v1/default/Pod/fake-pod-10-gldjt": {}, + "/v1/default/Pod/fake-pod-10-glwdw": {}, + "/v1/default/Pod/fake-pod-10-gm2zv": {}, + "/v1/default/Pod/fake-pod-10-gsvqt": {}, + "/v1/default/Pod/fake-pod-10-gw49b": {}, + "/v1/default/Pod/fake-pod-10-h264r": {}, + "/v1/default/Pod/fake-pod-10-hbjvt": {}, + "/v1/default/Pod/fake-pod-10-hgz5j": {}, + "/v1/default/Pod/fake-pod-10-hmw7h": {}, + "/v1/default/Pod/fake-pod-10-hp2tx": {}, + "/v1/default/Pod/fake-pod-10-hpt4m": {}, + "/v1/default/Pod/fake-pod-10-hrgwx": {}, + "/v1/default/Pod/fake-pod-10-hs6vp": {}, + "/v1/default/Pod/fake-pod-10-hx6xm": {}, + "/v1/default/Pod/fake-pod-10-j74bb": {}, + "/v1/default/Pod/fake-pod-10-j7m6w": {}, + "/v1/default/Pod/fake-pod-10-j8kmt": {}, + "/v1/default/Pod/fake-pod-10-jf9dr": {}, + "/v1/default/Pod/fake-pod-10-jg7vm": {}, + "/v1/default/Pod/fake-pod-10-jgdjs": {}, + "/v1/default/Pod/fake-pod-10-jh797": {}, + "/v1/default/Pod/fake-pod-10-jk2zs": {}, + "/v1/default/Pod/fake-pod-10-jm24h": {}, + "/v1/default/Pod/fake-pod-10-jqz2q": {}, + "/v1/default/Pod/fake-pod-10-jrgh9": {}, + "/v1/default/Pod/fake-pod-10-jrlp9": {}, + "/v1/default/Pod/fake-pod-10-k4nzz": {}, + "/v1/default/Pod/fake-pod-10-k6v8j": {}, + "/v1/default/Pod/fake-pod-10-k86cb": {}, + "/v1/default/Pod/fake-pod-10-k9wg7": {}, + "/v1/default/Pod/fake-pod-10-k9zjc": {}, + "/v1/default/Pod/fake-pod-10-kdbb8": {}, + "/v1/default/Pod/fake-pod-10-klbl5": {}, + "/v1/default/Pod/fake-pod-10-klgvn": {}, + "/v1/default/Pod/fake-pod-10-klhc7": {}, + "/v1/default/Pod/fake-pod-10-kmbsl": {}, + "/v1/default/Pod/fake-pod-10-l47dc": {}, + "/v1/default/Pod/fake-pod-10-l4nzz": {}, + "/v1/default/Pod/fake-pod-10-l96x2": {}, + "/v1/default/Pod/fake-pod-10-lbl5q": {}, + "/v1/default/Pod/fake-pod-10-lbqnm": {}, + "/v1/default/Pod/fake-pod-10-ldsk2": {}, + "/v1/default/Pod/fake-pod-10-lhc8z": {}, + "/v1/default/Pod/fake-pod-10-lhslb": {}, + "/v1/default/Pod/fake-pod-10-lhxln": {}, + "/v1/default/Pod/fake-pod-10-lndn2": {}, + "/v1/default/Pod/fake-pod-10-lprk5": {}, + "/v1/default/Pod/fake-pod-10-lx789": {}, + "/v1/default/Pod/fake-pod-10-lx9cz": {}, + "/v1/default/Pod/fake-pod-10-mf5qq": {}, + "/v1/default/Pod/fake-pod-10-mfkl4": {}, + "/v1/default/Pod/fake-pod-10-mhbpv": {}, + "/v1/default/Pod/fake-pod-10-mm96l": {}, + "/v1/default/Pod/fake-pod-10-mpjjs": {}, + "/v1/default/Pod/fake-pod-10-mqnxt": {}, + "/v1/default/Pod/fake-pod-10-mqphh": {}, + "/v1/default/Pod/fake-pod-10-mqpsn": {}, + "/v1/default/Pod/fake-pod-10-mx5rk": {}, + "/v1/default/Pod/fake-pod-10-mx9lb": {}, + "/v1/default/Pod/fake-pod-10-n66ck": {}, + "/v1/default/Pod/fake-pod-10-nbldw": {}, + "/v1/default/Pod/fake-pod-10-ng94z": {}, + "/v1/default/Pod/fake-pod-10-nhkd2": {}, + "/v1/default/Pod/fake-pod-10-nkwck": {}, + "/v1/default/Pod/fake-pod-10-nlxss": {}, + "/v1/default/Pod/fake-pod-10-np7rm": {}, + "/v1/default/Pod/fake-pod-10-nssb6": {}, + "/v1/default/Pod/fake-pod-10-nxvsr": {}, + "/v1/default/Pod/fake-pod-10-nzr58": {}, + "/v1/default/Pod/fake-pod-10-p42c9": {}, + "/v1/default/Pod/fake-pod-10-p92xc": {}, + "/v1/default/Pod/fake-pod-10-p9mjc": {}, + "/v1/default/Pod/fake-pod-10-pfrt7": {}, + "/v1/default/Pod/fake-pod-10-pgqsq": {}, + "/v1/default/Pod/fake-pod-10-plg8q": {}, + "/v1/default/Pod/fake-pod-10-q2c8z": {}, + "/v1/default/Pod/fake-pod-10-q47xz": {}, + "/v1/default/Pod/fake-pod-10-q56ks": {}, + "/v1/default/Pod/fake-pod-10-q7tsp": {}, + "/v1/default/Pod/fake-pod-10-q94t7": {}, + "/v1/default/Pod/fake-pod-10-q9sll": {}, + "/v1/default/Pod/fake-pod-10-qbhk6": {}, + "/v1/default/Pod/fake-pod-10-qcxfk": {}, + "/v1/default/Pod/fake-pod-10-qdmdl": {}, + "/v1/default/Pod/fake-pod-10-qhm2l": {}, + "/v1/default/Pod/fake-pod-10-qk6d8": {}, + "/v1/default/Pod/fake-pod-10-qn5ql": {}, + "/v1/default/Pod/fake-pod-10-qnnw9": {}, + "/v1/default/Pod/fake-pod-10-qqzm9": {}, + "/v1/default/Pod/fake-pod-10-qsgp8": {}, + "/v1/default/Pod/fake-pod-10-r6cpg": {}, + "/v1/default/Pod/fake-pod-10-r9x42": {}, + "/v1/default/Pod/fake-pod-10-rgb9r": {}, + "/v1/default/Pod/fake-pod-10-rjj4h": {}, + "/v1/default/Pod/fake-pod-10-rltdb": {}, + "/v1/default/Pod/fake-pod-10-rn5m7": {}, + "/v1/default/Pod/fake-pod-10-rrnxh": {}, + "/v1/default/Pod/fake-pod-10-rtlf8": {}, + "/v1/default/Pod/fake-pod-10-rtsl2": {}, + "/v1/default/Pod/fake-pod-10-rtvpq": {}, + "/v1/default/Pod/fake-pod-10-rtxgf": {}, + "/v1/default/Pod/fake-pod-10-rwx82": {}, + "/v1/default/Pod/fake-pod-10-s2gxh": {}, + "/v1/default/Pod/fake-pod-10-s5lsn": {}, + "/v1/default/Pod/fake-pod-10-s7dfc": {}, + "/v1/default/Pod/fake-pod-10-s7v7g": {}, + "/v1/default/Pod/fake-pod-10-shp6r": {}, + "/v1/default/Pod/fake-pod-10-sn99f": {}, + "/v1/default/Pod/fake-pod-10-spcrg": {}, + "/v1/default/Pod/fake-pod-10-spvwc": {}, + "/v1/default/Pod/fake-pod-10-srq9b": {}, + "/v1/default/Pod/fake-pod-10-sxc7k": {}, + "/v1/default/Pod/fake-pod-10-t24tr": {}, + "/v1/default/Pod/fake-pod-10-t5rxg": {}, + "/v1/default/Pod/fake-pod-10-tfd4n": {}, + "/v1/default/Pod/fake-pod-10-thcpc": {}, + "/v1/default/Pod/fake-pod-10-tl4kf": {}, + "/v1/default/Pod/fake-pod-10-tl98n": {}, + "/v1/default/Pod/fake-pod-10-tm6px": {}, + "/v1/default/Pod/fake-pod-10-tmdmm": {}, + "/v1/default/Pod/fake-pod-10-tmnbg": {}, + "/v1/default/Pod/fake-pod-10-tn6pk": {}, + "/v1/default/Pod/fake-pod-10-ttqr8": {}, + "/v1/default/Pod/fake-pod-10-tvdw9": {}, + "/v1/default/Pod/fake-pod-10-tvl6z": {}, + "/v1/default/Pod/fake-pod-10-tvr6d": {}, + "/v1/default/Pod/fake-pod-10-tvwzg": {}, + "/v1/default/Pod/fake-pod-10-tz5tf": {}, + "/v1/default/Pod/fake-pod-10-tzhwl": {}, + "/v1/default/Pod/fake-pod-10-v2c97": {}, + "/v1/default/Pod/fake-pod-10-v4wkc": {}, + "/v1/default/Pod/fake-pod-10-vdmc5": {}, + "/v1/default/Pod/fake-pod-10-vh48m": {}, + "/v1/default/Pod/fake-pod-10-vj8jl": {}, + "/v1/default/Pod/fake-pod-10-vj9vb": {}, + "/v1/default/Pod/fake-pod-10-vl7h7": {}, + "/v1/default/Pod/fake-pod-10-vszh6": {}, + "/v1/default/Pod/fake-pod-10-vv9cr": {}, + "/v1/default/Pod/fake-pod-10-vz4s5": {}, + "/v1/default/Pod/fake-pod-10-vzxpl": {}, + "/v1/default/Pod/fake-pod-10-w26gj": {}, + "/v1/default/Pod/fake-pod-10-w7fgx": {}, + "/v1/default/Pod/fake-pod-10-wb2g9": {}, + "/v1/default/Pod/fake-pod-10-wbp8x": {}, + "/v1/default/Pod/fake-pod-10-wfvjk": {}, + "/v1/default/Pod/fake-pod-10-wm67n": {}, + "/v1/default/Pod/fake-pod-10-wng9c": {}, + "/v1/default/Pod/fake-pod-10-wp82h": {}, + "/v1/default/Pod/fake-pod-10-wrqlk": {}, + "/v1/default/Pod/fake-pod-10-wx8wt": {}, + "/v1/default/Pod/fake-pod-10-x77c7": {}, + "/v1/default/Pod/fake-pod-10-xdmwj": {}, + "/v1/default/Pod/fake-pod-10-xdwns": {}, + "/v1/default/Pod/fake-pod-10-xjxdz": {}, + "/v1/default/Pod/fake-pod-10-xjz4f": {}, + "/v1/default/Pod/fake-pod-10-xktt2": {}, + "/v1/default/Pod/fake-pod-10-xslgf": {}, + "/v1/default/Pod/fake-pod-10-xt4j2": {}, + "/v1/default/Pod/fake-pod-10-xvjfl": {}, + "/v1/default/Pod/fake-pod-10-z2nwk": {}, + "/v1/default/Pod/fake-pod-10-z2z68": {}, + "/v1/default/Pod/fake-pod-10-z4fsw": {}, + "/v1/default/Pod/fake-pod-10-z5lsq": {}, + "/v1/default/Pod/fake-pod-10-zbj5d": {}, + "/v1/default/Pod/fake-pod-10-zjdm6": {}, + "/v1/default/Pod/fake-pod-10-zkd8n": {}, + "/v1/default/Pod/fake-pod-10-zvr5b": {}, + "/v1/default/Pod/fake-pod-10-zxlr6": {}, + "/v1/default/Pod/fake-pod-11-24fzq": {}, + "/v1/default/Pod/fake-pod-11-24p5c": {}, + "/v1/default/Pod/fake-pod-11-296q4": {}, + "/v1/default/Pod/fake-pod-11-2dmnp": {}, + "/v1/default/Pod/fake-pod-11-2f76p": {}, + "/v1/default/Pod/fake-pod-11-2nfdc": {}, + "/v1/default/Pod/fake-pod-11-2q9nc": {}, + "/v1/default/Pod/fake-pod-11-2tv8z": {}, + "/v1/default/Pod/fake-pod-11-2z4x9": {}, + "/v1/default/Pod/fake-pod-11-42q78": {}, + "/v1/default/Pod/fake-pod-11-44mw7": {}, + "/v1/default/Pod/fake-pod-11-44n2d": {}, + "/v1/default/Pod/fake-pod-11-48ffz": {}, + "/v1/default/Pod/fake-pod-11-4cggs": {}, + "/v1/default/Pod/fake-pod-11-4d4pf": {}, + "/v1/default/Pod/fake-pod-11-4g7zg": {}, + "/v1/default/Pod/fake-pod-11-4gzkd": {}, + "/v1/default/Pod/fake-pod-11-4k6r5": {}, + "/v1/default/Pod/fake-pod-11-4ktw2": {}, + "/v1/default/Pod/fake-pod-11-4n946": {}, + "/v1/default/Pod/fake-pod-11-4p2mr": {}, + "/v1/default/Pod/fake-pod-11-4ptp6": {}, + "/v1/default/Pod/fake-pod-11-4rcfw": {}, + "/v1/default/Pod/fake-pod-11-4snmt": {}, + "/v1/default/Pod/fake-pod-11-4ttgz": {}, + "/v1/default/Pod/fake-pod-11-4xznk": {}, + "/v1/default/Pod/fake-pod-11-4zlms": {}, + "/v1/default/Pod/fake-pod-11-4zzlt": {}, + "/v1/default/Pod/fake-pod-11-58nvq": {}, + "/v1/default/Pod/fake-pod-11-5c6j5": {}, + "/v1/default/Pod/fake-pod-11-5f7bd": {}, + "/v1/default/Pod/fake-pod-11-5lb8p": {}, + "/v1/default/Pod/fake-pod-11-5lmg4": {}, + "/v1/default/Pod/fake-pod-11-5pthc": {}, + "/v1/default/Pod/fake-pod-11-5rhjg": {}, + "/v1/default/Pod/fake-pod-11-5sccz": {}, + "/v1/default/Pod/fake-pod-11-5tnjd": {}, + "/v1/default/Pod/fake-pod-11-5zh7c": {}, + "/v1/default/Pod/fake-pod-11-64h4r": {}, + "/v1/default/Pod/fake-pod-11-69c7b": {}, + "/v1/default/Pod/fake-pod-11-69rzr": {}, + "/v1/default/Pod/fake-pod-11-6c26h": {}, + "/v1/default/Pod/fake-pod-11-6f6hf": {}, + "/v1/default/Pod/fake-pod-11-76vkb": {}, + "/v1/default/Pod/fake-pod-11-7jkth": {}, + "/v1/default/Pod/fake-pod-11-7mn6h": {}, + "/v1/default/Pod/fake-pod-11-7n8fv": {}, + "/v1/default/Pod/fake-pod-11-7qhwr": {}, + "/v1/default/Pod/fake-pod-11-7rs28": {}, + "/v1/default/Pod/fake-pod-11-7zptj": {}, + "/v1/default/Pod/fake-pod-11-7zt88": {}, + "/v1/default/Pod/fake-pod-11-8247q": {}, + "/v1/default/Pod/fake-pod-11-84r5d": {}, + "/v1/default/Pod/fake-pod-11-86hx9": {}, + "/v1/default/Pod/fake-pod-11-87fmw": {}, + "/v1/default/Pod/fake-pod-11-898gp": {}, + "/v1/default/Pod/fake-pod-11-8jjvf": {}, + "/v1/default/Pod/fake-pod-11-8msjk": {}, + "/v1/default/Pod/fake-pod-11-8nngl": {}, + "/v1/default/Pod/fake-pod-11-8pdpq": {}, + "/v1/default/Pod/fake-pod-11-8pjjq": {}, + "/v1/default/Pod/fake-pod-11-92vfb": {}, + "/v1/default/Pod/fake-pod-11-986cp": {}, + "/v1/default/Pod/fake-pod-11-9b94q": {}, + "/v1/default/Pod/fake-pod-11-9gsrb": {}, + "/v1/default/Pod/fake-pod-11-9ktc2": {}, + "/v1/default/Pod/fake-pod-11-9ss7d": {}, + "/v1/default/Pod/fake-pod-11-b7d6b": {}, + "/v1/default/Pod/fake-pod-11-b8962": {}, + "/v1/default/Pod/fake-pod-11-b8t4v": {}, + "/v1/default/Pod/fake-pod-11-bccqw": {}, + "/v1/default/Pod/fake-pod-11-bgf6j": {}, + "/v1/default/Pod/fake-pod-11-bl6gw": {}, + "/v1/default/Pod/fake-pod-11-bnmhr": {}, + "/v1/default/Pod/fake-pod-11-bpb5g": {}, + "/v1/default/Pod/fake-pod-11-bpkfd": {}, + "/v1/default/Pod/fake-pod-11-bsqqs": {}, + "/v1/default/Pod/fake-pod-11-btvz2": {}, + "/v1/default/Pod/fake-pod-11-bvc9z": {}, + "/v1/default/Pod/fake-pod-11-bzm7h": {}, + "/v1/default/Pod/fake-pod-11-c2nf2": {}, + "/v1/default/Pod/fake-pod-11-c4tb7": {}, + "/v1/default/Pod/fake-pod-11-c76r2": {}, + "/v1/default/Pod/fake-pod-11-cbhg8": {}, + "/v1/default/Pod/fake-pod-11-cbq82": {}, + "/v1/default/Pod/fake-pod-11-cbwb2": {}, + "/v1/default/Pod/fake-pod-11-cczcw": {}, + "/v1/default/Pod/fake-pod-11-cdhcm": {}, + "/v1/default/Pod/fake-pod-11-cg8pk": {}, + "/v1/default/Pod/fake-pod-11-chg9q": {}, + "/v1/default/Pod/fake-pod-11-cj8k9": {}, + "/v1/default/Pod/fake-pod-11-cldp6": {}, + "/v1/default/Pod/fake-pod-11-cqtj9": {}, + "/v1/default/Pod/fake-pod-11-crfwk": {}, + "/v1/default/Pod/fake-pod-11-csc4r": {}, + "/v1/default/Pod/fake-pod-11-csvjt": {}, + "/v1/default/Pod/fake-pod-11-cwmsd": {}, + "/v1/default/Pod/fake-pod-11-cxdwf": {}, + "/v1/default/Pod/fake-pod-11-d5s6h": {}, + "/v1/default/Pod/fake-pod-11-d7gv7": {}, + "/v1/default/Pod/fake-pod-11-ddcm5": {}, + "/v1/default/Pod/fake-pod-11-dgskc": {}, + "/v1/default/Pod/fake-pod-11-djmpn": {}, + "/v1/default/Pod/fake-pod-11-dmhrv": {}, + "/v1/default/Pod/fake-pod-11-dqlwt": {}, + "/v1/default/Pod/fake-pod-11-dwgg8": {}, + "/v1/default/Pod/fake-pod-11-dwl89": {}, + "/v1/default/Pod/fake-pod-11-fp8wq": {}, + "/v1/default/Pod/fake-pod-11-fq6bl": {}, + "/v1/default/Pod/fake-pod-11-ft989": {}, + "/v1/default/Pod/fake-pod-11-g9h7b": {}, + "/v1/default/Pod/fake-pod-11-gd8wq": {}, + "/v1/default/Pod/fake-pod-11-ggk27": {}, + "/v1/default/Pod/fake-pod-11-gq86t": {}, + "/v1/default/Pod/fake-pod-11-gwrtg": {}, + "/v1/default/Pod/fake-pod-11-gxp52": {}, + "/v1/default/Pod/fake-pod-11-h49tp": {}, + "/v1/default/Pod/fake-pod-11-h4d8s": {}, + "/v1/default/Pod/fake-pod-11-h4jx4": {}, + "/v1/default/Pod/fake-pod-11-h77k6": {}, + "/v1/default/Pod/fake-pod-11-h77wq": {}, + "/v1/default/Pod/fake-pod-11-h824h": {}, + "/v1/default/Pod/fake-pod-11-h84q7": {}, + "/v1/default/Pod/fake-pod-11-hf9p4": {}, + "/v1/default/Pod/fake-pod-11-hh5vz": {}, + "/v1/default/Pod/fake-pod-11-hq928": {}, + "/v1/default/Pod/fake-pod-11-ht9tg": {}, + "/v1/default/Pod/fake-pod-11-hvtwr": {}, + "/v1/default/Pod/fake-pod-11-hw26z": {}, + "/v1/default/Pod/fake-pod-11-j2lcl": {}, + "/v1/default/Pod/fake-pod-11-j5xvq": {}, + "/v1/default/Pod/fake-pod-11-j6v4g": {}, + "/v1/default/Pod/fake-pod-11-jglj5": {}, + "/v1/default/Pod/fake-pod-11-jhbh7": {}, + "/v1/default/Pod/fake-pod-11-jmchf": {}, + "/v1/default/Pod/fake-pod-11-jns44": {}, + "/v1/default/Pod/fake-pod-11-jp88j": {}, + "/v1/default/Pod/fake-pod-11-jspfh": {}, + "/v1/default/Pod/fake-pod-11-jt78g": {}, + "/v1/default/Pod/fake-pod-11-jx4kk": {}, + "/v1/default/Pod/fake-pod-11-jxb9m": {}, + "/v1/default/Pod/fake-pod-11-k44fb": {}, + "/v1/default/Pod/fake-pod-11-k4lnl": {}, + "/v1/default/Pod/fake-pod-11-k78zt": {}, + "/v1/default/Pod/fake-pod-11-k7gdp": {}, + "/v1/default/Pod/fake-pod-11-kbvlr": {}, + "/v1/default/Pod/fake-pod-11-khksm": {}, + "/v1/default/Pod/fake-pod-11-khzpr": {}, + "/v1/default/Pod/fake-pod-11-kj9qf": {}, + "/v1/default/Pod/fake-pod-11-kkv4g": {}, + "/v1/default/Pod/fake-pod-11-klxs6": {}, + "/v1/default/Pod/fake-pod-11-kmgw8": {}, + "/v1/default/Pod/fake-pod-11-ktjmp": {}, + "/v1/default/Pod/fake-pod-11-kwkvm": {}, + "/v1/default/Pod/fake-pod-11-l5kbc": {}, + "/v1/default/Pod/fake-pod-11-l688q": {}, + "/v1/default/Pod/fake-pod-11-l6f4d": {}, + "/v1/default/Pod/fake-pod-11-lcqh5": {}, + "/v1/default/Pod/fake-pod-11-llrhq": {}, + "/v1/default/Pod/fake-pod-11-lmqp5": {}, + "/v1/default/Pod/fake-pod-11-lntvd": {}, + "/v1/default/Pod/fake-pod-11-lp8xh": {}, + "/v1/default/Pod/fake-pod-11-lq9l7": {}, + "/v1/default/Pod/fake-pod-11-lww5m": {}, + "/v1/default/Pod/fake-pod-11-lxmjd": {}, + "/v1/default/Pod/fake-pod-11-lzmbt": {}, + "/v1/default/Pod/fake-pod-11-lzzhg": {}, + "/v1/default/Pod/fake-pod-11-m276p": {}, + "/v1/default/Pod/fake-pod-11-m2h7r": {}, + "/v1/default/Pod/fake-pod-11-m8lc8": {}, + "/v1/default/Pod/fake-pod-11-mbwrg": {}, + "/v1/default/Pod/fake-pod-11-mgdnd": {}, + "/v1/default/Pod/fake-pod-11-mjgfn": {}, + "/v1/default/Pod/fake-pod-11-mnmmf": {}, + "/v1/default/Pod/fake-pod-11-mrp4g": {}, + "/v1/default/Pod/fake-pod-11-mtgf8": {}, + "/v1/default/Pod/fake-pod-11-mvjrp": {}, + "/v1/default/Pod/fake-pod-11-mwsvf": {}, + "/v1/default/Pod/fake-pod-11-mx54l": {}, + "/v1/default/Pod/fake-pod-11-n56gr": {}, + "/v1/default/Pod/fake-pod-11-n57zn": {}, + "/v1/default/Pod/fake-pod-11-n5pqq": {}, + "/v1/default/Pod/fake-pod-11-n6c8j": {}, + "/v1/default/Pod/fake-pod-11-nbtdv": {}, + "/v1/default/Pod/fake-pod-11-ncqn2": {}, + "/v1/default/Pod/fake-pod-11-ndbw5": {}, + "/v1/default/Pod/fake-pod-11-nf5vc": {}, + "/v1/default/Pod/fake-pod-11-nl7d4": {}, + "/v1/default/Pod/fake-pod-11-nm9f2": {}, + "/v1/default/Pod/fake-pod-11-nmlr9": {}, + "/v1/default/Pod/fake-pod-11-nncdj": {}, + "/v1/default/Pod/fake-pod-11-np57s": {}, + "/v1/default/Pod/fake-pod-11-nqzmb": {}, + "/v1/default/Pod/fake-pod-11-nr7lm": {}, + "/v1/default/Pod/fake-pod-11-nrj52": {}, + "/v1/default/Pod/fake-pod-11-nsdmv": {}, + "/v1/default/Pod/fake-pod-11-nt5ns": {}, + "/v1/default/Pod/fake-pod-11-nt9qg": {}, + "/v1/default/Pod/fake-pod-11-nvdtx": {}, + "/v1/default/Pod/fake-pod-11-p54w2": {}, + "/v1/default/Pod/fake-pod-11-p5vh6": {}, + "/v1/default/Pod/fake-pod-11-p6t2j": {}, + "/v1/default/Pod/fake-pod-11-p7x74": {}, + "/v1/default/Pod/fake-pod-11-p87gv": {}, + "/v1/default/Pod/fake-pod-11-pbc7l": {}, + "/v1/default/Pod/fake-pod-11-pdgk4": {}, + "/v1/default/Pod/fake-pod-11-pfc74": {}, + "/v1/default/Pod/fake-pod-11-pgfmc": {}, + "/v1/default/Pod/fake-pod-11-pgx68": {}, + "/v1/default/Pod/fake-pod-11-phz2r": {}, + "/v1/default/Pod/fake-pod-11-pmjlw": {}, + "/v1/default/Pod/fake-pod-11-pphzg": {}, + "/v1/default/Pod/fake-pod-11-ppxrd": {}, + "/v1/default/Pod/fake-pod-11-prgmq": {}, + "/v1/default/Pod/fake-pod-11-pvfbb": {}, + "/v1/default/Pod/fake-pod-11-q5zsv": {}, + "/v1/default/Pod/fake-pod-11-q84ms": {}, + "/v1/default/Pod/fake-pod-11-q8ql8": {}, + "/v1/default/Pod/fake-pod-11-qcwlc": {}, + "/v1/default/Pod/fake-pod-11-qdpp8": {}, + "/v1/default/Pod/fake-pod-11-qg49q": {}, + "/v1/default/Pod/fake-pod-11-qg5k4": {}, + "/v1/default/Pod/fake-pod-11-qp6w6": {}, + "/v1/default/Pod/fake-pod-11-qv69q": {}, + "/v1/default/Pod/fake-pod-11-qvvkg": {}, + "/v1/default/Pod/fake-pod-11-qxlch": {}, + "/v1/default/Pod/fake-pod-11-r4b5z": {}, + "/v1/default/Pod/fake-pod-11-r5dfp": {}, + "/v1/default/Pod/fake-pod-11-r7wws": {}, + "/v1/default/Pod/fake-pod-11-r7zl5": {}, + "/v1/default/Pod/fake-pod-11-rcv4r": {}, + "/v1/default/Pod/fake-pod-11-rg2hm": {}, + "/v1/default/Pod/fake-pod-11-rn45h": {}, + "/v1/default/Pod/fake-pod-11-rst6q": {}, + "/v1/default/Pod/fake-pod-11-rt76f": {}, + "/v1/default/Pod/fake-pod-11-s5knc": {}, + "/v1/default/Pod/fake-pod-11-s7c9j": {}, + "/v1/default/Pod/fake-pod-11-s8gmd": {}, + "/v1/default/Pod/fake-pod-11-s8jd8": {}, + "/v1/default/Pod/fake-pod-11-sf4cf": {}, + "/v1/default/Pod/fake-pod-11-sfhb2": {}, + "/v1/default/Pod/fake-pod-11-snkxm": {}, + "/v1/default/Pod/fake-pod-11-ss954": {}, + "/v1/default/Pod/fake-pod-11-stjxl": {}, + "/v1/default/Pod/fake-pod-11-t5gfb": {}, + "/v1/default/Pod/fake-pod-11-t5kpv": {}, + "/v1/default/Pod/fake-pod-11-t64nv": {}, + "/v1/default/Pod/fake-pod-11-t72sk": {}, + "/v1/default/Pod/fake-pod-11-t7dzv": {}, + "/v1/default/Pod/fake-pod-11-t7pdn": {}, + "/v1/default/Pod/fake-pod-11-t8mv2": {}, + "/v1/default/Pod/fake-pod-11-t9725": {}, + "/v1/default/Pod/fake-pod-11-t9bk8": {}, + "/v1/default/Pod/fake-pod-11-t9x6n": {}, + "/v1/default/Pod/fake-pod-11-tcg7s": {}, + "/v1/default/Pod/fake-pod-11-tl66z": {}, + "/v1/default/Pod/fake-pod-11-tp94z": {}, + "/v1/default/Pod/fake-pod-11-tv9cc": {}, + "/v1/default/Pod/fake-pod-11-tz2tf": {}, + "/v1/default/Pod/fake-pod-11-v86kh": {}, + "/v1/default/Pod/fake-pod-11-vfpss": {}, + "/v1/default/Pod/fake-pod-11-vhl9c": {}, + "/v1/default/Pod/fake-pod-11-vlzx6": {}, + "/v1/default/Pod/fake-pod-11-vqlbr": {}, + "/v1/default/Pod/fake-pod-11-vqtpq": {}, + "/v1/default/Pod/fake-pod-11-w5v4x": {}, + "/v1/default/Pod/fake-pod-11-wbb46": {}, + "/v1/default/Pod/fake-pod-11-wbwb9": {}, + "/v1/default/Pod/fake-pod-11-wclxz": {}, + "/v1/default/Pod/fake-pod-11-wj8m5": {}, + "/v1/default/Pod/fake-pod-11-wkt8l": {}, + "/v1/default/Pod/fake-pod-11-wpdpt": {}, + "/v1/default/Pod/fake-pod-11-wq8k7": {}, + "/v1/default/Pod/fake-pod-11-wtwrk": {}, + "/v1/default/Pod/fake-pod-11-wxnzt": {}, + "/v1/default/Pod/fake-pod-11-wxv98": {}, + "/v1/default/Pod/fake-pod-11-x4vtq": {}, + "/v1/default/Pod/fake-pod-11-x6nqp": {}, + "/v1/default/Pod/fake-pod-11-xb2cs": {}, + "/v1/default/Pod/fake-pod-11-xch64": {}, + "/v1/default/Pod/fake-pod-11-xcl78": {}, + "/v1/default/Pod/fake-pod-11-xfzs5": {}, + "/v1/default/Pod/fake-pod-11-xh826": {}, + "/v1/default/Pod/fake-pod-11-xldz5": {}, + "/v1/default/Pod/fake-pod-11-xn9ct": {}, + "/v1/default/Pod/fake-pod-11-xq6f8": {}, + "/v1/default/Pod/fake-pod-11-xrjgc": {}, + "/v1/default/Pod/fake-pod-11-xwgcq": {}, + "/v1/default/Pod/fake-pod-11-xzm97": {}, + "/v1/default/Pod/fake-pod-11-z4lsf": {}, + "/v1/default/Pod/fake-pod-11-zb92d": {}, + "/v1/default/Pod/fake-pod-11-zc9wf": {}, + "/v1/default/Pod/fake-pod-11-zcmz2": {}, + "/v1/default/Pod/fake-pod-11-zfhjq": {}, + "/v1/default/Pod/fake-pod-11-zj9m4": {}, + "/v1/default/Pod/fake-pod-11-zr75b": {}, + "/v1/default/Pod/fake-pod-11-ztn7h": {}, + "/v1/default/Pod/fake-pod-11-zwbzl": {}, + "/v1/default/Pod/fake-pod-11-zznlx": {}, + "/v1/default/Pod/fake-pod-12-24q6r": {}, + "/v1/default/Pod/fake-pod-12-26j7z": {}, + "/v1/default/Pod/fake-pod-12-28czr": {}, + "/v1/default/Pod/fake-pod-12-29cgs": {}, + "/v1/default/Pod/fake-pod-12-2crqb": {}, + "/v1/default/Pod/fake-pod-12-2lpg6": {}, + "/v1/default/Pod/fake-pod-12-2lzvr": {}, + "/v1/default/Pod/fake-pod-12-2p9tc": {}, + "/v1/default/Pod/fake-pod-12-2v5hr": {}, + "/v1/default/Pod/fake-pod-12-2wq4k": {}, + "/v1/default/Pod/fake-pod-12-2zhgl": {}, + "/v1/default/Pod/fake-pod-12-2ztq9": {}, + "/v1/default/Pod/fake-pod-12-4479z": {}, + "/v1/default/Pod/fake-pod-12-44b5s": {}, + "/v1/default/Pod/fake-pod-12-4622k": {}, + "/v1/default/Pod/fake-pod-12-46w6g": {}, + "/v1/default/Pod/fake-pod-12-477xp": {}, + "/v1/default/Pod/fake-pod-12-4dppc": {}, + "/v1/default/Pod/fake-pod-12-4h7sf": {}, + "/v1/default/Pod/fake-pod-12-4hv8j": {}, + "/v1/default/Pod/fake-pod-12-4kbmw": {}, + "/v1/default/Pod/fake-pod-12-4kp44": {}, + "/v1/default/Pod/fake-pod-12-4qb6x": {}, + "/v1/default/Pod/fake-pod-12-4qn99": {}, + "/v1/default/Pod/fake-pod-12-4qrwc": {}, + "/v1/default/Pod/fake-pod-12-4rz9t": {}, + "/v1/default/Pod/fake-pod-12-52cnt": {}, + "/v1/default/Pod/fake-pod-12-54c86": {}, + "/v1/default/Pod/fake-pod-12-56n8j": {}, + "/v1/default/Pod/fake-pod-12-56rzs": {}, + "/v1/default/Pod/fake-pod-12-597qz": {}, + "/v1/default/Pod/fake-pod-12-5bl6h": {}, + "/v1/default/Pod/fake-pod-12-5g2l5": {}, + "/v1/default/Pod/fake-pod-12-5lhr7": {}, + "/v1/default/Pod/fake-pod-12-5np67": {}, + "/v1/default/Pod/fake-pod-12-5qxh7": {}, + "/v1/default/Pod/fake-pod-12-5shlj": {}, + "/v1/default/Pod/fake-pod-12-5wc6v": {}, + "/v1/default/Pod/fake-pod-12-5x96s": {}, + "/v1/default/Pod/fake-pod-12-5xwvn": {}, + "/v1/default/Pod/fake-pod-12-5z5bp": {}, + "/v1/default/Pod/fake-pod-12-64z7x": {}, + "/v1/default/Pod/fake-pod-12-688wp": {}, + "/v1/default/Pod/fake-pod-12-6fgks": {}, + "/v1/default/Pod/fake-pod-12-6jvwg": {}, + "/v1/default/Pod/fake-pod-12-6qj42": {}, + "/v1/default/Pod/fake-pod-12-6v4r7": {}, + "/v1/default/Pod/fake-pod-12-6w86x": {}, + "/v1/default/Pod/fake-pod-12-6wqbr": {}, + "/v1/default/Pod/fake-pod-12-756n7": {}, + "/v1/default/Pod/fake-pod-12-75flp": {}, + "/v1/default/Pod/fake-pod-12-78vxp": {}, + "/v1/default/Pod/fake-pod-12-7kqmn": {}, + "/v1/default/Pod/fake-pod-12-7s67b": {}, + "/v1/default/Pod/fake-pod-12-7ztwj": {}, + "/v1/default/Pod/fake-pod-12-858j2": {}, + "/v1/default/Pod/fake-pod-12-8659n": {}, + "/v1/default/Pod/fake-pod-12-882hz": {}, + "/v1/default/Pod/fake-pod-12-892gx": {}, + "/v1/default/Pod/fake-pod-12-8hr7h": {}, + "/v1/default/Pod/fake-pod-12-8k882": {}, + "/v1/default/Pod/fake-pod-12-8lxxf": {}, + "/v1/default/Pod/fake-pod-12-8pc68": {}, + "/v1/default/Pod/fake-pod-12-8vjbv": {}, + "/v1/default/Pod/fake-pod-12-8x9gk": {}, + "/v1/default/Pod/fake-pod-12-8z6v8": {}, + "/v1/default/Pod/fake-pod-12-96grt": {}, + "/v1/default/Pod/fake-pod-12-972dj": {}, + "/v1/default/Pod/fake-pod-12-98hnf": {}, + "/v1/default/Pod/fake-pod-12-98v4z": {}, + "/v1/default/Pod/fake-pod-12-9d82c": {}, + "/v1/default/Pod/fake-pod-12-9dnx7": {}, + "/v1/default/Pod/fake-pod-12-9h5hr": {}, + "/v1/default/Pod/fake-pod-12-9jh57": {}, + "/v1/default/Pod/fake-pod-12-9lfjv": {}, + "/v1/default/Pod/fake-pod-12-9ljds": {}, + "/v1/default/Pod/fake-pod-12-9nfz2": {}, + "/v1/default/Pod/fake-pod-12-9t62d": {}, + "/v1/default/Pod/fake-pod-12-9v28v": {}, + "/v1/default/Pod/fake-pod-12-9zkgc": {}, + "/v1/default/Pod/fake-pod-12-b5bd9": {}, + "/v1/default/Pod/fake-pod-12-b7btn": {}, + "/v1/default/Pod/fake-pod-12-b7j7l": {}, + "/v1/default/Pod/fake-pod-12-b7l98": {}, + "/v1/default/Pod/fake-pod-12-bft2f": {}, + "/v1/default/Pod/fake-pod-12-bhdd2": {}, + "/v1/default/Pod/fake-pod-12-bjp72": {}, + "/v1/default/Pod/fake-pod-12-bjzq5": {}, + "/v1/default/Pod/fake-pod-12-bkhhh": {}, + "/v1/default/Pod/fake-pod-12-bl2wp": {}, + "/v1/default/Pod/fake-pod-12-bl9bt": {}, + "/v1/default/Pod/fake-pod-12-bm6cf": {}, + "/v1/default/Pod/fake-pod-12-bpvc9": {}, + "/v1/default/Pod/fake-pod-12-brjm6": {}, + "/v1/default/Pod/fake-pod-12-bwc8p": {}, + "/v1/default/Pod/fake-pod-12-c6cph": {}, + "/v1/default/Pod/fake-pod-12-c76r4": {}, + "/v1/default/Pod/fake-pod-12-c7jx6": {}, + "/v1/default/Pod/fake-pod-12-c86ll": {}, + "/v1/default/Pod/fake-pod-12-c9w2l": {}, + "/v1/default/Pod/fake-pod-12-cdfmk": {}, + "/v1/default/Pod/fake-pod-12-chcsg": {}, + "/v1/default/Pod/fake-pod-12-cjlmb": {}, + "/v1/default/Pod/fake-pod-12-cklzd": {}, + "/v1/default/Pod/fake-pod-12-d5fzv": {}, + "/v1/default/Pod/fake-pod-12-d62z4": {}, + "/v1/default/Pod/fake-pod-12-dbbrb": {}, + "/v1/default/Pod/fake-pod-12-dczvs": {}, + "/v1/default/Pod/fake-pod-12-dgcqb": {}, + "/v1/default/Pod/fake-pod-12-dggvw": {}, + "/v1/default/Pod/fake-pod-12-dmcld": {}, + "/v1/default/Pod/fake-pod-12-dtnss": {}, + "/v1/default/Pod/fake-pod-12-dv7fv": {}, + "/v1/default/Pod/fake-pod-12-dvg7p": {}, + "/v1/default/Pod/fake-pod-12-dxmlx": {}, + "/v1/default/Pod/fake-pod-12-f52mg": {}, + "/v1/default/Pod/fake-pod-12-f7qc5": {}, + "/v1/default/Pod/fake-pod-12-f95jz": {}, + "/v1/default/Pod/fake-pod-12-f9hl2": {}, + "/v1/default/Pod/fake-pod-12-fb9s5": {}, + "/v1/default/Pod/fake-pod-12-fcmv7": {}, + "/v1/default/Pod/fake-pod-12-fdsg4": {}, + "/v1/default/Pod/fake-pod-12-fk9h7": {}, + "/v1/default/Pod/fake-pod-12-fkzc9": {}, + "/v1/default/Pod/fake-pod-12-fldpm": {}, + "/v1/default/Pod/fake-pod-12-fnbkg": {}, + "/v1/default/Pod/fake-pod-12-fnvxl": {}, + "/v1/default/Pod/fake-pod-12-fr446": {}, + "/v1/default/Pod/fake-pod-12-frv9j": {}, + "/v1/default/Pod/fake-pod-12-fsktv": {}, + "/v1/default/Pod/fake-pod-12-fsz26": {}, + "/v1/default/Pod/fake-pod-12-fvfxt": {}, + "/v1/default/Pod/fake-pod-12-fx972": {}, + "/v1/default/Pod/fake-pod-12-fzrhh": {}, + "/v1/default/Pod/fake-pod-12-g4g74": {}, + "/v1/default/Pod/fake-pod-12-gbcgr": {}, + "/v1/default/Pod/fake-pod-12-gcbrr": {}, + "/v1/default/Pod/fake-pod-12-gfg98": {}, + "/v1/default/Pod/fake-pod-12-gfwht": {}, + "/v1/default/Pod/fake-pod-12-ghpl2": {}, + "/v1/default/Pod/fake-pod-12-ghvrd": {}, + "/v1/default/Pod/fake-pod-12-gm7x8": {}, + "/v1/default/Pod/fake-pod-12-gmksp": {}, + "/v1/default/Pod/fake-pod-12-gpnvs": {}, + "/v1/default/Pod/fake-pod-12-gqrnn": {}, + "/v1/default/Pod/fake-pod-12-gwf2w": {}, + "/v1/default/Pod/fake-pod-12-h6w79": {}, + "/v1/default/Pod/fake-pod-12-h8qbm": {}, + "/v1/default/Pod/fake-pod-12-hb2dg": {}, + "/v1/default/Pod/fake-pod-12-hc4mq": {}, + "/v1/default/Pod/fake-pod-12-hc6jt": {}, + "/v1/default/Pod/fake-pod-12-hfc5n": {}, + "/v1/default/Pod/fake-pod-12-hh2gf": {}, + "/v1/default/Pod/fake-pod-12-hjv6p": {}, + "/v1/default/Pod/fake-pod-12-hjxhb": {}, + "/v1/default/Pod/fake-pod-12-hk8ft": {}, + "/v1/default/Pod/fake-pod-12-hq5bn": {}, + "/v1/default/Pod/fake-pod-12-hv9wj": {}, + "/v1/default/Pod/fake-pod-12-hvkn8": {}, + "/v1/default/Pod/fake-pod-12-hxsfc": {}, + "/v1/default/Pod/fake-pod-12-j2gc8": {}, + "/v1/default/Pod/fake-pod-12-j475b": {}, + "/v1/default/Pod/fake-pod-12-j4ggr": {}, + "/v1/default/Pod/fake-pod-12-j5j48": {}, + "/v1/default/Pod/fake-pod-12-j7mtj": {}, + "/v1/default/Pod/fake-pod-12-j8klb": {}, + "/v1/default/Pod/fake-pod-12-j9zbg": {}, + "/v1/default/Pod/fake-pod-12-jbcd2": {}, + "/v1/default/Pod/fake-pod-12-jfnz2": {}, + "/v1/default/Pod/fake-pod-12-jgdwz": {}, + "/v1/default/Pod/fake-pod-12-jqgtg": {}, + "/v1/default/Pod/fake-pod-12-jttfg": {}, + "/v1/default/Pod/fake-pod-12-jzfj4": {}, + "/v1/default/Pod/fake-pod-12-k5bfs": {}, + "/v1/default/Pod/fake-pod-12-k65kh": {}, + "/v1/default/Pod/fake-pod-12-kb778": {}, + "/v1/default/Pod/fake-pod-12-kc7sk": {}, + "/v1/default/Pod/fake-pod-12-kddk2": {}, + "/v1/default/Pod/fake-pod-12-khfd8": {}, + "/v1/default/Pod/fake-pod-12-kl7ct": {}, + "/v1/default/Pod/fake-pod-12-knksg": {}, + "/v1/default/Pod/fake-pod-12-kp7fs": {}, + "/v1/default/Pod/fake-pod-12-kqb6r": {}, + "/v1/default/Pod/fake-pod-12-kqcbd": {}, + "/v1/default/Pod/fake-pod-12-kqn24": {}, + "/v1/default/Pod/fake-pod-12-ksrvg": {}, + "/v1/default/Pod/fake-pod-12-ktbhg": {}, + "/v1/default/Pod/fake-pod-12-kwqdz": {}, + "/v1/default/Pod/fake-pod-12-l5stm": {}, + "/v1/default/Pod/fake-pod-12-l6mdd": {}, + "/v1/default/Pod/fake-pod-12-l95lj": {}, + "/v1/default/Pod/fake-pod-12-lfzjm": {}, + "/v1/default/Pod/fake-pod-12-lhn4b": {}, + "/v1/default/Pod/fake-pod-12-lv8fc": {}, + "/v1/default/Pod/fake-pod-12-lwqhg": {}, + "/v1/default/Pod/fake-pod-12-mbt6q": {}, + "/v1/default/Pod/fake-pod-12-mds7t": {}, + "/v1/default/Pod/fake-pod-12-mxfvk": {}, + "/v1/default/Pod/fake-pod-12-n877t": {}, + "/v1/default/Pod/fake-pod-12-ndksw": {}, + "/v1/default/Pod/fake-pod-12-ndmqf": {}, + "/v1/default/Pod/fake-pod-12-nfhxs": {}, + "/v1/default/Pod/fake-pod-12-ngvqv": {}, + "/v1/default/Pod/fake-pod-12-nhlq7": {}, + "/v1/default/Pod/fake-pod-12-nncmn": {}, + "/v1/default/Pod/fake-pod-12-nps8t": {}, + "/v1/default/Pod/fake-pod-12-pdpck": {}, + "/v1/default/Pod/fake-pod-12-pkzxr": {}, + "/v1/default/Pod/fake-pod-12-pmwdx": {}, + "/v1/default/Pod/fake-pod-12-pv2pj": {}, + "/v1/default/Pod/fake-pod-12-pvjtn": {}, + "/v1/default/Pod/fake-pod-12-px6jc": {}, + "/v1/default/Pod/fake-pod-12-pxc9z": {}, + "/v1/default/Pod/fake-pod-12-pxjw5": {}, + "/v1/default/Pod/fake-pod-12-q5rmz": {}, + "/v1/default/Pod/fake-pod-12-q759d": {}, + "/v1/default/Pod/fake-pod-12-qcdjz": {}, + "/v1/default/Pod/fake-pod-12-qdmth": {}, + "/v1/default/Pod/fake-pod-12-qfg6f": {}, + "/v1/default/Pod/fake-pod-12-qhz4x": {}, + "/v1/default/Pod/fake-pod-12-qj94x": {}, + "/v1/default/Pod/fake-pod-12-qmgcm": {}, + "/v1/default/Pod/fake-pod-12-qnh92": {}, + "/v1/default/Pod/fake-pod-12-qnl2p": {}, + "/v1/default/Pod/fake-pod-12-qnp4p": {}, + "/v1/default/Pod/fake-pod-12-qp4dh": {}, + "/v1/default/Pod/fake-pod-12-qrmsx": {}, + "/v1/default/Pod/fake-pod-12-qzj76": {}, + "/v1/default/Pod/fake-pod-12-r5cxd": {}, + "/v1/default/Pod/fake-pod-12-r7pf2": {}, + "/v1/default/Pod/fake-pod-12-rbssv": {}, + "/v1/default/Pod/fake-pod-12-rchbj": {}, + "/v1/default/Pod/fake-pod-12-rf48k": {}, + "/v1/default/Pod/fake-pod-12-rl8vh": {}, + "/v1/default/Pod/fake-pod-12-rnnfw": {}, + "/v1/default/Pod/fake-pod-12-rqhkr": {}, + "/v1/default/Pod/fake-pod-12-rs9mc": {}, + "/v1/default/Pod/fake-pod-12-rwmwg": {}, + "/v1/default/Pod/fake-pod-12-s9qk7": {}, + "/v1/default/Pod/fake-pod-12-s9t2b": {}, + "/v1/default/Pod/fake-pod-12-sc5w8": {}, + "/v1/default/Pod/fake-pod-12-sdbxj": {}, + "/v1/default/Pod/fake-pod-12-sdnlp": {}, + "/v1/default/Pod/fake-pod-12-skntd": {}, + "/v1/default/Pod/fake-pod-12-smzts": {}, + "/v1/default/Pod/fake-pod-12-t4stg": {}, + "/v1/default/Pod/fake-pod-12-t9zbf": {}, + "/v1/default/Pod/fake-pod-12-tbfjt": {}, + "/v1/default/Pod/fake-pod-12-tk2sv": {}, + "/v1/default/Pod/fake-pod-12-tktjh": {}, + "/v1/default/Pod/fake-pod-12-tm7vn": {}, + "/v1/default/Pod/fake-pod-12-tsbpr": {}, + "/v1/default/Pod/fake-pod-12-tt7dl": {}, + "/v1/default/Pod/fake-pod-12-v2ppp": {}, + "/v1/default/Pod/fake-pod-12-v49nw": {}, + "/v1/default/Pod/fake-pod-12-v72zk": {}, + "/v1/default/Pod/fake-pod-12-v7mgw": {}, + "/v1/default/Pod/fake-pod-12-vftqs": {}, + "/v1/default/Pod/fake-pod-12-vfw7p": {}, + "/v1/default/Pod/fake-pod-12-vh42s": {}, + "/v1/default/Pod/fake-pod-12-vpbgk": {}, + "/v1/default/Pod/fake-pod-12-vq2gw": {}, + "/v1/default/Pod/fake-pod-12-vtt4m": {}, + "/v1/default/Pod/fake-pod-12-vxlsr": {}, + "/v1/default/Pod/fake-pod-12-vz7qk": {}, + "/v1/default/Pod/fake-pod-12-w4b2d": {}, + "/v1/default/Pod/fake-pod-12-wbl52": {}, + "/v1/default/Pod/fake-pod-12-wcllw": {}, + "/v1/default/Pod/fake-pod-12-wctwt": {}, + "/v1/default/Pod/fake-pod-12-wds7v": {}, + "/v1/default/Pod/fake-pod-12-wgmxs": {}, + "/v1/default/Pod/fake-pod-12-wnlzs": {}, + "/v1/default/Pod/fake-pod-12-wns6z": {}, + "/v1/default/Pod/fake-pod-12-wp2wk": {}, + "/v1/default/Pod/fake-pod-12-wqc2v": {}, + "/v1/default/Pod/fake-pod-12-wr2jn": {}, + "/v1/default/Pod/fake-pod-12-wr2tk": {}, + "/v1/default/Pod/fake-pod-12-wwh5g": {}, + "/v1/default/Pod/fake-pod-12-x2jpl": {}, + "/v1/default/Pod/fake-pod-12-xc24f": {}, + "/v1/default/Pod/fake-pod-12-xfqth": {}, + "/v1/default/Pod/fake-pod-12-xgggg": {}, + "/v1/default/Pod/fake-pod-12-xkfzr": {}, + "/v1/default/Pod/fake-pod-12-xldsq": {}, + "/v1/default/Pod/fake-pod-12-xlnc5": {}, + "/v1/default/Pod/fake-pod-12-xrkkz": {}, + "/v1/default/Pod/fake-pod-12-z2ltn": {}, + "/v1/default/Pod/fake-pod-12-z6lf6": {}, + "/v1/default/Pod/fake-pod-12-z729f": {}, + "/v1/default/Pod/fake-pod-12-zb9xf": {}, + "/v1/default/Pod/fake-pod-12-zc2nh": {}, + "/v1/default/Pod/fake-pod-12-zcvmq": {}, + "/v1/default/Pod/fake-pod-12-zfkqb": {}, + "/v1/default/Pod/fake-pod-12-zk86n": {}, + "/v1/default/Pod/fake-pod-12-zng29": {}, + "/v1/default/Pod/fake-pod-12-zsvfm": {}, + "/v1/default/Pod/fake-pod-12-zsxmb": {}, + "/v1/default/Pod/fake-pod-12-zv5t5": {}, + "/v1/default/Pod/fake-pod-12-zw2sc": {}, + "/v1/default/Pod/fake-pod-13-228xp": {}, + "/v1/default/Pod/fake-pod-13-28d85": {}, + "/v1/default/Pod/fake-pod-13-2kt5m": {}, + "/v1/default/Pod/fake-pod-13-2tkp6": {}, + "/v1/default/Pod/fake-pod-13-2vpcz": {}, + "/v1/default/Pod/fake-pod-13-45snj": {}, + "/v1/default/Pod/fake-pod-13-46l25": {}, + "/v1/default/Pod/fake-pod-13-4bvz8": {}, + "/v1/default/Pod/fake-pod-13-4kl65": {}, + "/v1/default/Pod/fake-pod-13-4plvs": {}, + "/v1/default/Pod/fake-pod-13-4rwp7": {}, + "/v1/default/Pod/fake-pod-13-4w8k4": {}, + "/v1/default/Pod/fake-pod-13-4wbmn": {}, + "/v1/default/Pod/fake-pod-13-4zgsd": {}, + "/v1/default/Pod/fake-pod-13-52lkn": {}, + "/v1/default/Pod/fake-pod-13-57vxb": {}, + "/v1/default/Pod/fake-pod-13-58slj": {}, + "/v1/default/Pod/fake-pod-13-59njc": {}, + "/v1/default/Pod/fake-pod-13-5hm2t": {}, + "/v1/default/Pod/fake-pod-13-5jkks": {}, + "/v1/default/Pod/fake-pod-13-5k9sv": {}, + "/v1/default/Pod/fake-pod-13-5m2qk": {}, + "/v1/default/Pod/fake-pod-13-5stg9": {}, + "/v1/default/Pod/fake-pod-13-5zz58": {}, + "/v1/default/Pod/fake-pod-13-6dldr": {}, + "/v1/default/Pod/fake-pod-13-6n4hj": {}, + "/v1/default/Pod/fake-pod-13-6pk64": {}, + "/v1/default/Pod/fake-pod-13-6q8nv": {}, + "/v1/default/Pod/fake-pod-13-6srsb": {}, + "/v1/default/Pod/fake-pod-13-6t8nf": {}, + "/v1/default/Pod/fake-pod-13-6vlj5": {}, + "/v1/default/Pod/fake-pod-13-6z286": {}, + "/v1/default/Pod/fake-pod-13-6z2rs": {}, + "/v1/default/Pod/fake-pod-13-72cbr": {}, + "/v1/default/Pod/fake-pod-13-76lm2": {}, + "/v1/default/Pod/fake-pod-13-7b2x7": {}, + "/v1/default/Pod/fake-pod-13-7d4fm": {}, + "/v1/default/Pod/fake-pod-13-7ksq6": {}, + "/v1/default/Pod/fake-pod-13-7lsb5": {}, + "/v1/default/Pod/fake-pod-13-7rx4p": {}, + "/v1/default/Pod/fake-pod-13-7vbbv": {}, + "/v1/default/Pod/fake-pod-13-7vnbx": {}, + "/v1/default/Pod/fake-pod-13-7vrdq": {}, + "/v1/default/Pod/fake-pod-13-7wsp2": {}, + "/v1/default/Pod/fake-pod-13-7zsn6": {}, + "/v1/default/Pod/fake-pod-13-82wzj": {}, + "/v1/default/Pod/fake-pod-13-88vnr": {}, + "/v1/default/Pod/fake-pod-13-88xxw": {}, + "/v1/default/Pod/fake-pod-13-8c4bm": {}, + "/v1/default/Pod/fake-pod-13-8c9xd": {}, + "/v1/default/Pod/fake-pod-13-8dpqw": {}, + "/v1/default/Pod/fake-pod-13-8fjk8": {}, + "/v1/default/Pod/fake-pod-13-8r6qk": {}, + "/v1/default/Pod/fake-pod-13-8rx4j": {}, + "/v1/default/Pod/fake-pod-13-8s27d": {}, + "/v1/default/Pod/fake-pod-13-8sgmr": {}, + "/v1/default/Pod/fake-pod-13-8v8m9": {}, + "/v1/default/Pod/fake-pod-13-8vlv6": {}, + "/v1/default/Pod/fake-pod-13-8xqm4": {}, + "/v1/default/Pod/fake-pod-13-949gc": {}, + "/v1/default/Pod/fake-pod-13-989pr": {}, + "/v1/default/Pod/fake-pod-13-98fkr": {}, + "/v1/default/Pod/fake-pod-13-98k8l": {}, + "/v1/default/Pod/fake-pod-13-98twj": {}, + "/v1/default/Pod/fake-pod-13-99bk7": {}, + "/v1/default/Pod/fake-pod-13-9b5jg": {}, + "/v1/default/Pod/fake-pod-13-9f9bm": {}, + "/v1/default/Pod/fake-pod-13-9ffx5": {}, + "/v1/default/Pod/fake-pod-13-9jvwr": {}, + "/v1/default/Pod/fake-pod-13-9l2xm": {}, + "/v1/default/Pod/fake-pod-13-9l9b9": {}, + "/v1/default/Pod/fake-pod-13-9ptmn": {}, + "/v1/default/Pod/fake-pod-13-9qbz4": {}, + "/v1/default/Pod/fake-pod-13-9shv2": {}, + "/v1/default/Pod/fake-pod-13-9td97": {}, + "/v1/default/Pod/fake-pod-13-9x48b": {}, + "/v1/default/Pod/fake-pod-13-9x5ss": {}, + "/v1/default/Pod/fake-pod-13-9xq9f": {}, + "/v1/default/Pod/fake-pod-13-9zftm": {}, + "/v1/default/Pod/fake-pod-13-9zsch": {}, + "/v1/default/Pod/fake-pod-13-b62w2": {}, + "/v1/default/Pod/fake-pod-13-b6bhb": {}, + "/v1/default/Pod/fake-pod-13-b6lsw": {}, + "/v1/default/Pod/fake-pod-13-b87qg": {}, + "/v1/default/Pod/fake-pod-13-bdgc2": {}, + "/v1/default/Pod/fake-pod-13-bhlms": {}, + "/v1/default/Pod/fake-pod-13-bnf85": {}, + "/v1/default/Pod/fake-pod-13-c868q": {}, + "/v1/default/Pod/fake-pod-13-c8p64": {}, + "/v1/default/Pod/fake-pod-13-clnhw": {}, + "/v1/default/Pod/fake-pod-13-cnvtw": {}, + "/v1/default/Pod/fake-pod-13-cpb2r": {}, + "/v1/default/Pod/fake-pod-13-cq4df": {}, + "/v1/default/Pod/fake-pod-13-crp5n": {}, + "/v1/default/Pod/fake-pod-13-cv2nt": {}, + "/v1/default/Pod/fake-pod-13-d25fb": {}, + "/v1/default/Pod/fake-pod-13-d4nw9": {}, + "/v1/default/Pod/fake-pod-13-dfhjd": {}, + "/v1/default/Pod/fake-pod-13-dfnfr": {}, + "/v1/default/Pod/fake-pod-13-dpx2k": {}, + "/v1/default/Pod/fake-pod-13-dsrbk": {}, + "/v1/default/Pod/fake-pod-13-dtmxj": {}, + "/v1/default/Pod/fake-pod-13-dx9br": {}, + "/v1/default/Pod/fake-pod-13-dzbts": {}, + "/v1/default/Pod/fake-pod-13-f2cn4": {}, + "/v1/default/Pod/fake-pod-13-f449b": {}, + "/v1/default/Pod/fake-pod-13-f5pxv": {}, + "/v1/default/Pod/fake-pod-13-f7p6g": {}, + "/v1/default/Pod/fake-pod-13-f8vc4": {}, + "/v1/default/Pod/fake-pod-13-fgcml": {}, + "/v1/default/Pod/fake-pod-13-fgfbt": {}, + "/v1/default/Pod/fake-pod-13-fmxsx": {}, + "/v1/default/Pod/fake-pod-13-fpplb": {}, + "/v1/default/Pod/fake-pod-13-fpzrr": {}, + "/v1/default/Pod/fake-pod-13-fr6qz": {}, + "/v1/default/Pod/fake-pod-13-fr8vf": {}, + "/v1/default/Pod/fake-pod-13-fwx8j": {}, + "/v1/default/Pod/fake-pod-13-g84zz": {}, + "/v1/default/Pod/fake-pod-13-g95bd": {}, + "/v1/default/Pod/fake-pod-13-gbkrt": {}, + "/v1/default/Pod/fake-pod-13-gf478": {}, + "/v1/default/Pod/fake-pod-13-ggbqf": {}, + "/v1/default/Pod/fake-pod-13-gkfx4": {}, + "/v1/default/Pod/fake-pod-13-gmzg4": {}, + "/v1/default/Pod/fake-pod-13-gpk96": {}, + "/v1/default/Pod/fake-pod-13-grjvl": {}, + "/v1/default/Pod/fake-pod-13-gv2cm": {}, + "/v1/default/Pod/fake-pod-13-gv2gq": {}, + "/v1/default/Pod/fake-pod-13-gvlsk": {}, + "/v1/default/Pod/fake-pod-13-h824j": {}, + "/v1/default/Pod/fake-pod-13-h8cpp": {}, + "/v1/default/Pod/fake-pod-13-h8d8d": {}, + "/v1/default/Pod/fake-pod-13-h8vdr": {}, + "/v1/default/Pod/fake-pod-13-hb7tw": {}, + "/v1/default/Pod/fake-pod-13-hbmkj": {}, + "/v1/default/Pod/fake-pod-13-hdbw2": {}, + "/v1/default/Pod/fake-pod-13-hdhq7": {}, + "/v1/default/Pod/fake-pod-13-hfstr": {}, + "/v1/default/Pod/fake-pod-13-hmk5d": {}, + "/v1/default/Pod/fake-pod-13-hnb4j": {}, + "/v1/default/Pod/fake-pod-13-hpb85": {}, + "/v1/default/Pod/fake-pod-13-ht7f4": {}, + "/v1/default/Pod/fake-pod-13-htq8p": {}, + "/v1/default/Pod/fake-pod-13-j2bnj": {}, + "/v1/default/Pod/fake-pod-13-j7f99": {}, + "/v1/default/Pod/fake-pod-13-j8gp9": {}, + "/v1/default/Pod/fake-pod-13-j969k": {}, + "/v1/default/Pod/fake-pod-13-jd2s4": {}, + "/v1/default/Pod/fake-pod-13-jd7cb": {}, + "/v1/default/Pod/fake-pod-13-jfhk6": {}, + "/v1/default/Pod/fake-pod-13-jfpbp": {}, + "/v1/default/Pod/fake-pod-13-jnd7f": {}, + "/v1/default/Pod/fake-pod-13-jnddf": {}, + "/v1/default/Pod/fake-pod-13-jqrv2": {}, + "/v1/default/Pod/fake-pod-13-jwnfz": {}, + "/v1/default/Pod/fake-pod-13-k2cj8": {}, + "/v1/default/Pod/fake-pod-13-k4mn9": {}, + "/v1/default/Pod/fake-pod-13-kb284": {}, + "/v1/default/Pod/fake-pod-13-kf588": {}, + "/v1/default/Pod/fake-pod-13-kmmz6": {}, + "/v1/default/Pod/fake-pod-13-kmvcf": {}, + "/v1/default/Pod/fake-pod-13-ks6nd": {}, + "/v1/default/Pod/fake-pod-13-l4lmh": {}, + "/v1/default/Pod/fake-pod-13-l5562": {}, + "/v1/default/Pod/fake-pod-13-l6lh8": {}, + "/v1/default/Pod/fake-pod-13-l79w9": {}, + "/v1/default/Pod/fake-pod-13-ldvmx": {}, + "/v1/default/Pod/fake-pod-13-lg4lw": {}, + "/v1/default/Pod/fake-pod-13-lg65r": {}, + "/v1/default/Pod/fake-pod-13-lk4mj": {}, + "/v1/default/Pod/fake-pod-13-llhcn": {}, + "/v1/default/Pod/fake-pod-13-lxcp6": {}, + "/v1/default/Pod/fake-pod-13-m2jbd": {}, + "/v1/default/Pod/fake-pod-13-m7zxf": {}, + "/v1/default/Pod/fake-pod-13-m8d96": {}, + "/v1/default/Pod/fake-pod-13-mcr8j": {}, + "/v1/default/Pod/fake-pod-13-mdvss": {}, + "/v1/default/Pod/fake-pod-13-mlxlm": {}, + "/v1/default/Pod/fake-pod-13-mmn6f": {}, + "/v1/default/Pod/fake-pod-13-msvfg": {}, + "/v1/default/Pod/fake-pod-13-mtrx6": {}, + "/v1/default/Pod/fake-pod-13-mvrlp": {}, + "/v1/default/Pod/fake-pod-13-mwspd": {}, + "/v1/default/Pod/fake-pod-13-n2mk6": {}, + "/v1/default/Pod/fake-pod-13-n75nv": {}, + "/v1/default/Pod/fake-pod-13-n8tsw": {}, + "/v1/default/Pod/fake-pod-13-n9zqk": {}, + "/v1/default/Pod/fake-pod-13-nc9ft": {}, + "/v1/default/Pod/fake-pod-13-nj5lp": {}, + "/v1/default/Pod/fake-pod-13-nljpd": {}, + "/v1/default/Pod/fake-pod-13-nlqmk": {}, + "/v1/default/Pod/fake-pod-13-nrn4q": {}, + "/v1/default/Pod/fake-pod-13-ntdlj": {}, + "/v1/default/Pod/fake-pod-13-ntkgq": {}, + "/v1/default/Pod/fake-pod-13-ntxcw": {}, + "/v1/default/Pod/fake-pod-13-nxxfn": {}, + "/v1/default/Pod/fake-pod-13-nz79h": {}, + "/v1/default/Pod/fake-pod-13-nznxf": {}, + "/v1/default/Pod/fake-pod-13-p4nmt": {}, + "/v1/default/Pod/fake-pod-13-pj7hk": {}, + "/v1/default/Pod/fake-pod-13-pjqnf": {}, + "/v1/default/Pod/fake-pod-13-pnwjf": {}, + "/v1/default/Pod/fake-pod-13-pqg7f": {}, + "/v1/default/Pod/fake-pod-13-psdnv": {}, + "/v1/default/Pod/fake-pod-13-ptpxv": {}, + "/v1/default/Pod/fake-pod-13-pxckh": {}, + "/v1/default/Pod/fake-pod-13-pzl8h": {}, + "/v1/default/Pod/fake-pod-13-q2ck6": {}, + "/v1/default/Pod/fake-pod-13-q2gf6": {}, + "/v1/default/Pod/fake-pod-13-q58wv": {}, + "/v1/default/Pod/fake-pod-13-q5g8g": {}, + "/v1/default/Pod/fake-pod-13-q5tmg": {}, + "/v1/default/Pod/fake-pod-13-q6cj7": {}, + "/v1/default/Pod/fake-pod-13-q9hpb": {}, + "/v1/default/Pod/fake-pod-13-qb6hg": {}, + "/v1/default/Pod/fake-pod-13-qc52h": {}, + "/v1/default/Pod/fake-pod-13-qccwb": {}, + "/v1/default/Pod/fake-pod-13-qdz4p": {}, + "/v1/default/Pod/fake-pod-13-qgltx": {}, + "/v1/default/Pod/fake-pod-13-qjr5s": {}, + "/v1/default/Pod/fake-pod-13-qm5cm": {}, + "/v1/default/Pod/fake-pod-13-qshth": {}, + "/v1/default/Pod/fake-pod-13-qt6w6": {}, + "/v1/default/Pod/fake-pod-13-qtrlc": {}, + "/v1/default/Pod/fake-pod-13-qzfgz": {}, + "/v1/default/Pod/fake-pod-13-qzzwp": {}, + "/v1/default/Pod/fake-pod-13-r6pzx": {}, + "/v1/default/Pod/fake-pod-13-rbv2c": {}, + "/v1/default/Pod/fake-pod-13-rgbw5": {}, + "/v1/default/Pod/fake-pod-13-rgwdw": {}, + "/v1/default/Pod/fake-pod-13-rhbcx": {}, + "/v1/default/Pod/fake-pod-13-rhdvv": {}, + "/v1/default/Pod/fake-pod-13-rhfpp": {}, + "/v1/default/Pod/fake-pod-13-rhxwp": {}, + "/v1/default/Pod/fake-pod-13-rj5k8": {}, + "/v1/default/Pod/fake-pod-13-rszmb": {}, + "/v1/default/Pod/fake-pod-13-s75sp": {}, + "/v1/default/Pod/fake-pod-13-s7h7k": {}, + "/v1/default/Pod/fake-pod-13-s9tmm": {}, + "/v1/default/Pod/fake-pod-13-sbjtz": {}, + "/v1/default/Pod/fake-pod-13-sck45": {}, + "/v1/default/Pod/fake-pod-13-sjnwr": {}, + "/v1/default/Pod/fake-pod-13-sm2m7": {}, + "/v1/default/Pod/fake-pod-13-sn25j": {}, + "/v1/default/Pod/fake-pod-13-snk2p": {}, + "/v1/default/Pod/fake-pod-13-sv4j6": {}, + "/v1/default/Pod/fake-pod-13-t6ggx": {}, + "/v1/default/Pod/fake-pod-13-tk9kh": {}, + "/v1/default/Pod/fake-pod-13-tmklj": {}, + "/v1/default/Pod/fake-pod-13-tmz5x": {}, + "/v1/default/Pod/fake-pod-13-tn4kp": {}, + "/v1/default/Pod/fake-pod-13-tnx7d": {}, + "/v1/default/Pod/fake-pod-13-tqpvm": {}, + "/v1/default/Pod/fake-pod-13-tvwzh": {}, + "/v1/default/Pod/fake-pod-13-tx769": {}, + "/v1/default/Pod/fake-pod-13-v679s": {}, + "/v1/default/Pod/fake-pod-13-vbls4": {}, + "/v1/default/Pod/fake-pod-13-vbp6n": {}, + "/v1/default/Pod/fake-pod-13-vdll6": {}, + "/v1/default/Pod/fake-pod-13-vfkbz": {}, + "/v1/default/Pod/fake-pod-13-vgr92": {}, + "/v1/default/Pod/fake-pod-13-vh7kz": {}, + "/v1/default/Pod/fake-pod-13-vkqlk": {}, + "/v1/default/Pod/fake-pod-13-vqj2c": {}, + "/v1/default/Pod/fake-pod-13-vqmvp": {}, + "/v1/default/Pod/fake-pod-13-vssrq": {}, + "/v1/default/Pod/fake-pod-13-vxg5c": {}, + "/v1/default/Pod/fake-pod-13-vzjpl": {}, + "/v1/default/Pod/fake-pod-13-w25vt": {}, + "/v1/default/Pod/fake-pod-13-w5whs": {}, + "/v1/default/Pod/fake-pod-13-w6tvw": {}, + "/v1/default/Pod/fake-pod-13-wdzrn": {}, + "/v1/default/Pod/fake-pod-13-wg8sn": {}, + "/v1/default/Pod/fake-pod-13-wgz4w": {}, + "/v1/default/Pod/fake-pod-13-wn2w6": {}, + "/v1/default/Pod/fake-pod-13-wnws8": {}, + "/v1/default/Pod/fake-pod-13-wr9vw": {}, + "/v1/default/Pod/fake-pod-13-wshjg": {}, + "/v1/default/Pod/fake-pod-13-wwd8j": {}, + "/v1/default/Pod/fake-pod-13-wwq6z": {}, + "/v1/default/Pod/fake-pod-13-xbdbr": {}, + "/v1/default/Pod/fake-pod-13-xcmw7": {}, + "/v1/default/Pod/fake-pod-13-xcp95": {}, + "/v1/default/Pod/fake-pod-13-xd8zn": {}, + "/v1/default/Pod/fake-pod-13-xlpx5": {}, + "/v1/default/Pod/fake-pod-13-xng79": {}, + "/v1/default/Pod/fake-pod-13-xr8sn": {}, + "/v1/default/Pod/fake-pod-13-xsd28": {}, + "/v1/default/Pod/fake-pod-13-xx4js": {}, + "/v1/default/Pod/fake-pod-13-xzljh": {}, + "/v1/default/Pod/fake-pod-13-xzlk8": {}, + "/v1/default/Pod/fake-pod-13-z6wrb": {}, + "/v1/default/Pod/fake-pod-13-z88mn": {}, + "/v1/default/Pod/fake-pod-13-zb4xm": {}, + "/v1/default/Pod/fake-pod-13-zcpd9": {}, + "/v1/default/Pod/fake-pod-13-zdgj4": {}, + "/v1/default/Pod/fake-pod-13-zhbxv": {}, + "/v1/default/Pod/fake-pod-13-zhdzm": {}, + "/v1/default/Pod/fake-pod-13-zjqhr": {}, + "/v1/default/Pod/fake-pod-14-29nvv": {}, + "/v1/default/Pod/fake-pod-14-2gklx": {}, + "/v1/default/Pod/fake-pod-14-2nb4z": {}, + "/v1/default/Pod/fake-pod-14-2pl6l": {}, + "/v1/default/Pod/fake-pod-14-2wqgs": {}, + "/v1/default/Pod/fake-pod-14-42vvz": {}, + "/v1/default/Pod/fake-pod-14-49zwh": {}, + "/v1/default/Pod/fake-pod-14-4c6j8": {}, + "/v1/default/Pod/fake-pod-14-4ccw2": {}, + "/v1/default/Pod/fake-pod-14-4dfk7": {}, + "/v1/default/Pod/fake-pod-14-4fmft": {}, + "/v1/default/Pod/fake-pod-14-4htj2": {}, + "/v1/default/Pod/fake-pod-14-4jxh4": {}, + "/v1/default/Pod/fake-pod-14-4lmtd": {}, + "/v1/default/Pod/fake-pod-14-4r8cm": {}, + "/v1/default/Pod/fake-pod-14-52fs2": {}, + "/v1/default/Pod/fake-pod-14-58qxn": {}, + "/v1/default/Pod/fake-pod-14-58xkg": {}, + "/v1/default/Pod/fake-pod-14-5bm2l": {}, + "/v1/default/Pod/fake-pod-14-5d7nh": {}, + "/v1/default/Pod/fake-pod-14-5jjf5": {}, + "/v1/default/Pod/fake-pod-14-5q87q": {}, + "/v1/default/Pod/fake-pod-14-5t7q2": {}, + "/v1/default/Pod/fake-pod-14-5zl72": {}, + "/v1/default/Pod/fake-pod-14-66jzf": {}, + "/v1/default/Pod/fake-pod-14-67db9": {}, + "/v1/default/Pod/fake-pod-14-68tmc": {}, + "/v1/default/Pod/fake-pod-14-6bgml": {}, + "/v1/default/Pod/fake-pod-14-6d8rh": {}, + "/v1/default/Pod/fake-pod-14-6fxtl": {}, + "/v1/default/Pod/fake-pod-14-6hnhc": {}, + "/v1/default/Pod/fake-pod-14-6j5vc": {}, + "/v1/default/Pod/fake-pod-14-6qxhl": {}, + "/v1/default/Pod/fake-pod-14-6tgxg": {}, + "/v1/default/Pod/fake-pod-14-6w8x5": {}, + "/v1/default/Pod/fake-pod-14-6xvvm": {}, + "/v1/default/Pod/fake-pod-14-72vm9": {}, + "/v1/default/Pod/fake-pod-14-76krq": {}, + "/v1/default/Pod/fake-pod-14-7gljk": {}, + "/v1/default/Pod/fake-pod-14-7jk2f": {}, + "/v1/default/Pod/fake-pod-14-7n4ff": {}, + "/v1/default/Pod/fake-pod-14-7pl9d": {}, + "/v1/default/Pod/fake-pod-14-7svnc": {}, + "/v1/default/Pod/fake-pod-14-7tqqh": {}, + "/v1/default/Pod/fake-pod-14-7tzlx": {}, + "/v1/default/Pod/fake-pod-14-7vjz7": {}, + "/v1/default/Pod/fake-pod-14-89qmr": {}, + "/v1/default/Pod/fake-pod-14-8d6wr": {}, + "/v1/default/Pod/fake-pod-14-8h6xd": {}, + "/v1/default/Pod/fake-pod-14-8j7pm": {}, + "/v1/default/Pod/fake-pod-14-8nqv5": {}, + "/v1/default/Pod/fake-pod-14-8pfnd": {}, + "/v1/default/Pod/fake-pod-14-8sqp7": {}, + "/v1/default/Pod/fake-pod-14-8v27s": {}, + "/v1/default/Pod/fake-pod-14-8wkpq": {}, + "/v1/default/Pod/fake-pod-14-94xxw": {}, + "/v1/default/Pod/fake-pod-14-957md": {}, + "/v1/default/Pod/fake-pod-14-98754": {}, + "/v1/default/Pod/fake-pod-14-9csvv": {}, + "/v1/default/Pod/fake-pod-14-9g4t8": {}, + "/v1/default/Pod/fake-pod-14-9gsmt": {}, + "/v1/default/Pod/fake-pod-14-9khxx": {}, + "/v1/default/Pod/fake-pod-14-9mgm9": {}, + "/v1/default/Pod/fake-pod-14-9mmsq": {}, + "/v1/default/Pod/fake-pod-14-9rxb7": {}, + "/v1/default/Pod/fake-pod-14-9t4wz": {}, + "/v1/default/Pod/fake-pod-14-9vcqw": {}, + "/v1/default/Pod/fake-pod-14-9xvxb": {}, + "/v1/default/Pod/fake-pod-14-9zzqd": {}, + "/v1/default/Pod/fake-pod-14-b4447": {}, + "/v1/default/Pod/fake-pod-14-b95kr": {}, + "/v1/default/Pod/fake-pod-14-b97p7": {}, + "/v1/default/Pod/fake-pod-14-bbdjm": {}, + "/v1/default/Pod/fake-pod-14-bh29x": {}, + "/v1/default/Pod/fake-pod-14-bq9g8": {}, + "/v1/default/Pod/fake-pod-14-bqsr9": {}, + "/v1/default/Pod/fake-pod-14-brghm": {}, + "/v1/default/Pod/fake-pod-14-bsjgk": {}, + "/v1/default/Pod/fake-pod-14-bvxvl": {}, + "/v1/default/Pod/fake-pod-14-bw8bg": {}, + "/v1/default/Pod/fake-pod-14-bx495": {}, + "/v1/default/Pod/fake-pod-14-bzhm2": {}, + "/v1/default/Pod/fake-pod-14-c5fm6": {}, + "/v1/default/Pod/fake-pod-14-c6xq9": {}, + "/v1/default/Pod/fake-pod-14-cbhrm": {}, + "/v1/default/Pod/fake-pod-14-cfbdz": {}, + "/v1/default/Pod/fake-pod-14-cljsr": {}, + "/v1/default/Pod/fake-pod-14-cshq5": {}, + "/v1/default/Pod/fake-pod-14-d54hk": {}, + "/v1/default/Pod/fake-pod-14-d6xzm": {}, + "/v1/default/Pod/fake-pod-14-d8gkr": {}, + "/v1/default/Pod/fake-pod-14-dcv4m": {}, + "/v1/default/Pod/fake-pod-14-dczjz": {}, + "/v1/default/Pod/fake-pod-14-dfr6k": {}, + "/v1/default/Pod/fake-pod-14-dgc7s": {}, + "/v1/default/Pod/fake-pod-14-djzm4": {}, + "/v1/default/Pod/fake-pod-14-dk227": {}, + "/v1/default/Pod/fake-pod-14-dpfqm": {}, + "/v1/default/Pod/fake-pod-14-dqfp8": {}, + "/v1/default/Pod/fake-pod-14-dt25b": {}, + "/v1/default/Pod/fake-pod-14-dvfms": {}, + "/v1/default/Pod/fake-pod-14-f54k5": {}, + "/v1/default/Pod/fake-pod-14-f9b4z": {}, + "/v1/default/Pod/fake-pod-14-ffv7z": {}, + "/v1/default/Pod/fake-pod-14-fgtbj": {}, + "/v1/default/Pod/fake-pod-14-fgvwp": {}, + "/v1/default/Pod/fake-pod-14-fkqfg": {}, + "/v1/default/Pod/fake-pod-14-fp5jg": {}, + "/v1/default/Pod/fake-pod-14-fpdht": {}, + "/v1/default/Pod/fake-pod-14-fpksn": {}, + "/v1/default/Pod/fake-pod-14-fr84p": {}, + "/v1/default/Pod/fake-pod-14-fr8ns": {}, + "/v1/default/Pod/fake-pod-14-ftk8c": {}, + "/v1/default/Pod/fake-pod-14-fx8zl": {}, + "/v1/default/Pod/fake-pod-14-g27xf": {}, + "/v1/default/Pod/fake-pod-14-g8hjd": {}, + "/v1/default/Pod/fake-pod-14-g8wws": {}, + "/v1/default/Pod/fake-pod-14-gf2rx": {}, + "/v1/default/Pod/fake-pod-14-gggzb": {}, + "/v1/default/Pod/fake-pod-14-gmkbr": {}, + "/v1/default/Pod/fake-pod-14-gqzrb": {}, + "/v1/default/Pod/fake-pod-14-grrxr": {}, + "/v1/default/Pod/fake-pod-14-gtd8q": {}, + "/v1/default/Pod/fake-pod-14-gtmct": {}, + "/v1/default/Pod/fake-pod-14-gtvxv": {}, + "/v1/default/Pod/fake-pod-14-gwvk6": {}, + "/v1/default/Pod/fake-pod-14-gxcgj": {}, + "/v1/default/Pod/fake-pod-14-gz7d4": {}, + "/v1/default/Pod/fake-pod-14-h2m8k": {}, + "/v1/default/Pod/fake-pod-14-h5vxt": {}, + "/v1/default/Pod/fake-pod-14-h6x57": {}, + "/v1/default/Pod/fake-pod-14-h9dbb": {}, + "/v1/default/Pod/fake-pod-14-h9dw5": {}, + "/v1/default/Pod/fake-pod-14-hcg7f": {}, + "/v1/default/Pod/fake-pod-14-hj86j": {}, + "/v1/default/Pod/fake-pod-14-hl84x": {}, + "/v1/default/Pod/fake-pod-14-hmrpn": {}, + "/v1/default/Pod/fake-pod-14-hmx2t": {}, + "/v1/default/Pod/fake-pod-14-hvczx": {}, + "/v1/default/Pod/fake-pod-14-hwk5b": {}, + "/v1/default/Pod/fake-pod-14-hwsnn": {}, + "/v1/default/Pod/fake-pod-14-hxw66": {}, + "/v1/default/Pod/fake-pod-14-hznw2": {}, + "/v1/default/Pod/fake-pod-14-j4b4q": {}, + "/v1/default/Pod/fake-pod-14-j6lqq": {}, + "/v1/default/Pod/fake-pod-14-j8ddt": {}, + "/v1/default/Pod/fake-pod-14-j8fpm": {}, + "/v1/default/Pod/fake-pod-14-jcmn6": {}, + "/v1/default/Pod/fake-pod-14-jdn4x": {}, + "/v1/default/Pod/fake-pod-14-jdrkc": {}, + "/v1/default/Pod/fake-pod-14-jlmkv": {}, + "/v1/default/Pod/fake-pod-14-jnc2w": {}, + "/v1/default/Pod/fake-pod-14-jrdsm": {}, + "/v1/default/Pod/fake-pod-14-jsqrg": {}, + "/v1/default/Pod/fake-pod-14-jt4jw": {}, + "/v1/default/Pod/fake-pod-14-jtrsv": {}, + "/v1/default/Pod/fake-pod-14-k4clc": {}, + "/v1/default/Pod/fake-pod-14-k7kzq": {}, + "/v1/default/Pod/fake-pod-14-k9558": {}, + "/v1/default/Pod/fake-pod-14-kd6kt": {}, + "/v1/default/Pod/fake-pod-14-kgppg": {}, + "/v1/default/Pod/fake-pod-14-kjnmd": {}, + "/v1/default/Pod/fake-pod-14-kkvcd": {}, + "/v1/default/Pod/fake-pod-14-kmsk4": {}, + "/v1/default/Pod/fake-pod-14-kqd72": {}, + "/v1/default/Pod/fake-pod-14-kvkfx": {}, + "/v1/default/Pod/fake-pod-14-kxb4r": {}, + "/v1/default/Pod/fake-pod-14-l4c8d": {}, + "/v1/default/Pod/fake-pod-14-l4q8l": {}, + "/v1/default/Pod/fake-pod-14-l5j2n": {}, + "/v1/default/Pod/fake-pod-14-l7z5t": {}, + "/v1/default/Pod/fake-pod-14-l8xrw": {}, + "/v1/default/Pod/fake-pod-14-l98mw": {}, + "/v1/default/Pod/fake-pod-14-ldxbd": {}, + "/v1/default/Pod/fake-pod-14-lf8zc": {}, + "/v1/default/Pod/fake-pod-14-lfktp": {}, + "/v1/default/Pod/fake-pod-14-lkczt": {}, + "/v1/default/Pod/fake-pod-14-ln5zk": {}, + "/v1/default/Pod/fake-pod-14-lppgz": {}, + "/v1/default/Pod/fake-pod-14-lq4hr": {}, + "/v1/default/Pod/fake-pod-14-lvppc": {}, + "/v1/default/Pod/fake-pod-14-lwm5v": {}, + "/v1/default/Pod/fake-pod-14-m267b": {}, + "/v1/default/Pod/fake-pod-14-m57xj": {}, + "/v1/default/Pod/fake-pod-14-m5wrp": {}, + "/v1/default/Pod/fake-pod-14-m7z4s": {}, + "/v1/default/Pod/fake-pod-14-mbvfx": {}, + "/v1/default/Pod/fake-pod-14-mcqkv": {}, + "/v1/default/Pod/fake-pod-14-ml4n2": {}, + "/v1/default/Pod/fake-pod-14-mlxdv": {}, + "/v1/default/Pod/fake-pod-14-mpq8p": {}, + "/v1/default/Pod/fake-pod-14-mvrtd": {}, + "/v1/default/Pod/fake-pod-14-n6mf6": {}, + "/v1/default/Pod/fake-pod-14-n752b": {}, + "/v1/default/Pod/fake-pod-14-nb6n7": {}, + "/v1/default/Pod/fake-pod-14-nl4wz": {}, + "/v1/default/Pod/fake-pod-14-nmhj8": {}, + "/v1/default/Pod/fake-pod-14-npmt8": {}, + "/v1/default/Pod/fake-pod-14-nrcwb": {}, + "/v1/default/Pod/fake-pod-14-nrzc7": {}, + "/v1/default/Pod/fake-pod-14-nsncm": {}, + "/v1/default/Pod/fake-pod-14-nwmzl": {}, + "/v1/default/Pod/fake-pod-14-p7w6s": {}, + "/v1/default/Pod/fake-pod-14-pbms5": {}, + "/v1/default/Pod/fake-pod-14-pjhj6": {}, + "/v1/default/Pod/fake-pod-14-pk8wd": {}, + "/v1/default/Pod/fake-pod-14-plc57": {}, + "/v1/default/Pod/fake-pod-14-plj92": {}, + "/v1/default/Pod/fake-pod-14-ppnr5": {}, + "/v1/default/Pod/fake-pod-14-pwhjp": {}, + "/v1/default/Pod/fake-pod-14-pxbj8": {}, + "/v1/default/Pod/fake-pod-14-q52dn": {}, + "/v1/default/Pod/fake-pod-14-q5q89": {}, + "/v1/default/Pod/fake-pod-14-q8pfb": {}, + "/v1/default/Pod/fake-pod-14-qbzxf": {}, + "/v1/default/Pod/fake-pod-14-qdjl2": {}, + "/v1/default/Pod/fake-pod-14-qfhkl": {}, + "/v1/default/Pod/fake-pod-14-qjncs": {}, + "/v1/default/Pod/fake-pod-14-r2lcr": {}, + "/v1/default/Pod/fake-pod-14-r5phh": {}, + "/v1/default/Pod/fake-pod-14-r6d4p": {}, + "/v1/default/Pod/fake-pod-14-r8nhj": {}, + "/v1/default/Pod/fake-pod-14-r9zlf": {}, + "/v1/default/Pod/fake-pod-14-rctb6": {}, + "/v1/default/Pod/fake-pod-14-rfrh9": {}, + "/v1/default/Pod/fake-pod-14-rpnr9": {}, + "/v1/default/Pod/fake-pod-14-rs2fq": {}, + "/v1/default/Pod/fake-pod-14-rw5z9": {}, + "/v1/default/Pod/fake-pod-14-rwv2d": {}, + "/v1/default/Pod/fake-pod-14-rzh2d": {}, + "/v1/default/Pod/fake-pod-14-s8n5t": {}, + "/v1/default/Pod/fake-pod-14-s9tqt": {}, + "/v1/default/Pod/fake-pod-14-sbtd9": {}, + "/v1/default/Pod/fake-pod-14-sdjkh": {}, + "/v1/default/Pod/fake-pod-14-sh9bd": {}, + "/v1/default/Pod/fake-pod-14-sp25g": {}, + "/v1/default/Pod/fake-pod-14-stcdp": {}, + "/v1/default/Pod/fake-pod-14-sw5rp": {}, + "/v1/default/Pod/fake-pod-14-sz7sl": {}, + "/v1/default/Pod/fake-pod-14-szvt9": {}, + "/v1/default/Pod/fake-pod-14-t5vcc": {}, + "/v1/default/Pod/fake-pod-14-tbcvd": {}, + "/v1/default/Pod/fake-pod-14-tjn7c": {}, + "/v1/default/Pod/fake-pod-14-tk67w": {}, + "/v1/default/Pod/fake-pod-14-tknnk": {}, + "/v1/default/Pod/fake-pod-14-tqd6c": {}, + "/v1/default/Pod/fake-pod-14-ttqgx": {}, + "/v1/default/Pod/fake-pod-14-tvgcd": {}, + "/v1/default/Pod/fake-pod-14-tzb4h": {}, + "/v1/default/Pod/fake-pod-14-v5hgv": {}, + "/v1/default/Pod/fake-pod-14-v7flj": {}, + "/v1/default/Pod/fake-pod-14-v8pdj": {}, + "/v1/default/Pod/fake-pod-14-vdrjb": {}, + "/v1/default/Pod/fake-pod-14-vnktg": {}, + "/v1/default/Pod/fake-pod-14-vp7kf": {}, + "/v1/default/Pod/fake-pod-14-vvrzm": {}, + "/v1/default/Pod/fake-pod-14-vx76d": {}, + "/v1/default/Pod/fake-pod-14-vz7b9": {}, + "/v1/default/Pod/fake-pod-14-vzn8b": {}, + "/v1/default/Pod/fake-pod-14-vzs2m": {}, + "/v1/default/Pod/fake-pod-14-w4fmb": {}, + "/v1/default/Pod/fake-pod-14-w5zvl": {}, + "/v1/default/Pod/fake-pod-14-w756n": {}, + "/v1/default/Pod/fake-pod-14-w8tjj": {}, + "/v1/default/Pod/fake-pod-14-w8z8w": {}, + "/v1/default/Pod/fake-pod-14-w9rc5": {}, + "/v1/default/Pod/fake-pod-14-wdzbh": {}, + "/v1/default/Pod/fake-pod-14-wjlj8": {}, + "/v1/default/Pod/fake-pod-14-wjw9b": {}, + "/v1/default/Pod/fake-pod-14-wm62c": {}, + "/v1/default/Pod/fake-pod-14-wnqld": {}, + "/v1/default/Pod/fake-pod-14-wp5c4": {}, + "/v1/default/Pod/fake-pod-14-wqdrh": {}, + "/v1/default/Pod/fake-pod-14-wrd9n": {}, + "/v1/default/Pod/fake-pod-14-wrpvm": {}, + "/v1/default/Pod/fake-pod-14-x2v4m": {}, + "/v1/default/Pod/fake-pod-14-x9b8v": {}, + "/v1/default/Pod/fake-pod-14-xc5ms": {}, + "/v1/default/Pod/fake-pod-14-xc6jq": {}, + "/v1/default/Pod/fake-pod-14-xdw8w": {}, + "/v1/default/Pod/fake-pod-14-xfcx2": {}, + "/v1/default/Pod/fake-pod-14-xhwvz": {}, + "/v1/default/Pod/fake-pod-14-xqdqb": {}, + "/v1/default/Pod/fake-pod-14-xqs94": {}, + "/v1/default/Pod/fake-pod-14-xvcrp": {}, + "/v1/default/Pod/fake-pod-14-xvxsx": {}, + "/v1/default/Pod/fake-pod-14-xxrxz": {}, + "/v1/default/Pod/fake-pod-14-xzk6c": {}, + "/v1/default/Pod/fake-pod-14-z2nkd": {}, + "/v1/default/Pod/fake-pod-14-z5t56": {}, + "/v1/default/Pod/fake-pod-14-zbct5": {}, + "/v1/default/Pod/fake-pod-14-zbm5s": {}, + "/v1/default/Pod/fake-pod-14-zdkrm": {}, + "/v1/default/Pod/fake-pod-14-zdvm4": {}, + "/v1/default/Pod/fake-pod-14-zmlgr": {}, + "/v1/default/Pod/fake-pod-14-zmwlr": {}, + "/v1/default/Pod/fake-pod-14-zqmtw": {}, + "/v1/default/Pod/fake-pod-14-zs58v": {}, + "/v1/default/Pod/fake-pod-14-zt645": {}, + "/v1/default/Pod/fake-pod-15-24js6": {}, + "/v1/default/Pod/fake-pod-15-26l6m": {}, + "/v1/default/Pod/fake-pod-15-28c4t": {}, + "/v1/default/Pod/fake-pod-15-2fn9p": {}, + "/v1/default/Pod/fake-pod-15-2g6kx": {}, + "/v1/default/Pod/fake-pod-15-2h4fj": {}, + "/v1/default/Pod/fake-pod-15-2lqrd": {}, + "/v1/default/Pod/fake-pod-15-2qmlz": {}, + "/v1/default/Pod/fake-pod-15-2qwz2": {}, + "/v1/default/Pod/fake-pod-15-2v6mc": {}, + "/v1/default/Pod/fake-pod-15-2xf7r": {}, + "/v1/default/Pod/fake-pod-15-2zg89": {}, + "/v1/default/Pod/fake-pod-15-448gb": {}, + "/v1/default/Pod/fake-pod-15-454d6": {}, + "/v1/default/Pod/fake-pod-15-47glj": {}, + "/v1/default/Pod/fake-pod-15-4bdj8": {}, + "/v1/default/Pod/fake-pod-15-4f9qw": {}, + "/v1/default/Pod/fake-pod-15-4ql4s": {}, + "/v1/default/Pod/fake-pod-15-4rmws": {}, + "/v1/default/Pod/fake-pod-15-4th8r": {}, + "/v1/default/Pod/fake-pod-15-527tx": {}, + "/v1/default/Pod/fake-pod-15-54wd4": {}, + "/v1/default/Pod/fake-pod-15-58jfq": {}, + "/v1/default/Pod/fake-pod-15-5bfbt": {}, + "/v1/default/Pod/fake-pod-15-5kr5p": {}, + "/v1/default/Pod/fake-pod-15-5nb72": {}, + "/v1/default/Pod/fake-pod-15-5pkk8": {}, + "/v1/default/Pod/fake-pod-15-5pkpg": {}, + "/v1/default/Pod/fake-pod-15-5qftm": {}, + "/v1/default/Pod/fake-pod-15-5rtq4": {}, + "/v1/default/Pod/fake-pod-15-5z4gj": {}, + "/v1/default/Pod/fake-pod-15-64bb6": {}, + "/v1/default/Pod/fake-pod-15-654dp": {}, + "/v1/default/Pod/fake-pod-15-67dxc": {}, + "/v1/default/Pod/fake-pod-15-69jts": {}, + "/v1/default/Pod/fake-pod-15-6c2g8": {}, + "/v1/default/Pod/fake-pod-15-6c6wd": {}, + "/v1/default/Pod/fake-pod-15-6j4nm": {}, + "/v1/default/Pod/fake-pod-15-6l5nq": {}, + "/v1/default/Pod/fake-pod-15-6pnqp": {}, + "/v1/default/Pod/fake-pod-15-6qqzb": {}, + "/v1/default/Pod/fake-pod-15-6wwt2": {}, + "/v1/default/Pod/fake-pod-15-7296p": {}, + "/v1/default/Pod/fake-pod-15-72psx": {}, + "/v1/default/Pod/fake-pod-15-746v2": {}, + "/v1/default/Pod/fake-pod-15-765qv": {}, + "/v1/default/Pod/fake-pod-15-79gfw": {}, + "/v1/default/Pod/fake-pod-15-7bkvp": {}, + "/v1/default/Pod/fake-pod-15-7bspl": {}, + "/v1/default/Pod/fake-pod-15-7c26t": {}, + "/v1/default/Pod/fake-pod-15-7cgjg": {}, + "/v1/default/Pod/fake-pod-15-7g9m5": {}, + "/v1/default/Pod/fake-pod-15-7h2mj": {}, + "/v1/default/Pod/fake-pod-15-7kk9v": {}, + "/v1/default/Pod/fake-pod-15-7zbdl": {}, + "/v1/default/Pod/fake-pod-15-7zpsn": {}, + "/v1/default/Pod/fake-pod-15-8dbf7": {}, + "/v1/default/Pod/fake-pod-15-8hmtt": {}, + "/v1/default/Pod/fake-pod-15-8hzlw": {}, + "/v1/default/Pod/fake-pod-15-8jjhr": {}, + "/v1/default/Pod/fake-pod-15-8lt72": {}, + "/v1/default/Pod/fake-pod-15-8p6qs": {}, + "/v1/default/Pod/fake-pod-15-8q86j": {}, + "/v1/default/Pod/fake-pod-15-92hnt": {}, + "/v1/default/Pod/fake-pod-15-95ddd": {}, + "/v1/default/Pod/fake-pod-15-96bqb": {}, + "/v1/default/Pod/fake-pod-15-96k8l": {}, + "/v1/default/Pod/fake-pod-15-97mhc": {}, + "/v1/default/Pod/fake-pod-15-9bd6x": {}, + "/v1/default/Pod/fake-pod-15-9c642": {}, + "/v1/default/Pod/fake-pod-15-9csbx": {}, + "/v1/default/Pod/fake-pod-15-9d2kp": {}, + "/v1/default/Pod/fake-pod-15-9gx8z": {}, + "/v1/default/Pod/fake-pod-15-9msfk": {}, + "/v1/default/Pod/fake-pod-15-9qp59": {}, + "/v1/default/Pod/fake-pod-15-9ttk7": {}, + "/v1/default/Pod/fake-pod-15-9wnxr": {}, + "/v1/default/Pod/fake-pod-15-b4p4k": {}, + "/v1/default/Pod/fake-pod-15-b7v4n": {}, + "/v1/default/Pod/fake-pod-15-b9947": {}, + "/v1/default/Pod/fake-pod-15-b9kg4": {}, + "/v1/default/Pod/fake-pod-15-bb9fz": {}, + "/v1/default/Pod/fake-pod-15-bbjlt": {}, + "/v1/default/Pod/fake-pod-15-bfhmp": {}, + "/v1/default/Pod/fake-pod-15-bj9c2": {}, + "/v1/default/Pod/fake-pod-15-bmzgh": {}, + "/v1/default/Pod/fake-pod-15-bpwbf": {}, + "/v1/default/Pod/fake-pod-15-c4lh4": {}, + "/v1/default/Pod/fake-pod-15-c8cnb": {}, + "/v1/default/Pod/fake-pod-15-cb2n4": {}, + "/v1/default/Pod/fake-pod-15-cc4pm": {}, + "/v1/default/Pod/fake-pod-15-chg8k": {}, + "/v1/default/Pod/fake-pod-15-ckqhp": {}, + "/v1/default/Pod/fake-pod-15-crbcl": {}, + "/v1/default/Pod/fake-pod-15-cxzxr": {}, + "/v1/default/Pod/fake-pod-15-cz7dk": {}, + "/v1/default/Pod/fake-pod-15-czhtt": {}, + "/v1/default/Pod/fake-pod-15-d2mm7": {}, + "/v1/default/Pod/fake-pod-15-d6rhs": {}, + "/v1/default/Pod/fake-pod-15-d8wd4": {}, + "/v1/default/Pod/fake-pod-15-d8zzq": {}, + "/v1/default/Pod/fake-pod-15-dcwmt": {}, + "/v1/default/Pod/fake-pod-15-dd9np": {}, + "/v1/default/Pod/fake-pod-15-dgnml": {}, + "/v1/default/Pod/fake-pod-15-dhbmj": {}, + "/v1/default/Pod/fake-pod-15-djg5c": {}, + "/v1/default/Pod/fake-pod-15-dpkz2": {}, + "/v1/default/Pod/fake-pod-15-dpqpt": {}, + "/v1/default/Pod/fake-pod-15-dt2px": {}, + "/v1/default/Pod/fake-pod-15-dv7n2": {}, + "/v1/default/Pod/fake-pod-15-dxn6z": {}, + "/v1/default/Pod/fake-pod-15-f2pz4": {}, + "/v1/default/Pod/fake-pod-15-f4d2s": {}, + "/v1/default/Pod/fake-pod-15-f6gn7": {}, + "/v1/default/Pod/fake-pod-15-f6t86": {}, + "/v1/default/Pod/fake-pod-15-fcfqk": {}, + "/v1/default/Pod/fake-pod-15-ffn5m": {}, + "/v1/default/Pod/fake-pod-15-flkmp": {}, + "/v1/default/Pod/fake-pod-15-fmhj9": {}, + "/v1/default/Pod/fake-pod-15-fr276": {}, + "/v1/default/Pod/fake-pod-15-fr9xp": {}, + "/v1/default/Pod/fake-pod-15-g4jc2": {}, + "/v1/default/Pod/fake-pod-15-g4khz": {}, + "/v1/default/Pod/fake-pod-15-g8mmw": {}, + "/v1/default/Pod/fake-pod-15-gk9px": {}, + "/v1/default/Pod/fake-pod-15-gn9bc": {}, + "/v1/default/Pod/fake-pod-15-gnwx5": {}, + "/v1/default/Pod/fake-pod-15-gqlp4": {}, + "/v1/default/Pod/fake-pod-15-gs97t": {}, + "/v1/default/Pod/fake-pod-15-gtcvc": {}, + "/v1/default/Pod/fake-pod-15-gvd2s": {}, + "/v1/default/Pod/fake-pod-15-gw2fq": {}, + "/v1/default/Pod/fake-pod-15-h7726": {}, + "/v1/default/Pod/fake-pod-15-h9kcw": {}, + "/v1/default/Pod/fake-pod-15-hb75w": {}, + "/v1/default/Pod/fake-pod-15-hcgkc": {}, + "/v1/default/Pod/fake-pod-15-hggb6": {}, + "/v1/default/Pod/fake-pod-15-hjlfh": {}, + "/v1/default/Pod/fake-pod-15-hmgmg": {}, + "/v1/default/Pod/fake-pod-15-hn2xh": {}, + "/v1/default/Pod/fake-pod-15-hnhts": {}, + "/v1/default/Pod/fake-pod-15-hrbpz": {}, + "/v1/default/Pod/fake-pod-15-htg7r": {}, + "/v1/default/Pod/fake-pod-15-hwdcm": {}, + "/v1/default/Pod/fake-pod-15-hzchs": {}, + "/v1/default/Pod/fake-pod-15-j58lb": {}, + "/v1/default/Pod/fake-pod-15-j6vcb": {}, + "/v1/default/Pod/fake-pod-15-j7bp4": {}, + "/v1/default/Pod/fake-pod-15-j7nhw": {}, + "/v1/default/Pod/fake-pod-15-j7pg5": {}, + "/v1/default/Pod/fake-pod-15-j7ptn": {}, + "/v1/default/Pod/fake-pod-15-j7s8r": {}, + "/v1/default/Pod/fake-pod-15-j7xqn": {}, + "/v1/default/Pod/fake-pod-15-jdbfw": {}, + "/v1/default/Pod/fake-pod-15-jdxcx": {}, + "/v1/default/Pod/fake-pod-15-jglwf": {}, + "/v1/default/Pod/fake-pod-15-jkxzh": {}, + "/v1/default/Pod/fake-pod-15-jmz7h": {}, + "/v1/default/Pod/fake-pod-15-jsj4g": {}, + "/v1/default/Pod/fake-pod-15-jsnfx": {}, + "/v1/default/Pod/fake-pod-15-jvr5b": {}, + "/v1/default/Pod/fake-pod-15-k2b48": {}, + "/v1/default/Pod/fake-pod-15-k55m6": {}, + "/v1/default/Pod/fake-pod-15-k66vf": {}, + "/v1/default/Pod/fake-pod-15-kcm6g": {}, + "/v1/default/Pod/fake-pod-15-kj6ch": {}, + "/v1/default/Pod/fake-pod-15-knxtm": {}, + "/v1/default/Pod/fake-pod-15-kr5n7": {}, + "/v1/default/Pod/fake-pod-15-kvcf9": {}, + "/v1/default/Pod/fake-pod-15-kvz96": {}, + "/v1/default/Pod/fake-pod-15-kxd2d": {}, + "/v1/default/Pod/fake-pod-15-kxwz4": {}, + "/v1/default/Pod/fake-pod-15-kz4g7": {}, + "/v1/default/Pod/fake-pod-15-kz72n": {}, + "/v1/default/Pod/fake-pod-15-l7x22": {}, + "/v1/default/Pod/fake-pod-15-l9chb": {}, + "/v1/default/Pod/fake-pod-15-l9nnx": {}, + "/v1/default/Pod/fake-pod-15-lc8jx": {}, + "/v1/default/Pod/fake-pod-15-lcg5t": {}, + "/v1/default/Pod/fake-pod-15-ljgnn": {}, + "/v1/default/Pod/fake-pod-15-lpfz5": {}, + "/v1/default/Pod/fake-pod-15-lpkrr": {}, + "/v1/default/Pod/fake-pod-15-lpqsm": {}, + "/v1/default/Pod/fake-pod-15-lrptz": {}, + "/v1/default/Pod/fake-pod-15-lwjfl": {}, + "/v1/default/Pod/fake-pod-15-m4969": {}, + "/v1/default/Pod/fake-pod-15-m7j4m": {}, + "/v1/default/Pod/fake-pod-15-m8g95": {}, + "/v1/default/Pod/fake-pod-15-mcvz6": {}, + "/v1/default/Pod/fake-pod-15-mdzc6": {}, + "/v1/default/Pod/fake-pod-15-mj4lh": {}, + "/v1/default/Pod/fake-pod-15-ms2xt": {}, + "/v1/default/Pod/fake-pod-15-ms72t": {}, + "/v1/default/Pod/fake-pod-15-n22sp": {}, + "/v1/default/Pod/fake-pod-15-n5sqq": {}, + "/v1/default/Pod/fake-pod-15-nf6rr": {}, + "/v1/default/Pod/fake-pod-15-njb7d": {}, + "/v1/default/Pod/fake-pod-15-njcrg": {}, + "/v1/default/Pod/fake-pod-15-nlwts": {}, + "/v1/default/Pod/fake-pod-15-nr29j": {}, + "/v1/default/Pod/fake-pod-15-nrfpb": {}, + "/v1/default/Pod/fake-pod-15-nxv7x": {}, + "/v1/default/Pod/fake-pod-15-p2ssh": {}, + "/v1/default/Pod/fake-pod-15-p565p": {}, + "/v1/default/Pod/fake-pod-15-p5d9c": {}, + "/v1/default/Pod/fake-pod-15-p74fs": {}, + "/v1/default/Pod/fake-pod-15-p9d77": {}, + "/v1/default/Pod/fake-pod-15-pc2m8": {}, + "/v1/default/Pod/fake-pod-15-prszq": {}, + "/v1/default/Pod/fake-pod-15-prt59": {}, + "/v1/default/Pod/fake-pod-15-pz7xj": {}, + "/v1/default/Pod/fake-pod-15-pz875": {}, + "/v1/default/Pod/fake-pod-15-q42mq": {}, + "/v1/default/Pod/fake-pod-15-q5ckh": {}, + "/v1/default/Pod/fake-pod-15-qbs4h": {}, + "/v1/default/Pod/fake-pod-15-qghk7": {}, + "/v1/default/Pod/fake-pod-15-qmzwf": {}, + "/v1/default/Pod/fake-pod-15-qpc7n": {}, + "/v1/default/Pod/fake-pod-15-qqs8t": {}, + "/v1/default/Pod/fake-pod-15-qrbth": {}, + "/v1/default/Pod/fake-pod-15-qrkhx": {}, + "/v1/default/Pod/fake-pod-15-rbkqq": {}, + "/v1/default/Pod/fake-pod-15-rclj7": {}, + "/v1/default/Pod/fake-pod-15-rcqlg": {}, + "/v1/default/Pod/fake-pod-15-rgv95": {}, + "/v1/default/Pod/fake-pod-15-rj442": {}, + "/v1/default/Pod/fake-pod-15-rj4tl": {}, + "/v1/default/Pod/fake-pod-15-rj9xd": {}, + "/v1/default/Pod/fake-pod-15-rljhb": {}, + "/v1/default/Pod/fake-pod-15-rsm8c": {}, + "/v1/default/Pod/fake-pod-15-s7cc6": {}, + "/v1/default/Pod/fake-pod-15-s99lg": {}, + "/v1/default/Pod/fake-pod-15-sb4th": {}, + "/v1/default/Pod/fake-pod-15-sczzx": {}, + "/v1/default/Pod/fake-pod-15-sgl8t": {}, + "/v1/default/Pod/fake-pod-15-sgrs5": {}, + "/v1/default/Pod/fake-pod-15-slc7h": {}, + "/v1/default/Pod/fake-pod-15-sv74c": {}, + "/v1/default/Pod/fake-pod-15-sxj6l": {}, + "/v1/default/Pod/fake-pod-15-t4wtl": {}, + "/v1/default/Pod/fake-pod-15-t5gzl": {}, + "/v1/default/Pod/fake-pod-15-t5ht6": {}, + "/v1/default/Pod/fake-pod-15-t8lxg": {}, + "/v1/default/Pod/fake-pod-15-t8qsg": {}, + "/v1/default/Pod/fake-pod-15-t9dbv": {}, + "/v1/default/Pod/fake-pod-15-t9xfg": {}, + "/v1/default/Pod/fake-pod-15-tdsm8": {}, + "/v1/default/Pod/fake-pod-15-tg2vv": {}, + "/v1/default/Pod/fake-pod-15-tk9f9": {}, + "/v1/default/Pod/fake-pod-15-tm4b7": {}, + "/v1/default/Pod/fake-pod-15-tn6ph": {}, + "/v1/default/Pod/fake-pod-15-trprw": {}, + "/v1/default/Pod/fake-pod-15-v46sv": {}, + "/v1/default/Pod/fake-pod-15-v52hh": {}, + "/v1/default/Pod/fake-pod-15-v7gm5": {}, + "/v1/default/Pod/fake-pod-15-v84h4": {}, + "/v1/default/Pod/fake-pod-15-v86tk": {}, + "/v1/default/Pod/fake-pod-15-v8n58": {}, + "/v1/default/Pod/fake-pod-15-vdwvj": {}, + "/v1/default/Pod/fake-pod-15-vggnd": {}, + "/v1/default/Pod/fake-pod-15-vsj4f": {}, + "/v1/default/Pod/fake-pod-15-vth7b": {}, + "/v1/default/Pod/fake-pod-15-w2bsn": {}, + "/v1/default/Pod/fake-pod-15-wh4jp": {}, + "/v1/default/Pod/fake-pod-15-wjjvg": {}, + "/v1/default/Pod/fake-pod-15-wm8vb": {}, + "/v1/default/Pod/fake-pod-15-wmszd": {}, + "/v1/default/Pod/fake-pod-15-wrvvm": {}, + "/v1/default/Pod/fake-pod-15-ws4vv": {}, + "/v1/default/Pod/fake-pod-15-wx5zj": {}, + "/v1/default/Pod/fake-pod-15-wxjnc": {}, + "/v1/default/Pod/fake-pod-15-x2cbd": {}, + "/v1/default/Pod/fake-pod-15-x4l4t": {}, + "/v1/default/Pod/fake-pod-15-x5wwg": {}, + "/v1/default/Pod/fake-pod-15-x6wwp": {}, + "/v1/default/Pod/fake-pod-15-xd9rg": {}, + "/v1/default/Pod/fake-pod-15-xggrh": {}, + "/v1/default/Pod/fake-pod-15-xgjwx": {}, + "/v1/default/Pod/fake-pod-15-xht5v": {}, + "/v1/default/Pod/fake-pod-15-xkb2z": {}, + "/v1/default/Pod/fake-pod-15-xlsqg": {}, + "/v1/default/Pod/fake-pod-15-xm6pm": {}, + "/v1/default/Pod/fake-pod-15-xn9dz": {}, + "/v1/default/Pod/fake-pod-15-xp4z7": {}, + "/v1/default/Pod/fake-pod-15-xqbrc": {}, + "/v1/default/Pod/fake-pod-15-xrqbk": {}, + "/v1/default/Pod/fake-pod-15-xvrl5": {}, + "/v1/default/Pod/fake-pod-15-z244c": {}, + "/v1/default/Pod/fake-pod-15-z4859": {}, + "/v1/default/Pod/fake-pod-15-z99lv": {}, + "/v1/default/Pod/fake-pod-15-z9wtn": {}, + "/v1/default/Pod/fake-pod-15-zfltw": {}, + "/v1/default/Pod/fake-pod-15-zgq7n": {}, + "/v1/default/Pod/fake-pod-15-zlrw4": {}, + "/v1/default/Pod/fake-pod-15-zr7g2": {}, + "/v1/default/Pod/fake-pod-15-zrhgd": {}, + "/v1/default/Pod/fake-pod-15-zsc2r": {}, + "/v1/default/Pod/fake-pod-15-zwrxx": {}, + "/v1/default/Pod/fake-pod-15-zz28z": {}, + "/v1/default/Pod/fake-pod-16-28jgt": {}, + "/v1/default/Pod/fake-pod-16-2fwr8": {}, + "/v1/default/Pod/fake-pod-16-2hq6n": {}, + "/v1/default/Pod/fake-pod-16-2j4gc": {}, + "/v1/default/Pod/fake-pod-16-2jvgj": {}, + "/v1/default/Pod/fake-pod-16-2kshz": {}, + "/v1/default/Pod/fake-pod-16-2nxbd": {}, + "/v1/default/Pod/fake-pod-16-2ptvv": {}, + "/v1/default/Pod/fake-pod-16-2r56c": {}, + "/v1/default/Pod/fake-pod-16-2tfmd": {}, + "/v1/default/Pod/fake-pod-16-2xptz": {}, + "/v1/default/Pod/fake-pod-16-2zzrt": {}, + "/v1/default/Pod/fake-pod-16-45jjv": {}, + "/v1/default/Pod/fake-pod-16-46nl7": {}, + "/v1/default/Pod/fake-pod-16-4b5k2": {}, + "/v1/default/Pod/fake-pod-16-4cwvh": {}, + "/v1/default/Pod/fake-pod-16-4gnnh": {}, + "/v1/default/Pod/fake-pod-16-4n6nq": {}, + "/v1/default/Pod/fake-pod-16-4nfj9": {}, + "/v1/default/Pod/fake-pod-16-4nmgk": {}, + "/v1/default/Pod/fake-pod-16-4p5ns": {}, + "/v1/default/Pod/fake-pod-16-4sbrw": {}, + "/v1/default/Pod/fake-pod-16-4xhx2": {}, + "/v1/default/Pod/fake-pod-16-5c8tp": {}, + "/v1/default/Pod/fake-pod-16-5f7b5": {}, + "/v1/default/Pod/fake-pod-16-5hxqh": {}, + "/v1/default/Pod/fake-pod-16-5jpr7": {}, + "/v1/default/Pod/fake-pod-16-5jsjl": {}, + "/v1/default/Pod/fake-pod-16-5k8zj": {}, + "/v1/default/Pod/fake-pod-16-5kxlm": {}, + "/v1/default/Pod/fake-pod-16-5mfjz": {}, + "/v1/default/Pod/fake-pod-16-5n5zj": {}, + "/v1/default/Pod/fake-pod-16-5pts2": {}, + "/v1/default/Pod/fake-pod-16-5rsnz": {}, + "/v1/default/Pod/fake-pod-16-5w6ch": {}, + "/v1/default/Pod/fake-pod-16-5x2s7": {}, + "/v1/default/Pod/fake-pod-16-67hg7": {}, + "/v1/default/Pod/fake-pod-16-686jz": {}, + "/v1/default/Pod/fake-pod-16-68vxv": {}, + "/v1/default/Pod/fake-pod-16-6f269": {}, + "/v1/default/Pod/fake-pod-16-6mbcv": {}, + "/v1/default/Pod/fake-pod-16-6n8kp": {}, + "/v1/default/Pod/fake-pod-16-6pp4z": {}, + "/v1/default/Pod/fake-pod-16-75kkk": {}, + "/v1/default/Pod/fake-pod-16-76jtm": {}, + "/v1/default/Pod/fake-pod-16-79zpj": {}, + "/v1/default/Pod/fake-pod-16-7cxd4": {}, + "/v1/default/Pod/fake-pod-16-7k7jp": {}, + "/v1/default/Pod/fake-pod-16-7l5vz": {}, + "/v1/default/Pod/fake-pod-16-7p6gm": {}, + "/v1/default/Pod/fake-pod-16-7pvpg": {}, + "/v1/default/Pod/fake-pod-16-7sg9f": {}, + "/v1/default/Pod/fake-pod-16-7wwqj": {}, + "/v1/default/Pod/fake-pod-16-7x8q8": {}, + "/v1/default/Pod/fake-pod-16-7x8zh": {}, + "/v1/default/Pod/fake-pod-16-85tvl": {}, + "/v1/default/Pod/fake-pod-16-87bq4": {}, + "/v1/default/Pod/fake-pod-16-89pmk": {}, + "/v1/default/Pod/fake-pod-16-89w86": {}, + "/v1/default/Pod/fake-pod-16-8cxvz": {}, + "/v1/default/Pod/fake-pod-16-8d65p": {}, + "/v1/default/Pod/fake-pod-16-8h9dp": {}, + "/v1/default/Pod/fake-pod-16-8hkxq": {}, + "/v1/default/Pod/fake-pod-16-8nwvp": {}, + "/v1/default/Pod/fake-pod-16-8rgfn": {}, + "/v1/default/Pod/fake-pod-16-94w7z": {}, + "/v1/default/Pod/fake-pod-16-9b4w5": {}, + "/v1/default/Pod/fake-pod-16-9cb8c": {}, + "/v1/default/Pod/fake-pod-16-9f9qp": {}, + "/v1/default/Pod/fake-pod-16-9fb4n": {}, + "/v1/default/Pod/fake-pod-16-9gfck": {}, + "/v1/default/Pod/fake-pod-16-9j6wh": {}, + "/v1/default/Pod/fake-pod-16-9l5vk": {}, + "/v1/default/Pod/fake-pod-16-9rngh": {}, + "/v1/default/Pod/fake-pod-16-9x5lp": {}, + "/v1/default/Pod/fake-pod-16-9xs5t": {}, + "/v1/default/Pod/fake-pod-16-b22tj": {}, + "/v1/default/Pod/fake-pod-16-b95jv": {}, + "/v1/default/Pod/fake-pod-16-bb9dd": {}, + "/v1/default/Pod/fake-pod-16-bg6bc": {}, + "/v1/default/Pod/fake-pod-16-bgcwj": {}, + "/v1/default/Pod/fake-pod-16-bgdfj": {}, + "/v1/default/Pod/fake-pod-16-bjfkp": {}, + "/v1/default/Pod/fake-pod-16-bkdjb": {}, + "/v1/default/Pod/fake-pod-16-bklwt": {}, + "/v1/default/Pod/fake-pod-16-bm45m": {}, + "/v1/default/Pod/fake-pod-16-bmsb5": {}, + "/v1/default/Pod/fake-pod-16-bnwd7": {}, + "/v1/default/Pod/fake-pod-16-bp745": {}, + "/v1/default/Pod/fake-pod-16-bpjz5": {}, + "/v1/default/Pod/fake-pod-16-bqfrs": {}, + "/v1/default/Pod/fake-pod-16-bqk58": {}, + "/v1/default/Pod/fake-pod-16-bv7dp": {}, + "/v1/default/Pod/fake-pod-16-bwv62": {}, + "/v1/default/Pod/fake-pod-16-c27xv": {}, + "/v1/default/Pod/fake-pod-16-c4gzw": {}, + "/v1/default/Pod/fake-pod-16-c5lwr": {}, + "/v1/default/Pod/fake-pod-16-c9qqq": {}, + "/v1/default/Pod/fake-pod-16-cbx49": {}, + "/v1/default/Pod/fake-pod-16-ccnkf": {}, + "/v1/default/Pod/fake-pod-16-cdft6": {}, + "/v1/default/Pod/fake-pod-16-clkvg": {}, + "/v1/default/Pod/fake-pod-16-cr54g": {}, + "/v1/default/Pod/fake-pod-16-cr6w5": {}, + "/v1/default/Pod/fake-pod-16-cs5d6": {}, + "/v1/default/Pod/fake-pod-16-ctw7n": {}, + "/v1/default/Pod/fake-pod-16-cz2tt": {}, + "/v1/default/Pod/fake-pod-16-d2fxl": {}, + "/v1/default/Pod/fake-pod-16-d775v": {}, + "/v1/default/Pod/fake-pod-16-d86bf": {}, + "/v1/default/Pod/fake-pod-16-d9wkw": {}, + "/v1/default/Pod/fake-pod-16-dcqvf": {}, + "/v1/default/Pod/fake-pod-16-dd747": {}, + "/v1/default/Pod/fake-pod-16-dkkvg": {}, + "/v1/default/Pod/fake-pod-16-dnrbb": {}, + "/v1/default/Pod/fake-pod-16-dq4v5": {}, + "/v1/default/Pod/fake-pod-16-dsjdc": {}, + "/v1/default/Pod/fake-pod-16-dv97p": {}, + "/v1/default/Pod/fake-pod-16-dvkv5": {}, + "/v1/default/Pod/fake-pod-16-f5x8c": {}, + "/v1/default/Pod/fake-pod-16-f8qg8": {}, + "/v1/default/Pod/fake-pod-16-fbkxg": {}, + "/v1/default/Pod/fake-pod-16-fcqx5": {}, + "/v1/default/Pod/fake-pod-16-fddxw": {}, + "/v1/default/Pod/fake-pod-16-fg9k6": {}, + "/v1/default/Pod/fake-pod-16-fhmxr": {}, + "/v1/default/Pod/fake-pod-16-fkchd": {}, + "/v1/default/Pod/fake-pod-16-fnw8d": {}, + "/v1/default/Pod/fake-pod-16-fs2hd": {}, + "/v1/default/Pod/fake-pod-16-g4t4k": {}, + "/v1/default/Pod/fake-pod-16-gfs79": {}, + "/v1/default/Pod/fake-pod-16-ggcrr": {}, + "/v1/default/Pod/fake-pod-16-gkj5k": {}, + "/v1/default/Pod/fake-pod-16-gljtm": {}, + "/v1/default/Pod/fake-pod-16-glrvk": {}, + "/v1/default/Pod/fake-pod-16-grbr9": {}, + "/v1/default/Pod/fake-pod-16-gvhzs": {}, + "/v1/default/Pod/fake-pod-16-gvmsg": {}, + "/v1/default/Pod/fake-pod-16-gxngr": {}, + "/v1/default/Pod/fake-pod-16-h6h7l": {}, + "/v1/default/Pod/fake-pod-16-h8698": {}, + "/v1/default/Pod/fake-pod-16-h9vnk": {}, + "/v1/default/Pod/fake-pod-16-hfxd7": {}, + "/v1/default/Pod/fake-pod-16-hhlqm": {}, + "/v1/default/Pod/fake-pod-16-hhzl7": {}, + "/v1/default/Pod/fake-pod-16-hnmd5": {}, + "/v1/default/Pod/fake-pod-16-htf4w": {}, + "/v1/default/Pod/fake-pod-16-hv6f5": {}, + "/v1/default/Pod/fake-pod-16-hvwsx": {}, + "/v1/default/Pod/fake-pod-16-j4g8t": {}, + "/v1/default/Pod/fake-pod-16-j58w6": {}, + "/v1/default/Pod/fake-pod-16-j5958": {}, + "/v1/default/Pod/fake-pod-16-j5mc2": {}, + "/v1/default/Pod/fake-pod-16-j7b9g": {}, + "/v1/default/Pod/fake-pod-16-jbwxz": {}, + "/v1/default/Pod/fake-pod-16-jcb5f": {}, + "/v1/default/Pod/fake-pod-16-jdxv7": {}, + "/v1/default/Pod/fake-pod-16-jgkt4": {}, + "/v1/default/Pod/fake-pod-16-jhf87": {}, + "/v1/default/Pod/fake-pod-16-jjh5q": {}, + "/v1/default/Pod/fake-pod-16-jlscq": {}, + "/v1/default/Pod/fake-pod-16-jqjvj": {}, + "/v1/default/Pod/fake-pod-16-jrlj6": {}, + "/v1/default/Pod/fake-pod-16-jsmk5": {}, + "/v1/default/Pod/fake-pod-16-k5glj": {}, + "/v1/default/Pod/fake-pod-16-k9jsk": {}, + "/v1/default/Pod/fake-pod-16-kg577": {}, + "/v1/default/Pod/fake-pod-16-kh8sd": {}, + "/v1/default/Pod/fake-pod-16-kk6zh": {}, + "/v1/default/Pod/fake-pod-16-l5hrz": {}, + "/v1/default/Pod/fake-pod-16-l5ldg": {}, + "/v1/default/Pod/fake-pod-16-l8wkh": {}, + "/v1/default/Pod/fake-pod-16-lf59b": {}, + "/v1/default/Pod/fake-pod-16-lf7rl": {}, + "/v1/default/Pod/fake-pod-16-lk7xl": {}, + "/v1/default/Pod/fake-pod-16-lr555": {}, + "/v1/default/Pod/fake-pod-16-lv6jv": {}, + "/v1/default/Pod/fake-pod-16-lxkpl": {}, + "/v1/default/Pod/fake-pod-16-m52vh": {}, + "/v1/default/Pod/fake-pod-16-m695t": {}, + "/v1/default/Pod/fake-pod-16-m8k2p": {}, + "/v1/default/Pod/fake-pod-16-m97fn": {}, + "/v1/default/Pod/fake-pod-16-mdsrr": {}, + "/v1/default/Pod/fake-pod-16-mgpsr": {}, + "/v1/default/Pod/fake-pod-16-mkrxz": {}, + "/v1/default/Pod/fake-pod-16-mlmx4": {}, + "/v1/default/Pod/fake-pod-16-mnd9l": {}, + "/v1/default/Pod/fake-pod-16-n65h7": {}, + "/v1/default/Pod/fake-pod-16-n6qv7": {}, + "/v1/default/Pod/fake-pod-16-nc9h4": {}, + "/v1/default/Pod/fake-pod-16-nh8hd": {}, + "/v1/default/Pod/fake-pod-16-nkhbx": {}, + "/v1/default/Pod/fake-pod-16-nkjx5": {}, + "/v1/default/Pod/fake-pod-16-nlcjj": {}, + "/v1/default/Pod/fake-pod-16-nlgqz": {}, + "/v1/default/Pod/fake-pod-16-nmkbn": {}, + "/v1/default/Pod/fake-pod-16-nmnh9": {}, + "/v1/default/Pod/fake-pod-16-nnwsg": {}, + "/v1/default/Pod/fake-pod-16-nwpwg": {}, + "/v1/default/Pod/fake-pod-16-p4xw6": {}, + "/v1/default/Pod/fake-pod-16-pbvv7": {}, + "/v1/default/Pod/fake-pod-16-pd77w": {}, + "/v1/default/Pod/fake-pod-16-pjdz7": {}, + "/v1/default/Pod/fake-pod-16-pjn5f": {}, + "/v1/default/Pod/fake-pod-16-pjzfh": {}, + "/v1/default/Pod/fake-pod-16-pk7t6": {}, + "/v1/default/Pod/fake-pod-16-pphxh": {}, + "/v1/default/Pod/fake-pod-16-pxg28": {}, + "/v1/default/Pod/fake-pod-16-pzs2n": {}, + "/v1/default/Pod/fake-pod-16-q7hnd": {}, + "/v1/default/Pod/fake-pod-16-qd2w7": {}, + "/v1/default/Pod/fake-pod-16-qd892": {}, + "/v1/default/Pod/fake-pod-16-qdnhq": {}, + "/v1/default/Pod/fake-pod-16-qfmdq": {}, + "/v1/default/Pod/fake-pod-16-qgckz": {}, + "/v1/default/Pod/fake-pod-16-qgf7j": {}, + "/v1/default/Pod/fake-pod-16-qgfbz": {}, + "/v1/default/Pod/fake-pod-16-qhv8x": {}, + "/v1/default/Pod/fake-pod-16-qjvlm": {}, + "/v1/default/Pod/fake-pod-16-qkglr": {}, + "/v1/default/Pod/fake-pod-16-qszc4": {}, + "/v1/default/Pod/fake-pod-16-qxd9d": {}, + "/v1/default/Pod/fake-pod-16-r4j5x": {}, + "/v1/default/Pod/fake-pod-16-r577m": {}, + "/v1/default/Pod/fake-pod-16-rc6vh": {}, + "/v1/default/Pod/fake-pod-16-rh594": {}, + "/v1/default/Pod/fake-pod-16-rhml6": {}, + "/v1/default/Pod/fake-pod-16-rjz58": {}, + "/v1/default/Pod/fake-pod-16-rpql5": {}, + "/v1/default/Pod/fake-pod-16-rs8p5": {}, + "/v1/default/Pod/fake-pod-16-rvx8r": {}, + "/v1/default/Pod/fake-pod-16-rw5ls": {}, + "/v1/default/Pod/fake-pod-16-rz5qq": {}, + "/v1/default/Pod/fake-pod-16-rzf94": {}, + "/v1/default/Pod/fake-pod-16-rzvnf": {}, + "/v1/default/Pod/fake-pod-16-s22bn": {}, + "/v1/default/Pod/fake-pod-16-s4tkh": {}, + "/v1/default/Pod/fake-pod-16-s5m28": {}, + "/v1/default/Pod/fake-pod-16-s6gbs": {}, + "/v1/default/Pod/fake-pod-16-s97qv": {}, + "/v1/default/Pod/fake-pod-16-sb8nk": {}, + "/v1/default/Pod/fake-pod-16-scsp6": {}, + "/v1/default/Pod/fake-pod-16-sp2wp": {}, + "/v1/default/Pod/fake-pod-16-spgbd": {}, + "/v1/default/Pod/fake-pod-16-sq9f6": {}, + "/v1/default/Pod/fake-pod-16-swrvl": {}, + "/v1/default/Pod/fake-pod-16-tdb2j": {}, + "/v1/default/Pod/fake-pod-16-th5lw": {}, + "/v1/default/Pod/fake-pod-16-tj7n8": {}, + "/v1/default/Pod/fake-pod-16-tqgtl": {}, + "/v1/default/Pod/fake-pod-16-tqhq5": {}, + "/v1/default/Pod/fake-pod-16-twszn": {}, + "/v1/default/Pod/fake-pod-16-v2s4v": {}, + "/v1/default/Pod/fake-pod-16-v4kkv": {}, + "/v1/default/Pod/fake-pod-16-v4plt": {}, + "/v1/default/Pod/fake-pod-16-v5rn4": {}, + "/v1/default/Pod/fake-pod-16-v77l8": {}, + "/v1/default/Pod/fake-pod-16-v7brt": {}, + "/v1/default/Pod/fake-pod-16-v8s8x": {}, + "/v1/default/Pod/fake-pod-16-vdqvr": {}, + "/v1/default/Pod/fake-pod-16-vfd7r": {}, + "/v1/default/Pod/fake-pod-16-vlgkm": {}, + "/v1/default/Pod/fake-pod-16-vlw69": {}, + "/v1/default/Pod/fake-pod-16-vnrvv": {}, + "/v1/default/Pod/fake-pod-16-vqbpn": {}, + "/v1/default/Pod/fake-pod-16-vvrc6": {}, + "/v1/default/Pod/fake-pod-16-vzf7c": {}, + "/v1/default/Pod/fake-pod-16-w66x9": {}, + "/v1/default/Pod/fake-pod-16-w7g8c": {}, + "/v1/default/Pod/fake-pod-16-w7nhh": {}, + "/v1/default/Pod/fake-pod-16-wch6h": {}, + "/v1/default/Pod/fake-pod-16-wf5j4": {}, + "/v1/default/Pod/fake-pod-16-wgcxd": {}, + "/v1/default/Pod/fake-pod-16-wjrt6": {}, + "/v1/default/Pod/fake-pod-16-wlc4f": {}, + "/v1/default/Pod/fake-pod-16-wpwkc": {}, + "/v1/default/Pod/fake-pod-16-wq46h": {}, + "/v1/default/Pod/fake-pod-16-wq5ql": {}, + "/v1/default/Pod/fake-pod-16-x2mdh": {}, + "/v1/default/Pod/fake-pod-16-x8qs5": {}, + "/v1/default/Pod/fake-pod-16-xfpfl": {}, + "/v1/default/Pod/fake-pod-16-xkt5w": {}, + "/v1/default/Pod/fake-pod-16-xp7nh": {}, + "/v1/default/Pod/fake-pod-16-xwbvd": {}, + "/v1/default/Pod/fake-pod-16-xxv29": {}, + "/v1/default/Pod/fake-pod-16-z4nvc": {}, + "/v1/default/Pod/fake-pod-16-zcmvg": {}, + "/v1/default/Pod/fake-pod-16-zg5rd": {}, + "/v1/default/Pod/fake-pod-16-zjk6v": {}, + "/v1/default/Pod/fake-pod-16-zkhgh": {}, + "/v1/default/Pod/fake-pod-16-zlfp4": {}, + "/v1/default/Pod/fake-pod-16-zmdrv": {}, + "/v1/default/Pod/fake-pod-16-znz2w": {}, + "/v1/default/Pod/fake-pod-16-zqgxz": {}, + "/v1/default/Pod/fake-pod-16-zrg76": {}, + "/v1/default/Pod/fake-pod-16-zvdw8": {}, + "/v1/default/Pod/fake-pod-16-zvmwd": {}, + "/v1/default/Pod/fake-pod-16-zvt7w": {}, + "/v1/default/Pod/fake-pod-16-zvxgq": {}, + "/v1/default/Pod/fake-pod-17-25bnv": {}, + "/v1/default/Pod/fake-pod-17-26jvr": {}, + "/v1/default/Pod/fake-pod-17-294xd": {}, + "/v1/default/Pod/fake-pod-17-2ccsc": {}, + "/v1/default/Pod/fake-pod-17-2dvpr": {}, + "/v1/default/Pod/fake-pod-17-2htrg": {}, + "/v1/default/Pod/fake-pod-17-2j7xl": {}, + "/v1/default/Pod/fake-pod-17-2lfsh": {}, + "/v1/default/Pod/fake-pod-17-2lzkj": {}, + "/v1/default/Pod/fake-pod-17-2p59q": {}, + "/v1/default/Pod/fake-pod-17-2vddz": {}, + "/v1/default/Pod/fake-pod-17-2vghv": {}, + "/v1/default/Pod/fake-pod-17-44rhh": {}, + "/v1/default/Pod/fake-pod-17-4645s": {}, + "/v1/default/Pod/fake-pod-17-492vc": {}, + "/v1/default/Pod/fake-pod-17-4cwwv": {}, + "/v1/default/Pod/fake-pod-17-4f8vs": {}, + "/v1/default/Pod/fake-pod-17-4gqwb": {}, + "/v1/default/Pod/fake-pod-17-4gwbn": {}, + "/v1/default/Pod/fake-pod-17-4hkvw": {}, + "/v1/default/Pod/fake-pod-17-4hn2l": {}, + "/v1/default/Pod/fake-pod-17-4hvkx": {}, + "/v1/default/Pod/fake-pod-17-4p9l4": {}, + "/v1/default/Pod/fake-pod-17-4qcmv": {}, + "/v1/default/Pod/fake-pod-17-4rmp5": {}, + "/v1/default/Pod/fake-pod-17-4sdb8": {}, + "/v1/default/Pod/fake-pod-17-4tcrj": {}, + "/v1/default/Pod/fake-pod-17-58wz4": {}, + "/v1/default/Pod/fake-pod-17-5b6dl": {}, + "/v1/default/Pod/fake-pod-17-5fmfw": {}, + "/v1/default/Pod/fake-pod-17-5gt8g": {}, + "/v1/default/Pod/fake-pod-17-5kx6f": {}, + "/v1/default/Pod/fake-pod-17-5lqr5": {}, + "/v1/default/Pod/fake-pod-17-5m94m": {}, + "/v1/default/Pod/fake-pod-17-5r45d": {}, + "/v1/default/Pod/fake-pod-17-5s6c9": {}, + "/v1/default/Pod/fake-pod-17-5xgll": {}, + "/v1/default/Pod/fake-pod-17-68z29": {}, + "/v1/default/Pod/fake-pod-17-6f7w7": {}, + "/v1/default/Pod/fake-pod-17-6g7jb": {}, + "/v1/default/Pod/fake-pod-17-6ghv5": {}, + "/v1/default/Pod/fake-pod-17-6h8rc": {}, + "/v1/default/Pod/fake-pod-17-6l6vg": {}, + "/v1/default/Pod/fake-pod-17-6l9gf": {}, + "/v1/default/Pod/fake-pod-17-6n5j9": {}, + "/v1/default/Pod/fake-pod-17-6nlqz": {}, + "/v1/default/Pod/fake-pod-17-6r8lc": {}, + "/v1/default/Pod/fake-pod-17-6wl7r": {}, + "/v1/default/Pod/fake-pod-17-742v9": {}, + "/v1/default/Pod/fake-pod-17-74rwm": {}, + "/v1/default/Pod/fake-pod-17-7765s": {}, + "/v1/default/Pod/fake-pod-17-7mpnk": {}, + "/v1/default/Pod/fake-pod-17-7nqms": {}, + "/v1/default/Pod/fake-pod-17-7r6ql": {}, + "/v1/default/Pod/fake-pod-17-7x4wp": {}, + "/v1/default/Pod/fake-pod-17-84hfm": {}, + "/v1/default/Pod/fake-pod-17-85sgj": {}, + "/v1/default/Pod/fake-pod-17-867c4": {}, + "/v1/default/Pod/fake-pod-17-89qdc": {}, + "/v1/default/Pod/fake-pod-17-8d2j9": {}, + "/v1/default/Pod/fake-pod-17-8d5wb": {}, + "/v1/default/Pod/fake-pod-17-8hsdk": {}, + "/v1/default/Pod/fake-pod-17-8rn54": {}, + "/v1/default/Pod/fake-pod-17-94vf9": {}, + "/v1/default/Pod/fake-pod-17-989t7": {}, + "/v1/default/Pod/fake-pod-17-9bcn9": {}, + "/v1/default/Pod/fake-pod-17-9bl7g": {}, + "/v1/default/Pod/fake-pod-17-9ccz7": {}, + "/v1/default/Pod/fake-pod-17-9f4s7": {}, + "/v1/default/Pod/fake-pod-17-9hn62": {}, + "/v1/default/Pod/fake-pod-17-9k6fv": {}, + "/v1/default/Pod/fake-pod-17-9m84k": {}, + "/v1/default/Pod/fake-pod-17-9psqj": {}, + "/v1/default/Pod/fake-pod-17-9qg9p": {}, + "/v1/default/Pod/fake-pod-17-9rglh": {}, + "/v1/default/Pod/fake-pod-17-b5xdm": {}, + "/v1/default/Pod/fake-pod-17-b65hv": {}, + "/v1/default/Pod/fake-pod-17-bfcpr": {}, + "/v1/default/Pod/fake-pod-17-bgkf2": {}, + "/v1/default/Pod/fake-pod-17-bl5dz": {}, + "/v1/default/Pod/fake-pod-17-bndj6": {}, + "/v1/default/Pod/fake-pod-17-bnplc": {}, + "/v1/default/Pod/fake-pod-17-bvdsn": {}, + "/v1/default/Pod/fake-pod-17-bvxhp": {}, + "/v1/default/Pod/fake-pod-17-bvxrf": {}, + "/v1/default/Pod/fake-pod-17-c6r9m": {}, + "/v1/default/Pod/fake-pod-17-c797j": {}, + "/v1/default/Pod/fake-pod-17-c8ls7": {}, + "/v1/default/Pod/fake-pod-17-ccbt9": {}, + "/v1/default/Pod/fake-pod-17-cd4xs": {}, + "/v1/default/Pod/fake-pod-17-cfnsb": {}, + "/v1/default/Pod/fake-pod-17-ch5bd": {}, + "/v1/default/Pod/fake-pod-17-chg8j": {}, + "/v1/default/Pod/fake-pod-17-chrfp": {}, + "/v1/default/Pod/fake-pod-17-cv8pw": {}, + "/v1/default/Pod/fake-pod-17-cw6dh": {}, + "/v1/default/Pod/fake-pod-17-cx4vr": {}, + "/v1/default/Pod/fake-pod-17-d4nzg": {}, + "/v1/default/Pod/fake-pod-17-d6wbs": {}, + "/v1/default/Pod/fake-pod-17-d9bsj": {}, + "/v1/default/Pod/fake-pod-17-dcrbv": {}, + "/v1/default/Pod/fake-pod-17-dcxf4": {}, + "/v1/default/Pod/fake-pod-17-dd8fd": {}, + "/v1/default/Pod/fake-pod-17-df78x": {}, + "/v1/default/Pod/fake-pod-17-dfmrs": {}, + "/v1/default/Pod/fake-pod-17-djwsl": {}, + "/v1/default/Pod/fake-pod-17-dkvg6": {}, + "/v1/default/Pod/fake-pod-17-dl6c8": {}, + "/v1/default/Pod/fake-pod-17-dn9gl": {}, + "/v1/default/Pod/fake-pod-17-dnjtj": {}, + "/v1/default/Pod/fake-pod-17-dq8n8": {}, + "/v1/default/Pod/fake-pod-17-drf6p": {}, + "/v1/default/Pod/fake-pod-17-dszt8": {}, + "/v1/default/Pod/fake-pod-17-f476r": {}, + "/v1/default/Pod/fake-pod-17-f8nwb": {}, + "/v1/default/Pod/fake-pod-17-fd44s": {}, + "/v1/default/Pod/fake-pod-17-fklrv": {}, + "/v1/default/Pod/fake-pod-17-fq2wk": {}, + "/v1/default/Pod/fake-pod-17-fqtzg": {}, + "/v1/default/Pod/fake-pod-17-fwv95": {}, + "/v1/default/Pod/fake-pod-17-fxpxm": {}, + "/v1/default/Pod/fake-pod-17-g826q": {}, + "/v1/default/Pod/fake-pod-17-gjhbf": {}, + "/v1/default/Pod/fake-pod-17-gndcr": {}, + "/v1/default/Pod/fake-pod-17-gpr8t": {}, + "/v1/default/Pod/fake-pod-17-gr7t2": {}, + "/v1/default/Pod/fake-pod-17-gstxf": {}, + "/v1/default/Pod/fake-pod-17-gvmsg": {}, + "/v1/default/Pod/fake-pod-17-gwllm": {}, + "/v1/default/Pod/fake-pod-17-gx628": {}, + "/v1/default/Pod/fake-pod-17-gzjvv": {}, + "/v1/default/Pod/fake-pod-17-h5fql": {}, + "/v1/default/Pod/fake-pod-17-h72c9": {}, + "/v1/default/Pod/fake-pod-17-h8fcl": {}, + "/v1/default/Pod/fake-pod-17-hr749": {}, + "/v1/default/Pod/fake-pod-17-hvhq4": {}, + "/v1/default/Pod/fake-pod-17-hvm8j": {}, + "/v1/default/Pod/fake-pod-17-hw2s8": {}, + "/v1/default/Pod/fake-pod-17-j2nfq": {}, + "/v1/default/Pod/fake-pod-17-j4f5c": {}, + "/v1/default/Pod/fake-pod-17-j6nlb": {}, + "/v1/default/Pod/fake-pod-17-j847w": {}, + "/v1/default/Pod/fake-pod-17-jc76b": {}, + "/v1/default/Pod/fake-pod-17-jk2kz": {}, + "/v1/default/Pod/fake-pod-17-jk9qg": {}, + "/v1/default/Pod/fake-pod-17-jqjf6": {}, + "/v1/default/Pod/fake-pod-17-jqxvv": {}, + "/v1/default/Pod/fake-pod-17-k2h65": {}, + "/v1/default/Pod/fake-pod-17-k2trj": {}, + "/v1/default/Pod/fake-pod-17-k4j7c": {}, + "/v1/default/Pod/fake-pod-17-k5xc7": {}, + "/v1/default/Pod/fake-pod-17-k67rr": {}, + "/v1/default/Pod/fake-pod-17-k75xw": {}, + "/v1/default/Pod/fake-pod-17-k7dpk": {}, + "/v1/default/Pod/fake-pod-17-k7tx2": {}, + "/v1/default/Pod/fake-pod-17-kczk7": {}, + "/v1/default/Pod/fake-pod-17-kgwhf": {}, + "/v1/default/Pod/fake-pod-17-khzlb": {}, + "/v1/default/Pod/fake-pod-17-knzjg": {}, + "/v1/default/Pod/fake-pod-17-krqnv": {}, + "/v1/default/Pod/fake-pod-17-ks9zh": {}, + "/v1/default/Pod/fake-pod-17-ksb9m": {}, + "/v1/default/Pod/fake-pod-17-kx852": {}, + "/v1/default/Pod/fake-pod-17-kxpvf": {}, + "/v1/default/Pod/fake-pod-17-kzp96": {}, + "/v1/default/Pod/fake-pod-17-l2t5c": {}, + "/v1/default/Pod/fake-pod-17-l44cn": {}, + "/v1/default/Pod/fake-pod-17-l4xvd": {}, + "/v1/default/Pod/fake-pod-17-l6sh5": {}, + "/v1/default/Pod/fake-pod-17-l6v5x": {}, + "/v1/default/Pod/fake-pod-17-l98ld": {}, + "/v1/default/Pod/fake-pod-17-lfqhm": {}, + "/v1/default/Pod/fake-pod-17-lfwpr": {}, + "/v1/default/Pod/fake-pod-17-lhv8n": {}, + "/v1/default/Pod/fake-pod-17-lhzr8": {}, + "/v1/default/Pod/fake-pod-17-lk9lg": {}, + "/v1/default/Pod/fake-pod-17-lklnl": {}, + "/v1/default/Pod/fake-pod-17-llpwv": {}, + "/v1/default/Pod/fake-pod-17-lmqzt": {}, + "/v1/default/Pod/fake-pod-17-lpdcn": {}, + "/v1/default/Pod/fake-pod-17-lrw5x": {}, + "/v1/default/Pod/fake-pod-17-lvqqn": {}, + "/v1/default/Pod/fake-pod-17-lxdb6": {}, + "/v1/default/Pod/fake-pod-17-m2mph": {}, + "/v1/default/Pod/fake-pod-17-m4tkk": {}, + "/v1/default/Pod/fake-pod-17-mb27t": {}, + "/v1/default/Pod/fake-pod-17-mg8ld": {}, + "/v1/default/Pod/fake-pod-17-mh67b": {}, + "/v1/default/Pod/fake-pod-17-mhpwp": {}, + "/v1/default/Pod/fake-pod-17-mjdrg": {}, + "/v1/default/Pod/fake-pod-17-mk82v": {}, + "/v1/default/Pod/fake-pod-17-mr4pv": {}, + "/v1/default/Pod/fake-pod-17-mx9pn": {}, + "/v1/default/Pod/fake-pod-17-n2cd9": {}, + "/v1/default/Pod/fake-pod-17-n5b97": {}, + "/v1/default/Pod/fake-pod-17-n8pc5": {}, + "/v1/default/Pod/fake-pod-17-n9hsp": {}, + "/v1/default/Pod/fake-pod-17-nbjcj": {}, + "/v1/default/Pod/fake-pod-17-nfknp": {}, + "/v1/default/Pod/fake-pod-17-ng7m6": {}, + "/v1/default/Pod/fake-pod-17-njzx8": {}, + "/v1/default/Pod/fake-pod-17-nmrp7": {}, + "/v1/default/Pod/fake-pod-17-nqcv4": {}, + "/v1/default/Pod/fake-pod-17-nszzq": {}, + "/v1/default/Pod/fake-pod-17-ntbtb": {}, + "/v1/default/Pod/fake-pod-17-nxz8r": {}, + "/v1/default/Pod/fake-pod-17-p4gzq": {}, + "/v1/default/Pod/fake-pod-17-p57bz": {}, + "/v1/default/Pod/fake-pod-17-p5w8g": {}, + "/v1/default/Pod/fake-pod-17-p6v5t": {}, + "/v1/default/Pod/fake-pod-17-p9k26": {}, + "/v1/default/Pod/fake-pod-17-pc769": {}, + "/v1/default/Pod/fake-pod-17-pg7dn": {}, + "/v1/default/Pod/fake-pod-17-pj98f": {}, + "/v1/default/Pod/fake-pod-17-pv62l": {}, + "/v1/default/Pod/fake-pod-17-q4r7z": {}, + "/v1/default/Pod/fake-pod-17-q8ccz": {}, + "/v1/default/Pod/fake-pod-17-q8gss": {}, + "/v1/default/Pod/fake-pod-17-q9qr7": {}, + "/v1/default/Pod/fake-pod-17-qd7rc": {}, + "/v1/default/Pod/fake-pod-17-qjgxp": {}, + "/v1/default/Pod/fake-pod-17-qnp59": {}, + "/v1/default/Pod/fake-pod-17-qrn5p": {}, + "/v1/default/Pod/fake-pod-17-qzx8g": {}, + "/v1/default/Pod/fake-pod-17-r2vmc": {}, + "/v1/default/Pod/fake-pod-17-r2z4q": {}, + "/v1/default/Pod/fake-pod-17-r552z": {}, + "/v1/default/Pod/fake-pod-17-rcnxq": {}, + "/v1/default/Pod/fake-pod-17-rf8c7": {}, + "/v1/default/Pod/fake-pod-17-rksbq": {}, + "/v1/default/Pod/fake-pod-17-rtrrc": {}, + "/v1/default/Pod/fake-pod-17-rwjnq": {}, + "/v1/default/Pod/fake-pod-17-rx7k4": {}, + "/v1/default/Pod/fake-pod-17-s2pqj": {}, + "/v1/default/Pod/fake-pod-17-s4hdq": {}, + "/v1/default/Pod/fake-pod-17-s6vhq": {}, + "/v1/default/Pod/fake-pod-17-s7h8t": {}, + "/v1/default/Pod/fake-pod-17-s98s6": {}, + "/v1/default/Pod/fake-pod-17-scb4h": {}, + "/v1/default/Pod/fake-pod-17-sfmjf": {}, + "/v1/default/Pod/fake-pod-17-slmhp": {}, + "/v1/default/Pod/fake-pod-17-snptz": {}, + "/v1/default/Pod/fake-pod-17-srfld": {}, + "/v1/default/Pod/fake-pod-17-swss2": {}, + "/v1/default/Pod/fake-pod-17-sxm42": {}, + "/v1/default/Pod/fake-pod-17-t4zdx": {}, + "/v1/default/Pod/fake-pod-17-t78hg": {}, + "/v1/default/Pod/fake-pod-17-t8f6c": {}, + "/v1/default/Pod/fake-pod-17-tgt4d": {}, + "/v1/default/Pod/fake-pod-17-tmbdq": {}, + "/v1/default/Pod/fake-pod-17-tn2kl": {}, + "/v1/default/Pod/fake-pod-17-tv67d": {}, + "/v1/default/Pod/fake-pod-17-twr7c": {}, + "/v1/default/Pod/fake-pod-17-tzdtm": {}, + "/v1/default/Pod/fake-pod-17-v24jl": {}, + "/v1/default/Pod/fake-pod-17-v2vnb": {}, + "/v1/default/Pod/fake-pod-17-v5wjz": {}, + "/v1/default/Pod/fake-pod-17-v7vdr": {}, + "/v1/default/Pod/fake-pod-17-v9grt": {}, + "/v1/default/Pod/fake-pod-17-vgdpk": {}, + "/v1/default/Pod/fake-pod-17-vh8mb": {}, + "/v1/default/Pod/fake-pod-17-vj2jl": {}, + "/v1/default/Pod/fake-pod-17-vmzkj": {}, + "/v1/default/Pod/fake-pod-17-vrj2g": {}, + "/v1/default/Pod/fake-pod-17-vxmh2": {}, + "/v1/default/Pod/fake-pod-17-w22g7": {}, + "/v1/default/Pod/fake-pod-17-w68t2": {}, + "/v1/default/Pod/fake-pod-17-w7gx6": {}, + "/v1/default/Pod/fake-pod-17-w7tzq": {}, + "/v1/default/Pod/fake-pod-17-wcfjp": {}, + "/v1/default/Pod/fake-pod-17-wjj4d": {}, + "/v1/default/Pod/fake-pod-17-wnfbl": {}, + "/v1/default/Pod/fake-pod-17-wnstj": {}, + "/v1/default/Pod/fake-pod-17-wrbhk": {}, + "/v1/default/Pod/fake-pod-17-wtnrh": {}, + "/v1/default/Pod/fake-pod-17-wv6n5": {}, + "/v1/default/Pod/fake-pod-17-wxwfr": {}, + "/v1/default/Pod/fake-pod-17-x2p6h": {}, + "/v1/default/Pod/fake-pod-17-x4cjq": {}, + "/v1/default/Pod/fake-pod-17-x4qdp": {}, + "/v1/default/Pod/fake-pod-17-x4zh6": {}, + "/v1/default/Pod/fake-pod-17-x76jh": {}, + "/v1/default/Pod/fake-pod-17-xbmch": {}, + "/v1/default/Pod/fake-pod-17-xc4p2": {}, + "/v1/default/Pod/fake-pod-17-xf4gl": {}, + "/v1/default/Pod/fake-pod-17-xj85c": {}, + "/v1/default/Pod/fake-pod-17-xk8qb": {}, + "/v1/default/Pod/fake-pod-17-xvfqm": {}, + "/v1/default/Pod/fake-pod-17-xxrtm": {}, + "/v1/default/Pod/fake-pod-17-z4xx6": {}, + "/v1/default/Pod/fake-pod-17-z6lcw": {}, + "/v1/default/Pod/fake-pod-17-z7dng": {}, + "/v1/default/Pod/fake-pod-17-z9w22": {}, + "/v1/default/Pod/fake-pod-17-z9zc4": {}, + "/v1/default/Pod/fake-pod-17-zf6lg": {}, + "/v1/default/Pod/fake-pod-17-zl4np": {}, + "/v1/default/Pod/fake-pod-17-zqbf7": {}, + "/v1/default/Pod/fake-pod-17-zv2pd": {}, + "/v1/default/Pod/fake-pod-17-zww8v": {}, + "/v1/default/Pod/fake-pod-18-24nvs": {}, + "/v1/default/Pod/fake-pod-18-2cp2f": {}, + "/v1/default/Pod/fake-pod-18-2h55t": {}, + "/v1/default/Pod/fake-pod-18-2llt4": {}, + "/v1/default/Pod/fake-pod-18-2mwqw": {}, + "/v1/default/Pod/fake-pod-18-2psf2": {}, + "/v1/default/Pod/fake-pod-18-2skq5": {}, + "/v1/default/Pod/fake-pod-18-2t6nj": {}, + "/v1/default/Pod/fake-pod-18-2tlg9": {}, + "/v1/default/Pod/fake-pod-18-2vnc2": {}, + "/v1/default/Pod/fake-pod-18-2x5hz": {}, + "/v1/default/Pod/fake-pod-18-2xv8b": {}, + "/v1/default/Pod/fake-pod-18-2zc5p": {}, + "/v1/default/Pod/fake-pod-18-42w98": {}, + "/v1/default/Pod/fake-pod-18-46jb2": {}, + "/v1/default/Pod/fake-pod-18-46tts": {}, + "/v1/default/Pod/fake-pod-18-47zm7": {}, + "/v1/default/Pod/fake-pod-18-49fcs": {}, + "/v1/default/Pod/fake-pod-18-4fg6j": {}, + "/v1/default/Pod/fake-pod-18-4fqr2": {}, + "/v1/default/Pod/fake-pod-18-4k7l7": {}, + "/v1/default/Pod/fake-pod-18-4n9n6": {}, + "/v1/default/Pod/fake-pod-18-4q9v7": {}, + "/v1/default/Pod/fake-pod-18-4wjrk": {}, + "/v1/default/Pod/fake-pod-18-52sfk": {}, + "/v1/default/Pod/fake-pod-18-569qw": {}, + "/v1/default/Pod/fake-pod-18-56tjb": {}, + "/v1/default/Pod/fake-pod-18-588ms": {}, + "/v1/default/Pod/fake-pod-18-5cjvq": {}, + "/v1/default/Pod/fake-pod-18-5n6fg": {}, + "/v1/default/Pod/fake-pod-18-62kwh": {}, + "/v1/default/Pod/fake-pod-18-68nn7": {}, + "/v1/default/Pod/fake-pod-18-6fzk4": {}, + "/v1/default/Pod/fake-pod-18-6hrjl": {}, + "/v1/default/Pod/fake-pod-18-6k88q": {}, + "/v1/default/Pod/fake-pod-18-6rtdm": {}, + "/v1/default/Pod/fake-pod-18-6slsh": {}, + "/v1/default/Pod/fake-pod-18-6vnvr": {}, + "/v1/default/Pod/fake-pod-18-6wjh4": {}, + "/v1/default/Pod/fake-pod-18-6xwhd": {}, + "/v1/default/Pod/fake-pod-18-6zcq8": {}, + "/v1/default/Pod/fake-pod-18-6zngn": {}, + "/v1/default/Pod/fake-pod-18-6zrlv": {}, + "/v1/default/Pod/fake-pod-18-72gnt": {}, + "/v1/default/Pod/fake-pod-18-74vlj": {}, + "/v1/default/Pod/fake-pod-18-75qqj": {}, + "/v1/default/Pod/fake-pod-18-764sf": {}, + "/v1/default/Pod/fake-pod-18-76kzr": {}, + "/v1/default/Pod/fake-pod-18-779n9": {}, + "/v1/default/Pod/fake-pod-18-786x2": {}, + "/v1/default/Pod/fake-pod-18-79dtn": {}, + "/v1/default/Pod/fake-pod-18-7bdrq": {}, + "/v1/default/Pod/fake-pod-18-7jgfx": {}, + "/v1/default/Pod/fake-pod-18-7kp9h": {}, + "/v1/default/Pod/fake-pod-18-7plv8": {}, + "/v1/default/Pod/fake-pod-18-7tqxf": {}, + "/v1/default/Pod/fake-pod-18-88c2m": {}, + "/v1/default/Pod/fake-pod-18-8bxdt": {}, + "/v1/default/Pod/fake-pod-18-8cj47": {}, + "/v1/default/Pod/fake-pod-18-8hj89": {}, + "/v1/default/Pod/fake-pod-18-8hs7h": {}, + "/v1/default/Pod/fake-pod-18-8jhtr": {}, + "/v1/default/Pod/fake-pod-18-8zg5m": {}, + "/v1/default/Pod/fake-pod-18-8zqng": {}, + "/v1/default/Pod/fake-pod-18-92fdq": {}, + "/v1/default/Pod/fake-pod-18-976hj": {}, + "/v1/default/Pod/fake-pod-18-97lrz": {}, + "/v1/default/Pod/fake-pod-18-97whz": {}, + "/v1/default/Pod/fake-pod-18-9cvmz": {}, + "/v1/default/Pod/fake-pod-18-9fhkn": {}, + "/v1/default/Pod/fake-pod-18-9hrtl": {}, + "/v1/default/Pod/fake-pod-18-9j8ds": {}, + "/v1/default/Pod/fake-pod-18-9l2x6": {}, + "/v1/default/Pod/fake-pod-18-9s7jp": {}, + "/v1/default/Pod/fake-pod-18-9vlpc": {}, + "/v1/default/Pod/fake-pod-18-9wkg8": {}, + "/v1/default/Pod/fake-pod-18-b2bd6": {}, + "/v1/default/Pod/fake-pod-18-b4cnp": {}, + "/v1/default/Pod/fake-pod-18-b4jlw": {}, + "/v1/default/Pod/fake-pod-18-b68bv": {}, + "/v1/default/Pod/fake-pod-18-b6wbt": {}, + "/v1/default/Pod/fake-pod-18-b8r5g": {}, + "/v1/default/Pod/fake-pod-18-b8w4r": {}, + "/v1/default/Pod/fake-pod-18-bbnt9": {}, + "/v1/default/Pod/fake-pod-18-bbzx8": {}, + "/v1/default/Pod/fake-pod-18-bc58p": {}, + "/v1/default/Pod/fake-pod-18-bf88x": {}, + "/v1/default/Pod/fake-pod-18-bg85c": {}, + "/v1/default/Pod/fake-pod-18-bg9r4": {}, + "/v1/default/Pod/fake-pod-18-bkc89": {}, + "/v1/default/Pod/fake-pod-18-bncr5": {}, + "/v1/default/Pod/fake-pod-18-bnqhj": {}, + "/v1/default/Pod/fake-pod-18-bpp4f": {}, + "/v1/default/Pod/fake-pod-18-bthfm": {}, + "/v1/default/Pod/fake-pod-18-bx6gt": {}, + "/v1/default/Pod/fake-pod-18-bxlm2": {}, + "/v1/default/Pod/fake-pod-18-c84q5": {}, + "/v1/default/Pod/fake-pod-18-cbc9g": {}, + "/v1/default/Pod/fake-pod-18-chnrk": {}, + "/v1/default/Pod/fake-pod-18-ckhzk": {}, + "/v1/default/Pod/fake-pod-18-cng95": {}, + "/v1/default/Pod/fake-pod-18-cq597": {}, + "/v1/default/Pod/fake-pod-18-czqkv": {}, + "/v1/default/Pod/fake-pod-18-d46k8": {}, + "/v1/default/Pod/fake-pod-18-d5rns": {}, + "/v1/default/Pod/fake-pod-18-d6b26": {}, + "/v1/default/Pod/fake-pod-18-dg57h": {}, + "/v1/default/Pod/fake-pod-18-dhc4w": {}, + "/v1/default/Pod/fake-pod-18-dhf6v": {}, + "/v1/default/Pod/fake-pod-18-dlwl6": {}, + "/v1/default/Pod/fake-pod-18-dprk7": {}, + "/v1/default/Pod/fake-pod-18-dq6sq": {}, + "/v1/default/Pod/fake-pod-18-dr64h": {}, + "/v1/default/Pod/fake-pod-18-drb2b": {}, + "/v1/default/Pod/fake-pod-18-ds8tw": {}, + "/v1/default/Pod/fake-pod-18-dzhhm": {}, + "/v1/default/Pod/fake-pod-18-f6tph": {}, + "/v1/default/Pod/fake-pod-18-fbv5m": {}, + "/v1/default/Pod/fake-pod-18-ffd6l": {}, + "/v1/default/Pod/fake-pod-18-fhr74": {}, + "/v1/default/Pod/fake-pod-18-frfz9": {}, + "/v1/default/Pod/fake-pod-18-ft8wb": {}, + "/v1/default/Pod/fake-pod-18-ftk6w": {}, + "/v1/default/Pod/fake-pod-18-fw4q8": {}, + "/v1/default/Pod/fake-pod-18-g2rd7": {}, + "/v1/default/Pod/fake-pod-18-g4gjn": {}, + "/v1/default/Pod/fake-pod-18-g5djd": {}, + "/v1/default/Pod/fake-pod-18-g6dkx": {}, + "/v1/default/Pod/fake-pod-18-g72m2": {}, + "/v1/default/Pod/fake-pod-18-g8tgj": {}, + "/v1/default/Pod/fake-pod-18-gbsml": {}, + "/v1/default/Pod/fake-pod-18-gczvf": {}, + "/v1/default/Pod/fake-pod-18-gfkzs": {}, + "/v1/default/Pod/fake-pod-18-ggk6r": {}, + "/v1/default/Pod/fake-pod-18-gl8bw": {}, + "/v1/default/Pod/fake-pod-18-gt77v": {}, + "/v1/default/Pod/fake-pod-18-gthrd": {}, + "/v1/default/Pod/fake-pod-18-h8zms": {}, + "/v1/default/Pod/fake-pod-18-hmbjk": {}, + "/v1/default/Pod/fake-pod-18-hmp5b": {}, + "/v1/default/Pod/fake-pod-18-hvp5c": {}, + "/v1/default/Pod/fake-pod-18-hwps6": {}, + "/v1/default/Pod/fake-pod-18-j6pf8": {}, + "/v1/default/Pod/fake-pod-18-j8x7k": {}, + "/v1/default/Pod/fake-pod-18-jcvpd": {}, + "/v1/default/Pod/fake-pod-18-jmtc4": {}, + "/v1/default/Pod/fake-pod-18-jntt8": {}, + "/v1/default/Pod/fake-pod-18-jnxpw": {}, + "/v1/default/Pod/fake-pod-18-jqd9f": {}, + "/v1/default/Pod/fake-pod-18-jqh9r": {}, + "/v1/default/Pod/fake-pod-18-jrsn7": {}, + "/v1/default/Pod/fake-pod-18-jvtzz": {}, + "/v1/default/Pod/fake-pod-18-k2z4r": {}, + "/v1/default/Pod/fake-pod-18-k4stq": {}, + "/v1/default/Pod/fake-pod-18-k8tdc": {}, + "/v1/default/Pod/fake-pod-18-kf769": {}, + "/v1/default/Pod/fake-pod-18-kmrrk": {}, + "/v1/default/Pod/fake-pod-18-kpxbj": {}, + "/v1/default/Pod/fake-pod-18-krf5j": {}, + "/v1/default/Pod/fake-pod-18-krz7x": {}, + "/v1/default/Pod/fake-pod-18-ks8sk": {}, + "/v1/default/Pod/fake-pod-18-ktgxd": {}, + "/v1/default/Pod/fake-pod-18-kvnp5": {}, + "/v1/default/Pod/fake-pod-18-kzsg9": {}, + "/v1/default/Pod/fake-pod-18-l6fm4": {}, + "/v1/default/Pod/fake-pod-18-l8q5v": {}, + "/v1/default/Pod/fake-pod-18-l9cpd": {}, + "/v1/default/Pod/fake-pod-18-l9gt7": {}, + "/v1/default/Pod/fake-pod-18-lg76v": {}, + "/v1/default/Pod/fake-pod-18-lrnp6": {}, + "/v1/default/Pod/fake-pod-18-lwrnx": {}, + "/v1/default/Pod/fake-pod-18-lz6cb": {}, + "/v1/default/Pod/fake-pod-18-m5vwt": {}, + "/v1/default/Pod/fake-pod-18-m5wpw": {}, + "/v1/default/Pod/fake-pod-18-m6lsv": {}, + "/v1/default/Pod/fake-pod-18-m9r72": {}, + "/v1/default/Pod/fake-pod-18-mdxvc": {}, + "/v1/default/Pod/fake-pod-18-mkbzq": {}, + "/v1/default/Pod/fake-pod-18-mmmfk": {}, + "/v1/default/Pod/fake-pod-18-mqpmr": {}, + "/v1/default/Pod/fake-pod-18-n4wxj": {}, + "/v1/default/Pod/fake-pod-18-n64c9": {}, + "/v1/default/Pod/fake-pod-18-n7f2m": {}, + "/v1/default/Pod/fake-pod-18-n9f9b": {}, + "/v1/default/Pod/fake-pod-18-n9gbc": {}, + "/v1/default/Pod/fake-pod-18-n9h8d": {}, + "/v1/default/Pod/fake-pod-18-nbfwx": {}, + "/v1/default/Pod/fake-pod-18-ndlpc": {}, + "/v1/default/Pod/fake-pod-18-nhhfg": {}, + "/v1/default/Pod/fake-pod-18-njqml": {}, + "/v1/default/Pod/fake-pod-18-nkr95": {}, + "/v1/default/Pod/fake-pod-18-nmfnl": {}, + "/v1/default/Pod/fake-pod-18-npbxb": {}, + "/v1/default/Pod/fake-pod-18-nrjk4": {}, + "/v1/default/Pod/fake-pod-18-ntssk": {}, + "/v1/default/Pod/fake-pod-18-p9nn9": {}, + "/v1/default/Pod/fake-pod-18-phqtj": {}, + "/v1/default/Pod/fake-pod-18-pkqkd": {}, + "/v1/default/Pod/fake-pod-18-pmz9f": {}, + "/v1/default/Pod/fake-pod-18-pn79h": {}, + "/v1/default/Pod/fake-pod-18-ppg57": {}, + "/v1/default/Pod/fake-pod-18-przqv": {}, + "/v1/default/Pod/fake-pod-18-pxcwl": {}, + "/v1/default/Pod/fake-pod-18-pzbkg": {}, + "/v1/default/Pod/fake-pod-18-q4hc9": {}, + "/v1/default/Pod/fake-pod-18-q62fw": {}, + "/v1/default/Pod/fake-pod-18-q6958": {}, + "/v1/default/Pod/fake-pod-18-qcn9n": {}, + "/v1/default/Pod/fake-pod-18-qgm8p": {}, + "/v1/default/Pod/fake-pod-18-qpvvg": {}, + "/v1/default/Pod/fake-pod-18-qrlfl": {}, + "/v1/default/Pod/fake-pod-18-qwlcj": {}, + "/v1/default/Pod/fake-pod-18-qxtgw": {}, + "/v1/default/Pod/fake-pod-18-qzth7": {}, + "/v1/default/Pod/fake-pod-18-r278d": {}, + "/v1/default/Pod/fake-pod-18-r7zfs": {}, + "/v1/default/Pod/fake-pod-18-r8p9x": {}, + "/v1/default/Pod/fake-pod-18-rbm5p": {}, + "/v1/default/Pod/fake-pod-18-rk6t4": {}, + "/v1/default/Pod/fake-pod-18-rmx6b": {}, + "/v1/default/Pod/fake-pod-18-rqq9s": {}, + "/v1/default/Pod/fake-pod-18-rrhnd": {}, + "/v1/default/Pod/fake-pod-18-rwl82": {}, + "/v1/default/Pod/fake-pod-18-rxrl9": {}, + "/v1/default/Pod/fake-pod-18-rzf7k": {}, + "/v1/default/Pod/fake-pod-18-s4kfd": {}, + "/v1/default/Pod/fake-pod-18-s7kpr": {}, + "/v1/default/Pod/fake-pod-18-s88pc": {}, + "/v1/default/Pod/fake-pod-18-s8qfz": {}, + "/v1/default/Pod/fake-pod-18-s9hs5": {}, + "/v1/default/Pod/fake-pod-18-s9jkx": {}, + "/v1/default/Pod/fake-pod-18-scdj4": {}, + "/v1/default/Pod/fake-pod-18-shc4h": {}, + "/v1/default/Pod/fake-pod-18-sl57d": {}, + "/v1/default/Pod/fake-pod-18-slzgp": {}, + "/v1/default/Pod/fake-pod-18-snkbn": {}, + "/v1/default/Pod/fake-pod-18-sp7ft": {}, + "/v1/default/Pod/fake-pod-18-sq8m4": {}, + "/v1/default/Pod/fake-pod-18-sqdlx": {}, + "/v1/default/Pod/fake-pod-18-sr7w7": {}, + "/v1/default/Pod/fake-pod-18-ss648": {}, + "/v1/default/Pod/fake-pod-18-stkc2": {}, + "/v1/default/Pod/fake-pod-18-t4gzn": {}, + "/v1/default/Pod/fake-pod-18-t5cn6": {}, + "/v1/default/Pod/fake-pod-18-t7zzq": {}, + "/v1/default/Pod/fake-pod-18-t9dnq": {}, + "/v1/default/Pod/fake-pod-18-tcrdd": {}, + "/v1/default/Pod/fake-pod-18-tl48l": {}, + "/v1/default/Pod/fake-pod-18-tlxps": {}, + "/v1/default/Pod/fake-pod-18-tsj85": {}, + "/v1/default/Pod/fake-pod-18-tv4vl": {}, + "/v1/default/Pod/fake-pod-18-txgqt": {}, + "/v1/default/Pod/fake-pod-18-v4bcs": {}, + "/v1/default/Pod/fake-pod-18-v57sb": {}, + "/v1/default/Pod/fake-pod-18-v8n97": {}, + "/v1/default/Pod/fake-pod-18-vc52m": {}, + "/v1/default/Pod/fake-pod-18-vfhrj": {}, + "/v1/default/Pod/fake-pod-18-vhwjk": {}, + "/v1/default/Pod/fake-pod-18-vlzxw": {}, + "/v1/default/Pod/fake-pod-18-vqn4m": {}, + "/v1/default/Pod/fake-pod-18-vqzn8": {}, + "/v1/default/Pod/fake-pod-18-vwpgx": {}, + "/v1/default/Pod/fake-pod-18-vzpk9": {}, + "/v1/default/Pod/fake-pod-18-w8qwz": {}, + "/v1/default/Pod/fake-pod-18-w9zx4": {}, + "/v1/default/Pod/fake-pod-18-wbj4n": {}, + "/v1/default/Pod/fake-pod-18-wbzcd": {}, + "/v1/default/Pod/fake-pod-18-wcxmm": {}, + "/v1/default/Pod/fake-pod-18-wt74g": {}, + "/v1/default/Pod/fake-pod-18-wthdv": {}, + "/v1/default/Pod/fake-pod-18-wxk47": {}, + "/v1/default/Pod/fake-pod-18-wzg8d": {}, + "/v1/default/Pod/fake-pod-18-wzjkv": {}, + "/v1/default/Pod/fake-pod-18-wztvg": {}, + "/v1/default/Pod/fake-pod-18-wzwwc": {}, + "/v1/default/Pod/fake-pod-18-x52jf": {}, + "/v1/default/Pod/fake-pod-18-x5fl2": {}, + "/v1/default/Pod/fake-pod-18-xb9rv": {}, + "/v1/default/Pod/fake-pod-18-xbv72": {}, + "/v1/default/Pod/fake-pod-18-xf48l": {}, + "/v1/default/Pod/fake-pod-18-xf75g": {}, + "/v1/default/Pod/fake-pod-18-xfvjf": {}, + "/v1/default/Pod/fake-pod-18-xlxtb": {}, + "/v1/default/Pod/fake-pod-18-xpr77": {}, + "/v1/default/Pod/fake-pod-18-xrtbl": {}, + "/v1/default/Pod/fake-pod-18-xwlph": {}, + "/v1/default/Pod/fake-pod-18-z2rtk": {}, + "/v1/default/Pod/fake-pod-18-z6kx7": {}, + "/v1/default/Pod/fake-pod-18-z7dvd": {}, + "/v1/default/Pod/fake-pod-18-z8hz5": {}, + "/v1/default/Pod/fake-pod-18-z944d": {}, + "/v1/default/Pod/fake-pod-18-zb6f9": {}, + "/v1/default/Pod/fake-pod-18-zg8ff": {}, + "/v1/default/Pod/fake-pod-18-zjx78": {}, + "/v1/default/Pod/fake-pod-18-zkbfd": {}, + "/v1/default/Pod/fake-pod-18-znzbr": {}, + "/v1/default/Pod/fake-pod-18-zpkm4": {}, + "/v1/default/Pod/fake-pod-18-zqdhq": {}, + "/v1/default/Pod/fake-pod-18-zwxb4": {}, + "/v1/default/Pod/fake-pod-19-22h9d": {}, + "/v1/default/Pod/fake-pod-19-22vsq": {}, + "/v1/default/Pod/fake-pod-19-26fw9": {}, + "/v1/default/Pod/fake-pod-19-26kkt": {}, + "/v1/default/Pod/fake-pod-19-28zmh": {}, + "/v1/default/Pod/fake-pod-19-2jz58": {}, + "/v1/default/Pod/fake-pod-19-2lrls": {}, + "/v1/default/Pod/fake-pod-19-2plk7": {}, + "/v1/default/Pod/fake-pod-19-2w8t4": {}, + "/v1/default/Pod/fake-pod-19-2w9qp": {}, + "/v1/default/Pod/fake-pod-19-2wjbx": {}, + "/v1/default/Pod/fake-pod-19-2xmk6": {}, + "/v1/default/Pod/fake-pod-19-45v4r": {}, + "/v1/default/Pod/fake-pod-19-47ppj": {}, + "/v1/default/Pod/fake-pod-19-4bls5": {}, + "/v1/default/Pod/fake-pod-19-4f9bd": {}, + "/v1/default/Pod/fake-pod-19-4fcc7": {}, + "/v1/default/Pod/fake-pod-19-4npcr": {}, + "/v1/default/Pod/fake-pod-19-4qb7c": {}, + "/v1/default/Pod/fake-pod-19-4w4nv": {}, + "/v1/default/Pod/fake-pod-19-4x76v": {}, + "/v1/default/Pod/fake-pod-19-4xr4g": {}, + "/v1/default/Pod/fake-pod-19-52sc7": {}, + "/v1/default/Pod/fake-pod-19-5bmvc": {}, + "/v1/default/Pod/fake-pod-19-5lc8q": {}, + "/v1/default/Pod/fake-pod-19-5m7nd": {}, + "/v1/default/Pod/fake-pod-19-5n5qj": {}, + "/v1/default/Pod/fake-pod-19-5rqxz": {}, + "/v1/default/Pod/fake-pod-19-5xnrw": {}, + "/v1/default/Pod/fake-pod-19-69vlk": {}, + "/v1/default/Pod/fake-pod-19-6djbq": {}, + "/v1/default/Pod/fake-pod-19-6n5xd": {}, + "/v1/default/Pod/fake-pod-19-6nzks": {}, + "/v1/default/Pod/fake-pod-19-6vwfv": {}, + "/v1/default/Pod/fake-pod-19-6wqjt": {}, + "/v1/default/Pod/fake-pod-19-6zwns": {}, + "/v1/default/Pod/fake-pod-19-6zzwn": {}, + "/v1/default/Pod/fake-pod-19-72mpt": {}, + "/v1/default/Pod/fake-pod-19-7798k": {}, + "/v1/default/Pod/fake-pod-19-78n7z": {}, + "/v1/default/Pod/fake-pod-19-78xxh": {}, + "/v1/default/Pod/fake-pod-19-7bf9k": {}, + "/v1/default/Pod/fake-pod-19-7d4wn": {}, + "/v1/default/Pod/fake-pod-19-7dgk4": {}, + "/v1/default/Pod/fake-pod-19-7dvxs": {}, + "/v1/default/Pod/fake-pod-19-7ggmk": {}, + "/v1/default/Pod/fake-pod-19-7mz8h": {}, + "/v1/default/Pod/fake-pod-19-7nwx5": {}, + "/v1/default/Pod/fake-pod-19-7p4k4": {}, + "/v1/default/Pod/fake-pod-19-7rc2n": {}, + "/v1/default/Pod/fake-pod-19-84k42": {}, + "/v1/default/Pod/fake-pod-19-86hnx": {}, + "/v1/default/Pod/fake-pod-19-88gvd": {}, + "/v1/default/Pod/fake-pod-19-899pw": {}, + "/v1/default/Pod/fake-pod-19-8b25c": {}, + "/v1/default/Pod/fake-pod-19-8b5pm": {}, + "/v1/default/Pod/fake-pod-19-8cv7d": {}, + "/v1/default/Pod/fake-pod-19-8d7ws": {}, + "/v1/default/Pod/fake-pod-19-8ftrn": {}, + "/v1/default/Pod/fake-pod-19-8kglf": {}, + "/v1/default/Pod/fake-pod-19-8rtjf": {}, + "/v1/default/Pod/fake-pod-19-8szhl": {}, + "/v1/default/Pod/fake-pod-19-8v64q": {}, + "/v1/default/Pod/fake-pod-19-8zflq": {}, + "/v1/default/Pod/fake-pod-19-9649l": {}, + "/v1/default/Pod/fake-pod-19-977qx": {}, + "/v1/default/Pod/fake-pod-19-995d4": {}, + "/v1/default/Pod/fake-pod-19-9ck2s": {}, + "/v1/default/Pod/fake-pod-19-9gm2l": {}, + "/v1/default/Pod/fake-pod-19-9h5mc": {}, + "/v1/default/Pod/fake-pod-19-9mvk2": {}, + "/v1/default/Pod/fake-pod-19-9pvwb": {}, + "/v1/default/Pod/fake-pod-19-9r566": {}, + "/v1/default/Pod/fake-pod-19-9sfl2": {}, + "/v1/default/Pod/fake-pod-19-9xqqt": {}, + "/v1/default/Pod/fake-pod-19-b6dtp": {}, + "/v1/default/Pod/fake-pod-19-b6gnf": {}, + "/v1/default/Pod/fake-pod-19-bbgnv": {}, + "/v1/default/Pod/fake-pod-19-bmpkp": {}, + "/v1/default/Pod/fake-pod-19-bq4kz": {}, + "/v1/default/Pod/fake-pod-19-bs8f4": {}, + "/v1/default/Pod/fake-pod-19-bsvmg": {}, + "/v1/default/Pod/fake-pod-19-bwg58": {}, + "/v1/default/Pod/fake-pod-19-c4zp4": {}, + "/v1/default/Pod/fake-pod-19-c5wzv": {}, + "/v1/default/Pod/fake-pod-19-chdkc": {}, + "/v1/default/Pod/fake-pod-19-cj4bz": {}, + "/v1/default/Pod/fake-pod-19-cjlzx": {}, + "/v1/default/Pod/fake-pod-19-cn5tl": {}, + "/v1/default/Pod/fake-pod-19-csxct": {}, + "/v1/default/Pod/fake-pod-19-d4x2x": {}, + "/v1/default/Pod/fake-pod-19-d796j": {}, + "/v1/default/Pod/fake-pod-19-d8v8p": {}, + "/v1/default/Pod/fake-pod-19-d9bp4": {}, + "/v1/default/Pod/fake-pod-19-dd4jp": {}, + "/v1/default/Pod/fake-pod-19-dfdb5": {}, + "/v1/default/Pod/fake-pod-19-dfkjv": {}, + "/v1/default/Pod/fake-pod-19-dgcnj": {}, + "/v1/default/Pod/fake-pod-19-dgkpt": {}, + "/v1/default/Pod/fake-pod-19-dhj6v": {}, + "/v1/default/Pod/fake-pod-19-djmn8": {}, + "/v1/default/Pod/fake-pod-19-dkbpd": {}, + "/v1/default/Pod/fake-pod-19-dl4mb": {}, + "/v1/default/Pod/fake-pod-19-dp6ns": {}, + "/v1/default/Pod/fake-pod-19-dzc4z": {}, + "/v1/default/Pod/fake-pod-19-f4rgj": {}, + "/v1/default/Pod/fake-pod-19-f5b2p": {}, + "/v1/default/Pod/fake-pod-19-f64b2": {}, + "/v1/default/Pod/fake-pod-19-f72df": {}, + "/v1/default/Pod/fake-pod-19-f7jdk": {}, + "/v1/default/Pod/fake-pod-19-f95hk": {}, + "/v1/default/Pod/fake-pod-19-fcgzg": {}, + "/v1/default/Pod/fake-pod-19-ffz46": {}, + "/v1/default/Pod/fake-pod-19-fhcmn": {}, + "/v1/default/Pod/fake-pod-19-fhhwz": {}, + "/v1/default/Pod/fake-pod-19-fhzzj": {}, + "/v1/default/Pod/fake-pod-19-g4h2n": {}, + "/v1/default/Pod/fake-pod-19-gbxbb": {}, + "/v1/default/Pod/fake-pod-19-ghr2d": {}, + "/v1/default/Pod/fake-pod-19-gjv29": {}, + "/v1/default/Pod/fake-pod-19-gjx6l": {}, + "/v1/default/Pod/fake-pod-19-gplcx": {}, + "/v1/default/Pod/fake-pod-19-gzs54": {}, + "/v1/default/Pod/fake-pod-19-h5dpp": {}, + "/v1/default/Pod/fake-pod-19-h8fk6": {}, + "/v1/default/Pod/fake-pod-19-h9drn": {}, + "/v1/default/Pod/fake-pod-19-hb454": {}, + "/v1/default/Pod/fake-pod-19-hcshg": {}, + "/v1/default/Pod/fake-pod-19-hf8t8": {}, + "/v1/default/Pod/fake-pod-19-hgs44": {}, + "/v1/default/Pod/fake-pod-19-hkxrn": {}, + "/v1/default/Pod/fake-pod-19-hptl6": {}, + "/v1/default/Pod/fake-pod-19-hq4qk": {}, + "/v1/default/Pod/fake-pod-19-hvv8c": {}, + "/v1/default/Pod/fake-pod-19-hzt5k": {}, + "/v1/default/Pod/fake-pod-19-jdkp2": {}, + "/v1/default/Pod/fake-pod-19-jdr4v": {}, + "/v1/default/Pod/fake-pod-19-jl7js": {}, + "/v1/default/Pod/fake-pod-19-jnnb4": {}, + "/v1/default/Pod/fake-pod-19-jq5dm": {}, + "/v1/default/Pod/fake-pod-19-jtrpr": {}, + "/v1/default/Pod/fake-pod-19-jvlc4": {}, + "/v1/default/Pod/fake-pod-19-jz4jv": {}, + "/v1/default/Pod/fake-pod-19-jzxr6": {}, + "/v1/default/Pod/fake-pod-19-k7h68": {}, + "/v1/default/Pod/fake-pod-19-k9tqc": {}, + "/v1/default/Pod/fake-pod-19-kbp6j": {}, + "/v1/default/Pod/fake-pod-19-kfgnj": {}, + "/v1/default/Pod/fake-pod-19-kfh7x": {}, + "/v1/default/Pod/fake-pod-19-khsvw": {}, + "/v1/default/Pod/fake-pod-19-kjg57": {}, + "/v1/default/Pod/fake-pod-19-kjss4": {}, + "/v1/default/Pod/fake-pod-19-kkx7w": {}, + "/v1/default/Pod/fake-pod-19-kqzfg": {}, + "/v1/default/Pod/fake-pod-19-ks48s": {}, + "/v1/default/Pod/fake-pod-19-kvjxq": {}, + "/v1/default/Pod/fake-pod-19-kxqs2": {}, + "/v1/default/Pod/fake-pod-19-kz2h6": {}, + "/v1/default/Pod/fake-pod-19-l26rv": {}, + "/v1/default/Pod/fake-pod-19-l9cvw": {}, + "/v1/default/Pod/fake-pod-19-lbjht": {}, + "/v1/default/Pod/fake-pod-19-ldf7t": {}, + "/v1/default/Pod/fake-pod-19-ldjnq": {}, + "/v1/default/Pod/fake-pod-19-lh72p": {}, + "/v1/default/Pod/fake-pod-19-lkrnt": {}, + "/v1/default/Pod/fake-pod-19-lkw4b": {}, + "/v1/default/Pod/fake-pod-19-lms6m": {}, + "/v1/default/Pod/fake-pod-19-lp48b": {}, + "/v1/default/Pod/fake-pod-19-lvrsg": {}, + "/v1/default/Pod/fake-pod-19-lw6f5": {}, + "/v1/default/Pod/fake-pod-19-lwqck": {}, + "/v1/default/Pod/fake-pod-19-lzjd4": {}, + "/v1/default/Pod/fake-pod-19-m2dh6": {}, + "/v1/default/Pod/fake-pod-19-m6rkm": {}, + "/v1/default/Pod/fake-pod-19-m7zdj": {}, + "/v1/default/Pod/fake-pod-19-mc7zm": {}, + "/v1/default/Pod/fake-pod-19-mccf6": {}, + "/v1/default/Pod/fake-pod-19-mm2l7": {}, + "/v1/default/Pod/fake-pod-19-mzzdd": {}, + "/v1/default/Pod/fake-pod-19-n2mxs": {}, + "/v1/default/Pod/fake-pod-19-n56mg": {}, + "/v1/default/Pod/fake-pod-19-nf5p5": {}, + "/v1/default/Pod/fake-pod-19-njp9x": {}, + "/v1/default/Pod/fake-pod-19-nk8tz": {}, + "/v1/default/Pod/fake-pod-19-nl4jj": {}, + "/v1/default/Pod/fake-pod-19-ntdcd": {}, + "/v1/default/Pod/fake-pod-19-nvmbv": {}, + "/v1/default/Pod/fake-pod-19-nwrd7": {}, + "/v1/default/Pod/fake-pod-19-nzv9w": {}, + "/v1/default/Pod/fake-pod-19-nzwzs": {}, + "/v1/default/Pod/fake-pod-19-p25bf": {}, + "/v1/default/Pod/fake-pod-19-p6b88": {}, + "/v1/default/Pod/fake-pod-19-pcnsb": {}, + "/v1/default/Pod/fake-pod-19-pfppg": {}, + "/v1/default/Pod/fake-pod-19-pjklg": {}, + "/v1/default/Pod/fake-pod-19-pjm4n": {}, + "/v1/default/Pod/fake-pod-19-pnc6p": {}, + "/v1/default/Pod/fake-pod-19-psqx6": {}, + "/v1/default/Pod/fake-pod-19-q2lgd": {}, + "/v1/default/Pod/fake-pod-19-q5l6v": {}, + "/v1/default/Pod/fake-pod-19-q7j7k": {}, + "/v1/default/Pod/fake-pod-19-qb2sm": {}, + "/v1/default/Pod/fake-pod-19-qhs8x": {}, + "/v1/default/Pod/fake-pod-19-qjs4l": {}, + "/v1/default/Pod/fake-pod-19-qmqjq": {}, + "/v1/default/Pod/fake-pod-19-qmslm": {}, + "/v1/default/Pod/fake-pod-19-qnv2c": {}, + "/v1/default/Pod/fake-pod-19-qqfz7": {}, + "/v1/default/Pod/fake-pod-19-qsrt2": {}, + "/v1/default/Pod/fake-pod-19-qt47n": {}, + "/v1/default/Pod/fake-pod-19-qt9fz": {}, + "/v1/default/Pod/fake-pod-19-qw5fr": {}, + "/v1/default/Pod/fake-pod-19-qzt5n": {}, + "/v1/default/Pod/fake-pod-19-r2hqr": {}, + "/v1/default/Pod/fake-pod-19-r4l6p": {}, + "/v1/default/Pod/fake-pod-19-r4lnc": {}, + "/v1/default/Pod/fake-pod-19-r8btq": {}, + "/v1/default/Pod/fake-pod-19-rcjrw": {}, + "/v1/default/Pod/fake-pod-19-rj42l": {}, + "/v1/default/Pod/fake-pod-19-rm44j": {}, + "/v1/default/Pod/fake-pod-19-rmb4t": {}, + "/v1/default/Pod/fake-pod-19-rmdsh": {}, + "/v1/default/Pod/fake-pod-19-rqr4g": {}, + "/v1/default/Pod/fake-pod-19-rw9v2": {}, + "/v1/default/Pod/fake-pod-19-rxnrj": {}, + "/v1/default/Pod/fake-pod-19-s27f4": {}, + "/v1/default/Pod/fake-pod-19-s2ktx": {}, + "/v1/default/Pod/fake-pod-19-s4p9f": {}, + "/v1/default/Pod/fake-pod-19-s4wtd": {}, + "/v1/default/Pod/fake-pod-19-s6b92": {}, + "/v1/default/Pod/fake-pod-19-s89nz": {}, + "/v1/default/Pod/fake-pod-19-s8wv7": {}, + "/v1/default/Pod/fake-pod-19-scqz6": {}, + "/v1/default/Pod/fake-pod-19-sdngx": {}, + "/v1/default/Pod/fake-pod-19-sdvx9": {}, + "/v1/default/Pod/fake-pod-19-sf9hf": {}, + "/v1/default/Pod/fake-pod-19-sfk5j": {}, + "/v1/default/Pod/fake-pod-19-sgl65": {}, + "/v1/default/Pod/fake-pod-19-sn8db": {}, + "/v1/default/Pod/fake-pod-19-stc4s": {}, + "/v1/default/Pod/fake-pod-19-stfrg": {}, + "/v1/default/Pod/fake-pod-19-swhgq": {}, + "/v1/default/Pod/fake-pod-19-szkc8": {}, + "/v1/default/Pod/fake-pod-19-t28gv": {}, + "/v1/default/Pod/fake-pod-19-t4l24": {}, + "/v1/default/Pod/fake-pod-19-t6mdk": {}, + "/v1/default/Pod/fake-pod-19-t7rbk": {}, + "/v1/default/Pod/fake-pod-19-td2mj": {}, + "/v1/default/Pod/fake-pod-19-tdtg9": {}, + "/v1/default/Pod/fake-pod-19-th2cq": {}, + "/v1/default/Pod/fake-pod-19-tk9xz": {}, + "/v1/default/Pod/fake-pod-19-tnzlv": {}, + "/v1/default/Pod/fake-pod-19-twtrv": {}, + "/v1/default/Pod/fake-pod-19-txs6k": {}, + "/v1/default/Pod/fake-pod-19-v2vdp": {}, + "/v1/default/Pod/fake-pod-19-vcl5f": {}, + "/v1/default/Pod/fake-pod-19-vgct2": {}, + "/v1/default/Pod/fake-pod-19-vlmjd": {}, + "/v1/default/Pod/fake-pod-19-vpv79": {}, + "/v1/default/Pod/fake-pod-19-vrnzs": {}, + "/v1/default/Pod/fake-pod-19-vsfk7": {}, + "/v1/default/Pod/fake-pod-19-w9fxv": {}, + "/v1/default/Pod/fake-pod-19-w9ztr": {}, + "/v1/default/Pod/fake-pod-19-wbfct": {}, + "/v1/default/Pod/fake-pod-19-wc2f7": {}, + "/v1/default/Pod/fake-pod-19-wcdkq": {}, + "/v1/default/Pod/fake-pod-19-wjmzs": {}, + "/v1/default/Pod/fake-pod-19-wmr7b": {}, + "/v1/default/Pod/fake-pod-19-wmrnm": {}, + "/v1/default/Pod/fake-pod-19-wsl5m": {}, + "/v1/default/Pod/fake-pod-19-wsr8h": {}, + "/v1/default/Pod/fake-pod-19-wwlpk": {}, + "/v1/default/Pod/fake-pod-19-wxfml": {}, + "/v1/default/Pod/fake-pod-19-x5z8g": {}, + "/v1/default/Pod/fake-pod-19-x6r5h": {}, + "/v1/default/Pod/fake-pod-19-x7n9z": {}, + "/v1/default/Pod/fake-pod-19-x9zxp": {}, + "/v1/default/Pod/fake-pod-19-xbvtb": {}, + "/v1/default/Pod/fake-pod-19-xhcdb": {}, + "/v1/default/Pod/fake-pod-19-xnhjx": {}, + "/v1/default/Pod/fake-pod-19-xpt97": {}, + "/v1/default/Pod/fake-pod-19-xwg8l": {}, + "/v1/default/Pod/fake-pod-19-z4wbt": {}, + "/v1/default/Pod/fake-pod-19-z5nb4": {}, + "/v1/default/Pod/fake-pod-19-z68kb": {}, + "/v1/default/Pod/fake-pod-19-z68mj": {}, + "/v1/default/Pod/fake-pod-19-z69lz": {}, + "/v1/default/Pod/fake-pod-19-zfxqt": {}, + "/v1/default/Pod/fake-pod-19-zgftw": {}, + "/v1/default/Pod/fake-pod-19-zhgbw": {}, + "/v1/default/Pod/fake-pod-19-zhphx": {}, + "/v1/default/Pod/fake-pod-19-zhvdq": {}, + "/v1/default/Pod/fake-pod-19-znd59": {}, + "/v1/default/Pod/fake-pod-19-zpkwd": {}, + "/v1/default/Pod/fake-pod-19-zv8mf": {}, + "/v1/default/Pod/fake-pod-19-zv9rf": {}, + "/v1/default/Pod/fake-pod-19-zwsmw": {}, + "/v1/default/Pod/fake-pod-19-zzlbq": {}, + "/v1/default/Pod/fake-pod-19-zzmpm": {}, + "/v1/default/Pod/fake-pod-2-22j7n": {}, + "/v1/default/Pod/fake-pod-2-255nq": {}, + "/v1/default/Pod/fake-pod-2-272nh": {}, + "/v1/default/Pod/fake-pod-2-27hvq": {}, + "/v1/default/Pod/fake-pod-2-27jbz": {}, + "/v1/default/Pod/fake-pod-2-27szs": {}, + "/v1/default/Pod/fake-pod-2-29hz4": {}, + "/v1/default/Pod/fake-pod-2-2bhpc": {}, + "/v1/default/Pod/fake-pod-2-2nws6": {}, + "/v1/default/Pod/fake-pod-2-2qn9h": {}, + "/v1/default/Pod/fake-pod-2-2s89c": {}, + "/v1/default/Pod/fake-pod-2-2tc42": {}, + "/v1/default/Pod/fake-pod-2-2vhzx": {}, + "/v1/default/Pod/fake-pod-2-2vt7p": {}, + "/v1/default/Pod/fake-pod-2-44ch7": {}, + "/v1/default/Pod/fake-pod-2-47nql": {}, + "/v1/default/Pod/fake-pod-2-497bc": {}, + "/v1/default/Pod/fake-pod-2-49r56": {}, + "/v1/default/Pod/fake-pod-2-4jqnq": {}, + "/v1/default/Pod/fake-pod-2-4jrkj": {}, + "/v1/default/Pod/fake-pod-2-4mb7v": {}, + "/v1/default/Pod/fake-pod-2-4n6b4": {}, + "/v1/default/Pod/fake-pod-2-4pr9v": {}, + "/v1/default/Pod/fake-pod-2-4ps6f": {}, + "/v1/default/Pod/fake-pod-2-4rk5q": {}, + "/v1/default/Pod/fake-pod-2-4sgxr": {}, + "/v1/default/Pod/fake-pod-2-4vhnn": {}, + "/v1/default/Pod/fake-pod-2-4vmkv": {}, + "/v1/default/Pod/fake-pod-2-4wldj": {}, + "/v1/default/Pod/fake-pod-2-54q59": {}, + "/v1/default/Pod/fake-pod-2-58lm6": {}, + "/v1/default/Pod/fake-pod-2-5fw9t": {}, + "/v1/default/Pod/fake-pod-2-5jwlv": {}, + "/v1/default/Pod/fake-pod-2-5l929": {}, + "/v1/default/Pod/fake-pod-2-5qmwb": {}, + "/v1/default/Pod/fake-pod-2-5w8jr": {}, + "/v1/default/Pod/fake-pod-2-5wspr": {}, + "/v1/default/Pod/fake-pod-2-626z6": {}, + "/v1/default/Pod/fake-pod-2-646mq": {}, + "/v1/default/Pod/fake-pod-2-67777": {}, + "/v1/default/Pod/fake-pod-2-68mjr": {}, + "/v1/default/Pod/fake-pod-2-6c5fn": {}, + "/v1/default/Pod/fake-pod-2-6crpb": {}, + "/v1/default/Pod/fake-pod-2-6dltz": {}, + "/v1/default/Pod/fake-pod-2-6nj2b": {}, + "/v1/default/Pod/fake-pod-2-6p67x": {}, + "/v1/default/Pod/fake-pod-2-6sng2": {}, + "/v1/default/Pod/fake-pod-2-6v6tw": {}, + "/v1/default/Pod/fake-pod-2-6vr4g": {}, + "/v1/default/Pod/fake-pod-2-74cv8": {}, + "/v1/default/Pod/fake-pod-2-776lk": {}, + "/v1/default/Pod/fake-pod-2-7ck7d": {}, + "/v1/default/Pod/fake-pod-2-7ct9x": {}, + "/v1/default/Pod/fake-pod-2-7gcgj": {}, + "/v1/default/Pod/fake-pod-2-7gvm6": {}, + "/v1/default/Pod/fake-pod-2-7hww2": {}, + "/v1/default/Pod/fake-pod-2-7k6ll": {}, + "/v1/default/Pod/fake-pod-2-7mglf": {}, + "/v1/default/Pod/fake-pod-2-7n6np": {}, + "/v1/default/Pod/fake-pod-2-7pfbq": {}, + "/v1/default/Pod/fake-pod-2-7qk99": {}, + "/v1/default/Pod/fake-pod-2-7znzf": {}, + "/v1/default/Pod/fake-pod-2-8bwvr": {}, + "/v1/default/Pod/fake-pod-2-8fld6": {}, + "/v1/default/Pod/fake-pod-2-8fwmq": {}, + "/v1/default/Pod/fake-pod-2-8gb6w": {}, + "/v1/default/Pod/fake-pod-2-8k2vs": {}, + "/v1/default/Pod/fake-pod-2-8k5pr": {}, + "/v1/default/Pod/fake-pod-2-8r4kl": {}, + "/v1/default/Pod/fake-pod-2-94drh": {}, + "/v1/default/Pod/fake-pod-2-96dll": {}, + "/v1/default/Pod/fake-pod-2-98c28": {}, + "/v1/default/Pod/fake-pod-2-9c9m2": {}, + "/v1/default/Pod/fake-pod-2-9f69l": {}, + "/v1/default/Pod/fake-pod-2-9kwm4": {}, + "/v1/default/Pod/fake-pod-2-9mjt8": {}, + "/v1/default/Pod/fake-pod-2-9qfn9": {}, + "/v1/default/Pod/fake-pod-2-9rcxj": {}, + "/v1/default/Pod/fake-pod-2-b2hvq": {}, + "/v1/default/Pod/fake-pod-2-b5s88": {}, + "/v1/default/Pod/fake-pod-2-b6j6r": {}, + "/v1/default/Pod/fake-pod-2-b8x8l": {}, + "/v1/default/Pod/fake-pod-2-bdzpl": {}, + "/v1/default/Pod/fake-pod-2-bg9pc": {}, + "/v1/default/Pod/fake-pod-2-blrbf": {}, + "/v1/default/Pod/fake-pod-2-bpzd9": {}, + "/v1/default/Pod/fake-pod-2-brv9f": {}, + "/v1/default/Pod/fake-pod-2-brxrh": {}, + "/v1/default/Pod/fake-pod-2-bzgcc": {}, + "/v1/default/Pod/fake-pod-2-c7g6s": {}, + "/v1/default/Pod/fake-pod-2-c7kfs": {}, + "/v1/default/Pod/fake-pod-2-ckw88": {}, + "/v1/default/Pod/fake-pod-2-cltkr": {}, + "/v1/default/Pod/fake-pod-2-cmh4s": {}, + "/v1/default/Pod/fake-pod-2-cpgcz": {}, + "/v1/default/Pod/fake-pod-2-cpvbj": {}, + "/v1/default/Pod/fake-pod-2-crhhn": {}, + "/v1/default/Pod/fake-pod-2-cxvx6": {}, + "/v1/default/Pod/fake-pod-2-cz6vj": {}, + "/v1/default/Pod/fake-pod-2-d27tt": {}, + "/v1/default/Pod/fake-pod-2-d6dhm": {}, + "/v1/default/Pod/fake-pod-2-d7bfx": {}, + "/v1/default/Pod/fake-pod-2-d84cc": {}, + "/v1/default/Pod/fake-pod-2-ddnvq": {}, + "/v1/default/Pod/fake-pod-2-dg45c": {}, + "/v1/default/Pod/fake-pod-2-dh69z": {}, + "/v1/default/Pod/fake-pod-2-dkbpx": {}, + "/v1/default/Pod/fake-pod-2-dprs8": {}, + "/v1/default/Pod/fake-pod-2-dwjlj": {}, + "/v1/default/Pod/fake-pod-2-f5ftk": {}, + "/v1/default/Pod/fake-pod-2-f5qx4": {}, + "/v1/default/Pod/fake-pod-2-f7dvl": {}, + "/v1/default/Pod/fake-pod-2-f8dlp": {}, + "/v1/default/Pod/fake-pod-2-fbdkf": {}, + "/v1/default/Pod/fake-pod-2-fjqsm": {}, + "/v1/default/Pod/fake-pod-2-flms4": {}, + "/v1/default/Pod/fake-pod-2-ftbst": {}, + "/v1/default/Pod/fake-pod-2-g5j6h": {}, + "/v1/default/Pod/fake-pod-2-g5spc": {}, + "/v1/default/Pod/fake-pod-2-g6fvj": {}, + "/v1/default/Pod/fake-pod-2-gjx4l": {}, + "/v1/default/Pod/fake-pod-2-glvb2": {}, + "/v1/default/Pod/fake-pod-2-gpgks": {}, + "/v1/default/Pod/fake-pod-2-gpq2p": {}, + "/v1/default/Pod/fake-pod-2-gs5x9": {}, + "/v1/default/Pod/fake-pod-2-gxpnt": {}, + "/v1/default/Pod/fake-pod-2-h2llq": {}, + "/v1/default/Pod/fake-pod-2-h6l9v": {}, + "/v1/default/Pod/fake-pod-2-hbpvh": {}, + "/v1/default/Pod/fake-pod-2-hflzt": {}, + "/v1/default/Pod/fake-pod-2-hfxgs": {}, + "/v1/default/Pod/fake-pod-2-hhck6": {}, + "/v1/default/Pod/fake-pod-2-hkll2": {}, + "/v1/default/Pod/fake-pod-2-hp87k": {}, + "/v1/default/Pod/fake-pod-2-hpfcs": {}, + "/v1/default/Pod/fake-pod-2-hqrfx": {}, + "/v1/default/Pod/fake-pod-2-hs4ng": {}, + "/v1/default/Pod/fake-pod-2-hwb8r": {}, + "/v1/default/Pod/fake-pod-2-hxf5s": {}, + "/v1/default/Pod/fake-pod-2-j4v49": {}, + "/v1/default/Pod/fake-pod-2-j862d": {}, + "/v1/default/Pod/fake-pod-2-j8vzn": {}, + "/v1/default/Pod/fake-pod-2-j97kw": {}, + "/v1/default/Pod/fake-pod-2-j9dh7": {}, + "/v1/default/Pod/fake-pod-2-jbspw": {}, + "/v1/default/Pod/fake-pod-2-jh4fb": {}, + "/v1/default/Pod/fake-pod-2-jj66c": {}, + "/v1/default/Pod/fake-pod-2-jlbb2": {}, + "/v1/default/Pod/fake-pod-2-jx2m5": {}, + "/v1/default/Pod/fake-pod-2-k68vf": {}, + "/v1/default/Pod/fake-pod-2-k6cvt": {}, + "/v1/default/Pod/fake-pod-2-kbvlk": {}, + "/v1/default/Pod/fake-pod-2-kcl9z": {}, + "/v1/default/Pod/fake-pod-2-kcw5k": {}, + "/v1/default/Pod/fake-pod-2-kf8cl": {}, + "/v1/default/Pod/fake-pod-2-kgbtl": {}, + "/v1/default/Pod/fake-pod-2-kjknk": {}, + "/v1/default/Pod/fake-pod-2-kkv8r": {}, + "/v1/default/Pod/fake-pod-2-kpn8p": {}, + "/v1/default/Pod/fake-pod-2-kqzpd": {}, + "/v1/default/Pod/fake-pod-2-ktbv4": {}, + "/v1/default/Pod/fake-pod-2-kws2h": {}, + "/v1/default/Pod/fake-pod-2-l4tcl": {}, + "/v1/default/Pod/fake-pod-2-l554q": {}, + "/v1/default/Pod/fake-pod-2-l85hb": {}, + "/v1/default/Pod/fake-pod-2-lbb8p": {}, + "/v1/default/Pod/fake-pod-2-lcpwv": {}, + "/v1/default/Pod/fake-pod-2-lklxp": {}, + "/v1/default/Pod/fake-pod-2-lnms4": {}, + "/v1/default/Pod/fake-pod-2-lqg7v": {}, + "/v1/default/Pod/fake-pod-2-lvdlc": {}, + "/v1/default/Pod/fake-pod-2-lwgt6": {}, + "/v1/default/Pod/fake-pod-2-lwj8d": {}, + "/v1/default/Pod/fake-pod-2-lztgt": {}, + "/v1/default/Pod/fake-pod-2-m44zq": {}, + "/v1/default/Pod/fake-pod-2-m4s68": {}, + "/v1/default/Pod/fake-pod-2-m5hdj": {}, + "/v1/default/Pod/fake-pod-2-m79kl": {}, + "/v1/default/Pod/fake-pod-2-md2kw": {}, + "/v1/default/Pod/fake-pod-2-mh5zf": {}, + "/v1/default/Pod/fake-pod-2-mmgtw": {}, + "/v1/default/Pod/fake-pod-2-mmk9t": {}, + "/v1/default/Pod/fake-pod-2-mnnff": {}, + "/v1/default/Pod/fake-pod-2-mr42k": {}, + "/v1/default/Pod/fake-pod-2-msmr2": {}, + "/v1/default/Pod/fake-pod-2-mstjt": {}, + "/v1/default/Pod/fake-pod-2-n8cft": {}, + "/v1/default/Pod/fake-pod-2-n92cm": {}, + "/v1/default/Pod/fake-pod-2-nbdrz": {}, + "/v1/default/Pod/fake-pod-2-nfkzz": {}, + "/v1/default/Pod/fake-pod-2-nfp2c": {}, + "/v1/default/Pod/fake-pod-2-ngjjn": {}, + "/v1/default/Pod/fake-pod-2-nhf65": {}, + "/v1/default/Pod/fake-pod-2-nncxj": {}, + "/v1/default/Pod/fake-pod-2-nwqw7": {}, + "/v1/default/Pod/fake-pod-2-nxvp6": {}, + "/v1/default/Pod/fake-pod-2-p8qql": {}, + "/v1/default/Pod/fake-pod-2-pchc2": {}, + "/v1/default/Pod/fake-pod-2-pffcf": {}, + "/v1/default/Pod/fake-pod-2-plbwd": {}, + "/v1/default/Pod/fake-pod-2-pngct": {}, + "/v1/default/Pod/fake-pod-2-pt2m5": {}, + "/v1/default/Pod/fake-pod-2-px5jb": {}, + "/v1/default/Pod/fake-pod-2-pxp9t": {}, + "/v1/default/Pod/fake-pod-2-q2hz6": {}, + "/v1/default/Pod/fake-pod-2-q7s8l": {}, + "/v1/default/Pod/fake-pod-2-q897v": {}, + "/v1/default/Pod/fake-pod-2-q8b84": {}, + "/v1/default/Pod/fake-pod-2-qfhh6": {}, + "/v1/default/Pod/fake-pod-2-qgvzg": {}, + "/v1/default/Pod/fake-pod-2-qhbp4": {}, + "/v1/default/Pod/fake-pod-2-qht42": {}, + "/v1/default/Pod/fake-pod-2-qmkz8": {}, + "/v1/default/Pod/fake-pod-2-qpm4d": {}, + "/v1/default/Pod/fake-pod-2-qrcn6": {}, + "/v1/default/Pod/fake-pod-2-qvmkh": {}, + "/v1/default/Pod/fake-pod-2-qzt66": {}, + "/v1/default/Pod/fake-pod-2-r2n8z": {}, + "/v1/default/Pod/fake-pod-2-r4wfj": {}, + "/v1/default/Pod/fake-pod-2-r7fvk": {}, + "/v1/default/Pod/fake-pod-2-rbfm2": {}, + "/v1/default/Pod/fake-pod-2-rcqk5": {}, + "/v1/default/Pod/fake-pod-2-rdtqp": {}, + "/v1/default/Pod/fake-pod-2-rfmr8": {}, + "/v1/default/Pod/fake-pod-2-rhgm7": {}, + "/v1/default/Pod/fake-pod-2-rlm4c": {}, + "/v1/default/Pod/fake-pod-2-rnkg8": {}, + "/v1/default/Pod/fake-pod-2-rrtkt": {}, + "/v1/default/Pod/fake-pod-2-rsg6f": {}, + "/v1/default/Pod/fake-pod-2-rsznl": {}, + "/v1/default/Pod/fake-pod-2-rxncj": {}, + "/v1/default/Pod/fake-pod-2-rzbv8": {}, + "/v1/default/Pod/fake-pod-2-s4mcw": {}, + "/v1/default/Pod/fake-pod-2-s5lsl": {}, + "/v1/default/Pod/fake-pod-2-s5s69": {}, + "/v1/default/Pod/fake-pod-2-s74mf": {}, + "/v1/default/Pod/fake-pod-2-sdgcl": {}, + "/v1/default/Pod/fake-pod-2-sfbx9": {}, + "/v1/default/Pod/fake-pod-2-sftqj": {}, + "/v1/default/Pod/fake-pod-2-sjqgr": {}, + "/v1/default/Pod/fake-pod-2-sjtts": {}, + "/v1/default/Pod/fake-pod-2-sqhrn": {}, + "/v1/default/Pod/fake-pod-2-sqq54": {}, + "/v1/default/Pod/fake-pod-2-swff9": {}, + "/v1/default/Pod/fake-pod-2-t2g6f": {}, + "/v1/default/Pod/fake-pod-2-t4774": {}, + "/v1/default/Pod/fake-pod-2-tbksj": {}, + "/v1/default/Pod/fake-pod-2-th259": {}, + "/v1/default/Pod/fake-pod-2-th6dn": {}, + "/v1/default/Pod/fake-pod-2-tj5fb": {}, + "/v1/default/Pod/fake-pod-2-tkp92": {}, + "/v1/default/Pod/fake-pod-2-tl5t7": {}, + "/v1/default/Pod/fake-pod-2-ttsfq": {}, + "/v1/default/Pod/fake-pod-2-ttxbw": {}, + "/v1/default/Pod/fake-pod-2-tv25c": {}, + "/v1/default/Pod/fake-pod-2-tvgw8": {}, + "/v1/default/Pod/fake-pod-2-tvzlt": {}, + "/v1/default/Pod/fake-pod-2-v2h4x": {}, + "/v1/default/Pod/fake-pod-2-v2srz": {}, + "/v1/default/Pod/fake-pod-2-v4wqt": {}, + "/v1/default/Pod/fake-pod-2-v5mnw": {}, + "/v1/default/Pod/fake-pod-2-v8ms6": {}, + "/v1/default/Pod/fake-pod-2-v9rpb": {}, + "/v1/default/Pod/fake-pod-2-vdp9r": {}, + "/v1/default/Pod/fake-pod-2-vfz8b": {}, + "/v1/default/Pod/fake-pod-2-vhnqv": {}, + "/v1/default/Pod/fake-pod-2-vw2vz": {}, + "/v1/default/Pod/fake-pod-2-vwjqv": {}, + "/v1/default/Pod/fake-pod-2-vwxpw": {}, + "/v1/default/Pod/fake-pod-2-w5gtp": {}, + "/v1/default/Pod/fake-pod-2-w96j7": {}, + "/v1/default/Pod/fake-pod-2-wfh45": {}, + "/v1/default/Pod/fake-pod-2-wjd2f": {}, + "/v1/default/Pod/fake-pod-2-wz62s": {}, + "/v1/default/Pod/fake-pod-2-x4wnr": {}, + "/v1/default/Pod/fake-pod-2-x5qkp": {}, + "/v1/default/Pod/fake-pod-2-x6fjz": {}, + "/v1/default/Pod/fake-pod-2-x6rmm": {}, + "/v1/default/Pod/fake-pod-2-x8ltg": {}, + "/v1/default/Pod/fake-pod-2-x96gw": {}, + "/v1/default/Pod/fake-pod-2-xf6ft": {}, + "/v1/default/Pod/fake-pod-2-xfz4t": {}, + "/v1/default/Pod/fake-pod-2-xh7s7": {}, + "/v1/default/Pod/fake-pod-2-xj5hn": {}, + "/v1/default/Pod/fake-pod-2-xl7p5": {}, + "/v1/default/Pod/fake-pod-2-xnlrt": {}, + "/v1/default/Pod/fake-pod-2-xtpjz": {}, + "/v1/default/Pod/fake-pod-2-xwkk9": {}, + "/v1/default/Pod/fake-pod-2-z2t9k": {}, + "/v1/default/Pod/fake-pod-2-z799c": {}, + "/v1/default/Pod/fake-pod-2-z9j7v": {}, + "/v1/default/Pod/fake-pod-2-zbx6d": {}, + "/v1/default/Pod/fake-pod-2-zcdjp": {}, + "/v1/default/Pod/fake-pod-2-zgv2v": {}, + "/v1/default/Pod/fake-pod-2-zhvvb": {}, + "/v1/default/Pod/fake-pod-2-zkfwc": {}, + "/v1/default/Pod/fake-pod-2-zndfz": {}, + "/v1/default/Pod/fake-pod-2-znjwv": {}, + "/v1/default/Pod/fake-pod-2-zvlxb": {}, + "/v1/default/Pod/fake-pod-20-2dxrf": {}, + "/v1/default/Pod/fake-pod-20-2hz25": {}, + "/v1/default/Pod/fake-pod-20-2nzzn": {}, + "/v1/default/Pod/fake-pod-20-2x875": {}, + "/v1/default/Pod/fake-pod-20-2xkks": {}, + "/v1/default/Pod/fake-pod-20-46dc5": {}, + "/v1/default/Pod/fake-pod-20-47n7v": {}, + "/v1/default/Pod/fake-pod-20-47q4q": {}, + "/v1/default/Pod/fake-pod-20-4dpfp": {}, + "/v1/default/Pod/fake-pod-20-4fkvz": {}, + "/v1/default/Pod/fake-pod-20-4gkbj": {}, + "/v1/default/Pod/fake-pod-20-4gqkn": {}, + "/v1/default/Pod/fake-pod-20-4kv2r": {}, + "/v1/default/Pod/fake-pod-20-4lzx5": {}, + "/v1/default/Pod/fake-pod-20-4stcw": {}, + "/v1/default/Pod/fake-pod-20-4svpw": {}, + "/v1/default/Pod/fake-pod-20-4v76f": {}, + "/v1/default/Pod/fake-pod-20-4vxpv": {}, + "/v1/default/Pod/fake-pod-20-4x7bx": {}, + "/v1/default/Pod/fake-pod-20-4xvl4": {}, + "/v1/default/Pod/fake-pod-20-557h5": {}, + "/v1/default/Pod/fake-pod-20-56bcm": {}, + "/v1/default/Pod/fake-pod-20-58wvt": {}, + "/v1/default/Pod/fake-pod-20-5cvdt": {}, + "/v1/default/Pod/fake-pod-20-5dj4c": {}, + "/v1/default/Pod/fake-pod-20-5ftct": {}, + "/v1/default/Pod/fake-pod-20-5j2gj": {}, + "/v1/default/Pod/fake-pod-20-5jqtg": {}, + "/v1/default/Pod/fake-pod-20-5lxw9": {}, + "/v1/default/Pod/fake-pod-20-5qsg8": {}, + "/v1/default/Pod/fake-pod-20-5rrml": {}, + "/v1/default/Pod/fake-pod-20-5v5gf": {}, + "/v1/default/Pod/fake-pod-20-5xkw9": {}, + "/v1/default/Pod/fake-pod-20-62fn7": {}, + "/v1/default/Pod/fake-pod-20-68spx": {}, + "/v1/default/Pod/fake-pod-20-6cspw": {}, + "/v1/default/Pod/fake-pod-20-6dqgg": {}, + "/v1/default/Pod/fake-pod-20-6gsjw": {}, + "/v1/default/Pod/fake-pod-20-6h5hl": {}, + "/v1/default/Pod/fake-pod-20-6kr57": {}, + "/v1/default/Pod/fake-pod-20-6nskl": {}, + "/v1/default/Pod/fake-pod-20-6rnbs": {}, + "/v1/default/Pod/fake-pod-20-6s29f": {}, + "/v1/default/Pod/fake-pod-20-6tnqw": {}, + "/v1/default/Pod/fake-pod-20-6wz76": {}, + "/v1/default/Pod/fake-pod-20-6z6lv": {}, + "/v1/default/Pod/fake-pod-20-6zx2c": {}, + "/v1/default/Pod/fake-pod-20-77cfk": {}, + "/v1/default/Pod/fake-pod-20-78gbr": {}, + "/v1/default/Pod/fake-pod-20-7hkwz": {}, + "/v1/default/Pod/fake-pod-20-7l8xp": {}, + "/v1/default/Pod/fake-pod-20-7nzjw": {}, + "/v1/default/Pod/fake-pod-20-7sf2b": {}, + "/v1/default/Pod/fake-pod-20-7ts8z": {}, + "/v1/default/Pod/fake-pod-20-7wn24": {}, + "/v1/default/Pod/fake-pod-20-7x78j": {}, + "/v1/default/Pod/fake-pod-20-8kx62": {}, + "/v1/default/Pod/fake-pod-20-8ljxt": {}, + "/v1/default/Pod/fake-pod-20-8lkzd": {}, + "/v1/default/Pod/fake-pod-20-8m72l": {}, + "/v1/default/Pod/fake-pod-20-8mmnv": {}, + "/v1/default/Pod/fake-pod-20-8qkqf": {}, + "/v1/default/Pod/fake-pod-20-8tbtj": {}, + "/v1/default/Pod/fake-pod-20-8tll7": {}, + "/v1/default/Pod/fake-pod-20-8vz8r": {}, + "/v1/default/Pod/fake-pod-20-962sn": {}, + "/v1/default/Pod/fake-pod-20-9865k": {}, + "/v1/default/Pod/fake-pod-20-98zf7": {}, + "/v1/default/Pod/fake-pod-20-9g4wd": {}, + "/v1/default/Pod/fake-pod-20-9lx9j": {}, + "/v1/default/Pod/fake-pod-20-9nxsd": {}, + "/v1/default/Pod/fake-pod-20-9qvwm": {}, + "/v1/default/Pod/fake-pod-20-9s2zk": {}, + "/v1/default/Pod/fake-pod-20-9zr5m": {}, + "/v1/default/Pod/fake-pod-20-b6s8f": {}, + "/v1/default/Pod/fake-pod-20-bdwws": {}, + "/v1/default/Pod/fake-pod-20-blc2r": {}, + "/v1/default/Pod/fake-pod-20-bmcnm": {}, + "/v1/default/Pod/fake-pod-20-bmnkt": {}, + "/v1/default/Pod/fake-pod-20-bmphl": {}, + "/v1/default/Pod/fake-pod-20-bn99l": {}, + "/v1/default/Pod/fake-pod-20-bqq2v": {}, + "/v1/default/Pod/fake-pod-20-btt7k": {}, + "/v1/default/Pod/fake-pod-20-bz5mq": {}, + "/v1/default/Pod/fake-pod-20-c22p8": {}, + "/v1/default/Pod/fake-pod-20-c5hfr": {}, + "/v1/default/Pod/fake-pod-20-cfkdr": {}, + "/v1/default/Pod/fake-pod-20-cm6t6": {}, + "/v1/default/Pod/fake-pod-20-cnnbt": {}, + "/v1/default/Pod/fake-pod-20-cp28n": {}, + "/v1/default/Pod/fake-pod-20-cpk58": {}, + "/v1/default/Pod/fake-pod-20-crg4z": {}, + "/v1/default/Pod/fake-pod-20-ctvrf": {}, + "/v1/default/Pod/fake-pod-20-d4mj7": {}, + "/v1/default/Pod/fake-pod-20-d54xx": {}, + "/v1/default/Pod/fake-pod-20-d5vgw": {}, + "/v1/default/Pod/fake-pod-20-d72bs": {}, + "/v1/default/Pod/fake-pod-20-d7ljk": {}, + "/v1/default/Pod/fake-pod-20-dcgtt": {}, + "/v1/default/Pod/fake-pod-20-ddv2v": {}, + "/v1/default/Pod/fake-pod-20-dhhh7": {}, + "/v1/default/Pod/fake-pod-20-dlz92": {}, + "/v1/default/Pod/fake-pod-20-dm4p9": {}, + "/v1/default/Pod/fake-pod-20-drf9v": {}, + "/v1/default/Pod/fake-pod-20-dv5jp": {}, + "/v1/default/Pod/fake-pod-20-f4h57": {}, + "/v1/default/Pod/fake-pod-20-f8qbt": {}, + "/v1/default/Pod/fake-pod-20-fbgzw": {}, + "/v1/default/Pod/fake-pod-20-fbhpr": {}, + "/v1/default/Pod/fake-pod-20-fdq98": {}, + "/v1/default/Pod/fake-pod-20-fhm97": {}, + "/v1/default/Pod/fake-pod-20-fjb8s": {}, + "/v1/default/Pod/fake-pod-20-fjqw6": {}, + "/v1/default/Pod/fake-pod-20-fpld8": {}, + "/v1/default/Pod/fake-pod-20-ft22f": {}, + "/v1/default/Pod/fake-pod-20-g4gj2": {}, + "/v1/default/Pod/fake-pod-20-g4ktj": {}, + "/v1/default/Pod/fake-pod-20-g5ljv": {}, + "/v1/default/Pod/fake-pod-20-g77gn": {}, + "/v1/default/Pod/fake-pod-20-gbfhn": {}, + "/v1/default/Pod/fake-pod-20-gfw7t": {}, + "/v1/default/Pod/fake-pod-20-glt55": {}, + "/v1/default/Pod/fake-pod-20-gnbqn": {}, + "/v1/default/Pod/fake-pod-20-gtzbk": {}, + "/v1/default/Pod/fake-pod-20-gvmkj": {}, + "/v1/default/Pod/fake-pod-20-gx6br": {}, + "/v1/default/Pod/fake-pod-20-h2f8s": {}, + "/v1/default/Pod/fake-pod-20-h2kpk": {}, + "/v1/default/Pod/fake-pod-20-h49bw": {}, + "/v1/default/Pod/fake-pod-20-h4hh5": {}, + "/v1/default/Pod/fake-pod-20-h7hwk": {}, + "/v1/default/Pod/fake-pod-20-h8rcl": {}, + "/v1/default/Pod/fake-pod-20-hj9nd": {}, + "/v1/default/Pod/fake-pod-20-hkf7c": {}, + "/v1/default/Pod/fake-pod-20-hkkt9": {}, + "/v1/default/Pod/fake-pod-20-hnccg": {}, + "/v1/default/Pod/fake-pod-20-hrdmn": {}, + "/v1/default/Pod/fake-pod-20-hvshd": {}, + "/v1/default/Pod/fake-pod-20-hwbst": {}, + "/v1/default/Pod/fake-pod-20-hwr8p": {}, + "/v1/default/Pod/fake-pod-20-j4t2q": {}, + "/v1/default/Pod/fake-pod-20-jd9x8": {}, + "/v1/default/Pod/fake-pod-20-jdsn9": {}, + "/v1/default/Pod/fake-pod-20-jfqsm": {}, + "/v1/default/Pod/fake-pod-20-jrtbx": {}, + "/v1/default/Pod/fake-pod-20-k5t9m": {}, + "/v1/default/Pod/fake-pod-20-k9vrm": {}, + "/v1/default/Pod/fake-pod-20-kf9cv": {}, + "/v1/default/Pod/fake-pod-20-kfmtn": {}, + "/v1/default/Pod/fake-pod-20-kgfps": {}, + "/v1/default/Pod/fake-pod-20-kgvks": {}, + "/v1/default/Pod/fake-pod-20-kkmxd": {}, + "/v1/default/Pod/fake-pod-20-kmhzh": {}, + "/v1/default/Pod/fake-pod-20-kqqpq": {}, + "/v1/default/Pod/fake-pod-20-kswqt": {}, + "/v1/default/Pod/fake-pod-20-kxjsg": {}, + "/v1/default/Pod/fake-pod-20-kxjw5": {}, + "/v1/default/Pod/fake-pod-20-kzr6f": {}, + "/v1/default/Pod/fake-pod-20-l275c": {}, + "/v1/default/Pod/fake-pod-20-l4qj8": {}, + "/v1/default/Pod/fake-pod-20-l5l56": {}, + "/v1/default/Pod/fake-pod-20-l5lc7": {}, + "/v1/default/Pod/fake-pod-20-l74sp": {}, + "/v1/default/Pod/fake-pod-20-lmn4x": {}, + "/v1/default/Pod/fake-pod-20-lzbpr": {}, + "/v1/default/Pod/fake-pod-20-m5zkj": {}, + "/v1/default/Pod/fake-pod-20-m79ld": {}, + "/v1/default/Pod/fake-pod-20-mb544": {}, + "/v1/default/Pod/fake-pod-20-mcb5l": {}, + "/v1/default/Pod/fake-pod-20-mctlr": {}, + "/v1/default/Pod/fake-pod-20-mcz6g": {}, + "/v1/default/Pod/fake-pod-20-mdp9j": {}, + "/v1/default/Pod/fake-pod-20-mfc82": {}, + "/v1/default/Pod/fake-pod-20-mhf59": {}, + "/v1/default/Pod/fake-pod-20-mk6pn": {}, + "/v1/default/Pod/fake-pod-20-mvqjz": {}, + "/v1/default/Pod/fake-pod-20-mxrkx": {}, + "/v1/default/Pod/fake-pod-20-nbgdk": {}, + "/v1/default/Pod/fake-pod-20-nc4gz": {}, + "/v1/default/Pod/fake-pod-20-ndjd8": {}, + "/v1/default/Pod/fake-pod-20-ndshw": {}, + "/v1/default/Pod/fake-pod-20-nfs5s": {}, + "/v1/default/Pod/fake-pod-20-ngjxz": {}, + "/v1/default/Pod/fake-pod-20-nl57l": {}, + "/v1/default/Pod/fake-pod-20-nm9p6": {}, + "/v1/default/Pod/fake-pod-20-npp58": {}, + "/v1/default/Pod/fake-pod-20-npt9w": {}, + "/v1/default/Pod/fake-pod-20-nq7ff": {}, + "/v1/default/Pod/fake-pod-20-nq9zm": {}, + "/v1/default/Pod/fake-pod-20-nr2tm": {}, + "/v1/default/Pod/fake-pod-20-ns7b2": {}, + "/v1/default/Pod/fake-pod-20-nw6q4": {}, + "/v1/default/Pod/fake-pod-20-nzb59": {}, + "/v1/default/Pod/fake-pod-20-p7lgl": {}, + "/v1/default/Pod/fake-pod-20-p8vhj": {}, + "/v1/default/Pod/fake-pod-20-pc684": {}, + "/v1/default/Pod/fake-pod-20-pddhw": {}, + "/v1/default/Pod/fake-pod-20-pdnfk": {}, + "/v1/default/Pod/fake-pod-20-pgrsw": {}, + "/v1/default/Pod/fake-pod-20-pjtbm": {}, + "/v1/default/Pod/fake-pod-20-pl7mr": {}, + "/v1/default/Pod/fake-pod-20-pnr2l": {}, + "/v1/default/Pod/fake-pod-20-pqgts": {}, + "/v1/default/Pod/fake-pod-20-q82q5": {}, + "/v1/default/Pod/fake-pod-20-q86j2": {}, + "/v1/default/Pod/fake-pod-20-q8mjw": {}, + "/v1/default/Pod/fake-pod-20-q9c47": {}, + "/v1/default/Pod/fake-pod-20-qb4bl": {}, + "/v1/default/Pod/fake-pod-20-qhqp6": {}, + "/v1/default/Pod/fake-pod-20-qkgdj": {}, + "/v1/default/Pod/fake-pod-20-qln59": {}, + "/v1/default/Pod/fake-pod-20-qmd2v": {}, + "/v1/default/Pod/fake-pod-20-qn4jz": {}, + "/v1/default/Pod/fake-pod-20-qxjs5": {}, + "/v1/default/Pod/fake-pod-20-qzhzp": {}, + "/v1/default/Pod/fake-pod-20-r2ktv": {}, + "/v1/default/Pod/fake-pod-20-r2x6m": {}, + "/v1/default/Pod/fake-pod-20-r5qln": {}, + "/v1/default/Pod/fake-pod-20-r5rww": {}, + "/v1/default/Pod/fake-pod-20-rgmrv": {}, + "/v1/default/Pod/fake-pod-20-rjt2g": {}, + "/v1/default/Pod/fake-pod-20-rpltj": {}, + "/v1/default/Pod/fake-pod-20-rqwwz": {}, + "/v1/default/Pod/fake-pod-20-rv4vb": {}, + "/v1/default/Pod/fake-pod-20-rxsnv": {}, + "/v1/default/Pod/fake-pod-20-rznjt": {}, + "/v1/default/Pod/fake-pod-20-s6jhv": {}, + "/v1/default/Pod/fake-pod-20-s72pz": {}, + "/v1/default/Pod/fake-pod-20-scjr2": {}, + "/v1/default/Pod/fake-pod-20-sf6xl": {}, + "/v1/default/Pod/fake-pod-20-sg4hd": {}, + "/v1/default/Pod/fake-pod-20-sgvvx": {}, + "/v1/default/Pod/fake-pod-20-sllld": {}, + "/v1/default/Pod/fake-pod-20-slvz9": {}, + "/v1/default/Pod/fake-pod-20-spgsh": {}, + "/v1/default/Pod/fake-pod-20-sqhjs": {}, + "/v1/default/Pod/fake-pod-20-sqr8q": {}, + "/v1/default/Pod/fake-pod-20-srk8m": {}, + "/v1/default/Pod/fake-pod-20-srs7l": {}, + "/v1/default/Pod/fake-pod-20-swrp2": {}, + "/v1/default/Pod/fake-pod-20-t2bgs": {}, + "/v1/default/Pod/fake-pod-20-t2lk6": {}, + "/v1/default/Pod/fake-pod-20-t6t2c": {}, + "/v1/default/Pod/fake-pod-20-t6v7j": {}, + "/v1/default/Pod/fake-pod-20-t9kzr": {}, + "/v1/default/Pod/fake-pod-20-tc29c": {}, + "/v1/default/Pod/fake-pod-20-tgp2z": {}, + "/v1/default/Pod/fake-pod-20-tjf8v": {}, + "/v1/default/Pod/fake-pod-20-tjj2p": {}, + "/v1/default/Pod/fake-pod-20-tkfr8": {}, + "/v1/default/Pod/fake-pod-20-tmzkz": {}, + "/v1/default/Pod/fake-pod-20-tn6qf": {}, + "/v1/default/Pod/fake-pod-20-tx6r7": {}, + "/v1/default/Pod/fake-pod-20-v75vj": {}, + "/v1/default/Pod/fake-pod-20-v7ln4": {}, + "/v1/default/Pod/fake-pod-20-v7vmz": {}, + "/v1/default/Pod/fake-pod-20-v8jjj": {}, + "/v1/default/Pod/fake-pod-20-v9m7r": {}, + "/v1/default/Pod/fake-pod-20-v9mbz": {}, + "/v1/default/Pod/fake-pod-20-vc58r": {}, + "/v1/default/Pod/fake-pod-20-vdclp": {}, + "/v1/default/Pod/fake-pod-20-vfz9f": {}, + "/v1/default/Pod/fake-pod-20-vkt66": {}, + "/v1/default/Pod/fake-pod-20-vlwsp": {}, + "/v1/default/Pod/fake-pod-20-vqd6l": {}, + "/v1/default/Pod/fake-pod-20-vqrd5": {}, + "/v1/default/Pod/fake-pod-20-vrzpz": {}, + "/v1/default/Pod/fake-pod-20-vv4b5": {}, + "/v1/default/Pod/fake-pod-20-vvbdr": {}, + "/v1/default/Pod/fake-pod-20-vw28p": {}, + "/v1/default/Pod/fake-pod-20-w4j2h": {}, + "/v1/default/Pod/fake-pod-20-wkft8": {}, + "/v1/default/Pod/fake-pod-20-wqg2q": {}, + "/v1/default/Pod/fake-pod-20-wsk2s": {}, + "/v1/default/Pod/fake-pod-20-wtmn8": {}, + "/v1/default/Pod/fake-pod-20-wvp67": {}, + "/v1/default/Pod/fake-pod-20-wz7m7": {}, + "/v1/default/Pod/fake-pod-20-x6pnf": {}, + "/v1/default/Pod/fake-pod-20-xc5lp": {}, + "/v1/default/Pod/fake-pod-20-xg46z": {}, + "/v1/default/Pod/fake-pod-20-xgb8k": {}, + "/v1/default/Pod/fake-pod-20-xmnml": {}, + "/v1/default/Pod/fake-pod-20-xskpj": {}, + "/v1/default/Pod/fake-pod-20-xv2wb": {}, + "/v1/default/Pod/fake-pod-20-z2k8p": {}, + "/v1/default/Pod/fake-pod-20-z8xxm": {}, + "/v1/default/Pod/fake-pod-20-zccsv": {}, + "/v1/default/Pod/fake-pod-20-zfthm": {}, + "/v1/default/Pod/fake-pod-20-zmphg": {}, + "/v1/default/Pod/fake-pod-20-znfp9": {}, + "/v1/default/Pod/fake-pod-20-znzhn": {}, + "/v1/default/Pod/fake-pod-20-zpwcb": {}, + "/v1/default/Pod/fake-pod-20-zr2v4": {}, + "/v1/default/Pod/fake-pod-20-zr6lv": {}, + "/v1/default/Pod/fake-pod-20-zr8s2": {}, + "/v1/default/Pod/fake-pod-20-zvs76": {}, + "/v1/default/Pod/fake-pod-20-zw8fz": {}, + "/v1/default/Pod/fake-pod-20-zx8v4": {}, + "/v1/default/Pod/fake-pod-20-zxtxg": {}, + "/v1/default/Pod/fake-pod-21-24wcm": {}, + "/v1/default/Pod/fake-pod-21-26qpr": {}, + "/v1/default/Pod/fake-pod-21-27f9w": {}, + "/v1/default/Pod/fake-pod-21-2b2sp": {}, + "/v1/default/Pod/fake-pod-21-2dzbl": {}, + "/v1/default/Pod/fake-pod-21-2f4kr": {}, + "/v1/default/Pod/fake-pod-21-2fsj9": {}, + "/v1/default/Pod/fake-pod-21-2kgtn": {}, + "/v1/default/Pod/fake-pod-21-2n6v5": {}, + "/v1/default/Pod/fake-pod-21-2nsfz": {}, + "/v1/default/Pod/fake-pod-21-2pm9z": {}, + "/v1/default/Pod/fake-pod-21-2r5tz": {}, + "/v1/default/Pod/fake-pod-21-2s2f5": {}, + "/v1/default/Pod/fake-pod-21-2txrj": {}, + "/v1/default/Pod/fake-pod-21-2xcjb": {}, + "/v1/default/Pod/fake-pod-21-2xfnt": {}, + "/v1/default/Pod/fake-pod-21-2zj7z": {}, + "/v1/default/Pod/fake-pod-21-428zg": {}, + "/v1/default/Pod/fake-pod-21-42d52": {}, + "/v1/default/Pod/fake-pod-21-46l9f": {}, + "/v1/default/Pod/fake-pod-21-46xq9": {}, + "/v1/default/Pod/fake-pod-21-48t4t": {}, + "/v1/default/Pod/fake-pod-21-4fm7w": {}, + "/v1/default/Pod/fake-pod-21-4h4d9": {}, + "/v1/default/Pod/fake-pod-21-4l2lk": {}, + "/v1/default/Pod/fake-pod-21-4lpzv": {}, + "/v1/default/Pod/fake-pod-21-4mcfb": {}, + "/v1/default/Pod/fake-pod-21-4pp67": {}, + "/v1/default/Pod/fake-pod-21-4qlks": {}, + "/v1/default/Pod/fake-pod-21-4vgc7": {}, + "/v1/default/Pod/fake-pod-21-4wxmf": {}, + "/v1/default/Pod/fake-pod-21-599bv": {}, + "/v1/default/Pod/fake-pod-21-5h28p": {}, + "/v1/default/Pod/fake-pod-21-5l755": {}, + "/v1/default/Pod/fake-pod-21-5sxjt": {}, + "/v1/default/Pod/fake-pod-21-5v27m": {}, + "/v1/default/Pod/fake-pod-21-69w2x": {}, + "/v1/default/Pod/fake-pod-21-6bbtw": {}, + "/v1/default/Pod/fake-pod-21-6bkkk": {}, + "/v1/default/Pod/fake-pod-21-6cqpb": {}, + "/v1/default/Pod/fake-pod-21-6dk5w": {}, + "/v1/default/Pod/fake-pod-21-6hsq8": {}, + "/v1/default/Pod/fake-pod-21-6jnm4": {}, + "/v1/default/Pod/fake-pod-21-6k5ml": {}, + "/v1/default/Pod/fake-pod-21-6rr2c": {}, + "/v1/default/Pod/fake-pod-21-6swxv": {}, + "/v1/default/Pod/fake-pod-21-6znxh": {}, + "/v1/default/Pod/fake-pod-21-75z9n": {}, + "/v1/default/Pod/fake-pod-21-7c4hk": {}, + "/v1/default/Pod/fake-pod-21-7c7wx": {}, + "/v1/default/Pod/fake-pod-21-7k9v8": {}, + "/v1/default/Pod/fake-pod-21-7nqkj": {}, + "/v1/default/Pod/fake-pod-21-7p4kx": {}, + "/v1/default/Pod/fake-pod-21-822ln": {}, + "/v1/default/Pod/fake-pod-21-84f8n": {}, + "/v1/default/Pod/fake-pod-21-8954b": {}, + "/v1/default/Pod/fake-pod-21-8c5lr": {}, + "/v1/default/Pod/fake-pod-21-8hgwx": {}, + "/v1/default/Pod/fake-pod-21-8kh5v": {}, + "/v1/default/Pod/fake-pod-21-8nkhd": {}, + "/v1/default/Pod/fake-pod-21-8pmf5": {}, + "/v1/default/Pod/fake-pod-21-8v2n4": {}, + "/v1/default/Pod/fake-pod-21-8vpzm": {}, + "/v1/default/Pod/fake-pod-21-974nc": {}, + "/v1/default/Pod/fake-pod-21-9bdxp": {}, + "/v1/default/Pod/fake-pod-21-9dlg9": {}, + "/v1/default/Pod/fake-pod-21-9dmvz": {}, + "/v1/default/Pod/fake-pod-21-9dz8v": {}, + "/v1/default/Pod/fake-pod-21-9f2fq": {}, + "/v1/default/Pod/fake-pod-21-9gtkx": {}, + "/v1/default/Pod/fake-pod-21-9hvsz": {}, + "/v1/default/Pod/fake-pod-21-9jg5t": {}, + "/v1/default/Pod/fake-pod-21-9kfbj": {}, + "/v1/default/Pod/fake-pod-21-9npkd": {}, + "/v1/default/Pod/fake-pod-21-9pjbr": {}, + "/v1/default/Pod/fake-pod-21-9tg25": {}, + "/v1/default/Pod/fake-pod-21-b2987": {}, + "/v1/default/Pod/fake-pod-21-b5bg4": {}, + "/v1/default/Pod/fake-pod-21-b8tln": {}, + "/v1/default/Pod/fake-pod-21-bj7xp": {}, + "/v1/default/Pod/fake-pod-21-bl2jb": {}, + "/v1/default/Pod/fake-pod-21-blqcd": {}, + "/v1/default/Pod/fake-pod-21-bmj9f": {}, + "/v1/default/Pod/fake-pod-21-bmn7p": {}, + "/v1/default/Pod/fake-pod-21-bncl8": {}, + "/v1/default/Pod/fake-pod-21-bp6k5": {}, + "/v1/default/Pod/fake-pod-21-bqpm8": {}, + "/v1/default/Pod/fake-pod-21-br292": {}, + "/v1/default/Pod/fake-pod-21-brbq7": {}, + "/v1/default/Pod/fake-pod-21-brjcb": {}, + "/v1/default/Pod/fake-pod-21-btb6p": {}, + "/v1/default/Pod/fake-pod-21-bxp9f": {}, + "/v1/default/Pod/fake-pod-21-bxqv9": {}, + "/v1/default/Pod/fake-pod-21-c2nbw": {}, + "/v1/default/Pod/fake-pod-21-c5x4c": {}, + "/v1/default/Pod/fake-pod-21-c77vw": {}, + "/v1/default/Pod/fake-pod-21-c8t2k": {}, + "/v1/default/Pod/fake-pod-21-cc474": {}, + "/v1/default/Pod/fake-pod-21-cc6tp": {}, + "/v1/default/Pod/fake-pod-21-cgpzc": {}, + "/v1/default/Pod/fake-pod-21-ckq8j": {}, + "/v1/default/Pod/fake-pod-21-cmv5h": {}, + "/v1/default/Pod/fake-pod-21-cskgx": {}, + "/v1/default/Pod/fake-pod-21-ct7g8": {}, + "/v1/default/Pod/fake-pod-21-cvf49": {}, + "/v1/default/Pod/fake-pod-21-cxpfn": {}, + "/v1/default/Pod/fake-pod-21-d25j7": {}, + "/v1/default/Pod/fake-pod-21-d59vm": {}, + "/v1/default/Pod/fake-pod-21-d5sx9": {}, + "/v1/default/Pod/fake-pod-21-dd2rw": {}, + "/v1/default/Pod/fake-pod-21-dhsdr": {}, + "/v1/default/Pod/fake-pod-21-dkv96": {}, + "/v1/default/Pod/fake-pod-21-dmrww": {}, + "/v1/default/Pod/fake-pod-21-dqgxg": {}, + "/v1/default/Pod/fake-pod-21-dqvjl": {}, + "/v1/default/Pod/fake-pod-21-dqxsq": {}, + "/v1/default/Pod/fake-pod-21-dscq8": {}, + "/v1/default/Pod/fake-pod-21-dztht": {}, + "/v1/default/Pod/fake-pod-21-f8c4c": {}, + "/v1/default/Pod/fake-pod-21-f8x8d": {}, + "/v1/default/Pod/fake-pod-21-f99mh": {}, + "/v1/default/Pod/fake-pod-21-fbf2z": {}, + "/v1/default/Pod/fake-pod-21-ff52s": {}, + "/v1/default/Pod/fake-pod-21-ff8tf": {}, + "/v1/default/Pod/fake-pod-21-ffxs7": {}, + "/v1/default/Pod/fake-pod-21-fj55z": {}, + "/v1/default/Pod/fake-pod-21-fm6hv": {}, + "/v1/default/Pod/fake-pod-21-fmt5k": {}, + "/v1/default/Pod/fake-pod-21-fnczw": {}, + "/v1/default/Pod/fake-pod-21-fnjms": {}, + "/v1/default/Pod/fake-pod-21-fshk6": {}, + "/v1/default/Pod/fake-pod-21-fx75l": {}, + "/v1/default/Pod/fake-pod-21-fzk6l": {}, + "/v1/default/Pod/fake-pod-21-g2q79": {}, + "/v1/default/Pod/fake-pod-21-g7lxv": {}, + "/v1/default/Pod/fake-pod-21-g9mc6": {}, + "/v1/default/Pod/fake-pod-21-g9sn8": {}, + "/v1/default/Pod/fake-pod-21-gbb77": {}, + "/v1/default/Pod/fake-pod-21-gc6ww": {}, + "/v1/default/Pod/fake-pod-21-gd5j6": {}, + "/v1/default/Pod/fake-pod-21-gd8zr": {}, + "/v1/default/Pod/fake-pod-21-gds86": {}, + "/v1/default/Pod/fake-pod-21-gdsp8": {}, + "/v1/default/Pod/fake-pod-21-gk54g": {}, + "/v1/default/Pod/fake-pod-21-gltmz": {}, + "/v1/default/Pod/fake-pod-21-gm48b": {}, + "/v1/default/Pod/fake-pod-21-gm9km": {}, + "/v1/default/Pod/fake-pod-21-gqghc": {}, + "/v1/default/Pod/fake-pod-21-gwnv8": {}, + "/v1/default/Pod/fake-pod-21-h5n4l": {}, + "/v1/default/Pod/fake-pod-21-h5szp": {}, + "/v1/default/Pod/fake-pod-21-h72f6": {}, + "/v1/default/Pod/fake-pod-21-hdg92": {}, + "/v1/default/Pod/fake-pod-21-hfwms": {}, + "/v1/default/Pod/fake-pod-21-hhlg7": {}, + "/v1/default/Pod/fake-pod-21-hk4m8": {}, + "/v1/default/Pod/fake-pod-21-hwfnq": {}, + "/v1/default/Pod/fake-pod-21-j569h": {}, + "/v1/default/Pod/fake-pod-21-j72v6": {}, + "/v1/default/Pod/fake-pod-21-jb5rq": {}, + "/v1/default/Pod/fake-pod-21-jmftt": {}, + "/v1/default/Pod/fake-pod-21-jp52x": {}, + "/v1/default/Pod/fake-pod-21-jvtvl": {}, + "/v1/default/Pod/fake-pod-21-jwnvr": {}, + "/v1/default/Pod/fake-pod-21-jwz5s": {}, + "/v1/default/Pod/fake-pod-21-k9k7x": {}, + "/v1/default/Pod/fake-pod-21-kb4lc": {}, + "/v1/default/Pod/fake-pod-21-kd7rs": {}, + "/v1/default/Pod/fake-pod-21-kfvp7": {}, + "/v1/default/Pod/fake-pod-21-kh8z4": {}, + "/v1/default/Pod/fake-pod-21-kq2k9": {}, + "/v1/default/Pod/fake-pod-21-kq7pl": {}, + "/v1/default/Pod/fake-pod-21-kqtqj": {}, + "/v1/default/Pod/fake-pod-21-kvfg6": {}, + "/v1/default/Pod/fake-pod-21-kvj5l": {}, + "/v1/default/Pod/fake-pod-21-kz5zv": {}, + "/v1/default/Pod/fake-pod-21-kzcrd": {}, + "/v1/default/Pod/fake-pod-21-kzhjk": {}, + "/v1/default/Pod/fake-pod-21-l5wz6": {}, + "/v1/default/Pod/fake-pod-21-l6pm5": {}, + "/v1/default/Pod/fake-pod-21-l97k2": {}, + "/v1/default/Pod/fake-pod-21-lfq9c": {}, + "/v1/default/Pod/fake-pod-21-lmvzf": {}, + "/v1/default/Pod/fake-pod-21-lp9cq": {}, + "/v1/default/Pod/fake-pod-21-lsbmg": {}, + "/v1/default/Pod/fake-pod-21-lv5sx": {}, + "/v1/default/Pod/fake-pod-21-m5gq2": {}, + "/v1/default/Pod/fake-pod-21-m7m4d": {}, + "/v1/default/Pod/fake-pod-21-mbtc8": {}, + "/v1/default/Pod/fake-pod-21-mcdq8": {}, + "/v1/default/Pod/fake-pod-21-mhnhl": {}, + "/v1/default/Pod/fake-pod-21-mmg6d": {}, + "/v1/default/Pod/fake-pod-21-mmsds": {}, + "/v1/default/Pod/fake-pod-21-mppsm": {}, + "/v1/default/Pod/fake-pod-21-mqs7h": {}, + "/v1/default/Pod/fake-pod-21-mv766": {}, + "/v1/default/Pod/fake-pod-21-n2h5b": {}, + "/v1/default/Pod/fake-pod-21-n7fm2": {}, + "/v1/default/Pod/fake-pod-21-n8tbt": {}, + "/v1/default/Pod/fake-pod-21-nbwvn": {}, + "/v1/default/Pod/fake-pod-21-nf6zh": {}, + "/v1/default/Pod/fake-pod-21-ngj82": {}, + "/v1/default/Pod/fake-pod-21-nhknn": {}, + "/v1/default/Pod/fake-pod-21-nkvtm": {}, + "/v1/default/Pod/fake-pod-21-nm4w7": {}, + "/v1/default/Pod/fake-pod-21-nnt2m": {}, + "/v1/default/Pod/fake-pod-21-npmjq": {}, + "/v1/default/Pod/fake-pod-21-nqzqw": {}, + "/v1/default/Pod/fake-pod-21-nv2hg": {}, + "/v1/default/Pod/fake-pod-21-nwqmt": {}, + "/v1/default/Pod/fake-pod-21-p4zbk": {}, + "/v1/default/Pod/fake-pod-21-p5jrm": {}, + "/v1/default/Pod/fake-pod-21-p65mc": {}, + "/v1/default/Pod/fake-pod-21-p6n9p": {}, + "/v1/default/Pod/fake-pod-21-pg78q": {}, + "/v1/default/Pod/fake-pod-21-pn5mb": {}, + "/v1/default/Pod/fake-pod-21-pns55": {}, + "/v1/default/Pod/fake-pod-21-pphbz": {}, + "/v1/default/Pod/fake-pod-21-ps4tx": {}, + "/v1/default/Pod/fake-pod-21-px7pn": {}, + "/v1/default/Pod/fake-pod-21-pz5rw": {}, + "/v1/default/Pod/fake-pod-21-q2pkw": {}, + "/v1/default/Pod/fake-pod-21-q7hk2": {}, + "/v1/default/Pod/fake-pod-21-qjxbj": {}, + "/v1/default/Pod/fake-pod-21-qm78b": {}, + "/v1/default/Pod/fake-pod-21-qnqdl": {}, + "/v1/default/Pod/fake-pod-21-qntcm": {}, + "/v1/default/Pod/fake-pod-21-qp75j": {}, + "/v1/default/Pod/fake-pod-21-qt4tc": {}, + "/v1/default/Pod/fake-pod-21-qxfvz": {}, + "/v1/default/Pod/fake-pod-21-r5tbj": {}, + "/v1/default/Pod/fake-pod-21-r8vq8": {}, + "/v1/default/Pod/fake-pod-21-rjc9d": {}, + "/v1/default/Pod/fake-pod-21-rkm5v": {}, + "/v1/default/Pod/fake-pod-21-rtbwb": {}, + "/v1/default/Pod/fake-pod-21-rxhcm": {}, + "/v1/default/Pod/fake-pod-21-rztv7": {}, + "/v1/default/Pod/fake-pod-21-s6mjl": {}, + "/v1/default/Pod/fake-pod-21-s8twq": {}, + "/v1/default/Pod/fake-pod-21-s959v": {}, + "/v1/default/Pod/fake-pod-21-s9rcs": {}, + "/v1/default/Pod/fake-pod-21-sb54z": {}, + "/v1/default/Pod/fake-pod-21-sbbkd": {}, + "/v1/default/Pod/fake-pod-21-sbkg8": {}, + "/v1/default/Pod/fake-pod-21-scjlx": {}, + "/v1/default/Pod/fake-pod-21-sdqx9": {}, + "/v1/default/Pod/fake-pod-21-sgc9d": {}, + "/v1/default/Pod/fake-pod-21-sjnhw": {}, + "/v1/default/Pod/fake-pod-21-sqkjd": {}, + "/v1/default/Pod/fake-pod-21-stnjx": {}, + "/v1/default/Pod/fake-pod-21-swf8k": {}, + "/v1/default/Pod/fake-pod-21-swmdh": {}, + "/v1/default/Pod/fake-pod-21-sxhnc": {}, + "/v1/default/Pod/fake-pod-21-t4vjv": {}, + "/v1/default/Pod/fake-pod-21-t6t69": {}, + "/v1/default/Pod/fake-pod-21-t9z92": {}, + "/v1/default/Pod/fake-pod-21-tb2fp": {}, + "/v1/default/Pod/fake-pod-21-tdph4": {}, + "/v1/default/Pod/fake-pod-21-tdsxq": {}, + "/v1/default/Pod/fake-pod-21-tgspk": {}, + "/v1/default/Pod/fake-pod-21-th8c8": {}, + "/v1/default/Pod/fake-pod-21-tm5mn": {}, + "/v1/default/Pod/fake-pod-21-tm9g5": {}, + "/v1/default/Pod/fake-pod-21-tnlkg": {}, + "/v1/default/Pod/fake-pod-21-tsnh5": {}, + "/v1/default/Pod/fake-pod-21-v8m7f": {}, + "/v1/default/Pod/fake-pod-21-vbjkl": {}, + "/v1/default/Pod/fake-pod-21-vfjkr": {}, + "/v1/default/Pod/fake-pod-21-vhh64": {}, + "/v1/default/Pod/fake-pod-21-vmn7l": {}, + "/v1/default/Pod/fake-pod-21-vnqxl": {}, + "/v1/default/Pod/fake-pod-21-vvmpb": {}, + "/v1/default/Pod/fake-pod-21-vwt2l": {}, + "/v1/default/Pod/fake-pod-21-w2q98": {}, + "/v1/default/Pod/fake-pod-21-w4q2k": {}, + "/v1/default/Pod/fake-pod-21-w84tx": {}, + "/v1/default/Pod/fake-pod-21-wc4ts": {}, + "/v1/default/Pod/fake-pod-21-wfj8g": {}, + "/v1/default/Pod/fake-pod-21-wflx9": {}, + "/v1/default/Pod/fake-pod-21-wqkmm": {}, + "/v1/default/Pod/fake-pod-21-wss54": {}, + "/v1/default/Pod/fake-pod-21-x2jwh": {}, + "/v1/default/Pod/fake-pod-21-x5jbs": {}, + "/v1/default/Pod/fake-pod-21-x8t5q": {}, + "/v1/default/Pod/fake-pod-21-xhbbs": {}, + "/v1/default/Pod/fake-pod-21-xnb8n": {}, + "/v1/default/Pod/fake-pod-21-xqhtr": {}, + "/v1/default/Pod/fake-pod-21-xr5vq": {}, + "/v1/default/Pod/fake-pod-21-xx5dj": {}, + "/v1/default/Pod/fake-pod-21-xzlxc": {}, + "/v1/default/Pod/fake-pod-21-z6v29": {}, + "/v1/default/Pod/fake-pod-21-z9kp2": {}, + "/v1/default/Pod/fake-pod-21-zb4wl": {}, + "/v1/default/Pod/fake-pod-21-zb8dx": {}, + "/v1/default/Pod/fake-pod-21-zcfpk": {}, + "/v1/default/Pod/fake-pod-21-zhgzn": {}, + "/v1/default/Pod/fake-pod-21-zj6l8": {}, + "/v1/default/Pod/fake-pod-21-zklpt": {}, + "/v1/default/Pod/fake-pod-21-zpsj5": {}, + "/v1/default/Pod/fake-pod-22-22pnz": {}, + "/v1/default/Pod/fake-pod-22-24g7f": {}, + "/v1/default/Pod/fake-pod-22-25nrg": {}, + "/v1/default/Pod/fake-pod-22-26fmj": {}, + "/v1/default/Pod/fake-pod-22-2jrrs": {}, + "/v1/default/Pod/fake-pod-22-2l5dp": {}, + "/v1/default/Pod/fake-pod-22-2m6hp": {}, + "/v1/default/Pod/fake-pod-22-2p5ct": {}, + "/v1/default/Pod/fake-pod-22-2qkxq": {}, + "/v1/default/Pod/fake-pod-22-2sj58": {}, + "/v1/default/Pod/fake-pod-22-2ttx4": {}, + "/v1/default/Pod/fake-pod-22-2vbcf": {}, + "/v1/default/Pod/fake-pod-22-2wpjj": {}, + "/v1/default/Pod/fake-pod-22-2wzq9": {}, + "/v1/default/Pod/fake-pod-22-44x8k": {}, + "/v1/default/Pod/fake-pod-22-45tpm": {}, + "/v1/default/Pod/fake-pod-22-468nk": {}, + "/v1/default/Pod/fake-pod-22-4bczh": {}, + "/v1/default/Pod/fake-pod-22-4c79v": {}, + "/v1/default/Pod/fake-pod-22-4kswn": {}, + "/v1/default/Pod/fake-pod-22-4nnfp": {}, + "/v1/default/Pod/fake-pod-22-4q7qr": {}, + "/v1/default/Pod/fake-pod-22-4qqrh": {}, + "/v1/default/Pod/fake-pod-22-4zdh4": {}, + "/v1/default/Pod/fake-pod-22-58cpq": {}, + "/v1/default/Pod/fake-pod-22-5g5gf": {}, + "/v1/default/Pod/fake-pod-22-5gzh2": {}, + "/v1/default/Pod/fake-pod-22-5k76v": {}, + "/v1/default/Pod/fake-pod-22-5nf6d": {}, + "/v1/default/Pod/fake-pod-22-5rwqv": {}, + "/v1/default/Pod/fake-pod-22-5t2l4": {}, + "/v1/default/Pod/fake-pod-22-5v4fw": {}, + "/v1/default/Pod/fake-pod-22-5wkfh": {}, + "/v1/default/Pod/fake-pod-22-64m9s": {}, + "/v1/default/Pod/fake-pod-22-68qzm": {}, + "/v1/default/Pod/fake-pod-22-6bgmd": {}, + "/v1/default/Pod/fake-pod-22-6djf2": {}, + "/v1/default/Pod/fake-pod-22-6fhgp": {}, + "/v1/default/Pod/fake-pod-22-6gtnf": {}, + "/v1/default/Pod/fake-pod-22-6hmd6": {}, + "/v1/default/Pod/fake-pod-22-6lhwf": {}, + "/v1/default/Pod/fake-pod-22-6lq77": {}, + "/v1/default/Pod/fake-pod-22-6m92z": {}, + "/v1/default/Pod/fake-pod-22-6nwvj": {}, + "/v1/default/Pod/fake-pod-22-6rdwh": {}, + "/v1/default/Pod/fake-pod-22-6vvbk": {}, + "/v1/default/Pod/fake-pod-22-6zq8f": {}, + "/v1/default/Pod/fake-pod-22-74g7s": {}, + "/v1/default/Pod/fake-pod-22-76fd8": {}, + "/v1/default/Pod/fake-pod-22-76pvg": {}, + "/v1/default/Pod/fake-pod-22-7brrp": {}, + "/v1/default/Pod/fake-pod-22-7cfsn": {}, + "/v1/default/Pod/fake-pod-22-7gfvj": {}, + "/v1/default/Pod/fake-pod-22-7gt7s": {}, + "/v1/default/Pod/fake-pod-22-7h8xw": {}, + "/v1/default/Pod/fake-pod-22-7jz5r": {}, + "/v1/default/Pod/fake-pod-22-7mbh2": {}, + "/v1/default/Pod/fake-pod-22-7pj9t": {}, + "/v1/default/Pod/fake-pod-22-7qqnb": {}, + "/v1/default/Pod/fake-pod-22-7x4xd": {}, + "/v1/default/Pod/fake-pod-22-7xpbj": {}, + "/v1/default/Pod/fake-pod-22-7zxd7": {}, + "/v1/default/Pod/fake-pod-22-875hl": {}, + "/v1/default/Pod/fake-pod-22-8ctb6": {}, + "/v1/default/Pod/fake-pod-22-8jbmv": {}, + "/v1/default/Pod/fake-pod-22-8ldwb": {}, + "/v1/default/Pod/fake-pod-22-8pdr6": {}, + "/v1/default/Pod/fake-pod-22-8skc8": {}, + "/v1/default/Pod/fake-pod-22-8v2fp": {}, + "/v1/default/Pod/fake-pod-22-8wjct": {}, + "/v1/default/Pod/fake-pod-22-98tmd": {}, + "/v1/default/Pod/fake-pod-22-992r6": {}, + "/v1/default/Pod/fake-pod-22-9bvj7": {}, + "/v1/default/Pod/fake-pod-22-9fpjn": {}, + "/v1/default/Pod/fake-pod-22-9hcjp": {}, + "/v1/default/Pod/fake-pod-22-9jhjb": {}, + "/v1/default/Pod/fake-pod-22-9jr2n": {}, + "/v1/default/Pod/fake-pod-22-9qcr9": {}, + "/v1/default/Pod/fake-pod-22-9v77p": {}, + "/v1/default/Pod/fake-pod-22-9vdpm": {}, + "/v1/default/Pod/fake-pod-22-9vlr6": {}, + "/v1/default/Pod/fake-pod-22-9w6jr": {}, + "/v1/default/Pod/fake-pod-22-9wmvf": {}, + "/v1/default/Pod/fake-pod-22-9xhv4": {}, + "/v1/default/Pod/fake-pod-22-b4ngf": {}, + "/v1/default/Pod/fake-pod-22-b6ndx": {}, + "/v1/default/Pod/fake-pod-22-b7xqn": {}, + "/v1/default/Pod/fake-pod-22-b8ttw": {}, + "/v1/default/Pod/fake-pod-22-bdgzj": {}, + "/v1/default/Pod/fake-pod-22-bgk8g": {}, + "/v1/default/Pod/fake-pod-22-bklr8": {}, + "/v1/default/Pod/fake-pod-22-blgsm": {}, + "/v1/default/Pod/fake-pod-22-bmm8p": {}, + "/v1/default/Pod/fake-pod-22-bttm8": {}, + "/v1/default/Pod/fake-pod-22-bznm9": {}, + "/v1/default/Pod/fake-pod-22-c2jv9": {}, + "/v1/default/Pod/fake-pod-22-c2www": {}, + "/v1/default/Pod/fake-pod-22-cbxqr": {}, + "/v1/default/Pod/fake-pod-22-cfwgp": {}, + "/v1/default/Pod/fake-pod-22-cgqxn": {}, + "/v1/default/Pod/fake-pod-22-ch8jd": {}, + "/v1/default/Pod/fake-pod-22-cjq76": {}, + "/v1/default/Pod/fake-pod-22-cjs4j": {}, + "/v1/default/Pod/fake-pod-22-cnr9m": {}, + "/v1/default/Pod/fake-pod-22-cwzkq": {}, + "/v1/default/Pod/fake-pod-22-cxvn5": {}, + "/v1/default/Pod/fake-pod-22-cz8rc": {}, + "/v1/default/Pod/fake-pod-22-czcrt": {}, + "/v1/default/Pod/fake-pod-22-d4sb7": {}, + "/v1/default/Pod/fake-pod-22-d5grq": {}, + "/v1/default/Pod/fake-pod-22-d7g7d": {}, + "/v1/default/Pod/fake-pod-22-dld6x": {}, + "/v1/default/Pod/fake-pod-22-dlh9z": {}, + "/v1/default/Pod/fake-pod-22-dx2rf": {}, + "/v1/default/Pod/fake-pod-22-dx5js": {}, + "/v1/default/Pod/fake-pod-22-f6ftd": {}, + "/v1/default/Pod/fake-pod-22-fdgzf": {}, + "/v1/default/Pod/fake-pod-22-fkv7j": {}, + "/v1/default/Pod/fake-pod-22-fmd7g": {}, + "/v1/default/Pod/fake-pod-22-fnzph": {}, + "/v1/default/Pod/fake-pod-22-fzxwp": {}, + "/v1/default/Pod/fake-pod-22-g4lm9": {}, + "/v1/default/Pod/fake-pod-22-g65nt": {}, + "/v1/default/Pod/fake-pod-22-g8gt5": {}, + "/v1/default/Pod/fake-pod-22-g8k27": {}, + "/v1/default/Pod/fake-pod-22-gbdj9": {}, + "/v1/default/Pod/fake-pod-22-gc8lq": {}, + "/v1/default/Pod/fake-pod-22-ghcrx": {}, + "/v1/default/Pod/fake-pod-22-gkp79": {}, + "/v1/default/Pod/fake-pod-22-gmnzc": {}, + "/v1/default/Pod/fake-pod-22-gmtm6": {}, + "/v1/default/Pod/fake-pod-22-grtvf": {}, + "/v1/default/Pod/fake-pod-22-gz7zl": {}, + "/v1/default/Pod/fake-pod-22-gzwlz": {}, + "/v1/default/Pod/fake-pod-22-h4dk9": {}, + "/v1/default/Pod/fake-pod-22-h5rrx": {}, + "/v1/default/Pod/fake-pod-22-h5xlm": {}, + "/v1/default/Pod/fake-pod-22-h76g8": {}, + "/v1/default/Pod/fake-pod-22-h8gf5": {}, + "/v1/default/Pod/fake-pod-22-hc6gw": {}, + "/v1/default/Pod/fake-pod-22-hfkzt": {}, + "/v1/default/Pod/fake-pod-22-hggp8": {}, + "/v1/default/Pod/fake-pod-22-hgnnh": {}, + "/v1/default/Pod/fake-pod-22-hgxfx": {}, + "/v1/default/Pod/fake-pod-22-hh9t8": {}, + "/v1/default/Pod/fake-pod-22-hhqvd": {}, + "/v1/default/Pod/fake-pod-22-hkf8w": {}, + "/v1/default/Pod/fake-pod-22-hkffv": {}, + "/v1/default/Pod/fake-pod-22-hpsg5": {}, + "/v1/default/Pod/fake-pod-22-hpvsq": {}, + "/v1/default/Pod/fake-pod-22-hr4l8": {}, + "/v1/default/Pod/fake-pod-22-hzksv": {}, + "/v1/default/Pod/fake-pod-22-j4ljr": {}, + "/v1/default/Pod/fake-pod-22-j5bd5": {}, + "/v1/default/Pod/fake-pod-22-j6vrl": {}, + "/v1/default/Pod/fake-pod-22-jhbfm": {}, + "/v1/default/Pod/fake-pod-22-jjrvg": {}, + "/v1/default/Pod/fake-pod-22-jkddr": {}, + "/v1/default/Pod/fake-pod-22-jkpx8": {}, + "/v1/default/Pod/fake-pod-22-jlmn2": {}, + "/v1/default/Pod/fake-pod-22-jwx9x": {}, + "/v1/default/Pod/fake-pod-22-jxzqf": {}, + "/v1/default/Pod/fake-pod-22-k2pk4": {}, + "/v1/default/Pod/fake-pod-22-k7v92": {}, + "/v1/default/Pod/fake-pod-22-kbwpj": {}, + "/v1/default/Pod/fake-pod-22-kcp9r": {}, + "/v1/default/Pod/fake-pod-22-klzxm": {}, + "/v1/default/Pod/fake-pod-22-kn5dd": {}, + "/v1/default/Pod/fake-pod-22-kqm2t": {}, + "/v1/default/Pod/fake-pod-22-kttfx": {}, + "/v1/default/Pod/fake-pod-22-kvmwm": {}, + "/v1/default/Pod/fake-pod-22-l4fzz": {}, + "/v1/default/Pod/fake-pod-22-l4qx9": {}, + "/v1/default/Pod/fake-pod-22-l72lf": {}, + "/v1/default/Pod/fake-pod-22-l92zc": {}, + "/v1/default/Pod/fake-pod-22-lc5xj": {}, + "/v1/default/Pod/fake-pod-22-ldrv6": {}, + "/v1/default/Pod/fake-pod-22-lhqkw": {}, + "/v1/default/Pod/fake-pod-22-lm65g": {}, + "/v1/default/Pod/fake-pod-22-lpfp8": {}, + "/v1/default/Pod/fake-pod-22-lppbj": {}, + "/v1/default/Pod/fake-pod-22-lv57k": {}, + "/v1/default/Pod/fake-pod-22-lv6d7": {}, + "/v1/default/Pod/fake-pod-22-lvlt5": {}, + "/v1/default/Pod/fake-pod-22-m2xcp": {}, + "/v1/default/Pod/fake-pod-22-m7647": {}, + "/v1/default/Pod/fake-pod-22-m79lb": {}, + "/v1/default/Pod/fake-pod-22-mcr76": {}, + "/v1/default/Pod/fake-pod-22-mfzjd": {}, + "/v1/default/Pod/fake-pod-22-mg5tg": {}, + "/v1/default/Pod/fake-pod-22-mgb96": {}, + "/v1/default/Pod/fake-pod-22-mhh4h": {}, + "/v1/default/Pod/fake-pod-22-mj2mg": {}, + "/v1/default/Pod/fake-pod-22-mjfts": {}, + "/v1/default/Pod/fake-pod-22-mjzpd": {}, + "/v1/default/Pod/fake-pod-22-mpb5d": {}, + "/v1/default/Pod/fake-pod-22-mpgsj": {}, + "/v1/default/Pod/fake-pod-22-mqr9n": {}, + "/v1/default/Pod/fake-pod-22-mr7lv": {}, + "/v1/default/Pod/fake-pod-22-mtdc9": {}, + "/v1/default/Pod/fake-pod-22-n2n55": {}, + "/v1/default/Pod/fake-pod-22-n54s5": {}, + "/v1/default/Pod/fake-pod-22-n669n": {}, + "/v1/default/Pod/fake-pod-22-n8jnz": {}, + "/v1/default/Pod/fake-pod-22-ng682": {}, + "/v1/default/Pod/fake-pod-22-nlccp": {}, + "/v1/default/Pod/fake-pod-22-nnrkb": {}, + "/v1/default/Pod/fake-pod-22-nqsn5": {}, + "/v1/default/Pod/fake-pod-22-ntgsf": {}, + "/v1/default/Pod/fake-pod-22-ntpr6": {}, + "/v1/default/Pod/fake-pod-22-p5h4z": {}, + "/v1/default/Pod/fake-pod-22-p5nnj": {}, + "/v1/default/Pod/fake-pod-22-p79j7": {}, + "/v1/default/Pod/fake-pod-22-p92cm": {}, + "/v1/default/Pod/fake-pod-22-p9xtx": {}, + "/v1/default/Pod/fake-pod-22-pbskp": {}, + "/v1/default/Pod/fake-pod-22-pcqr9": {}, + "/v1/default/Pod/fake-pod-22-pdd56": {}, + "/v1/default/Pod/fake-pod-22-pdhrc": {}, + "/v1/default/Pod/fake-pod-22-pm6np": {}, + "/v1/default/Pod/fake-pod-22-ptpzc": {}, + "/v1/default/Pod/fake-pod-22-ptrr5": {}, + "/v1/default/Pod/fake-pod-22-q6nqg": {}, + "/v1/default/Pod/fake-pod-22-q7sf5": {}, + "/v1/default/Pod/fake-pod-22-q82ms": {}, + "/v1/default/Pod/fake-pod-22-qhdtc": {}, + "/v1/default/Pod/fake-pod-22-qhr7z": {}, + "/v1/default/Pod/fake-pod-22-qjhxj": {}, + "/v1/default/Pod/fake-pod-22-qlrhg": {}, + "/v1/default/Pod/fake-pod-22-qlwl6": {}, + "/v1/default/Pod/fake-pod-22-qn8mg": {}, + "/v1/default/Pod/fake-pod-22-qs7bq": {}, + "/v1/default/Pod/fake-pod-22-qw2dh": {}, + "/v1/default/Pod/fake-pod-22-qw9k5": {}, + "/v1/default/Pod/fake-pod-22-r6kj8": {}, + "/v1/default/Pod/fake-pod-22-r6wd6": {}, + "/v1/default/Pod/fake-pod-22-r99r8": {}, + "/v1/default/Pod/fake-pod-22-rfpk4": {}, + "/v1/default/Pod/fake-pod-22-rlvcc": {}, + "/v1/default/Pod/fake-pod-22-rmf9b": {}, + "/v1/default/Pod/fake-pod-22-rmjhd": {}, + "/v1/default/Pod/fake-pod-22-rmkk8": {}, + "/v1/default/Pod/fake-pod-22-rmq7b": {}, + "/v1/default/Pod/fake-pod-22-rp2pp": {}, + "/v1/default/Pod/fake-pod-22-rqhrk": {}, + "/v1/default/Pod/fake-pod-22-rtdbl": {}, + "/v1/default/Pod/fake-pod-22-s5b4n": {}, + "/v1/default/Pod/fake-pod-22-s9gqk": {}, + "/v1/default/Pod/fake-pod-22-sbpfn": {}, + "/v1/default/Pod/fake-pod-22-sdmdd": {}, + "/v1/default/Pod/fake-pod-22-sf6rf": {}, + "/v1/default/Pod/fake-pod-22-sjq7b": {}, + "/v1/default/Pod/fake-pod-22-sn2x8": {}, + "/v1/default/Pod/fake-pod-22-sp6nf": {}, + "/v1/default/Pod/fake-pod-22-sp9k6": {}, + "/v1/default/Pod/fake-pod-22-ssmcf": {}, + "/v1/default/Pod/fake-pod-22-swfk6": {}, + "/v1/default/Pod/fake-pod-22-t2v4r": {}, + "/v1/default/Pod/fake-pod-22-t4tkj": {}, + "/v1/default/Pod/fake-pod-22-t7jxm": {}, + "/v1/default/Pod/fake-pod-22-t7trd": {}, + "/v1/default/Pod/fake-pod-22-t858g": {}, + "/v1/default/Pod/fake-pod-22-t9nx7": {}, + "/v1/default/Pod/fake-pod-22-t9tp7": {}, + "/v1/default/Pod/fake-pod-22-tbwnm": {}, + "/v1/default/Pod/fake-pod-22-tcbf4": {}, + "/v1/default/Pod/fake-pod-22-tfgw6": {}, + "/v1/default/Pod/fake-pod-22-tfkwn": {}, + "/v1/default/Pod/fake-pod-22-tpdpf": {}, + "/v1/default/Pod/fake-pod-22-trx7p": {}, + "/v1/default/Pod/fake-pod-22-tth7z": {}, + "/v1/default/Pod/fake-pod-22-tvwpx": {}, + "/v1/default/Pod/fake-pod-22-tx9hn": {}, + "/v1/default/Pod/fake-pod-22-v2jsz": {}, + "/v1/default/Pod/fake-pod-22-v78tj": {}, + "/v1/default/Pod/fake-pod-22-vckth": {}, + "/v1/default/Pod/fake-pod-22-vl78q": {}, + "/v1/default/Pod/fake-pod-22-vmkt6": {}, + "/v1/default/Pod/fake-pod-22-w4sh5": {}, + "/v1/default/Pod/fake-pod-22-w4t82": {}, + "/v1/default/Pod/fake-pod-22-w88k8": {}, + "/v1/default/Pod/fake-pod-22-w89ln": {}, + "/v1/default/Pod/fake-pod-22-whcp7": {}, + "/v1/default/Pod/fake-pod-22-wxmrq": {}, + "/v1/default/Pod/fake-pod-22-x2cjj": {}, + "/v1/default/Pod/fake-pod-22-x2jf4": {}, + "/v1/default/Pod/fake-pod-22-x4hqz": {}, + "/v1/default/Pod/fake-pod-22-x7v5n": {}, + "/v1/default/Pod/fake-pod-22-xkk2q": {}, + "/v1/default/Pod/fake-pod-22-xmhj8": {}, + "/v1/default/Pod/fake-pod-22-xzdfz": {}, + "/v1/default/Pod/fake-pod-22-z5tql": {}, + "/v1/default/Pod/fake-pod-22-z6f9w": {}, + "/v1/default/Pod/fake-pod-22-zcjzq": {}, + "/v1/default/Pod/fake-pod-22-zjhv8": {}, + "/v1/default/Pod/fake-pod-22-zkvv4": {}, + "/v1/default/Pod/fake-pod-22-zkxq5": {}, + "/v1/default/Pod/fake-pod-22-zlzpk": {}, + "/v1/default/Pod/fake-pod-22-zqdt8": {}, + "/v1/default/Pod/fake-pod-23-22kch": {}, + "/v1/default/Pod/fake-pod-23-24dvv": {}, + "/v1/default/Pod/fake-pod-23-27dsk": {}, + "/v1/default/Pod/fake-pod-23-299sn": {}, + "/v1/default/Pod/fake-pod-23-2c44h": {}, + "/v1/default/Pod/fake-pod-23-2fdq4": {}, + "/v1/default/Pod/fake-pod-23-2k45k": {}, + "/v1/default/Pod/fake-pod-23-2kjpb": {}, + "/v1/default/Pod/fake-pod-23-2l5ss": {}, + "/v1/default/Pod/fake-pod-23-2mzzs": {}, + "/v1/default/Pod/fake-pod-23-2n4l2": {}, + "/v1/default/Pod/fake-pod-23-2nv47": {}, + "/v1/default/Pod/fake-pod-23-2przf": {}, + "/v1/default/Pod/fake-pod-23-47bbm": {}, + "/v1/default/Pod/fake-pod-23-47l5g": {}, + "/v1/default/Pod/fake-pod-23-4c7h8": {}, + "/v1/default/Pod/fake-pod-23-4hdx7": {}, + "/v1/default/Pod/fake-pod-23-4hfmb": {}, + "/v1/default/Pod/fake-pod-23-4m6gt": {}, + "/v1/default/Pod/fake-pod-23-4mcjq": {}, + "/v1/default/Pod/fake-pod-23-4rtwx": {}, + "/v1/default/Pod/fake-pod-23-4vlm8": {}, + "/v1/default/Pod/fake-pod-23-4w8kc": {}, + "/v1/default/Pod/fake-pod-23-54ffm": {}, + "/v1/default/Pod/fake-pod-23-54lrk": {}, + "/v1/default/Pod/fake-pod-23-56lms": {}, + "/v1/default/Pod/fake-pod-23-57wm4": {}, + "/v1/default/Pod/fake-pod-23-5d7vc": {}, + "/v1/default/Pod/fake-pod-23-5hxbp": {}, + "/v1/default/Pod/fake-pod-23-5j7gk": {}, + "/v1/default/Pod/fake-pod-23-5vgl4": {}, + "/v1/default/Pod/fake-pod-23-5x96n": {}, + "/v1/default/Pod/fake-pod-23-5xrzz": {}, + "/v1/default/Pod/fake-pod-23-5z492": {}, + "/v1/default/Pod/fake-pod-23-5zsf9": {}, + "/v1/default/Pod/fake-pod-23-66ksr": {}, + "/v1/default/Pod/fake-pod-23-6cfwh": {}, + "/v1/default/Pod/fake-pod-23-6k2mg": {}, + "/v1/default/Pod/fake-pod-23-6rfdb": {}, + "/v1/default/Pod/fake-pod-23-6wkw4": {}, + "/v1/default/Pod/fake-pod-23-6wlxz": {}, + "/v1/default/Pod/fake-pod-23-72gtq": {}, + "/v1/default/Pod/fake-pod-23-759pl": {}, + "/v1/default/Pod/fake-pod-23-78wj6": {}, + "/v1/default/Pod/fake-pod-23-7bpc2": {}, + "/v1/default/Pod/fake-pod-23-7cnsz": {}, + "/v1/default/Pod/fake-pod-23-7hsfx": {}, + "/v1/default/Pod/fake-pod-23-7zjpz": {}, + "/v1/default/Pod/fake-pod-23-897vb": {}, + "/v1/default/Pod/fake-pod-23-8c75b": {}, + "/v1/default/Pod/fake-pod-23-8ftp4": {}, + "/v1/default/Pod/fake-pod-23-8jsvm": {}, + "/v1/default/Pod/fake-pod-23-8kb2r": {}, + "/v1/default/Pod/fake-pod-23-8qbb4": {}, + "/v1/default/Pod/fake-pod-23-8r8h6": {}, + "/v1/default/Pod/fake-pod-23-8t7r5": {}, + "/v1/default/Pod/fake-pod-23-8zssj": {}, + "/v1/default/Pod/fake-pod-23-94lgq": {}, + "/v1/default/Pod/fake-pod-23-967cq": {}, + "/v1/default/Pod/fake-pod-23-9758f": {}, + "/v1/default/Pod/fake-pod-23-992s5": {}, + "/v1/default/Pod/fake-pod-23-99wh8": {}, + "/v1/default/Pod/fake-pod-23-9d8n5": {}, + "/v1/default/Pod/fake-pod-23-9ftz4": {}, + "/v1/default/Pod/fake-pod-23-9fw6v": {}, + "/v1/default/Pod/fake-pod-23-9hx7h": {}, + "/v1/default/Pod/fake-pod-23-9lhfq": {}, + "/v1/default/Pod/fake-pod-23-9nfts": {}, + "/v1/default/Pod/fake-pod-23-9rnb6": {}, + "/v1/default/Pod/fake-pod-23-9s5v7": {}, + "/v1/default/Pod/fake-pod-23-9xvnc": {}, + "/v1/default/Pod/fake-pod-23-9xxqb": {}, + "/v1/default/Pod/fake-pod-23-b5fx8": {}, + "/v1/default/Pod/fake-pod-23-bjs8r": {}, + "/v1/default/Pod/fake-pod-23-bk42m": {}, + "/v1/default/Pod/fake-pod-23-blxth": {}, + "/v1/default/Pod/fake-pod-23-btkw8": {}, + "/v1/default/Pod/fake-pod-23-bvc4q": {}, + "/v1/default/Pod/fake-pod-23-bvsmm": {}, + "/v1/default/Pod/fake-pod-23-bwvxs": {}, + "/v1/default/Pod/fake-pod-23-bxs5g": {}, + "/v1/default/Pod/fake-pod-23-bxx6k": {}, + "/v1/default/Pod/fake-pod-23-c5kkv": {}, + "/v1/default/Pod/fake-pod-23-c7t2g": {}, + "/v1/default/Pod/fake-pod-23-c7tl8": {}, + "/v1/default/Pod/fake-pod-23-c7znk": {}, + "/v1/default/Pod/fake-pod-23-c9zxv": {}, + "/v1/default/Pod/fake-pod-23-ccnsk": {}, + "/v1/default/Pod/fake-pod-23-chdjl": {}, + "/v1/default/Pod/fake-pod-23-cknms": {}, + "/v1/default/Pod/fake-pod-23-ckvbf": {}, + "/v1/default/Pod/fake-pod-23-clpcr": {}, + "/v1/default/Pod/fake-pod-23-cpgh4": {}, + "/v1/default/Pod/fake-pod-23-cq46j": {}, + "/v1/default/Pod/fake-pod-23-ctrg9": {}, + "/v1/default/Pod/fake-pod-23-ctv64": {}, + "/v1/default/Pod/fake-pod-23-d4fpd": {}, + "/v1/default/Pod/fake-pod-23-d5mpb": {}, + "/v1/default/Pod/fake-pod-23-d7sb6": {}, + "/v1/default/Pod/fake-pod-23-db227": {}, + "/v1/default/Pod/fake-pod-23-dlzg6": {}, + "/v1/default/Pod/fake-pod-23-dnmjd": {}, + "/v1/default/Pod/fake-pod-23-dqx9z": {}, + "/v1/default/Pod/fake-pod-23-ds4r6": {}, + "/v1/default/Pod/fake-pod-23-dskv6": {}, + "/v1/default/Pod/fake-pod-23-dwrr7": {}, + "/v1/default/Pod/fake-pod-23-f27zk": {}, + "/v1/default/Pod/fake-pod-23-f5kk4": {}, + "/v1/default/Pod/fake-pod-23-f8pq2": {}, + "/v1/default/Pod/fake-pod-23-f9wb4": {}, + "/v1/default/Pod/fake-pod-23-fg497": {}, + "/v1/default/Pod/fake-pod-23-fmrj9": {}, + "/v1/default/Pod/fake-pod-23-fsw7p": {}, + "/v1/default/Pod/fake-pod-23-ft6gj": {}, + "/v1/default/Pod/fake-pod-23-fw464": {}, + "/v1/default/Pod/fake-pod-23-fx9mk": {}, + "/v1/default/Pod/fake-pod-23-g2wxg": {}, + "/v1/default/Pod/fake-pod-23-g4j9r": {}, + "/v1/default/Pod/fake-pod-23-gkhxk": {}, + "/v1/default/Pod/fake-pod-23-gm6wk": {}, + "/v1/default/Pod/fake-pod-23-gm7gd": {}, + "/v1/default/Pod/fake-pod-23-gmmj8": {}, + "/v1/default/Pod/fake-pod-23-gpfbv": {}, + "/v1/default/Pod/fake-pod-23-gx2dq": {}, + "/v1/default/Pod/fake-pod-23-h6dh4": {}, + "/v1/default/Pod/fake-pod-23-h7cvf": {}, + "/v1/default/Pod/fake-pod-23-h7tjg": {}, + "/v1/default/Pod/fake-pod-23-hcgsh": {}, + "/v1/default/Pod/fake-pod-23-hffrn": {}, + "/v1/default/Pod/fake-pod-23-hk6l9": {}, + "/v1/default/Pod/fake-pod-23-hrh4h": {}, + "/v1/default/Pod/fake-pod-23-hs8lc": {}, + "/v1/default/Pod/fake-pod-23-hsd2s": {}, + "/v1/default/Pod/fake-pod-23-hvhnl": {}, + "/v1/default/Pod/fake-pod-23-j2dtj": {}, + "/v1/default/Pod/fake-pod-23-j42bh": {}, + "/v1/default/Pod/fake-pod-23-j5w8n": {}, + "/v1/default/Pod/fake-pod-23-j8chj": {}, + "/v1/default/Pod/fake-pod-23-j9j8t": {}, + "/v1/default/Pod/fake-pod-23-jddrs": {}, + "/v1/default/Pod/fake-pod-23-jf8zp": {}, + "/v1/default/Pod/fake-pod-23-jh9w9": {}, + "/v1/default/Pod/fake-pod-23-jjpjs": {}, + "/v1/default/Pod/fake-pod-23-jpg6r": {}, + "/v1/default/Pod/fake-pod-23-jq9cn": {}, + "/v1/default/Pod/fake-pod-23-jqvg7": {}, + "/v1/default/Pod/fake-pod-23-k42q8": {}, + "/v1/default/Pod/fake-pod-23-k5stj": {}, + "/v1/default/Pod/fake-pod-23-k8blx": {}, + "/v1/default/Pod/fake-pod-23-kh7zv": {}, + "/v1/default/Pod/fake-pod-23-kl5cc": {}, + "/v1/default/Pod/fake-pod-23-kmmbd": {}, + "/v1/default/Pod/fake-pod-23-knd7l": {}, + "/v1/default/Pod/fake-pod-23-kp7lg": {}, + "/v1/default/Pod/fake-pod-23-kv2gb": {}, + "/v1/default/Pod/fake-pod-23-l756j": {}, + "/v1/default/Pod/fake-pod-23-lb8v8": {}, + "/v1/default/Pod/fake-pod-23-lcb9k": {}, + "/v1/default/Pod/fake-pod-23-lk6bx": {}, + "/v1/default/Pod/fake-pod-23-ll7vx": {}, + "/v1/default/Pod/fake-pod-23-lllgx": {}, + "/v1/default/Pod/fake-pod-23-lnkqh": {}, + "/v1/default/Pod/fake-pod-23-lqkff": {}, + "/v1/default/Pod/fake-pod-23-lrgn9": {}, + "/v1/default/Pod/fake-pod-23-lrrj6": {}, + "/v1/default/Pod/fake-pod-23-ls5lv": {}, + "/v1/default/Pod/fake-pod-23-ls5pw": {}, + "/v1/default/Pod/fake-pod-23-lsqpm": {}, + "/v1/default/Pod/fake-pod-23-m8q9b": {}, + "/v1/default/Pod/fake-pod-23-mbfk2": {}, + "/v1/default/Pod/fake-pod-23-md4kf": {}, + "/v1/default/Pod/fake-pod-23-mdzrz": {}, + "/v1/default/Pod/fake-pod-23-mgkw5": {}, + "/v1/default/Pod/fake-pod-23-mgqwr": {}, + "/v1/default/Pod/fake-pod-23-mnbtd": {}, + "/v1/default/Pod/fake-pod-23-ms7cd": {}, + "/v1/default/Pod/fake-pod-23-mssns": {}, + "/v1/default/Pod/fake-pod-23-mth5k": {}, + "/v1/default/Pod/fake-pod-23-mvfxp": {}, + "/v1/default/Pod/fake-pod-23-mwrlb": {}, + "/v1/default/Pod/fake-pod-23-mwsdm": {}, + "/v1/default/Pod/fake-pod-23-ncznk": {}, + "/v1/default/Pod/fake-pod-23-ndz4n": {}, + "/v1/default/Pod/fake-pod-23-nj8d6": {}, + "/v1/default/Pod/fake-pod-23-nll79": {}, + "/v1/default/Pod/fake-pod-23-nms8k": {}, + "/v1/default/Pod/fake-pod-23-nqwrn": {}, + "/v1/default/Pod/fake-pod-23-nx596": {}, + "/v1/default/Pod/fake-pod-23-nxw97": {}, + "/v1/default/Pod/fake-pod-23-p6qjr": {}, + "/v1/default/Pod/fake-pod-23-p8rjg": {}, + "/v1/default/Pod/fake-pod-23-pfcbl": {}, + "/v1/default/Pod/fake-pod-23-pjhw5": {}, + "/v1/default/Pod/fake-pod-23-plk5t": {}, + "/v1/default/Pod/fake-pod-23-pqn6m": {}, + "/v1/default/Pod/fake-pod-23-pqtk7": {}, + "/v1/default/Pod/fake-pod-23-psmh4": {}, + "/v1/default/Pod/fake-pod-23-pt6k2": {}, + "/v1/default/Pod/fake-pod-23-ptp2p": {}, + "/v1/default/Pod/fake-pod-23-ptq5q": {}, + "/v1/default/Pod/fake-pod-23-pvdrg": {}, + "/v1/default/Pod/fake-pod-23-pzq6w": {}, + "/v1/default/Pod/fake-pod-23-q7csx": {}, + "/v1/default/Pod/fake-pod-23-q7pgh": {}, + "/v1/default/Pod/fake-pod-23-q92gr": {}, + "/v1/default/Pod/fake-pod-23-qcx5g": {}, + "/v1/default/Pod/fake-pod-23-qdbp2": {}, + "/v1/default/Pod/fake-pod-23-qdlb8": {}, + "/v1/default/Pod/fake-pod-23-qgckf": {}, + "/v1/default/Pod/fake-pod-23-qjnjw": {}, + "/v1/default/Pod/fake-pod-23-qjzhx": {}, + "/v1/default/Pod/fake-pod-23-qkxzr": {}, + "/v1/default/Pod/fake-pod-23-qm5sq": {}, + "/v1/default/Pod/fake-pod-23-qmpjm": {}, + "/v1/default/Pod/fake-pod-23-qn47v": {}, + "/v1/default/Pod/fake-pod-23-qr4fl": {}, + "/v1/default/Pod/fake-pod-23-qrb2f": {}, + "/v1/default/Pod/fake-pod-23-qtr6j": {}, + "/v1/default/Pod/fake-pod-23-qv7h9": {}, + "/v1/default/Pod/fake-pod-23-r2gg2": {}, + "/v1/default/Pod/fake-pod-23-r48tq": {}, + "/v1/default/Pod/fake-pod-23-rb9zn": {}, + "/v1/default/Pod/fake-pod-23-rfrln": {}, + "/v1/default/Pod/fake-pod-23-rhf46": {}, + "/v1/default/Pod/fake-pod-23-rj2jj": {}, + "/v1/default/Pod/fake-pod-23-rj89z": {}, + "/v1/default/Pod/fake-pod-23-rl2mv": {}, + "/v1/default/Pod/fake-pod-23-rnpc7": {}, + "/v1/default/Pod/fake-pod-23-rp4hf": {}, + "/v1/default/Pod/fake-pod-23-rrv76": {}, + "/v1/default/Pod/fake-pod-23-rwj8l": {}, + "/v1/default/Pod/fake-pod-23-rxjdr": {}, + "/v1/default/Pod/fake-pod-23-s677d": {}, + "/v1/default/Pod/fake-pod-23-s9hwm": {}, + "/v1/default/Pod/fake-pod-23-sbn8q": {}, + "/v1/default/Pod/fake-pod-23-sd4pr": {}, + "/v1/default/Pod/fake-pod-23-snjh8": {}, + "/v1/default/Pod/fake-pod-23-snl5g": {}, + "/v1/default/Pod/fake-pod-23-snwkp": {}, + "/v1/default/Pod/fake-pod-23-sqfxb": {}, + "/v1/default/Pod/fake-pod-23-stvvl": {}, + "/v1/default/Pod/fake-pod-23-szbrm": {}, + "/v1/default/Pod/fake-pod-23-t7p4h": {}, + "/v1/default/Pod/fake-pod-23-tc6z7": {}, + "/v1/default/Pod/fake-pod-23-tc7vt": {}, + "/v1/default/Pod/fake-pod-23-tht5v": {}, + "/v1/default/Pod/fake-pod-23-tl2r9": {}, + "/v1/default/Pod/fake-pod-23-tpdq9": {}, + "/v1/default/Pod/fake-pod-23-tpwsh": {}, + "/v1/default/Pod/fake-pod-23-trdff": {}, + "/v1/default/Pod/fake-pod-23-ttnj4": {}, + "/v1/default/Pod/fake-pod-23-tv9lz": {}, + "/v1/default/Pod/fake-pod-23-v8hvk": {}, + "/v1/default/Pod/fake-pod-23-vf4nn": {}, + "/v1/default/Pod/fake-pod-23-vh29w": {}, + "/v1/default/Pod/fake-pod-23-vh8fq": {}, + "/v1/default/Pod/fake-pod-23-vhcl8": {}, + "/v1/default/Pod/fake-pod-23-vsc56": {}, + "/v1/default/Pod/fake-pod-23-vsd5s": {}, + "/v1/default/Pod/fake-pod-23-vt5qv": {}, + "/v1/default/Pod/fake-pod-23-vvm54": {}, + "/v1/default/Pod/fake-pod-23-vzq9b": {}, + "/v1/default/Pod/fake-pod-23-vzx6f": {}, + "/v1/default/Pod/fake-pod-23-w7bqt": {}, + "/v1/default/Pod/fake-pod-23-w8nhb": {}, + "/v1/default/Pod/fake-pod-23-w8srq": {}, + "/v1/default/Pod/fake-pod-23-w95d5": {}, + "/v1/default/Pod/fake-pod-23-w9twt": {}, + "/v1/default/Pod/fake-pod-23-w9wtf": {}, + "/v1/default/Pod/fake-pod-23-wcn8t": {}, + "/v1/default/Pod/fake-pod-23-wfntb": {}, + "/v1/default/Pod/fake-pod-23-wnbdz": {}, + "/v1/default/Pod/fake-pod-23-wtqc9": {}, + "/v1/default/Pod/fake-pod-23-ww4z2": {}, + "/v1/default/Pod/fake-pod-23-x2ztj": {}, + "/v1/default/Pod/fake-pod-23-x4j5s": {}, + "/v1/default/Pod/fake-pod-23-xdmqh": {}, + "/v1/default/Pod/fake-pod-23-xf726": {}, + "/v1/default/Pod/fake-pod-23-xh567": {}, + "/v1/default/Pod/fake-pod-23-xkfdd": {}, + "/v1/default/Pod/fake-pod-23-xmtz4": {}, + "/v1/default/Pod/fake-pod-23-xpqg2": {}, + "/v1/default/Pod/fake-pod-23-xtzrl": {}, + "/v1/default/Pod/fake-pod-23-xvk9b": {}, + "/v1/default/Pod/fake-pod-23-xxssq": {}, + "/v1/default/Pod/fake-pod-23-z64wv": {}, + "/v1/default/Pod/fake-pod-23-z65m4": {}, + "/v1/default/Pod/fake-pod-23-z9txg": {}, + "/v1/default/Pod/fake-pod-23-zc6mr": {}, + "/v1/default/Pod/fake-pod-23-zf4q8": {}, + "/v1/default/Pod/fake-pod-23-zkt9j": {}, + "/v1/default/Pod/fake-pod-23-zmbmt": {}, + "/v1/default/Pod/fake-pod-23-zmwxl": {}, + "/v1/default/Pod/fake-pod-23-znrdz": {}, + "/v1/default/Pod/fake-pod-23-zphts": {}, + "/v1/default/Pod/fake-pod-23-zplll": {}, + "/v1/default/Pod/fake-pod-23-zs9kc": {}, + "/v1/default/Pod/fake-pod-23-zzb7f": {}, + "/v1/default/Pod/fake-pod-23-zzhqz": {}, + "/v1/default/Pod/fake-pod-24-2jnwg": {}, + "/v1/default/Pod/fake-pod-24-2jxxw": {}, + "/v1/default/Pod/fake-pod-24-2mh67": {}, + "/v1/default/Pod/fake-pod-24-2n2q7": {}, + "/v1/default/Pod/fake-pod-24-2t2pf": {}, + "/v1/default/Pod/fake-pod-24-2xhtz": {}, + "/v1/default/Pod/fake-pod-24-4cgzh": {}, + "/v1/default/Pod/fake-pod-24-4cl8t": {}, + "/v1/default/Pod/fake-pod-24-4cz2h": {}, + "/v1/default/Pod/fake-pod-24-4g4mq": {}, + "/v1/default/Pod/fake-pod-24-4hr9v": {}, + "/v1/default/Pod/fake-pod-24-4hz6f": {}, + "/v1/default/Pod/fake-pod-24-4ktt7": {}, + "/v1/default/Pod/fake-pod-24-4v8gt": {}, + "/v1/default/Pod/fake-pod-24-4wcdm": {}, + "/v1/default/Pod/fake-pod-24-4wwvc": {}, + "/v1/default/Pod/fake-pod-24-4x5mx": {}, + "/v1/default/Pod/fake-pod-24-4zzrq": {}, + "/v1/default/Pod/fake-pod-24-57n5p": {}, + "/v1/default/Pod/fake-pod-24-5g5rl": {}, + "/v1/default/Pod/fake-pod-24-5gppj": {}, + "/v1/default/Pod/fake-pod-24-5hwnh": {}, + "/v1/default/Pod/fake-pod-24-5m27m": {}, + "/v1/default/Pod/fake-pod-24-62vmf": {}, + "/v1/default/Pod/fake-pod-24-64zsj": {}, + "/v1/default/Pod/fake-pod-24-6bmh2": {}, + "/v1/default/Pod/fake-pod-24-6fbq2": {}, + "/v1/default/Pod/fake-pod-24-6hbch": {}, + "/v1/default/Pod/fake-pod-24-6mpm6": {}, + "/v1/default/Pod/fake-pod-24-6mw2l": {}, + "/v1/default/Pod/fake-pod-24-6qq7p": {}, + "/v1/default/Pod/fake-pod-24-6rvsn": {}, + "/v1/default/Pod/fake-pod-24-6sqck": {}, + "/v1/default/Pod/fake-pod-24-6v9db": {}, + "/v1/default/Pod/fake-pod-24-78cp6": {}, + "/v1/default/Pod/fake-pod-24-78jfp": {}, + "/v1/default/Pod/fake-pod-24-79bx2": {}, + "/v1/default/Pod/fake-pod-24-7cmn5": {}, + "/v1/default/Pod/fake-pod-24-7d5qv": {}, + "/v1/default/Pod/fake-pod-24-7f6ps": {}, + "/v1/default/Pod/fake-pod-24-7gqjv": {}, + "/v1/default/Pod/fake-pod-24-7h25c": {}, + "/v1/default/Pod/fake-pod-24-7jnd4": {}, + "/v1/default/Pod/fake-pod-24-7rs96": {}, + "/v1/default/Pod/fake-pod-24-7xsz8": {}, + "/v1/default/Pod/fake-pod-24-7z5bs": {}, + "/v1/default/Pod/fake-pod-24-86f67": {}, + "/v1/default/Pod/fake-pod-24-8bmhw": {}, + "/v1/default/Pod/fake-pod-24-8dc5f": {}, + "/v1/default/Pod/fake-pod-24-8dcfp": {}, + "/v1/default/Pod/fake-pod-24-8f44d": {}, + "/v1/default/Pod/fake-pod-24-8fbqr": {}, + "/v1/default/Pod/fake-pod-24-8fqdj": {}, + "/v1/default/Pod/fake-pod-24-8lltz": {}, + "/v1/default/Pod/fake-pod-24-8tmbd": {}, + "/v1/default/Pod/fake-pod-24-8wh48": {}, + "/v1/default/Pod/fake-pod-24-8z4l9": {}, + "/v1/default/Pod/fake-pod-24-96cw8": {}, + "/v1/default/Pod/fake-pod-24-96r8z": {}, + "/v1/default/Pod/fake-pod-24-98n4x": {}, + "/v1/default/Pod/fake-pod-24-9ct5v": {}, + "/v1/default/Pod/fake-pod-24-9d6qw": {}, + "/v1/default/Pod/fake-pod-24-9fznn": {}, + "/v1/default/Pod/fake-pod-24-9lztj": {}, + "/v1/default/Pod/fake-pod-24-9nn26": {}, + "/v1/default/Pod/fake-pod-24-9qth9": {}, + "/v1/default/Pod/fake-pod-24-9tchf": {}, + "/v1/default/Pod/fake-pod-24-b7vx2": {}, + "/v1/default/Pod/fake-pod-24-bgp5v": {}, + "/v1/default/Pod/fake-pod-24-bj2xw": {}, + "/v1/default/Pod/fake-pod-24-bkhbv": {}, + "/v1/default/Pod/fake-pod-24-bnff7": {}, + "/v1/default/Pod/fake-pod-24-bqbcx": {}, + "/v1/default/Pod/fake-pod-24-bzld4": {}, + "/v1/default/Pod/fake-pod-24-c8lr8": {}, + "/v1/default/Pod/fake-pod-24-cbsdk": {}, + "/v1/default/Pod/fake-pod-24-cbtc8": {}, + "/v1/default/Pod/fake-pod-24-cc6x9": {}, + "/v1/default/Pod/fake-pod-24-cdgbm": {}, + "/v1/default/Pod/fake-pod-24-cf2gn": {}, + "/v1/default/Pod/fake-pod-24-cj7zm": {}, + "/v1/default/Pod/fake-pod-24-cjw6q": {}, + "/v1/default/Pod/fake-pod-24-ckh9s": {}, + "/v1/default/Pod/fake-pod-24-cktrz": {}, + "/v1/default/Pod/fake-pod-24-cnkff": {}, + "/v1/default/Pod/fake-pod-24-cw788": {}, + "/v1/default/Pod/fake-pod-24-d2xfj": {}, + "/v1/default/Pod/fake-pod-24-d5dvl": {}, + "/v1/default/Pod/fake-pod-24-d7qvt": {}, + "/v1/default/Pod/fake-pod-24-d8kjb": {}, + "/v1/default/Pod/fake-pod-24-d97nd": {}, + "/v1/default/Pod/fake-pod-24-d9r7g": {}, + "/v1/default/Pod/fake-pod-24-dccvz": {}, + "/v1/default/Pod/fake-pod-24-ddsgv": {}, + "/v1/default/Pod/fake-pod-24-dgsv5": {}, + "/v1/default/Pod/fake-pod-24-djrwh": {}, + "/v1/default/Pod/fake-pod-24-dlkkx": {}, + "/v1/default/Pod/fake-pod-24-dtmqz": {}, + "/v1/default/Pod/fake-pod-24-dwzvd": {}, + "/v1/default/Pod/fake-pod-24-dxppx": {}, + "/v1/default/Pod/fake-pod-24-dzzdj": {}, + "/v1/default/Pod/fake-pod-24-f7n6w": {}, + "/v1/default/Pod/fake-pod-24-ffrl7": {}, + "/v1/default/Pod/fake-pod-24-fh6sb": {}, + "/v1/default/Pod/fake-pod-24-fj84k": {}, + "/v1/default/Pod/fake-pod-24-ft9xg": {}, + "/v1/default/Pod/fake-pod-24-ftr89": {}, + "/v1/default/Pod/fake-pod-24-fvrkv": {}, + "/v1/default/Pod/fake-pod-24-fwr7f": {}, + "/v1/default/Pod/fake-pod-24-fx6xl": {}, + "/v1/default/Pod/fake-pod-24-fx8vt": {}, + "/v1/default/Pod/fake-pod-24-fz7t9": {}, + "/v1/default/Pod/fake-pod-24-g84b6": {}, + "/v1/default/Pod/fake-pod-24-ggbk6": {}, + "/v1/default/Pod/fake-pod-24-ghpf2": {}, + "/v1/default/Pod/fake-pod-24-gjllr": {}, + "/v1/default/Pod/fake-pod-24-gll65": {}, + "/v1/default/Pod/fake-pod-24-gnrpp": {}, + "/v1/default/Pod/fake-pod-24-gv644": {}, + "/v1/default/Pod/fake-pod-24-h2plh": {}, + "/v1/default/Pod/fake-pod-24-h495p": {}, + "/v1/default/Pod/fake-pod-24-h8t7d": {}, + "/v1/default/Pod/fake-pod-24-hdb26": {}, + "/v1/default/Pod/fake-pod-24-hg4nh": {}, + "/v1/default/Pod/fake-pod-24-hkhns": {}, + "/v1/default/Pod/fake-pod-24-hpbgw": {}, + "/v1/default/Pod/fake-pod-24-hpqbp": {}, + "/v1/default/Pod/fake-pod-24-hrb7h": {}, + "/v1/default/Pod/fake-pod-24-hw7mr": {}, + "/v1/default/Pod/fake-pod-24-j7zdz": {}, + "/v1/default/Pod/fake-pod-24-jdnbz": {}, + "/v1/default/Pod/fake-pod-24-jjdgz": {}, + "/v1/default/Pod/fake-pod-24-jpc9v": {}, + "/v1/default/Pod/fake-pod-24-jtxwh": {}, + "/v1/default/Pod/fake-pod-24-jvqbb": {}, + "/v1/default/Pod/fake-pod-24-jxzmc": {}, + "/v1/default/Pod/fake-pod-24-kkx9x": {}, + "/v1/default/Pod/fake-pod-24-kn26g": {}, + "/v1/default/Pod/fake-pod-24-ksdkp": {}, + "/v1/default/Pod/fake-pod-24-kvcnx": {}, + "/v1/default/Pod/fake-pod-24-kvlv5": {}, + "/v1/default/Pod/fake-pod-24-kxfj5": {}, + "/v1/default/Pod/fake-pod-24-kxs5j": {}, + "/v1/default/Pod/fake-pod-24-l4g6l": {}, + "/v1/default/Pod/fake-pod-24-l5fc7": {}, + "/v1/default/Pod/fake-pod-24-l757p": {}, + "/v1/default/Pod/fake-pod-24-l8rjw": {}, + "/v1/default/Pod/fake-pod-24-l9lzn": {}, + "/v1/default/Pod/fake-pod-24-lbd8q": {}, + "/v1/default/Pod/fake-pod-24-ldn8l": {}, + "/v1/default/Pod/fake-pod-24-lgnvl": {}, + "/v1/default/Pod/fake-pod-24-llb6f": {}, + "/v1/default/Pod/fake-pod-24-lm7km": {}, + "/v1/default/Pod/fake-pod-24-lnmrw": {}, + "/v1/default/Pod/fake-pod-24-lnxsx": {}, + "/v1/default/Pod/fake-pod-24-lq6kw": {}, + "/v1/default/Pod/fake-pod-24-lqq6q": {}, + "/v1/default/Pod/fake-pod-24-lvlmx": {}, + "/v1/default/Pod/fake-pod-24-m5lrh": {}, + "/v1/default/Pod/fake-pod-24-mdlz8": {}, + "/v1/default/Pod/fake-pod-24-mfjgv": {}, + "/v1/default/Pod/fake-pod-24-mg7j7": {}, + "/v1/default/Pod/fake-pod-24-mlnhs": {}, + "/v1/default/Pod/fake-pod-24-mp66f": {}, + "/v1/default/Pod/fake-pod-24-mthp9": {}, + "/v1/default/Pod/fake-pod-24-mtqxw": {}, + "/v1/default/Pod/fake-pod-24-mvh68": {}, + "/v1/default/Pod/fake-pod-24-mx7r7": {}, + "/v1/default/Pod/fake-pod-24-mxc24": {}, + "/v1/default/Pod/fake-pod-24-mxjvh": {}, + "/v1/default/Pod/fake-pod-24-mzzkd": {}, + "/v1/default/Pod/fake-pod-24-n26l5": {}, + "/v1/default/Pod/fake-pod-24-n47th": {}, + "/v1/default/Pod/fake-pod-24-n5xxz": {}, + "/v1/default/Pod/fake-pod-24-n84pq": {}, + "/v1/default/Pod/fake-pod-24-n8qkc": {}, + "/v1/default/Pod/fake-pod-24-nbjpp": {}, + "/v1/default/Pod/fake-pod-24-ncd5r": {}, + "/v1/default/Pod/fake-pod-24-njh57": {}, + "/v1/default/Pod/fake-pod-24-nlthc": {}, + "/v1/default/Pod/fake-pod-24-np2rm": {}, + "/v1/default/Pod/fake-pod-24-npb7r": {}, + "/v1/default/Pod/fake-pod-24-npr4m": {}, + "/v1/default/Pod/fake-pod-24-nqbxm": {}, + "/v1/default/Pod/fake-pod-24-nrnd4": {}, + "/v1/default/Pod/fake-pod-24-nvwdg": {}, + "/v1/default/Pod/fake-pod-24-p2bbz": {}, + "/v1/default/Pod/fake-pod-24-p4fzh": {}, + "/v1/default/Pod/fake-pod-24-q45qv": {}, + "/v1/default/Pod/fake-pod-24-q4df7": {}, + "/v1/default/Pod/fake-pod-24-q75f8": {}, + "/v1/default/Pod/fake-pod-24-q8c2z": {}, + "/v1/default/Pod/fake-pod-24-q8dd2": {}, + "/v1/default/Pod/fake-pod-24-q9f2w": {}, + "/v1/default/Pod/fake-pod-24-qcj57": {}, + "/v1/default/Pod/fake-pod-24-qckst": {}, + "/v1/default/Pod/fake-pod-24-qdhfp": {}, + "/v1/default/Pod/fake-pod-24-qhs4x": {}, + "/v1/default/Pod/fake-pod-24-qml8c": {}, + "/v1/default/Pod/fake-pod-24-qqqmm": {}, + "/v1/default/Pod/fake-pod-24-qvhkn": {}, + "/v1/default/Pod/fake-pod-24-qvmbn": {}, + "/v1/default/Pod/fake-pod-24-qwssq": {}, + "/v1/default/Pod/fake-pod-24-rdm27": {}, + "/v1/default/Pod/fake-pod-24-rdqjm": {}, + "/v1/default/Pod/fake-pod-24-rhh9z": {}, + "/v1/default/Pod/fake-pod-24-rlxmq": {}, + "/v1/default/Pod/fake-pod-24-rm24r": {}, + "/v1/default/Pod/fake-pod-24-rsfnq": {}, + "/v1/default/Pod/fake-pod-24-rwc89": {}, + "/v1/default/Pod/fake-pod-24-rzjqt": {}, + "/v1/default/Pod/fake-pod-24-s247m": {}, + "/v1/default/Pod/fake-pod-24-s5cs7": {}, + "/v1/default/Pod/fake-pod-24-s6b7t": {}, + "/v1/default/Pod/fake-pod-24-s8n7j": {}, + "/v1/default/Pod/fake-pod-24-s9sxb": {}, + "/v1/default/Pod/fake-pod-24-sf264": {}, + "/v1/default/Pod/fake-pod-24-sfvxv": {}, + "/v1/default/Pod/fake-pod-24-smm2n": {}, + "/v1/default/Pod/fake-pod-24-spq2j": {}, + "/v1/default/Pod/fake-pod-24-sr6d4": {}, + "/v1/default/Pod/fake-pod-24-szv9l": {}, + "/v1/default/Pod/fake-pod-24-t2tj8": {}, + "/v1/default/Pod/fake-pod-24-t4llx": {}, + "/v1/default/Pod/fake-pod-24-t5d2v": {}, + "/v1/default/Pod/fake-pod-24-t5k4j": {}, + "/v1/default/Pod/fake-pod-24-t75wj": {}, + "/v1/default/Pod/fake-pod-24-t9r28": {}, + "/v1/default/Pod/fake-pod-24-tfgcc": {}, + "/v1/default/Pod/fake-pod-24-tgxv6": {}, + "/v1/default/Pod/fake-pod-24-tljbf": {}, + "/v1/default/Pod/fake-pod-24-tm8p6": {}, + "/v1/default/Pod/fake-pod-24-tq9t7": {}, + "/v1/default/Pod/fake-pod-24-ts2tc": {}, + "/v1/default/Pod/fake-pod-24-tvr4c": {}, + "/v1/default/Pod/fake-pod-24-twf27": {}, + "/v1/default/Pod/fake-pod-24-tzrdp": {}, + "/v1/default/Pod/fake-pod-24-v2jcf": {}, + "/v1/default/Pod/fake-pod-24-v6z6p": {}, + "/v1/default/Pod/fake-pod-24-v7vrf": {}, + "/v1/default/Pod/fake-pod-24-v8vb4": {}, + "/v1/default/Pod/fake-pod-24-v8wb6": {}, + "/v1/default/Pod/fake-pod-24-vbxvk": {}, + "/v1/default/Pod/fake-pod-24-vcl4j": {}, + "/v1/default/Pod/fake-pod-24-vd5rz": {}, + "/v1/default/Pod/fake-pod-24-vdkhv": {}, + "/v1/default/Pod/fake-pod-24-vdq6z": {}, + "/v1/default/Pod/fake-pod-24-vgp6t": {}, + "/v1/default/Pod/fake-pod-24-vjxq4": {}, + "/v1/default/Pod/fake-pod-24-vnhld": {}, + "/v1/default/Pod/fake-pod-24-vp99l": {}, + "/v1/default/Pod/fake-pod-24-vsf45": {}, + "/v1/default/Pod/fake-pod-24-vtt9f": {}, + "/v1/default/Pod/fake-pod-24-vxhmz": {}, + "/v1/default/Pod/fake-pod-24-w4fkm": {}, + "/v1/default/Pod/fake-pod-24-w56hf": {}, + "/v1/default/Pod/fake-pod-24-wb48p": {}, + "/v1/default/Pod/fake-pod-24-wfnbm": {}, + "/v1/default/Pod/fake-pod-24-wgqqp": {}, + "/v1/default/Pod/fake-pod-24-wjctm": {}, + "/v1/default/Pod/fake-pod-24-wjjts": {}, + "/v1/default/Pod/fake-pod-24-wklmd": {}, + "/v1/default/Pod/fake-pod-24-wll2z": {}, + "/v1/default/Pod/fake-pod-24-wn6tn": {}, + "/v1/default/Pod/fake-pod-24-wpjtw": {}, + "/v1/default/Pod/fake-pod-24-wshl8": {}, + "/v1/default/Pod/fake-pod-24-wspj9": {}, + "/v1/default/Pod/fake-pod-24-wsr47": {}, + "/v1/default/Pod/fake-pod-24-wtmmp": {}, + "/v1/default/Pod/fake-pod-24-wxj89": {}, + "/v1/default/Pod/fake-pod-24-wzl8p": {}, + "/v1/default/Pod/fake-pod-24-x5ndg": {}, + "/v1/default/Pod/fake-pod-24-x5xx8": {}, + "/v1/default/Pod/fake-pod-24-x6qtg": {}, + "/v1/default/Pod/fake-pod-24-x9sq8": {}, + "/v1/default/Pod/fake-pod-24-xb59z": {}, + "/v1/default/Pod/fake-pod-24-xcgb9": {}, + "/v1/default/Pod/fake-pod-24-xg57s": {}, + "/v1/default/Pod/fake-pod-24-xg86h": {}, + "/v1/default/Pod/fake-pod-24-xl85q": {}, + "/v1/default/Pod/fake-pod-24-xljcc": {}, + "/v1/default/Pod/fake-pod-24-xmrnj": {}, + "/v1/default/Pod/fake-pod-24-xmxjd": {}, + "/v1/default/Pod/fake-pod-24-xnqq2": {}, + "/v1/default/Pod/fake-pod-24-xpzd6": {}, + "/v1/default/Pod/fake-pod-24-xvskd": {}, + "/v1/default/Pod/fake-pod-24-xxhq6": {}, + "/v1/default/Pod/fake-pod-24-xzsgx": {}, + "/v1/default/Pod/fake-pod-24-z2bgx": {}, + "/v1/default/Pod/fake-pod-24-z7rmr": {}, + "/v1/default/Pod/fake-pod-24-zft2f": {}, + "/v1/default/Pod/fake-pod-24-zkqch": {}, + "/v1/default/Pod/fake-pod-24-zlg67": {}, + "/v1/default/Pod/fake-pod-24-znbfn": {}, + "/v1/default/Pod/fake-pod-24-znjx2": {}, + "/v1/default/Pod/fake-pod-24-zrkl6": {}, + "/v1/default/Pod/fake-pod-24-zs6n5": {}, + "/v1/default/Pod/fake-pod-24-zsxjn": {}, + "/v1/default/Pod/fake-pod-24-zvszw": {}, + "/v1/default/Pod/fake-pod-25-2272r": {}, + "/v1/default/Pod/fake-pod-25-24wk2": {}, + "/v1/default/Pod/fake-pod-25-2746p": {}, + "/v1/default/Pod/fake-pod-25-28qrj": {}, + "/v1/default/Pod/fake-pod-25-28vd8": {}, + "/v1/default/Pod/fake-pod-25-2ckt6": {}, + "/v1/default/Pod/fake-pod-25-2clgz": {}, + "/v1/default/Pod/fake-pod-25-2dxk9": {}, + "/v1/default/Pod/fake-pod-25-2gmgc": {}, + "/v1/default/Pod/fake-pod-25-2lvws": {}, + "/v1/default/Pod/fake-pod-25-2nc7p": {}, + "/v1/default/Pod/fake-pod-25-2px82": {}, + "/v1/default/Pod/fake-pod-25-2qppt": {}, + "/v1/default/Pod/fake-pod-25-2qtqx": {}, + "/v1/default/Pod/fake-pod-25-2r8nx": {}, + "/v1/default/Pod/fake-pod-25-2zb2t": {}, + "/v1/default/Pod/fake-pod-25-2zrnd": {}, + "/v1/default/Pod/fake-pod-25-455z5": {}, + "/v1/default/Pod/fake-pod-25-46jcp": {}, + "/v1/default/Pod/fake-pod-25-46rhr": {}, + "/v1/default/Pod/fake-pod-25-495l5": {}, + "/v1/default/Pod/fake-pod-25-49hzw": {}, + "/v1/default/Pod/fake-pod-25-4jrfx": {}, + "/v1/default/Pod/fake-pod-25-4pdsw": {}, + "/v1/default/Pod/fake-pod-25-4qnqr": {}, + "/v1/default/Pod/fake-pod-25-4rd6f": {}, + "/v1/default/Pod/fake-pod-25-4rh4x": {}, + "/v1/default/Pod/fake-pod-25-4tzz4": {}, + "/v1/default/Pod/fake-pod-25-4zcbg": {}, + "/v1/default/Pod/fake-pod-25-5497g": {}, + "/v1/default/Pod/fake-pod-25-54ffx": {}, + "/v1/default/Pod/fake-pod-25-58grm": {}, + "/v1/default/Pod/fake-pod-25-58snm": {}, + "/v1/default/Pod/fake-pod-25-5cr6l": {}, + "/v1/default/Pod/fake-pod-25-5fc25": {}, + "/v1/default/Pod/fake-pod-25-5h6vq": {}, + "/v1/default/Pod/fake-pod-25-5l54m": {}, + "/v1/default/Pod/fake-pod-25-5ljw7": {}, + "/v1/default/Pod/fake-pod-25-5rp72": {}, + "/v1/default/Pod/fake-pod-25-5vkfr": {}, + "/v1/default/Pod/fake-pod-25-5vvzz": {}, + "/v1/default/Pod/fake-pod-25-64x9r": {}, + "/v1/default/Pod/fake-pod-25-69wwf": {}, + "/v1/default/Pod/fake-pod-25-6dp2c": {}, + "/v1/default/Pod/fake-pod-25-6hj7h": {}, + "/v1/default/Pod/fake-pod-25-6m2rb": {}, + "/v1/default/Pod/fake-pod-25-76qv7": {}, + "/v1/default/Pod/fake-pod-25-7gwbr": {}, + "/v1/default/Pod/fake-pod-25-7jrzm": {}, + "/v1/default/Pod/fake-pod-25-7n5c2": {}, + "/v1/default/Pod/fake-pod-25-7tpvq": {}, + "/v1/default/Pod/fake-pod-25-7xmp9": {}, + "/v1/default/Pod/fake-pod-25-899t6": {}, + "/v1/default/Pod/fake-pod-25-8f4wk": {}, + "/v1/default/Pod/fake-pod-25-8fddw": {}, + "/v1/default/Pod/fake-pod-25-8kpg5": {}, + "/v1/default/Pod/fake-pod-25-8ll8t": {}, + "/v1/default/Pod/fake-pod-25-8nrzn": {}, + "/v1/default/Pod/fake-pod-25-8p9rn": {}, + "/v1/default/Pod/fake-pod-25-8qfb9": {}, + "/v1/default/Pod/fake-pod-25-8qknx": {}, + "/v1/default/Pod/fake-pod-25-8skn6": {}, + "/v1/default/Pod/fake-pod-25-8vbql": {}, + "/v1/default/Pod/fake-pod-25-95gzv": {}, + "/v1/default/Pod/fake-pod-25-98rsc": {}, + "/v1/default/Pod/fake-pod-25-9cxnp": {}, + "/v1/default/Pod/fake-pod-25-9d6kc": {}, + "/v1/default/Pod/fake-pod-25-9fxp7": {}, + "/v1/default/Pod/fake-pod-25-9gpnl": {}, + "/v1/default/Pod/fake-pod-25-9hdwr": {}, + "/v1/default/Pod/fake-pod-25-9hpw7": {}, + "/v1/default/Pod/fake-pod-25-9j7xh": {}, + "/v1/default/Pod/fake-pod-25-9mg68": {}, + "/v1/default/Pod/fake-pod-25-9mtl6": {}, + "/v1/default/Pod/fake-pod-25-9nbmd": {}, + "/v1/default/Pod/fake-pod-25-9nr2f": {}, + "/v1/default/Pod/fake-pod-25-9sls5": {}, + "/v1/default/Pod/fake-pod-25-9srft": {}, + "/v1/default/Pod/fake-pod-25-9vwhr": {}, + "/v1/default/Pod/fake-pod-25-9x25r": {}, + "/v1/default/Pod/fake-pod-25-b2gj9": {}, + "/v1/default/Pod/fake-pod-25-b2ktw": {}, + "/v1/default/Pod/fake-pod-25-bcsvw": {}, + "/v1/default/Pod/fake-pod-25-bfwzg": {}, + "/v1/default/Pod/fake-pod-25-bh7js": {}, + "/v1/default/Pod/fake-pod-25-bjtk5": {}, + "/v1/default/Pod/fake-pod-25-brrx2": {}, + "/v1/default/Pod/fake-pod-25-bxnxf": {}, + "/v1/default/Pod/fake-pod-25-bxpj4": {}, + "/v1/default/Pod/fake-pod-25-bxq4v": {}, + "/v1/default/Pod/fake-pod-25-c88qt": {}, + "/v1/default/Pod/fake-pod-25-c9bc8": {}, + "/v1/default/Pod/fake-pod-25-c9jvz": {}, + "/v1/default/Pod/fake-pod-25-cd2rp": {}, + "/v1/default/Pod/fake-pod-25-cdl7t": {}, + "/v1/default/Pod/fake-pod-25-cgkwv": {}, + "/v1/default/Pod/fake-pod-25-ch7xm": {}, + "/v1/default/Pod/fake-pod-25-cr6rg": {}, + "/v1/default/Pod/fake-pod-25-ct2k9": {}, + "/v1/default/Pod/fake-pod-25-cv4hr": {}, + "/v1/default/Pod/fake-pod-25-cwszq": {}, + "/v1/default/Pod/fake-pod-25-cxhj4": {}, + "/v1/default/Pod/fake-pod-25-czb77": {}, + "/v1/default/Pod/fake-pod-25-d4b2t": {}, + "/v1/default/Pod/fake-pod-25-d6ddj": {}, + "/v1/default/Pod/fake-pod-25-dg88c": {}, + "/v1/default/Pod/fake-pod-25-dht7j": {}, + "/v1/default/Pod/fake-pod-25-dk6pt": {}, + "/v1/default/Pod/fake-pod-25-dkf8b": {}, + "/v1/default/Pod/fake-pod-25-dkkzm": {}, + "/v1/default/Pod/fake-pod-25-dmhrx": {}, + "/v1/default/Pod/fake-pod-25-dq4ft": {}, + "/v1/default/Pod/fake-pod-25-dvsch": {}, + "/v1/default/Pod/fake-pod-25-dzjn4": {}, + "/v1/default/Pod/fake-pod-25-f2vpz": {}, + "/v1/default/Pod/fake-pod-25-f7pbl": {}, + "/v1/default/Pod/fake-pod-25-fdqh8": {}, + "/v1/default/Pod/fake-pod-25-frhbj": {}, + "/v1/default/Pod/fake-pod-25-fvd2n": {}, + "/v1/default/Pod/fake-pod-25-fw5vf": {}, + "/v1/default/Pod/fake-pod-25-fzntt": {}, + "/v1/default/Pod/fake-pod-25-g4v4k": {}, + "/v1/default/Pod/fake-pod-25-g68cj": {}, + "/v1/default/Pod/fake-pod-25-g6mr5": {}, + "/v1/default/Pod/fake-pod-25-gg7jj": {}, + "/v1/default/Pod/fake-pod-25-ghhhl": {}, + "/v1/default/Pod/fake-pod-25-gkxlh": {}, + "/v1/default/Pod/fake-pod-25-gmsq2": {}, + "/v1/default/Pod/fake-pod-25-gnv67": {}, + "/v1/default/Pod/fake-pod-25-grj9h": {}, + "/v1/default/Pod/fake-pod-25-gtsrd": {}, + "/v1/default/Pod/fake-pod-25-gzwmj": {}, + "/v1/default/Pod/fake-pod-25-h7z4q": {}, + "/v1/default/Pod/fake-pod-25-hdszs": {}, + "/v1/default/Pod/fake-pod-25-htpjn": {}, + "/v1/default/Pod/fake-pod-25-hz7q5": {}, + "/v1/default/Pod/fake-pod-25-j5l8h": {}, + "/v1/default/Pod/fake-pod-25-j8lsc": {}, + "/v1/default/Pod/fake-pod-25-jchgc": {}, + "/v1/default/Pod/fake-pod-25-jfbdx": {}, + "/v1/default/Pod/fake-pod-25-jhbd2": {}, + "/v1/default/Pod/fake-pod-25-jlrf4": {}, + "/v1/default/Pod/fake-pod-25-jp5k4": {}, + "/v1/default/Pod/fake-pod-25-jwm29": {}, + "/v1/default/Pod/fake-pod-25-k2x8r": {}, + "/v1/default/Pod/fake-pod-25-k8nw2": {}, + "/v1/default/Pod/fake-pod-25-khkjf": {}, + "/v1/default/Pod/fake-pod-25-khsb8": {}, + "/v1/default/Pod/fake-pod-25-kntws": {}, + "/v1/default/Pod/fake-pod-25-kr77h": {}, + "/v1/default/Pod/fake-pod-25-krd5s": {}, + "/v1/default/Pod/fake-pod-25-kvjdk": {}, + "/v1/default/Pod/fake-pod-25-kzpv9": {}, + "/v1/default/Pod/fake-pod-25-l25wq": {}, + "/v1/default/Pod/fake-pod-25-l2qg8": {}, + "/v1/default/Pod/fake-pod-25-l2zdk": {}, + "/v1/default/Pod/fake-pod-25-l8gbt": {}, + "/v1/default/Pod/fake-pod-25-l8kn8": {}, + "/v1/default/Pod/fake-pod-25-l9jnh": {}, + "/v1/default/Pod/fake-pod-25-lc76k": {}, + "/v1/default/Pod/fake-pod-25-lh448": {}, + "/v1/default/Pod/fake-pod-25-lqt5h": {}, + "/v1/default/Pod/fake-pod-25-lw256": {}, + "/v1/default/Pod/fake-pod-25-lztfx": {}, + "/v1/default/Pod/fake-pod-25-m2687": {}, + "/v1/default/Pod/fake-pod-25-m44nv": {}, + "/v1/default/Pod/fake-pod-25-m49bd": {}, + "/v1/default/Pod/fake-pod-25-m4dx4": {}, + "/v1/default/Pod/fake-pod-25-m4w4q": {}, + "/v1/default/Pod/fake-pod-25-m926v": {}, + "/v1/default/Pod/fake-pod-25-m9dsq": {}, + "/v1/default/Pod/fake-pod-25-mmrjl": {}, + "/v1/default/Pod/fake-pod-25-msb5m": {}, + "/v1/default/Pod/fake-pod-25-mxpxw": {}, + "/v1/default/Pod/fake-pod-25-mxq8n": {}, + "/v1/default/Pod/fake-pod-25-mzrrf": {}, + "/v1/default/Pod/fake-pod-25-n2kbr": {}, + "/v1/default/Pod/fake-pod-25-nbbmj": {}, + "/v1/default/Pod/fake-pod-25-ncg4b": {}, + "/v1/default/Pod/fake-pod-25-ndwjq": {}, + "/v1/default/Pod/fake-pod-25-npgxd": {}, + "/v1/default/Pod/fake-pod-25-ns6z6": {}, + "/v1/default/Pod/fake-pod-25-nwtqf": {}, + "/v1/default/Pod/fake-pod-25-p455p": {}, + "/v1/default/Pod/fake-pod-25-p8c7d": {}, + "/v1/default/Pod/fake-pod-25-p9hfg": {}, + "/v1/default/Pod/fake-pod-25-p9t7w": {}, + "/v1/default/Pod/fake-pod-25-pbx44": {}, + "/v1/default/Pod/fake-pod-25-pdbxl": {}, + "/v1/default/Pod/fake-pod-25-pdpcw": {}, + "/v1/default/Pod/fake-pod-25-pff9c": {}, + "/v1/default/Pod/fake-pod-25-pfk2g": {}, + "/v1/default/Pod/fake-pod-25-pmb87": {}, + "/v1/default/Pod/fake-pod-25-pmkmt": {}, + "/v1/default/Pod/fake-pod-25-pmprz": {}, + "/v1/default/Pod/fake-pod-25-prfnz": {}, + "/v1/default/Pod/fake-pod-25-ps926": {}, + "/v1/default/Pod/fake-pod-25-psf6s": {}, + "/v1/default/Pod/fake-pod-25-q5czn": {}, + "/v1/default/Pod/fake-pod-25-q5kf7": {}, + "/v1/default/Pod/fake-pod-25-q896v": {}, + "/v1/default/Pod/fake-pod-25-qgm4g": {}, + "/v1/default/Pod/fake-pod-25-qgtxx": {}, + "/v1/default/Pod/fake-pod-25-qh87h": {}, + "/v1/default/Pod/fake-pod-25-ql2k8": {}, + "/v1/default/Pod/fake-pod-25-qm85w": {}, + "/v1/default/Pod/fake-pod-25-qmkdt": {}, + "/v1/default/Pod/fake-pod-25-qr7kp": {}, + "/v1/default/Pod/fake-pod-25-r44nf": {}, + "/v1/default/Pod/fake-pod-25-r66p4": {}, + "/v1/default/Pod/fake-pod-25-r6x5d": {}, + "/v1/default/Pod/fake-pod-25-r7rj7": {}, + "/v1/default/Pod/fake-pod-25-r9wks": {}, + "/v1/default/Pod/fake-pod-25-rgkbc": {}, + "/v1/default/Pod/fake-pod-25-rksbt": {}, + "/v1/default/Pod/fake-pod-25-rnl6m": {}, + "/v1/default/Pod/fake-pod-25-rs9zq": {}, + "/v1/default/Pod/fake-pod-25-rtrpw": {}, + "/v1/default/Pod/fake-pod-25-rvnrg": {}, + "/v1/default/Pod/fake-pod-25-rwbhw": {}, + "/v1/default/Pod/fake-pod-25-rwtg5": {}, + "/v1/default/Pod/fake-pod-25-rxfc7": {}, + "/v1/default/Pod/fake-pod-25-rzmbg": {}, + "/v1/default/Pod/fake-pod-25-rznnc": {}, + "/v1/default/Pod/fake-pod-25-s2zz2": {}, + "/v1/default/Pod/fake-pod-25-s44rl": {}, + "/v1/default/Pod/fake-pod-25-s6dwz": {}, + "/v1/default/Pod/fake-pod-25-s8jwc": {}, + "/v1/default/Pod/fake-pod-25-sfcss": {}, + "/v1/default/Pod/fake-pod-25-sm527": {}, + "/v1/default/Pod/fake-pod-25-spkmt": {}, + "/v1/default/Pod/fake-pod-25-srg29": {}, + "/v1/default/Pod/fake-pod-25-srkj6": {}, + "/v1/default/Pod/fake-pod-25-ss5vr": {}, + "/v1/default/Pod/fake-pod-25-st4hg": {}, + "/v1/default/Pod/fake-pod-25-sxd2f": {}, + "/v1/default/Pod/fake-pod-25-sxw9b": {}, + "/v1/default/Pod/fake-pod-25-t2qtz": {}, + "/v1/default/Pod/fake-pod-25-t2z97": {}, + "/v1/default/Pod/fake-pod-25-t6h4j": {}, + "/v1/default/Pod/fake-pod-25-t8mm2": {}, + "/v1/default/Pod/fake-pod-25-th8w9": {}, + "/v1/default/Pod/fake-pod-25-tm8rg": {}, + "/v1/default/Pod/fake-pod-25-tphdc": {}, + "/v1/default/Pod/fake-pod-25-txpjp": {}, + "/v1/default/Pod/fake-pod-25-v5ggc": {}, + "/v1/default/Pod/fake-pod-25-v7txw": {}, + "/v1/default/Pod/fake-pod-25-v9l4m": {}, + "/v1/default/Pod/fake-pod-25-vbbrj": {}, + "/v1/default/Pod/fake-pod-25-vbqnt": {}, + "/v1/default/Pod/fake-pod-25-vdtkb": {}, + "/v1/default/Pod/fake-pod-25-vfhth": {}, + "/v1/default/Pod/fake-pod-25-vh4p2": {}, + "/v1/default/Pod/fake-pod-25-vmcvm": {}, + "/v1/default/Pod/fake-pod-25-vp87z": {}, + "/v1/default/Pod/fake-pod-25-vqbr6": {}, + "/v1/default/Pod/fake-pod-25-vxrcf": {}, + "/v1/default/Pod/fake-pod-25-vztfp": {}, + "/v1/default/Pod/fake-pod-25-vzzs8": {}, + "/v1/default/Pod/fake-pod-25-w48v9": {}, + "/v1/default/Pod/fake-pod-25-w4r6r": {}, + "/v1/default/Pod/fake-pod-25-w66lq": {}, + "/v1/default/Pod/fake-pod-25-wctcn": {}, + "/v1/default/Pod/fake-pod-25-wdm56": {}, + "/v1/default/Pod/fake-pod-25-wkv25": {}, + "/v1/default/Pod/fake-pod-25-wpjvt": {}, + "/v1/default/Pod/fake-pod-25-wxxj8": {}, + "/v1/default/Pod/fake-pod-25-x8bv7": {}, + "/v1/default/Pod/fake-pod-25-x8hf5": {}, + "/v1/default/Pod/fake-pod-25-x9lrk": {}, + "/v1/default/Pod/fake-pod-25-xg2rr": {}, + "/v1/default/Pod/fake-pod-25-xj88s": {}, + "/v1/default/Pod/fake-pod-25-xkppt": {}, + "/v1/default/Pod/fake-pod-25-xl8pf": {}, + "/v1/default/Pod/fake-pod-25-xp859": {}, + "/v1/default/Pod/fake-pod-25-xq67h": {}, + "/v1/default/Pod/fake-pod-25-z4g9g": {}, + "/v1/default/Pod/fake-pod-25-z4xl9": {}, + "/v1/default/Pod/fake-pod-25-z5mt9": {}, + "/v1/default/Pod/fake-pod-25-z79sl": {}, + "/v1/default/Pod/fake-pod-25-z9cck": {}, + "/v1/default/Pod/fake-pod-25-zdd8s": {}, + "/v1/default/Pod/fake-pod-25-zdkqr": {}, + "/v1/default/Pod/fake-pod-25-zfkqx": {}, + "/v1/default/Pod/fake-pod-25-zggb6": {}, + "/v1/default/Pod/fake-pod-25-zh445": {}, + "/v1/default/Pod/fake-pod-25-zkdx5": {}, + "/v1/default/Pod/fake-pod-25-zkt6p": {}, + "/v1/default/Pod/fake-pod-25-zldrc": {}, + "/v1/default/Pod/fake-pod-25-zmjtw": {}, + "/v1/default/Pod/fake-pod-25-zmsrp": {}, + "/v1/default/Pod/fake-pod-25-zpft8": {}, + "/v1/default/Pod/fake-pod-25-zpk76": {}, + "/v1/default/Pod/fake-pod-25-zrwxm": {}, + "/v1/default/Pod/fake-pod-25-ztbfp": {}, + "/v1/default/Pod/fake-pod-25-zvdrm": {}, + "/v1/default/Pod/fake-pod-25-zx2w4": {}, + "/v1/default/Pod/fake-pod-25-zx6z4": {}, + "/v1/default/Pod/fake-pod-25-zzflq": {}, + "/v1/default/Pod/fake-pod-26-2ckf8": {}, + "/v1/default/Pod/fake-pod-26-2dr88": {}, + "/v1/default/Pod/fake-pod-26-2h4rh": {}, + "/v1/default/Pod/fake-pod-26-2hdd7": {}, + "/v1/default/Pod/fake-pod-26-2hmws": {}, + "/v1/default/Pod/fake-pod-26-2ltst": {}, + "/v1/default/Pod/fake-pod-26-2lxgb": {}, + "/v1/default/Pod/fake-pod-26-2qx29": {}, + "/v1/default/Pod/fake-pod-26-2sldc": {}, + "/v1/default/Pod/fake-pod-26-2xjhl": {}, + "/v1/default/Pod/fake-pod-26-44hr4": {}, + "/v1/default/Pod/fake-pod-26-49pvq": {}, + "/v1/default/Pod/fake-pod-26-4bzwn": {}, + "/v1/default/Pod/fake-pod-26-4gl57": {}, + "/v1/default/Pod/fake-pod-26-4krww": {}, + "/v1/default/Pod/fake-pod-26-4m7gx": {}, + "/v1/default/Pod/fake-pod-26-4mvtc": {}, + "/v1/default/Pod/fake-pod-26-4mwj5": {}, + "/v1/default/Pod/fake-pod-26-4p9mf": {}, + "/v1/default/Pod/fake-pod-26-4w9b6": {}, + "/v1/default/Pod/fake-pod-26-4zcwp": {}, + "/v1/default/Pod/fake-pod-26-57vt6": {}, + "/v1/default/Pod/fake-pod-26-5g72t": {}, + "/v1/default/Pod/fake-pod-26-5hx94": {}, + "/v1/default/Pod/fake-pod-26-5nfbf": {}, + "/v1/default/Pod/fake-pod-26-5pgmd": {}, + "/v1/default/Pod/fake-pod-26-67mp2": {}, + "/v1/default/Pod/fake-pod-26-6cj2z": {}, + "/v1/default/Pod/fake-pod-26-6jp26": {}, + "/v1/default/Pod/fake-pod-26-6kfjl": {}, + "/v1/default/Pod/fake-pod-26-6mh4j": {}, + "/v1/default/Pod/fake-pod-26-6smtv": {}, + "/v1/default/Pod/fake-pod-26-6wf9r": {}, + "/v1/default/Pod/fake-pod-26-6xltp": {}, + "/v1/default/Pod/fake-pod-26-6xmfg": {}, + "/v1/default/Pod/fake-pod-26-78bnl": {}, + "/v1/default/Pod/fake-pod-26-7c99p": {}, + "/v1/default/Pod/fake-pod-26-7clp4": {}, + "/v1/default/Pod/fake-pod-26-7f6tz": {}, + "/v1/default/Pod/fake-pod-26-7fz84": {}, + "/v1/default/Pod/fake-pod-26-7jbvn": {}, + "/v1/default/Pod/fake-pod-26-7mczt": {}, + "/v1/default/Pod/fake-pod-26-7r6m6": {}, + "/v1/default/Pod/fake-pod-26-7s59m": {}, + "/v1/default/Pod/fake-pod-26-7spzm": {}, + "/v1/default/Pod/fake-pod-26-7w8c2": {}, + "/v1/default/Pod/fake-pod-26-8d29d": {}, + "/v1/default/Pod/fake-pod-26-8dsvg": {}, + "/v1/default/Pod/fake-pod-26-8n6gt": {}, + "/v1/default/Pod/fake-pod-26-8plv4": {}, + "/v1/default/Pod/fake-pod-26-948mx": {}, + "/v1/default/Pod/fake-pod-26-95m7s": {}, + "/v1/default/Pod/fake-pod-26-96kp5": {}, + "/v1/default/Pod/fake-pod-26-986jt": {}, + "/v1/default/Pod/fake-pod-26-99fvg": {}, + "/v1/default/Pod/fake-pod-26-9bdzh": {}, + "/v1/default/Pod/fake-pod-26-9bmvk": {}, + "/v1/default/Pod/fake-pod-26-9h64l": {}, + "/v1/default/Pod/fake-pod-26-9jtf9": {}, + "/v1/default/Pod/fake-pod-26-9qnxv": {}, + "/v1/default/Pod/fake-pod-26-9tbjn": {}, + "/v1/default/Pod/fake-pod-26-9tvnp": {}, + "/v1/default/Pod/fake-pod-26-9zrnt": {}, + "/v1/default/Pod/fake-pod-26-b25t2": {}, + "/v1/default/Pod/fake-pod-26-b9j88": {}, + "/v1/default/Pod/fake-pod-26-bf77z": {}, + "/v1/default/Pod/fake-pod-26-bjbdb": {}, + "/v1/default/Pod/fake-pod-26-bm9j9": {}, + "/v1/default/Pod/fake-pod-26-br9m8": {}, + "/v1/default/Pod/fake-pod-26-bt8cz": {}, + "/v1/default/Pod/fake-pod-26-btrnd": {}, + "/v1/default/Pod/fake-pod-26-bxsk2": {}, + "/v1/default/Pod/fake-pod-26-bzngf": {}, + "/v1/default/Pod/fake-pod-26-c5rh2": {}, + "/v1/default/Pod/fake-pod-26-c7qm5": {}, + "/v1/default/Pod/fake-pod-26-c87p5": {}, + "/v1/default/Pod/fake-pod-26-cc4v2": {}, + "/v1/default/Pod/fake-pod-26-cdtxk": {}, + "/v1/default/Pod/fake-pod-26-cfvnw": {}, + "/v1/default/Pod/fake-pod-26-cjrxt": {}, + "/v1/default/Pod/fake-pod-26-cnq6n": {}, + "/v1/default/Pod/fake-pod-26-cqlgz": {}, + "/v1/default/Pod/fake-pod-26-ctn24": {}, + "/v1/default/Pod/fake-pod-26-ctwzs": {}, + "/v1/default/Pod/fake-pod-26-cw4kv": {}, + "/v1/default/Pod/fake-pod-26-cwblr": {}, + "/v1/default/Pod/fake-pod-26-d2n6v": {}, + "/v1/default/Pod/fake-pod-26-d4j9v": {}, + "/v1/default/Pod/fake-pod-26-d76hw": {}, + "/v1/default/Pod/fake-pod-26-dcwz7": {}, + "/v1/default/Pod/fake-pod-26-df8xk": {}, + "/v1/default/Pod/fake-pod-26-dh7fn": {}, + "/v1/default/Pod/fake-pod-26-dhvxs": {}, + "/v1/default/Pod/fake-pod-26-dknfg": {}, + "/v1/default/Pod/fake-pod-26-dl2v2": {}, + "/v1/default/Pod/fake-pod-26-dnn2s": {}, + "/v1/default/Pod/fake-pod-26-dnsdl": {}, + "/v1/default/Pod/fake-pod-26-dszjr": {}, + "/v1/default/Pod/fake-pod-26-dzxpp": {}, + "/v1/default/Pod/fake-pod-26-f4k58": {}, + "/v1/default/Pod/fake-pod-26-f9kfd": {}, + "/v1/default/Pod/fake-pod-26-ff7lw": {}, + "/v1/default/Pod/fake-pod-26-fpwg7": {}, + "/v1/default/Pod/fake-pod-26-ft2jw": {}, + "/v1/default/Pod/fake-pod-26-ftj7d": {}, + "/v1/default/Pod/fake-pod-26-fwsg2": {}, + "/v1/default/Pod/fake-pod-26-g5qr2": {}, + "/v1/default/Pod/fake-pod-26-g9fj9": {}, + "/v1/default/Pod/fake-pod-26-ghgbx": {}, + "/v1/default/Pod/fake-pod-26-gv72b": {}, + "/v1/default/Pod/fake-pod-26-gx5xz": {}, + "/v1/default/Pod/fake-pod-26-gzgds": {}, + "/v1/default/Pod/fake-pod-26-h8csp": {}, + "/v1/default/Pod/fake-pod-26-h9g7d": {}, + "/v1/default/Pod/fake-pod-26-hd6h5": {}, + "/v1/default/Pod/fake-pod-26-hkqkg": {}, + "/v1/default/Pod/fake-pod-26-hm8fv": {}, + "/v1/default/Pod/fake-pod-26-hn5rn": {}, + "/v1/default/Pod/fake-pod-26-hpgxd": {}, + "/v1/default/Pod/fake-pod-26-hpx4h": {}, + "/v1/default/Pod/fake-pod-26-hszwh": {}, + "/v1/default/Pod/fake-pod-26-hthrl": {}, + "/v1/default/Pod/fake-pod-26-hwfdg": {}, + "/v1/default/Pod/fake-pod-26-hwzdh": {}, + "/v1/default/Pod/fake-pod-26-j57nr": {}, + "/v1/default/Pod/fake-pod-26-j5gph": {}, + "/v1/default/Pod/fake-pod-26-jdp5z": {}, + "/v1/default/Pod/fake-pod-26-jkvgr": {}, + "/v1/default/Pod/fake-pod-26-jm524": {}, + "/v1/default/Pod/fake-pod-26-jvt9v": {}, + "/v1/default/Pod/fake-pod-26-jwmxb": {}, + "/v1/default/Pod/fake-pod-26-k55hq": {}, + "/v1/default/Pod/fake-pod-26-k5dld": {}, + "/v1/default/Pod/fake-pod-26-k7k48": {}, + "/v1/default/Pod/fake-pod-26-k8jgn": {}, + "/v1/default/Pod/fake-pod-26-kbrtn": {}, + "/v1/default/Pod/fake-pod-26-kd7l7": {}, + "/v1/default/Pod/fake-pod-26-kfqs5": {}, + "/v1/default/Pod/fake-pod-26-kkbh4": {}, + "/v1/default/Pod/fake-pod-26-kmfxl": {}, + "/v1/default/Pod/fake-pod-26-kmgmc": {}, + "/v1/default/Pod/fake-pod-26-kmwh5": {}, + "/v1/default/Pod/fake-pod-26-kpwtn": {}, + "/v1/default/Pod/fake-pod-26-l5dhv": {}, + "/v1/default/Pod/fake-pod-26-l6cfw": {}, + "/v1/default/Pod/fake-pod-26-l6fkx": {}, + "/v1/default/Pod/fake-pod-26-l78vq": {}, + "/v1/default/Pod/fake-pod-26-l8dc2": {}, + "/v1/default/Pod/fake-pod-26-l9vkq": {}, + "/v1/default/Pod/fake-pod-26-lbmzq": {}, + "/v1/default/Pod/fake-pod-26-ld5c9": {}, + "/v1/default/Pod/fake-pod-26-ljwgh": {}, + "/v1/default/Pod/fake-pod-26-lklk4": {}, + "/v1/default/Pod/fake-pod-26-lmkpm": {}, + "/v1/default/Pod/fake-pod-26-lqqxb": {}, + "/v1/default/Pod/fake-pod-26-lqsvr": {}, + "/v1/default/Pod/fake-pod-26-ls5ws": {}, + "/v1/default/Pod/fake-pod-26-lsg89": {}, + "/v1/default/Pod/fake-pod-26-lsrmp": {}, + "/v1/default/Pod/fake-pod-26-lwjws": {}, + "/v1/default/Pod/fake-pod-26-lz7jx": {}, + "/v1/default/Pod/fake-pod-26-m6lpm": {}, + "/v1/default/Pod/fake-pod-26-m9xrx": {}, + "/v1/default/Pod/fake-pod-26-mcnjn": {}, + "/v1/default/Pod/fake-pod-26-mcw86": {}, + "/v1/default/Pod/fake-pod-26-mfdmw": {}, + "/v1/default/Pod/fake-pod-26-mmwmg": {}, + "/v1/default/Pod/fake-pod-26-mnmhl": {}, + "/v1/default/Pod/fake-pod-26-mpj5z": {}, + "/v1/default/Pod/fake-pod-26-mq4r7": {}, + "/v1/default/Pod/fake-pod-26-mttf9": {}, + "/v1/default/Pod/fake-pod-26-mzf8d": {}, + "/v1/default/Pod/fake-pod-26-n4dzp": {}, + "/v1/default/Pod/fake-pod-26-n754q": {}, + "/v1/default/Pod/fake-pod-26-n7zss": {}, + "/v1/default/Pod/fake-pod-26-n8t64": {}, + "/v1/default/Pod/fake-pod-26-nh72z": {}, + "/v1/default/Pod/fake-pod-26-nhzx2": {}, + "/v1/default/Pod/fake-pod-26-nk2cz": {}, + "/v1/default/Pod/fake-pod-26-nknp2": {}, + "/v1/default/Pod/fake-pod-26-nmnlt": {}, + "/v1/default/Pod/fake-pod-26-nqv6t": {}, + "/v1/default/Pod/fake-pod-26-nr6lz": {}, + "/v1/default/Pod/fake-pod-26-nwxlf": {}, + "/v1/default/Pod/fake-pod-26-nx4j4": {}, + "/v1/default/Pod/fake-pod-26-nxhbg": {}, + "/v1/default/Pod/fake-pod-26-p69b9": {}, + "/v1/default/Pod/fake-pod-26-p7sw2": {}, + "/v1/default/Pod/fake-pod-26-p9x6l": {}, + "/v1/default/Pod/fake-pod-26-pcwdr": {}, + "/v1/default/Pod/fake-pod-26-pf459": {}, + "/v1/default/Pod/fake-pod-26-pgtxp": {}, + "/v1/default/Pod/fake-pod-26-pj4nd": {}, + "/v1/default/Pod/fake-pod-26-pkcr2": {}, + "/v1/default/Pod/fake-pod-26-pn4hg": {}, + "/v1/default/Pod/fake-pod-26-pn557": {}, + "/v1/default/Pod/fake-pod-26-pnqvw": {}, + "/v1/default/Pod/fake-pod-26-ppdlv": {}, + "/v1/default/Pod/fake-pod-26-pxr9q": {}, + "/v1/default/Pod/fake-pod-26-q26gp": {}, + "/v1/default/Pod/fake-pod-26-q5k5p": {}, + "/v1/default/Pod/fake-pod-26-q6nh4": {}, + "/v1/default/Pod/fake-pod-26-q8rxc": {}, + "/v1/default/Pod/fake-pod-26-q97s5": {}, + "/v1/default/Pod/fake-pod-26-qb2jr": {}, + "/v1/default/Pod/fake-pod-26-qcg75": {}, + "/v1/default/Pod/fake-pod-26-qcss4": {}, + "/v1/default/Pod/fake-pod-26-qdmfr": {}, + "/v1/default/Pod/fake-pod-26-qdrt2": {}, + "/v1/default/Pod/fake-pod-26-qjv5j": {}, + "/v1/default/Pod/fake-pod-26-qn2lc": {}, + "/v1/default/Pod/fake-pod-26-qr6tx": {}, + "/v1/default/Pod/fake-pod-26-qrxfp": {}, + "/v1/default/Pod/fake-pod-26-qtwpr": {}, + "/v1/default/Pod/fake-pod-26-r2lt7": {}, + "/v1/default/Pod/fake-pod-26-rdxmk": {}, + "/v1/default/Pod/fake-pod-26-rf49c": {}, + "/v1/default/Pod/fake-pod-26-rfjbp": {}, + "/v1/default/Pod/fake-pod-26-rgqmt": {}, + "/v1/default/Pod/fake-pod-26-rvdvf": {}, + "/v1/default/Pod/fake-pod-26-s47v4": {}, + "/v1/default/Pod/fake-pod-26-s562v": {}, + "/v1/default/Pod/fake-pod-26-s7s56": {}, + "/v1/default/Pod/fake-pod-26-s8lrz": {}, + "/v1/default/Pod/fake-pod-26-s9wsr": {}, + "/v1/default/Pod/fake-pod-26-sfzqv": {}, + "/v1/default/Pod/fake-pod-26-sldjc": {}, + "/v1/default/Pod/fake-pod-26-sldqv": {}, + "/v1/default/Pod/fake-pod-26-ssg97": {}, + "/v1/default/Pod/fake-pod-26-st77d": {}, + "/v1/default/Pod/fake-pod-26-svwgq": {}, + "/v1/default/Pod/fake-pod-26-szmv7": {}, + "/v1/default/Pod/fake-pod-26-t222g": {}, + "/v1/default/Pod/fake-pod-26-t6bxd": {}, + "/v1/default/Pod/fake-pod-26-t6pj7": {}, + "/v1/default/Pod/fake-pod-26-t7288": {}, + "/v1/default/Pod/fake-pod-26-t9k8w": {}, + "/v1/default/Pod/fake-pod-26-tbm8m": {}, + "/v1/default/Pod/fake-pod-26-tbzbf": {}, + "/v1/default/Pod/fake-pod-26-tcxdk": {}, + "/v1/default/Pod/fake-pod-26-th4wl": {}, + "/v1/default/Pod/fake-pod-26-thfkv": {}, + "/v1/default/Pod/fake-pod-26-tjkxq": {}, + "/v1/default/Pod/fake-pod-26-tlhj9": {}, + "/v1/default/Pod/fake-pod-26-tmpfg": {}, + "/v1/default/Pod/fake-pod-26-tng6d": {}, + "/v1/default/Pod/fake-pod-26-tp57n": {}, + "/v1/default/Pod/fake-pod-26-tqzd4": {}, + "/v1/default/Pod/fake-pod-26-tqzs2": {}, + "/v1/default/Pod/fake-pod-26-tvj7d": {}, + "/v1/default/Pod/fake-pod-26-tz7w7": {}, + "/v1/default/Pod/fake-pod-26-v8stf": {}, + "/v1/default/Pod/fake-pod-26-v92r6": {}, + "/v1/default/Pod/fake-pod-26-vb29j": {}, + "/v1/default/Pod/fake-pod-26-vd522": {}, + "/v1/default/Pod/fake-pod-26-vfmdc": {}, + "/v1/default/Pod/fake-pod-26-vmk2h": {}, + "/v1/default/Pod/fake-pod-26-vpzbk": {}, + "/v1/default/Pod/fake-pod-26-vr9cb": {}, + "/v1/default/Pod/fake-pod-26-vrqmh": {}, + "/v1/default/Pod/fake-pod-26-vzcmb": {}, + "/v1/default/Pod/fake-pod-26-w2l8w": {}, + "/v1/default/Pod/fake-pod-26-w46jc": {}, + "/v1/default/Pod/fake-pod-26-w6h2p": {}, + "/v1/default/Pod/fake-pod-26-w7d6w": {}, + "/v1/default/Pod/fake-pod-26-wc2dq": {}, + "/v1/default/Pod/fake-pod-26-wjsv7": {}, + "/v1/default/Pod/fake-pod-26-wknxm": {}, + "/v1/default/Pod/fake-pod-26-wmm72": {}, + "/v1/default/Pod/fake-pod-26-wmmbk": {}, + "/v1/default/Pod/fake-pod-26-wn66b": {}, + "/v1/default/Pod/fake-pod-26-wprkx": {}, + "/v1/default/Pod/fake-pod-26-wqdqq": {}, + "/v1/default/Pod/fake-pod-26-wrctm": {}, + "/v1/default/Pod/fake-pod-26-wsqrr": {}, + "/v1/default/Pod/fake-pod-26-wwmvr": {}, + "/v1/default/Pod/fake-pod-26-wxhpw": {}, + "/v1/default/Pod/fake-pod-26-x2l2j": {}, + "/v1/default/Pod/fake-pod-26-x2nxt": {}, + "/v1/default/Pod/fake-pod-26-x2pjg": {}, + "/v1/default/Pod/fake-pod-26-x52bc": {}, + "/v1/default/Pod/fake-pod-26-x6lg4": {}, + "/v1/default/Pod/fake-pod-26-x7vk8": {}, + "/v1/default/Pod/fake-pod-26-xdnmb": {}, + "/v1/default/Pod/fake-pod-26-xgq9c": {}, + "/v1/default/Pod/fake-pod-26-xgxst": {}, + "/v1/default/Pod/fake-pod-26-xlc8h": {}, + "/v1/default/Pod/fake-pod-26-xn8wf": {}, + "/v1/default/Pod/fake-pod-26-xxmxc": {}, + "/v1/default/Pod/fake-pod-26-z2rf5": {}, + "/v1/default/Pod/fake-pod-26-z84kk": {}, + "/v1/default/Pod/fake-pod-26-z9kpg": {}, + "/v1/default/Pod/fake-pod-26-zdvxv": {}, + "/v1/default/Pod/fake-pod-26-znm6m": {}, + "/v1/default/Pod/fake-pod-26-zqmvf": {}, + "/v1/default/Pod/fake-pod-26-zvpwr": {}, + "/v1/default/Pod/fake-pod-26-zvwsv": {}, + "/v1/default/Pod/fake-pod-26-zxsj8": {}, + "/v1/default/Pod/fake-pod-26-zzdvb": {}, + "/v1/default/Pod/fake-pod-27-22w9l": {}, + "/v1/default/Pod/fake-pod-27-25wmh": {}, + "/v1/default/Pod/fake-pod-27-27779": {}, + "/v1/default/Pod/fake-pod-27-27r5m": {}, + "/v1/default/Pod/fake-pod-27-28xt2": {}, + "/v1/default/Pod/fake-pod-27-29b2x": {}, + "/v1/default/Pod/fake-pod-27-2c57h": {}, + "/v1/default/Pod/fake-pod-27-2d4zk": {}, + "/v1/default/Pod/fake-pod-27-2d5tp": {}, + "/v1/default/Pod/fake-pod-27-2dcks": {}, + "/v1/default/Pod/fake-pod-27-2gpvd": {}, + "/v1/default/Pod/fake-pod-27-2mnvv": {}, + "/v1/default/Pod/fake-pod-27-2p64d": {}, + "/v1/default/Pod/fake-pod-27-426wj": {}, + "/v1/default/Pod/fake-pod-27-427vc": {}, + "/v1/default/Pod/fake-pod-27-47w69": {}, + "/v1/default/Pod/fake-pod-27-48snc": {}, + "/v1/default/Pod/fake-pod-27-4flcd": {}, + "/v1/default/Pod/fake-pod-27-4mxnp": {}, + "/v1/default/Pod/fake-pod-27-4rs8w": {}, + "/v1/default/Pod/fake-pod-27-4rwgm": {}, + "/v1/default/Pod/fake-pod-27-4s8bf": {}, + "/v1/default/Pod/fake-pod-27-4t8v6": {}, + "/v1/default/Pod/fake-pod-27-4x7rb": {}, + "/v1/default/Pod/fake-pod-27-4x8p2": {}, + "/v1/default/Pod/fake-pod-27-58v44": {}, + "/v1/default/Pod/fake-pod-27-5ddp6": {}, + "/v1/default/Pod/fake-pod-27-5dm46": {}, + "/v1/default/Pod/fake-pod-27-5mtlb": {}, + "/v1/default/Pod/fake-pod-27-5mvbd": {}, + "/v1/default/Pod/fake-pod-27-5pktf": {}, + "/v1/default/Pod/fake-pod-27-5rhtv": {}, + "/v1/default/Pod/fake-pod-27-5s8zn": {}, + "/v1/default/Pod/fake-pod-27-5s9v4": {}, + "/v1/default/Pod/fake-pod-27-5v7s8": {}, + "/v1/default/Pod/fake-pod-27-649h5": {}, + "/v1/default/Pod/fake-pod-27-66mzz": {}, + "/v1/default/Pod/fake-pod-27-6757f": {}, + "/v1/default/Pod/fake-pod-27-67jw2": {}, + "/v1/default/Pod/fake-pod-27-686df": {}, + "/v1/default/Pod/fake-pod-27-68vlw": {}, + "/v1/default/Pod/fake-pod-27-6d48h": {}, + "/v1/default/Pod/fake-pod-27-6dg7l": {}, + "/v1/default/Pod/fake-pod-27-6dtv5": {}, + "/v1/default/Pod/fake-pod-27-6fhfh": {}, + "/v1/default/Pod/fake-pod-27-6fmqh": {}, + "/v1/default/Pod/fake-pod-27-6gpcs": {}, + "/v1/default/Pod/fake-pod-27-6h552": {}, + "/v1/default/Pod/fake-pod-27-6jrw9": {}, + "/v1/default/Pod/fake-pod-27-6ljph": {}, + "/v1/default/Pod/fake-pod-27-6rjdx": {}, + "/v1/default/Pod/fake-pod-27-6rknl": {}, + "/v1/default/Pod/fake-pod-27-6rm25": {}, + "/v1/default/Pod/fake-pod-27-6slpb": {}, + "/v1/default/Pod/fake-pod-27-6vk6n": {}, + "/v1/default/Pod/fake-pod-27-6wsgr": {}, + "/v1/default/Pod/fake-pod-27-6xpf8": {}, + "/v1/default/Pod/fake-pod-27-6zq8z": {}, + "/v1/default/Pod/fake-pod-27-7467m": {}, + "/v1/default/Pod/fake-pod-27-74khw": {}, + "/v1/default/Pod/fake-pod-27-74zdt": {}, + "/v1/default/Pod/fake-pod-27-7f226": {}, + "/v1/default/Pod/fake-pod-27-7fhfn": {}, + "/v1/default/Pod/fake-pod-27-7fwpw": {}, + "/v1/default/Pod/fake-pod-27-7gvmp": {}, + "/v1/default/Pod/fake-pod-27-7jbkr": {}, + "/v1/default/Pod/fake-pod-27-7jdvl": {}, + "/v1/default/Pod/fake-pod-27-7nmm6": {}, + "/v1/default/Pod/fake-pod-27-7r55k": {}, + "/v1/default/Pod/fake-pod-27-7sp7t": {}, + "/v1/default/Pod/fake-pod-27-7sqb7": {}, + "/v1/default/Pod/fake-pod-27-7tj6q": {}, + "/v1/default/Pod/fake-pod-27-7vbzg": {}, + "/v1/default/Pod/fake-pod-27-7wjr2": {}, + "/v1/default/Pod/fake-pod-27-84pws": {}, + "/v1/default/Pod/fake-pod-27-84rkf": {}, + "/v1/default/Pod/fake-pod-27-85x6f": {}, + "/v1/default/Pod/fake-pod-27-8bhqc": {}, + "/v1/default/Pod/fake-pod-27-8hbhn": {}, + "/v1/default/Pod/fake-pod-27-8p9gm": {}, + "/v1/default/Pod/fake-pod-27-8ppxm": {}, + "/v1/default/Pod/fake-pod-27-8zkzt": {}, + "/v1/default/Pod/fake-pod-27-8zp5t": {}, + "/v1/default/Pod/fake-pod-27-929gx": {}, + "/v1/default/Pod/fake-pod-27-9dpn7": {}, + "/v1/default/Pod/fake-pod-27-9gbg6": {}, + "/v1/default/Pod/fake-pod-27-9n2ff": {}, + "/v1/default/Pod/fake-pod-27-9pffr": {}, + "/v1/default/Pod/fake-pod-27-9t4nw": {}, + "/v1/default/Pod/fake-pod-27-9w9j4": {}, + "/v1/default/Pod/fake-pod-27-9z2m4": {}, + "/v1/default/Pod/fake-pod-27-b47kd": {}, + "/v1/default/Pod/fake-pod-27-bm2f4": {}, + "/v1/default/Pod/fake-pod-27-bnqk8": {}, + "/v1/default/Pod/fake-pod-27-bptx9": {}, + "/v1/default/Pod/fake-pod-27-bvnnz": {}, + "/v1/default/Pod/fake-pod-27-bxprk": {}, + "/v1/default/Pod/fake-pod-27-c26gd": {}, + "/v1/default/Pod/fake-pod-27-ccglk": {}, + "/v1/default/Pod/fake-pod-27-chcf9": {}, + "/v1/default/Pod/fake-pod-27-cjbtq": {}, + "/v1/default/Pod/fake-pod-27-cknfj": {}, + "/v1/default/Pod/fake-pod-27-cl22z": {}, + "/v1/default/Pod/fake-pod-27-csbzd": {}, + "/v1/default/Pod/fake-pod-27-cthkm": {}, + "/v1/default/Pod/fake-pod-27-cx6f9": {}, + "/v1/default/Pod/fake-pod-27-d24g2": {}, + "/v1/default/Pod/fake-pod-27-dccz2": {}, + "/v1/default/Pod/fake-pod-27-dd7f4": {}, + "/v1/default/Pod/fake-pod-27-dfh47": {}, + "/v1/default/Pod/fake-pod-27-dlcdm": {}, + "/v1/default/Pod/fake-pod-27-dp48w": {}, + "/v1/default/Pod/fake-pod-27-dv5fk": {}, + "/v1/default/Pod/fake-pod-27-f2g4x": {}, + "/v1/default/Pod/fake-pod-27-f75nc": {}, + "/v1/default/Pod/fake-pod-27-f87ll": {}, + "/v1/default/Pod/fake-pod-27-fbb9h": {}, + "/v1/default/Pod/fake-pod-27-fbnzp": {}, + "/v1/default/Pod/fake-pod-27-fdr7l": {}, + "/v1/default/Pod/fake-pod-27-fjbfr": {}, + "/v1/default/Pod/fake-pod-27-fmvzj": {}, + "/v1/default/Pod/fake-pod-27-fmz98": {}, + "/v1/default/Pod/fake-pod-27-g4h8g": {}, + "/v1/default/Pod/fake-pod-27-g4mcv": {}, + "/v1/default/Pod/fake-pod-27-g5w7b": {}, + "/v1/default/Pod/fake-pod-27-g9sz2": {}, + "/v1/default/Pod/fake-pod-27-gcgpp": {}, + "/v1/default/Pod/fake-pod-27-gf6xf": {}, + "/v1/default/Pod/fake-pod-27-gfzss": {}, + "/v1/default/Pod/fake-pod-27-gkwq8": {}, + "/v1/default/Pod/fake-pod-27-glxvw": {}, + "/v1/default/Pod/fake-pod-27-gn6g9": {}, + "/v1/default/Pod/fake-pod-27-gqj4r": {}, + "/v1/default/Pod/fake-pod-27-gt4mx": {}, + "/v1/default/Pod/fake-pod-27-gv6xm": {}, + "/v1/default/Pod/fake-pod-27-gv9pt": {}, + "/v1/default/Pod/fake-pod-27-gxl74": {}, + "/v1/default/Pod/fake-pod-27-h298s": {}, + "/v1/default/Pod/fake-pod-27-h84l6": {}, + "/v1/default/Pod/fake-pod-27-h8d82": {}, + "/v1/default/Pod/fake-pod-27-h9ncv": {}, + "/v1/default/Pod/fake-pod-27-hc4ww": {}, + "/v1/default/Pod/fake-pod-27-hcltg": {}, + "/v1/default/Pod/fake-pod-27-hd9kg": {}, + "/v1/default/Pod/fake-pod-27-hjkfx": {}, + "/v1/default/Pod/fake-pod-27-hx9xg": {}, + "/v1/default/Pod/fake-pod-27-hxnqh": {}, + "/v1/default/Pod/fake-pod-27-hzvcb": {}, + "/v1/default/Pod/fake-pod-27-j55ml": {}, + "/v1/default/Pod/fake-pod-27-j6mww": {}, + "/v1/default/Pod/fake-pod-27-j9l85": {}, + "/v1/default/Pod/fake-pod-27-j9mpv": {}, + "/v1/default/Pod/fake-pod-27-jbb9t": {}, + "/v1/default/Pod/fake-pod-27-jbl86": {}, + "/v1/default/Pod/fake-pod-27-jfll2": {}, + "/v1/default/Pod/fake-pod-27-jkxtx": {}, + "/v1/default/Pod/fake-pod-27-jld8d": {}, + "/v1/default/Pod/fake-pod-27-jmq8z": {}, + "/v1/default/Pod/fake-pod-27-js4qc": {}, + "/v1/default/Pod/fake-pod-27-jt4g4": {}, + "/v1/default/Pod/fake-pod-27-k2j2s": {}, + "/v1/default/Pod/fake-pod-27-k7247": {}, + "/v1/default/Pod/fake-pod-27-k7bfj": {}, + "/v1/default/Pod/fake-pod-27-kbhfb": {}, + "/v1/default/Pod/fake-pod-27-kgbkw": {}, + "/v1/default/Pod/fake-pod-27-kghrl": {}, + "/v1/default/Pod/fake-pod-27-kjt82": {}, + "/v1/default/Pod/fake-pod-27-kmjmr": {}, + "/v1/default/Pod/fake-pod-27-kpj98": {}, + "/v1/default/Pod/fake-pod-27-kqlv2": {}, + "/v1/default/Pod/fake-pod-27-ksfd7": {}, + "/v1/default/Pod/fake-pod-27-ktntd": {}, + "/v1/default/Pod/fake-pod-27-kwl95": {}, + "/v1/default/Pod/fake-pod-27-kzzmr": {}, + "/v1/default/Pod/fake-pod-27-l4pv8": {}, + "/v1/default/Pod/fake-pod-27-l7677": {}, + "/v1/default/Pod/fake-pod-27-ld2jt": {}, + "/v1/default/Pod/fake-pod-27-ljl68": {}, + "/v1/default/Pod/fake-pod-27-lpwzt": {}, + "/v1/default/Pod/fake-pod-27-lzlvw": {}, + "/v1/default/Pod/fake-pod-27-m5hgl": {}, + "/v1/default/Pod/fake-pod-27-mfdc7": {}, + "/v1/default/Pod/fake-pod-27-mjf2j": {}, + "/v1/default/Pod/fake-pod-27-mk49n": {}, + "/v1/default/Pod/fake-pod-27-mpgv2": {}, + "/v1/default/Pod/fake-pod-27-mzpxh": {}, + "/v1/default/Pod/fake-pod-27-n4zh4": {}, + "/v1/default/Pod/fake-pod-27-nb9j9": {}, + "/v1/default/Pod/fake-pod-27-nbbzx": {}, + "/v1/default/Pod/fake-pod-27-ng48c": {}, + "/v1/default/Pod/fake-pod-27-nlmkn": {}, + "/v1/default/Pod/fake-pod-27-nmdkq": {}, + "/v1/default/Pod/fake-pod-27-nmmn5": {}, + "/v1/default/Pod/fake-pod-27-p5nft": {}, + "/v1/default/Pod/fake-pod-27-p89pg": {}, + "/v1/default/Pod/fake-pod-27-p8vlf": {}, + "/v1/default/Pod/fake-pod-27-pdkbp": {}, + "/v1/default/Pod/fake-pod-27-pqdxl": {}, + "/v1/default/Pod/fake-pod-27-prfw6": {}, + "/v1/default/Pod/fake-pod-27-pswzn": {}, + "/v1/default/Pod/fake-pod-27-ptfck": {}, + "/v1/default/Pod/fake-pod-27-pwg58": {}, + "/v1/default/Pod/fake-pod-27-pz65s": {}, + "/v1/default/Pod/fake-pod-27-q2r6s": {}, + "/v1/default/Pod/fake-pod-27-q667q": {}, + "/v1/default/Pod/fake-pod-27-q9mqc": {}, + "/v1/default/Pod/fake-pod-27-qblgk": {}, + "/v1/default/Pod/fake-pod-27-qjwf8": {}, + "/v1/default/Pod/fake-pod-27-qpjvs": {}, + "/v1/default/Pod/fake-pod-27-qqkg7": {}, + "/v1/default/Pod/fake-pod-27-qqzjp": {}, + "/v1/default/Pod/fake-pod-27-qtcdm": {}, + "/v1/default/Pod/fake-pod-27-qwb67": {}, + "/v1/default/Pod/fake-pod-27-r22w8": {}, + "/v1/default/Pod/fake-pod-27-r7f6s": {}, + "/v1/default/Pod/fake-pod-27-rc6px": {}, + "/v1/default/Pod/fake-pod-27-rc9lq": {}, + "/v1/default/Pod/fake-pod-27-rdvgw": {}, + "/v1/default/Pod/fake-pod-27-rljxn": {}, + "/v1/default/Pod/fake-pod-27-rlm2x": {}, + "/v1/default/Pod/fake-pod-27-rqn2z": {}, + "/v1/default/Pod/fake-pod-27-rshwc": {}, + "/v1/default/Pod/fake-pod-27-rszs2": {}, + "/v1/default/Pod/fake-pod-27-rt4xm": {}, + "/v1/default/Pod/fake-pod-27-rvct2": {}, + "/v1/default/Pod/fake-pod-27-s27ng": {}, + "/v1/default/Pod/fake-pod-27-s2d57": {}, + "/v1/default/Pod/fake-pod-27-s5k86": {}, + "/v1/default/Pod/fake-pod-27-s5kr8": {}, + "/v1/default/Pod/fake-pod-27-s82w4": {}, + "/v1/default/Pod/fake-pod-27-scws2": {}, + "/v1/default/Pod/fake-pod-27-sqsh7": {}, + "/v1/default/Pod/fake-pod-27-st7gm": {}, + "/v1/default/Pod/fake-pod-27-stmb6": {}, + "/v1/default/Pod/fake-pod-27-stsl4": {}, + "/v1/default/Pod/fake-pod-27-stsxj": {}, + "/v1/default/Pod/fake-pod-27-sz8cw": {}, + "/v1/default/Pod/fake-pod-27-t42xj": {}, + "/v1/default/Pod/fake-pod-27-t49fs": {}, + "/v1/default/Pod/fake-pod-27-t82ff": {}, + "/v1/default/Pod/fake-pod-27-t9mp7": {}, + "/v1/default/Pod/fake-pod-27-tcbjh": {}, + "/v1/default/Pod/fake-pod-27-td6td": {}, + "/v1/default/Pod/fake-pod-27-tkfgs": {}, + "/v1/default/Pod/fake-pod-27-tzl8x": {}, + "/v1/default/Pod/fake-pod-27-v2qzh": {}, + "/v1/default/Pod/fake-pod-27-v4xvt": {}, + "/v1/default/Pod/fake-pod-27-v9tbz": {}, + "/v1/default/Pod/fake-pod-27-vbrqj": {}, + "/v1/default/Pod/fake-pod-27-vcrhw": {}, + "/v1/default/Pod/fake-pod-27-vcsw9": {}, + "/v1/default/Pod/fake-pod-27-vf74v": {}, + "/v1/default/Pod/fake-pod-27-vfdhj": {}, + "/v1/default/Pod/fake-pod-27-vfhg8": {}, + "/v1/default/Pod/fake-pod-27-vgvgs": {}, + "/v1/default/Pod/fake-pod-27-vh2pn": {}, + "/v1/default/Pod/fake-pod-27-vjj9n": {}, + "/v1/default/Pod/fake-pod-27-vjps7": {}, + "/v1/default/Pod/fake-pod-27-vkwzg": {}, + "/v1/default/Pod/fake-pod-27-vlbd6": {}, + "/v1/default/Pod/fake-pod-27-vr9jh": {}, + "/v1/default/Pod/fake-pod-27-vwgqs": {}, + "/v1/default/Pod/fake-pod-27-vx7gv": {}, + "/v1/default/Pod/fake-pod-27-vzkml": {}, + "/v1/default/Pod/fake-pod-27-w448g": {}, + "/v1/default/Pod/fake-pod-27-wb26k": {}, + "/v1/default/Pod/fake-pod-27-wblvl": {}, + "/v1/default/Pod/fake-pod-27-wcksn": {}, + "/v1/default/Pod/fake-pod-27-wd848": {}, + "/v1/default/Pod/fake-pod-27-whmwk": {}, + "/v1/default/Pod/fake-pod-27-whstt": {}, + "/v1/default/Pod/fake-pod-27-wp9wh": {}, + "/v1/default/Pod/fake-pod-27-wqpvq": {}, + "/v1/default/Pod/fake-pod-27-ws4jb": {}, + "/v1/default/Pod/fake-pod-27-wt27h": {}, + "/v1/default/Pod/fake-pod-27-wwzcn": {}, + "/v1/default/Pod/fake-pod-27-wxdpc": {}, + "/v1/default/Pod/fake-pod-27-wxtth": {}, + "/v1/default/Pod/fake-pod-27-x564p": {}, + "/v1/default/Pod/fake-pod-27-x8kqj": {}, + "/v1/default/Pod/fake-pod-27-xgnfr": {}, + "/v1/default/Pod/fake-pod-27-xjkdb": {}, + "/v1/default/Pod/fake-pod-27-xjvll": {}, + "/v1/default/Pod/fake-pod-27-xpsdn": {}, + "/v1/default/Pod/fake-pod-27-xwv67": {}, + "/v1/default/Pod/fake-pod-27-z4h4m": {}, + "/v1/default/Pod/fake-pod-27-z4vcw": {}, + "/v1/default/Pod/fake-pod-27-z5sps": {}, + "/v1/default/Pod/fake-pod-27-z68cp": {}, + "/v1/default/Pod/fake-pod-27-zb7hs": {}, + "/v1/default/Pod/fake-pod-27-zbbjp": {}, + "/v1/default/Pod/fake-pod-27-zf74t": {}, + "/v1/default/Pod/fake-pod-27-zh2nz": {}, + "/v1/default/Pod/fake-pod-27-zhnvj": {}, + "/v1/default/Pod/fake-pod-27-zj85j": {}, + "/v1/default/Pod/fake-pod-27-zmnfz": {}, + "/v1/default/Pod/fake-pod-27-zppjn": {}, + "/v1/default/Pod/fake-pod-27-zrrgl": {}, + "/v1/default/Pod/fake-pod-27-ztxhq": {}, + "/v1/default/Pod/fake-pod-28-26vzg": {}, + "/v1/default/Pod/fake-pod-28-2c9c9": {}, + "/v1/default/Pod/fake-pod-28-2mlzd": {}, + "/v1/default/Pod/fake-pod-28-2ppc7": {}, + "/v1/default/Pod/fake-pod-28-2tckp": {}, + "/v1/default/Pod/fake-pod-28-2th9n": {}, + "/v1/default/Pod/fake-pod-28-2tngf": {}, + "/v1/default/Pod/fake-pod-28-46h6q": {}, + "/v1/default/Pod/fake-pod-28-46kcj": {}, + "/v1/default/Pod/fake-pod-28-46nzv": {}, + "/v1/default/Pod/fake-pod-28-477jw": {}, + "/v1/default/Pod/fake-pod-28-47p2w": {}, + "/v1/default/Pod/fake-pod-28-48kr6": {}, + "/v1/default/Pod/fake-pod-28-498dh": {}, + "/v1/default/Pod/fake-pod-28-49zgx": {}, + "/v1/default/Pod/fake-pod-28-4kgdz": {}, + "/v1/default/Pod/fake-pod-28-4mnrm": {}, + "/v1/default/Pod/fake-pod-28-4rv26": {}, + "/v1/default/Pod/fake-pod-28-4shbr": {}, + "/v1/default/Pod/fake-pod-28-4tnr2": {}, + "/v1/default/Pod/fake-pod-28-4v2sr": {}, + "/v1/default/Pod/fake-pod-28-4wbss": {}, + "/v1/default/Pod/fake-pod-28-4z46q": {}, + "/v1/default/Pod/fake-pod-28-546jg": {}, + "/v1/default/Pod/fake-pod-28-59htz": {}, + "/v1/default/Pod/fake-pod-28-5gwj9": {}, + "/v1/default/Pod/fake-pod-28-5hj4g": {}, + "/v1/default/Pod/fake-pod-28-5ldwt": {}, + "/v1/default/Pod/fake-pod-28-5nfcq": {}, + "/v1/default/Pod/fake-pod-28-5pdpm": {}, + "/v1/default/Pod/fake-pod-28-5zqft": {}, + "/v1/default/Pod/fake-pod-28-62gxv": {}, + "/v1/default/Pod/fake-pod-28-696pm": {}, + "/v1/default/Pod/fake-pod-28-6btxg": {}, + "/v1/default/Pod/fake-pod-28-6d5zh": {}, + "/v1/default/Pod/fake-pod-28-6dfkz": {}, + "/v1/default/Pod/fake-pod-28-6f8mv": {}, + "/v1/default/Pod/fake-pod-28-6fjwc": {}, + "/v1/default/Pod/fake-pod-28-6ltxr": {}, + "/v1/default/Pod/fake-pod-28-6qc2v": {}, + "/v1/default/Pod/fake-pod-28-6ql9n": {}, + "/v1/default/Pod/fake-pod-28-6rx8b": {}, + "/v1/default/Pod/fake-pod-28-6sjsp": {}, + "/v1/default/Pod/fake-pod-28-6snwh": {}, + "/v1/default/Pod/fake-pod-28-6stf7": {}, + "/v1/default/Pod/fake-pod-28-6sv8j": {}, + "/v1/default/Pod/fake-pod-28-6tjfv": {}, + "/v1/default/Pod/fake-pod-28-6tx49": {}, + "/v1/default/Pod/fake-pod-28-6z2sd": {}, + "/v1/default/Pod/fake-pod-28-72s5d": {}, + "/v1/default/Pod/fake-pod-28-76fmm": {}, + "/v1/default/Pod/fake-pod-28-7d6qp": {}, + "/v1/default/Pod/fake-pod-28-7drlq": {}, + "/v1/default/Pod/fake-pod-28-7j2z8": {}, + "/v1/default/Pod/fake-pod-28-7n7vg": {}, + "/v1/default/Pod/fake-pod-28-7nb72": {}, + "/v1/default/Pod/fake-pod-28-7v9bv": {}, + "/v1/default/Pod/fake-pod-28-7wwk4": {}, + "/v1/default/Pod/fake-pod-28-84c25": {}, + "/v1/default/Pod/fake-pod-28-89bjv": {}, + "/v1/default/Pod/fake-pod-28-8brdv": {}, + "/v1/default/Pod/fake-pod-28-8db56": {}, + "/v1/default/Pod/fake-pod-28-8ghxm": {}, + "/v1/default/Pod/fake-pod-28-8gkn2": {}, + "/v1/default/Pod/fake-pod-28-8hg2x": {}, + "/v1/default/Pod/fake-pod-28-8ksxn": {}, + "/v1/default/Pod/fake-pod-28-8l6wb": {}, + "/v1/default/Pod/fake-pod-28-8mrt8": {}, + "/v1/default/Pod/fake-pod-28-8r8qn": {}, + "/v1/default/Pod/fake-pod-28-8vpn5": {}, + "/v1/default/Pod/fake-pod-28-8vr27": {}, + "/v1/default/Pod/fake-pod-28-927k9": {}, + "/v1/default/Pod/fake-pod-28-92xpg": {}, + "/v1/default/Pod/fake-pod-28-9565l": {}, + "/v1/default/Pod/fake-pod-28-9bbs2": {}, + "/v1/default/Pod/fake-pod-28-9bgn5": {}, + "/v1/default/Pod/fake-pod-28-9cs79": {}, + "/v1/default/Pod/fake-pod-28-9glh9": {}, + "/v1/default/Pod/fake-pod-28-9h948": {}, + "/v1/default/Pod/fake-pod-28-9mrg8": {}, + "/v1/default/Pod/fake-pod-28-9nnfz": {}, + "/v1/default/Pod/fake-pod-28-9nxqz": {}, + "/v1/default/Pod/fake-pod-28-9tfck": {}, + "/v1/default/Pod/fake-pod-28-9zmxd": {}, + "/v1/default/Pod/fake-pod-28-b24rt": {}, + "/v1/default/Pod/fake-pod-28-b78pt": {}, + "/v1/default/Pod/fake-pod-28-bbqmx": {}, + "/v1/default/Pod/fake-pod-28-bdhlv": {}, + "/v1/default/Pod/fake-pod-28-bhgtn": {}, + "/v1/default/Pod/fake-pod-28-bslrz": {}, + "/v1/default/Pod/fake-pod-28-bt4qv": {}, + "/v1/default/Pod/fake-pod-28-bz84f": {}, + "/v1/default/Pod/fake-pod-28-c4779": {}, + "/v1/default/Pod/fake-pod-28-c645m": {}, + "/v1/default/Pod/fake-pod-28-c6fqn": {}, + "/v1/default/Pod/fake-pod-28-c8fnr": {}, + "/v1/default/Pod/fake-pod-28-c9zsb": {}, + "/v1/default/Pod/fake-pod-28-cc76m": {}, + "/v1/default/Pod/fake-pod-28-cd4sq": {}, + "/v1/default/Pod/fake-pod-28-cdnmv": {}, + "/v1/default/Pod/fake-pod-28-cgh7d": {}, + "/v1/default/Pod/fake-pod-28-cjcc9": {}, + "/v1/default/Pod/fake-pod-28-cqvkx": {}, + "/v1/default/Pod/fake-pod-28-cwlmv": {}, + "/v1/default/Pod/fake-pod-28-d4txv": {}, + "/v1/default/Pod/fake-pod-28-d5fs7": {}, + "/v1/default/Pod/fake-pod-28-d677g": {}, + "/v1/default/Pod/fake-pod-28-d7zmf": {}, + "/v1/default/Pod/fake-pod-28-dj8wc": {}, + "/v1/default/Pod/fake-pod-28-dkgjq": {}, + "/v1/default/Pod/fake-pod-28-dmlr7": {}, + "/v1/default/Pod/fake-pod-28-dqbz9": {}, + "/v1/default/Pod/fake-pod-28-dr58w": {}, + "/v1/default/Pod/fake-pod-28-dthfw": {}, + "/v1/default/Pod/fake-pod-28-dtk8z": {}, + "/v1/default/Pod/fake-pod-28-dw7z5": {}, + "/v1/default/Pod/fake-pod-28-dz2bc": {}, + "/v1/default/Pod/fake-pod-28-f26hs": {}, + "/v1/default/Pod/fake-pod-28-f4j9r": {}, + "/v1/default/Pod/fake-pod-28-f8ww9": {}, + "/v1/default/Pod/fake-pod-28-fb64g": {}, + "/v1/default/Pod/fake-pod-28-fcjq7": {}, + "/v1/default/Pod/fake-pod-28-fcq9k": {}, + "/v1/default/Pod/fake-pod-28-ffm42": {}, + "/v1/default/Pod/fake-pod-28-fnsxr": {}, + "/v1/default/Pod/fake-pod-28-fpgnk": {}, + "/v1/default/Pod/fake-pod-28-fqlf6": {}, + "/v1/default/Pod/fake-pod-28-frfzx": {}, + "/v1/default/Pod/fake-pod-28-fss88": {}, + "/v1/default/Pod/fake-pod-28-fzbvm": {}, + "/v1/default/Pod/fake-pod-28-g9zvr": {}, + "/v1/default/Pod/fake-pod-28-gcm5d": {}, + "/v1/default/Pod/fake-pod-28-ggll8": {}, + "/v1/default/Pod/fake-pod-28-gl96l": {}, + "/v1/default/Pod/fake-pod-28-grqlt": {}, + "/v1/default/Pod/fake-pod-28-gxxtz": {}, + "/v1/default/Pod/fake-pod-28-h8f47": {}, + "/v1/default/Pod/fake-pod-28-hd57q": {}, + "/v1/default/Pod/fake-pod-28-hdphp": {}, + "/v1/default/Pod/fake-pod-28-hf58k": {}, + "/v1/default/Pod/fake-pod-28-hgp26": {}, + "/v1/default/Pod/fake-pod-28-hk9vn": {}, + "/v1/default/Pod/fake-pod-28-hkbmz": {}, + "/v1/default/Pod/fake-pod-28-hnw4m": {}, + "/v1/default/Pod/fake-pod-28-hp8ng": {}, + "/v1/default/Pod/fake-pod-28-hs972": {}, + "/v1/default/Pod/fake-pod-28-hsd2p": {}, + "/v1/default/Pod/fake-pod-28-j9c7n": {}, + "/v1/default/Pod/fake-pod-28-j9c8x": {}, + "/v1/default/Pod/fake-pod-28-j9vsk": {}, + "/v1/default/Pod/fake-pod-28-jbbd2": {}, + "/v1/default/Pod/fake-pod-28-jdftn": {}, + "/v1/default/Pod/fake-pod-28-jgjsh": {}, + "/v1/default/Pod/fake-pod-28-jhvvs": {}, + "/v1/default/Pod/fake-pod-28-jqhnh": {}, + "/v1/default/Pod/fake-pod-28-jqnkz": {}, + "/v1/default/Pod/fake-pod-28-jtg5c": {}, + "/v1/default/Pod/fake-pod-28-jwgrv": {}, + "/v1/default/Pod/fake-pod-28-k2skk": {}, + "/v1/default/Pod/fake-pod-28-k4q45": {}, + "/v1/default/Pod/fake-pod-28-k5c4h": {}, + "/v1/default/Pod/fake-pod-28-k5xn9": {}, + "/v1/default/Pod/fake-pod-28-k9lvl": {}, + "/v1/default/Pod/fake-pod-28-kdmtq": {}, + "/v1/default/Pod/fake-pod-28-kfmc2": {}, + "/v1/default/Pod/fake-pod-28-km5sp": {}, + "/v1/default/Pod/fake-pod-28-kmhws": {}, + "/v1/default/Pod/fake-pod-28-kq8ft": {}, + "/v1/default/Pod/fake-pod-28-ks967": {}, + "/v1/default/Pod/fake-pod-28-l4k5t": {}, + "/v1/default/Pod/fake-pod-28-ld6j9": {}, + "/v1/default/Pod/fake-pod-28-lhrcm": {}, + "/v1/default/Pod/fake-pod-28-lmnvh": {}, + "/v1/default/Pod/fake-pod-28-lrlt4": {}, + "/v1/default/Pod/fake-pod-28-ls84x": {}, + "/v1/default/Pod/fake-pod-28-m6sxq": {}, + "/v1/default/Pod/fake-pod-28-mbdbc": {}, + "/v1/default/Pod/fake-pod-28-mfkf9": {}, + "/v1/default/Pod/fake-pod-28-msp87": {}, + "/v1/default/Pod/fake-pod-28-mwtt8": {}, + "/v1/default/Pod/fake-pod-28-n2bzf": {}, + "/v1/default/Pod/fake-pod-28-n55sk": {}, + "/v1/default/Pod/fake-pod-28-n64j8": {}, + "/v1/default/Pod/fake-pod-28-n92qs": {}, + "/v1/default/Pod/fake-pod-28-nbcz8": {}, + "/v1/default/Pod/fake-pod-28-nclc8": {}, + "/v1/default/Pod/fake-pod-28-ndt2v": {}, + "/v1/default/Pod/fake-pod-28-nhmvb": {}, + "/v1/default/Pod/fake-pod-28-np6xz": {}, + "/v1/default/Pod/fake-pod-28-npdnl": {}, + "/v1/default/Pod/fake-pod-28-nsvzt": {}, + "/v1/default/Pod/fake-pod-28-nthkl": {}, + "/v1/default/Pod/fake-pod-28-nv7kr": {}, + "/v1/default/Pod/fake-pod-28-p2tjv": {}, + "/v1/default/Pod/fake-pod-28-p5mb8": {}, + "/v1/default/Pod/fake-pod-28-pbm5t": {}, + "/v1/default/Pod/fake-pod-28-pkq8b": {}, + "/v1/default/Pod/fake-pod-28-plbpg": {}, + "/v1/default/Pod/fake-pod-28-pnxkz": {}, + "/v1/default/Pod/fake-pod-28-ptpdp": {}, + "/v1/default/Pod/fake-pod-28-q5bjj": {}, + "/v1/default/Pod/fake-pod-28-qd2md": {}, + "/v1/default/Pod/fake-pod-28-qkc2j": {}, + "/v1/default/Pod/fake-pod-28-qlkpl": {}, + "/v1/default/Pod/fake-pod-28-qnwpj": {}, + "/v1/default/Pod/fake-pod-28-qpmmq": {}, + "/v1/default/Pod/fake-pod-28-qxm8t": {}, + "/v1/default/Pod/fake-pod-28-r6hfn": {}, + "/v1/default/Pod/fake-pod-28-r72zj": {}, + "/v1/default/Pod/fake-pod-28-r8w2z": {}, + "/v1/default/Pod/fake-pod-28-rddnx": {}, + "/v1/default/Pod/fake-pod-28-rgwzl": {}, + "/v1/default/Pod/fake-pod-28-rgzln": {}, + "/v1/default/Pod/fake-pod-28-rkvlk": {}, + "/v1/default/Pod/fake-pod-28-rsg2d": {}, + "/v1/default/Pod/fake-pod-28-rsgdg": {}, + "/v1/default/Pod/fake-pod-28-rxjg8": {}, + "/v1/default/Pod/fake-pod-28-rzhvp": {}, + "/v1/default/Pod/fake-pod-28-s2rbs": {}, + "/v1/default/Pod/fake-pod-28-s42cm": {}, + "/v1/default/Pod/fake-pod-28-s7dn5": {}, + "/v1/default/Pod/fake-pod-28-s7xzv": {}, + "/v1/default/Pod/fake-pod-28-sc8tj": {}, + "/v1/default/Pod/fake-pod-28-sdt6l": {}, + "/v1/default/Pod/fake-pod-28-sfp98": {}, + "/v1/default/Pod/fake-pod-28-sggbw": {}, + "/v1/default/Pod/fake-pod-28-sj6xt": {}, + "/v1/default/Pod/fake-pod-28-sm2ks": {}, + "/v1/default/Pod/fake-pod-28-sm2vf": {}, + "/v1/default/Pod/fake-pod-28-smz2b": {}, + "/v1/default/Pod/fake-pod-28-sqnhx": {}, + "/v1/default/Pod/fake-pod-28-t2cpj": {}, + "/v1/default/Pod/fake-pod-28-t2dnr": {}, + "/v1/default/Pod/fake-pod-28-t4bjf": {}, + "/v1/default/Pod/fake-pod-28-t4gx5": {}, + "/v1/default/Pod/fake-pod-28-t4xqc": {}, + "/v1/default/Pod/fake-pod-28-t5fqv": {}, + "/v1/default/Pod/fake-pod-28-t5qs8": {}, + "/v1/default/Pod/fake-pod-28-t5w4h": {}, + "/v1/default/Pod/fake-pod-28-tc46p": {}, + "/v1/default/Pod/fake-pod-28-tjtdl": {}, + "/v1/default/Pod/fake-pod-28-tjvbv": {}, + "/v1/default/Pod/fake-pod-28-tl47g": {}, + "/v1/default/Pod/fake-pod-28-tl65b": {}, + "/v1/default/Pod/fake-pod-28-tm4r4": {}, + "/v1/default/Pod/fake-pod-28-tmhnm": {}, + "/v1/default/Pod/fake-pod-28-tq8nh": {}, + "/v1/default/Pod/fake-pod-28-tsg5b": {}, + "/v1/default/Pod/fake-pod-28-ttkg6": {}, + "/v1/default/Pod/fake-pod-28-tx59h": {}, + "/v1/default/Pod/fake-pod-28-vcq42": {}, + "/v1/default/Pod/fake-pod-28-vd8lv": {}, + "/v1/default/Pod/fake-pod-28-vfzcg": {}, + "/v1/default/Pod/fake-pod-28-vljdv": {}, + "/v1/default/Pod/fake-pod-28-vs74c": {}, + "/v1/default/Pod/fake-pod-28-vslzb": {}, + "/v1/default/Pod/fake-pod-28-vt4cp": {}, + "/v1/default/Pod/fake-pod-28-vv9sp": {}, + "/v1/default/Pod/fake-pod-28-vx7lp": {}, + "/v1/default/Pod/fake-pod-28-vzcr8": {}, + "/v1/default/Pod/fake-pod-28-w4qdk": {}, + "/v1/default/Pod/fake-pod-28-w6w2q": {}, + "/v1/default/Pod/fake-pod-28-w8nnq": {}, + "/v1/default/Pod/fake-pod-28-w9kbv": {}, + "/v1/default/Pod/fake-pod-28-wb2v7": {}, + "/v1/default/Pod/fake-pod-28-wc68v": {}, + "/v1/default/Pod/fake-pod-28-wf7fb": {}, + "/v1/default/Pod/fake-pod-28-wgtpx": {}, + "/v1/default/Pod/fake-pod-28-whngk": {}, + "/v1/default/Pod/fake-pod-28-wkf79": {}, + "/v1/default/Pod/fake-pod-28-wmkp6": {}, + "/v1/default/Pod/fake-pod-28-wnv9m": {}, + "/v1/default/Pod/fake-pod-28-wqqds": {}, + "/v1/default/Pod/fake-pod-28-wsstk": {}, + "/v1/default/Pod/fake-pod-28-wvnm9": {}, + "/v1/default/Pod/fake-pod-28-wvpp7": {}, + "/v1/default/Pod/fake-pod-28-wxclv": {}, + "/v1/default/Pod/fake-pod-28-x5gnw": {}, + "/v1/default/Pod/fake-pod-28-x9mz4": {}, + "/v1/default/Pod/fake-pod-28-xfcnz": {}, + "/v1/default/Pod/fake-pod-28-xfzph": {}, + "/v1/default/Pod/fake-pod-28-xp6ch": {}, + "/v1/default/Pod/fake-pod-28-xslkf": {}, + "/v1/default/Pod/fake-pod-28-xssgn": {}, + "/v1/default/Pod/fake-pod-28-xtmxw": {}, + "/v1/default/Pod/fake-pod-28-xx2xl": {}, + "/v1/default/Pod/fake-pod-28-z2qcz": {}, + "/v1/default/Pod/fake-pod-28-z892n": {}, + "/v1/default/Pod/fake-pod-28-z99ch": {}, + "/v1/default/Pod/fake-pod-28-zg2dg": {}, + "/v1/default/Pod/fake-pod-28-zkmph": {}, + "/v1/default/Pod/fake-pod-28-zl2r4": {}, + "/v1/default/Pod/fake-pod-28-zmf5z": {}, + "/v1/default/Pod/fake-pod-28-zmn7t": {}, + "/v1/default/Pod/fake-pod-28-zt27z": {}, + "/v1/default/Pod/fake-pod-28-zvhng": {}, + "/v1/default/Pod/fake-pod-28-zwhrp": {}, + "/v1/default/Pod/fake-pod-28-zwxwm": {}, + "/v1/default/Pod/fake-pod-28-zxclg": {}, + "/v1/default/Pod/fake-pod-29-24vgv": {}, + "/v1/default/Pod/fake-pod-29-25wmp": {}, + "/v1/default/Pod/fake-pod-29-268p8": {}, + "/v1/default/Pod/fake-pod-29-27fdj": {}, + "/v1/default/Pod/fake-pod-29-28rqq": {}, + "/v1/default/Pod/fake-pod-29-2dws2": {}, + "/v1/default/Pod/fake-pod-29-2gtvg": {}, + "/v1/default/Pod/fake-pod-29-2h72b": {}, + "/v1/default/Pod/fake-pod-29-2pvjp": {}, + "/v1/default/Pod/fake-pod-29-2qbjf": {}, + "/v1/default/Pod/fake-pod-29-44d4t": {}, + "/v1/default/Pod/fake-pod-29-44k8c": {}, + "/v1/default/Pod/fake-pod-29-46wdg": {}, + "/v1/default/Pod/fake-pod-29-49f9p": {}, + "/v1/default/Pod/fake-pod-29-4b2km": {}, + "/v1/default/Pod/fake-pod-29-4p8w8": {}, + "/v1/default/Pod/fake-pod-29-4pl69": {}, + "/v1/default/Pod/fake-pod-29-4sx4m": {}, + "/v1/default/Pod/fake-pod-29-4zn9x": {}, + "/v1/default/Pod/fake-pod-29-555r9": {}, + "/v1/default/Pod/fake-pod-29-56qw4": {}, + "/v1/default/Pod/fake-pod-29-585fx": {}, + "/v1/default/Pod/fake-pod-29-59b92": {}, + "/v1/default/Pod/fake-pod-29-59lpl": {}, + "/v1/default/Pod/fake-pod-29-5cp4r": {}, + "/v1/default/Pod/fake-pod-29-5dm7p": {}, + "/v1/default/Pod/fake-pod-29-5hprr": {}, + "/v1/default/Pod/fake-pod-29-5kcr8": {}, + "/v1/default/Pod/fake-pod-29-5kg5c": {}, + "/v1/default/Pod/fake-pod-29-5ldvw": {}, + "/v1/default/Pod/fake-pod-29-5pj2z": {}, + "/v1/default/Pod/fake-pod-29-5pzlk": {}, + "/v1/default/Pod/fake-pod-29-5r8ws": {}, + "/v1/default/Pod/fake-pod-29-5rlck": {}, + "/v1/default/Pod/fake-pod-29-5tkv8": {}, + "/v1/default/Pod/fake-pod-29-5w8l4": {}, + "/v1/default/Pod/fake-pod-29-5z4fc": {}, + "/v1/default/Pod/fake-pod-29-5zf4r": {}, + "/v1/default/Pod/fake-pod-29-62w26": {}, + "/v1/default/Pod/fake-pod-29-64682": {}, + "/v1/default/Pod/fake-pod-29-68xfn": {}, + "/v1/default/Pod/fake-pod-29-69zff": {}, + "/v1/default/Pod/fake-pod-29-6g27s": {}, + "/v1/default/Pod/fake-pod-29-6mhrr": {}, + "/v1/default/Pod/fake-pod-29-6n9gp": {}, + "/v1/default/Pod/fake-pod-29-6p2b9": {}, + "/v1/default/Pod/fake-pod-29-6q6lj": {}, + "/v1/default/Pod/fake-pod-29-6qxrz": {}, + "/v1/default/Pod/fake-pod-29-6tv2m": {}, + "/v1/default/Pod/fake-pod-29-6xsxm": {}, + "/v1/default/Pod/fake-pod-29-6zph9": {}, + "/v1/default/Pod/fake-pod-29-74khl": {}, + "/v1/default/Pod/fake-pod-29-75q9s": {}, + "/v1/default/Pod/fake-pod-29-792ml": {}, + "/v1/default/Pod/fake-pod-29-7d2cw": {}, + "/v1/default/Pod/fake-pod-29-7dp79": {}, + "/v1/default/Pod/fake-pod-29-7fjtj": {}, + "/v1/default/Pod/fake-pod-29-7fwhp": {}, + "/v1/default/Pod/fake-pod-29-7hc7c": {}, + "/v1/default/Pod/fake-pod-29-7p2b6": {}, + "/v1/default/Pod/fake-pod-29-7qjvg": {}, + "/v1/default/Pod/fake-pod-29-7rrlf": {}, + "/v1/default/Pod/fake-pod-29-7sxgv": {}, + "/v1/default/Pod/fake-pod-29-7tzrc": {}, + "/v1/default/Pod/fake-pod-29-7vdnh": {}, + "/v1/default/Pod/fake-pod-29-7vmht": {}, + "/v1/default/Pod/fake-pod-29-7xvls": {}, + "/v1/default/Pod/fake-pod-29-7zfjs": {}, + "/v1/default/Pod/fake-pod-29-82pvm": {}, + "/v1/default/Pod/fake-pod-29-8496m": {}, + "/v1/default/Pod/fake-pod-29-85nc4": {}, + "/v1/default/Pod/fake-pod-29-89479": {}, + "/v1/default/Pod/fake-pod-29-8lj62": {}, + "/v1/default/Pod/fake-pod-29-8ljs9": {}, + "/v1/default/Pod/fake-pod-29-8m94t": {}, + "/v1/default/Pod/fake-pod-29-8tr7x": {}, + "/v1/default/Pod/fake-pod-29-8v6tp": {}, + "/v1/default/Pod/fake-pod-29-8wrwf": {}, + "/v1/default/Pod/fake-pod-29-946ww": {}, + "/v1/default/Pod/fake-pod-29-94t42": {}, + "/v1/default/Pod/fake-pod-29-95kjs": {}, + "/v1/default/Pod/fake-pod-29-95wcq": {}, + "/v1/default/Pod/fake-pod-29-99n5g": {}, + "/v1/default/Pod/fake-pod-29-99xfg": {}, + "/v1/default/Pod/fake-pod-29-9clvm": {}, + "/v1/default/Pod/fake-pod-29-9ddck": {}, + "/v1/default/Pod/fake-pod-29-9k7nn": {}, + "/v1/default/Pod/fake-pod-29-9q5dl": {}, + "/v1/default/Pod/fake-pod-29-9q6f4": {}, + "/v1/default/Pod/fake-pod-29-9qgf9": {}, + "/v1/default/Pod/fake-pod-29-9tlj8": {}, + "/v1/default/Pod/fake-pod-29-b56ph": {}, + "/v1/default/Pod/fake-pod-29-b7gcl": {}, + "/v1/default/Pod/fake-pod-29-b9cg7": {}, + "/v1/default/Pod/fake-pod-29-b9kj2": {}, + "/v1/default/Pod/fake-pod-29-bdgl4": {}, + "/v1/default/Pod/fake-pod-29-blh9c": {}, + "/v1/default/Pod/fake-pod-29-bnnq5": {}, + "/v1/default/Pod/fake-pod-29-brwb9": {}, + "/v1/default/Pod/fake-pod-29-btj2k": {}, + "/v1/default/Pod/fake-pod-29-c5jqn": {}, + "/v1/default/Pod/fake-pod-29-c6v79": {}, + "/v1/default/Pod/fake-pod-29-c8p8p": {}, + "/v1/default/Pod/fake-pod-29-c8vl2": {}, + "/v1/default/Pod/fake-pod-29-c8xbf": {}, + "/v1/default/Pod/fake-pod-29-ccv56": {}, + "/v1/default/Pod/fake-pod-29-cdtqq": {}, + "/v1/default/Pod/fake-pod-29-cglnq": {}, + "/v1/default/Pod/fake-pod-29-ch2qh": {}, + "/v1/default/Pod/fake-pod-29-clz98": {}, + "/v1/default/Pod/fake-pod-29-csr5l": {}, + "/v1/default/Pod/fake-pod-29-cswsl": {}, + "/v1/default/Pod/fake-pod-29-cwf99": {}, + "/v1/default/Pod/fake-pod-29-czc82": {}, + "/v1/default/Pod/fake-pod-29-d6d2c": {}, + "/v1/default/Pod/fake-pod-29-d8bm5": {}, + "/v1/default/Pod/fake-pod-29-d8qrk": {}, + "/v1/default/Pod/fake-pod-29-dbk2q": {}, + "/v1/default/Pod/fake-pod-29-dfd6m": {}, + "/v1/default/Pod/fake-pod-29-dgxjg": {}, + "/v1/default/Pod/fake-pod-29-dhbz5": {}, + "/v1/default/Pod/fake-pod-29-djt72": {}, + "/v1/default/Pod/fake-pod-29-dnx4n": {}, + "/v1/default/Pod/fake-pod-29-dsjsx": {}, + "/v1/default/Pod/fake-pod-29-dstql": {}, + "/v1/default/Pod/fake-pod-29-dwkq2": {}, + "/v1/default/Pod/fake-pod-29-f2t5m": {}, + "/v1/default/Pod/fake-pod-29-f5bp8": {}, + "/v1/default/Pod/fake-pod-29-f6vjv": {}, + "/v1/default/Pod/fake-pod-29-fbn9t": {}, + "/v1/default/Pod/fake-pod-29-ff6hm": {}, + "/v1/default/Pod/fake-pod-29-flmrs": {}, + "/v1/default/Pod/fake-pod-29-flpsf": {}, + "/v1/default/Pod/fake-pod-29-fsmqs": {}, + "/v1/default/Pod/fake-pod-29-fsn8c": {}, + "/v1/default/Pod/fake-pod-29-fwnwc": {}, + "/v1/default/Pod/fake-pod-29-fwwxm": {}, + "/v1/default/Pod/fake-pod-29-g2gx6": {}, + "/v1/default/Pod/fake-pod-29-g7q4t": {}, + "/v1/default/Pod/fake-pod-29-g7z7z": {}, + "/v1/default/Pod/fake-pod-29-g8555": {}, + "/v1/default/Pod/fake-pod-29-g8cm6": {}, + "/v1/default/Pod/fake-pod-29-gg96l": {}, + "/v1/default/Pod/fake-pod-29-ghkqq": {}, + "/v1/default/Pod/fake-pod-29-gkmlr": {}, + "/v1/default/Pod/fake-pod-29-gmkpp": {}, + "/v1/default/Pod/fake-pod-29-gpvfz": {}, + "/v1/default/Pod/fake-pod-29-gpzb6": {}, + "/v1/default/Pod/fake-pod-29-gqn4h": {}, + "/v1/default/Pod/fake-pod-29-grhs5": {}, + "/v1/default/Pod/fake-pod-29-h7bkn": {}, + "/v1/default/Pod/fake-pod-29-hb99s": {}, + "/v1/default/Pod/fake-pod-29-hdhtz": {}, + "/v1/default/Pod/fake-pod-29-hjmrr": {}, + "/v1/default/Pod/fake-pod-29-hptw2": {}, + "/v1/default/Pod/fake-pod-29-htwgz": {}, + "/v1/default/Pod/fake-pod-29-htxk9": {}, + "/v1/default/Pod/fake-pod-29-hwzx8": {}, + "/v1/default/Pod/fake-pod-29-hz9d9": {}, + "/v1/default/Pod/fake-pod-29-j6gz8": {}, + "/v1/default/Pod/fake-pod-29-j6tnw": {}, + "/v1/default/Pod/fake-pod-29-j8b5l": {}, + "/v1/default/Pod/fake-pod-29-jfdfq": {}, + "/v1/default/Pod/fake-pod-29-jfj7v": {}, + "/v1/default/Pod/fake-pod-29-jflsz": {}, + "/v1/default/Pod/fake-pod-29-jrlzx": {}, + "/v1/default/Pod/fake-pod-29-k58hs": {}, + "/v1/default/Pod/fake-pod-29-k6zrn": {}, + "/v1/default/Pod/fake-pod-29-kf5sj": {}, + "/v1/default/Pod/fake-pod-29-kk75g": {}, + "/v1/default/Pod/fake-pod-29-km78w": {}, + "/v1/default/Pod/fake-pod-29-knt6l": {}, + "/v1/default/Pod/fake-pod-29-kqn4x": {}, + "/v1/default/Pod/fake-pod-29-kzhjf": {}, + "/v1/default/Pod/fake-pod-29-l268w": {}, + "/v1/default/Pod/fake-pod-29-l46vh": {}, + "/v1/default/Pod/fake-pod-29-l54kp": {}, + "/v1/default/Pod/fake-pod-29-l9bkh": {}, + "/v1/default/Pod/fake-pod-29-lbb7p": {}, + "/v1/default/Pod/fake-pod-29-lcthw": {}, + "/v1/default/Pod/fake-pod-29-lctjn": {}, + "/v1/default/Pod/fake-pod-29-lqbp4": {}, + "/v1/default/Pod/fake-pod-29-lr2db": {}, + "/v1/default/Pod/fake-pod-29-lwj8x": {}, + "/v1/default/Pod/fake-pod-29-lwlh4": {}, + "/v1/default/Pod/fake-pod-29-m2h9s": {}, + "/v1/default/Pod/fake-pod-29-m5sb5": {}, + "/v1/default/Pod/fake-pod-29-m6jr2": {}, + "/v1/default/Pod/fake-pod-29-m82kv": {}, + "/v1/default/Pod/fake-pod-29-m9vw5": {}, + "/v1/default/Pod/fake-pod-29-mdz8t": {}, + "/v1/default/Pod/fake-pod-29-mftr2": {}, + "/v1/default/Pod/fake-pod-29-mhk2c": {}, + "/v1/default/Pod/fake-pod-29-mpkph": {}, + "/v1/default/Pod/fake-pod-29-mq97x": {}, + "/v1/default/Pod/fake-pod-29-mrfrj": {}, + "/v1/default/Pod/fake-pod-29-mzfx9": {}, + "/v1/default/Pod/fake-pod-29-n4mwk": {}, + "/v1/default/Pod/fake-pod-29-n6f9v": {}, + "/v1/default/Pod/fake-pod-29-n8nw5": {}, + "/v1/default/Pod/fake-pod-29-ndxjk": {}, + "/v1/default/Pod/fake-pod-29-nm8x5": {}, + "/v1/default/Pod/fake-pod-29-nqdr4": {}, + "/v1/default/Pod/fake-pod-29-nqhnr": {}, + "/v1/default/Pod/fake-pod-29-p7v7t": {}, + "/v1/default/Pod/fake-pod-29-pfwgl": {}, + "/v1/default/Pod/fake-pod-29-phr9p": {}, + "/v1/default/Pod/fake-pod-29-pkx4d": {}, + "/v1/default/Pod/fake-pod-29-pnlrg": {}, + "/v1/default/Pod/fake-pod-29-prxgd": {}, + "/v1/default/Pod/fake-pod-29-pw6d5": {}, + "/v1/default/Pod/fake-pod-29-pw89d": {}, + "/v1/default/Pod/fake-pod-29-pxv9m": {}, + "/v1/default/Pod/fake-pod-29-q4qng": {}, + "/v1/default/Pod/fake-pod-29-q747k": {}, + "/v1/default/Pod/fake-pod-29-qgprh": {}, + "/v1/default/Pod/fake-pod-29-qkxs4": {}, + "/v1/default/Pod/fake-pod-29-qq2dj": {}, + "/v1/default/Pod/fake-pod-29-qtnj5": {}, + "/v1/default/Pod/fake-pod-29-qv6kd": {}, + "/v1/default/Pod/fake-pod-29-qvc5f": {}, + "/v1/default/Pod/fake-pod-29-qxsb5": {}, + "/v1/default/Pod/fake-pod-29-r28d6": {}, + "/v1/default/Pod/fake-pod-29-r6jrc": {}, + "/v1/default/Pod/fake-pod-29-r7t2w": {}, + "/v1/default/Pod/fake-pod-29-r9hzr": {}, + "/v1/default/Pod/fake-pod-29-rbdh5": {}, + "/v1/default/Pod/fake-pod-29-rcw57": {}, + "/v1/default/Pod/fake-pod-29-rh529": {}, + "/v1/default/Pod/fake-pod-29-rj22n": {}, + "/v1/default/Pod/fake-pod-29-rj2wm": {}, + "/v1/default/Pod/fake-pod-29-rjfkq": {}, + "/v1/default/Pod/fake-pod-29-rqq2b": {}, + "/v1/default/Pod/fake-pod-29-rxpls": {}, + "/v1/default/Pod/fake-pod-29-s24dq": {}, + "/v1/default/Pod/fake-pod-29-s8bcj": {}, + "/v1/default/Pod/fake-pod-29-s8hj6": {}, + "/v1/default/Pod/fake-pod-29-s8xzm": {}, + "/v1/default/Pod/fake-pod-29-sbk42": {}, + "/v1/default/Pod/fake-pod-29-sh74w": {}, + "/v1/default/Pod/fake-pod-29-sp98b": {}, + "/v1/default/Pod/fake-pod-29-t52mr": {}, + "/v1/default/Pod/fake-pod-29-t59h5": {}, + "/v1/default/Pod/fake-pod-29-tgc7r": {}, + "/v1/default/Pod/fake-pod-29-tm6pq": {}, + "/v1/default/Pod/fake-pod-29-tprvh": {}, + "/v1/default/Pod/fake-pod-29-ttxcw": {}, + "/v1/default/Pod/fake-pod-29-tw5lj": {}, + "/v1/default/Pod/fake-pod-29-tx8gq": {}, + "/v1/default/Pod/fake-pod-29-v55kr": {}, + "/v1/default/Pod/fake-pod-29-vdc2c": {}, + "/v1/default/Pod/fake-pod-29-vftrj": {}, + "/v1/default/Pod/fake-pod-29-vgzbl": {}, + "/v1/default/Pod/fake-pod-29-vktf8": {}, + "/v1/default/Pod/fake-pod-29-vlwdg": {}, + "/v1/default/Pod/fake-pod-29-vr6gm": {}, + "/v1/default/Pod/fake-pod-29-vrp4m": {}, + "/v1/default/Pod/fake-pod-29-vrzzv": {}, + "/v1/default/Pod/fake-pod-29-vt6j6": {}, + "/v1/default/Pod/fake-pod-29-vvgfb": {}, + "/v1/default/Pod/fake-pod-29-vvx89": {}, + "/v1/default/Pod/fake-pod-29-vzr8p": {}, + "/v1/default/Pod/fake-pod-29-w4fmz": {}, + "/v1/default/Pod/fake-pod-29-w5bqb": {}, + "/v1/default/Pod/fake-pod-29-w5hrg": {}, + "/v1/default/Pod/fake-pod-29-w62fd": {}, + "/v1/default/Pod/fake-pod-29-w75b9": {}, + "/v1/default/Pod/fake-pod-29-w7dmm": {}, + "/v1/default/Pod/fake-pod-29-w8p82": {}, + "/v1/default/Pod/fake-pod-29-wdxnw": {}, + "/v1/default/Pod/fake-pod-29-wj2m5": {}, + "/v1/default/Pod/fake-pod-29-wkl7c": {}, + "/v1/default/Pod/fake-pod-29-wkqk6": {}, + "/v1/default/Pod/fake-pod-29-wm467": {}, + "/v1/default/Pod/fake-pod-29-wp5th": {}, + "/v1/default/Pod/fake-pod-29-wqvx9": {}, + "/v1/default/Pod/fake-pod-29-wr6x6": {}, + "/v1/default/Pod/fake-pod-29-wwf8x": {}, + "/v1/default/Pod/fake-pod-29-wwf99": {}, + "/v1/default/Pod/fake-pod-29-wxv4c": {}, + "/v1/default/Pod/fake-pod-29-wxzkk": {}, + "/v1/default/Pod/fake-pod-29-wzsnk": {}, + "/v1/default/Pod/fake-pod-29-xbhms": {}, + "/v1/default/Pod/fake-pod-29-xd7vr": {}, + "/v1/default/Pod/fake-pod-29-xw7jz": {}, + "/v1/default/Pod/fake-pod-29-xxcdl": {}, + "/v1/default/Pod/fake-pod-29-z57vp": {}, + "/v1/default/Pod/fake-pod-29-z59tc": {}, + "/v1/default/Pod/fake-pod-29-z6l6p": {}, + "/v1/default/Pod/fake-pod-29-z7g9s": {}, + "/v1/default/Pod/fake-pod-29-z8pr5": {}, + "/v1/default/Pod/fake-pod-29-zd9tl": {}, + "/v1/default/Pod/fake-pod-29-zf5j2": {}, + "/v1/default/Pod/fake-pod-29-zqcvm": {}, + "/v1/default/Pod/fake-pod-29-ztbn5": {}, + "/v1/default/Pod/fake-pod-29-zvpp6": {}, + "/v1/default/Pod/fake-pod-29-zvqbk": {}, + "/v1/default/Pod/fake-pod-29-zxlgk": {}, + "/v1/default/Pod/fake-pod-29-zzz9t": {}, + "/v1/default/Pod/fake-pod-3-22bmc": {}, + "/v1/default/Pod/fake-pod-3-275g6": {}, + "/v1/default/Pod/fake-pod-3-27nf9": {}, + "/v1/default/Pod/fake-pod-3-29brw": {}, + "/v1/default/Pod/fake-pod-3-2c86s": {}, + "/v1/default/Pod/fake-pod-3-2gkg9": {}, + "/v1/default/Pod/fake-pod-3-2m6wp": {}, + "/v1/default/Pod/fake-pod-3-2qnds": {}, + "/v1/default/Pod/fake-pod-3-2tmhk": {}, + "/v1/default/Pod/fake-pod-3-2vnvx": {}, + "/v1/default/Pod/fake-pod-3-2wd65": {}, + "/v1/default/Pod/fake-pod-3-2x9ws": {}, + "/v1/default/Pod/fake-pod-3-2zx6p": {}, + "/v1/default/Pod/fake-pod-3-42rgp": {}, + "/v1/default/Pod/fake-pod-3-44qfj": {}, + "/v1/default/Pod/fake-pod-3-454xv": {}, + "/v1/default/Pod/fake-pod-3-46c65": {}, + "/v1/default/Pod/fake-pod-3-484jd": {}, + "/v1/default/Pod/fake-pod-3-4c6lz": {}, + "/v1/default/Pod/fake-pod-3-4d7cz": {}, + "/v1/default/Pod/fake-pod-3-4hbsh": {}, + "/v1/default/Pod/fake-pod-3-4k567": {}, + "/v1/default/Pod/fake-pod-3-4kk7j": {}, + "/v1/default/Pod/fake-pod-3-4q8xj": {}, + "/v1/default/Pod/fake-pod-3-4tcfc": {}, + "/v1/default/Pod/fake-pod-3-54p2t": {}, + "/v1/default/Pod/fake-pod-3-54s4z": {}, + "/v1/default/Pod/fake-pod-3-57tgn": {}, + "/v1/default/Pod/fake-pod-3-598pc": {}, + "/v1/default/Pod/fake-pod-3-5dhfn": {}, + "/v1/default/Pod/fake-pod-3-5djsr": {}, + "/v1/default/Pod/fake-pod-3-5grbl": {}, + "/v1/default/Pod/fake-pod-3-5h5bh": {}, + "/v1/default/Pod/fake-pod-3-5hzdf": {}, + "/v1/default/Pod/fake-pod-3-5hzp6": {}, + "/v1/default/Pod/fake-pod-3-5jt8t": {}, + "/v1/default/Pod/fake-pod-3-5jzqk": {}, + "/v1/default/Pod/fake-pod-3-5kwml": {}, + "/v1/default/Pod/fake-pod-3-5ljqh": {}, + "/v1/default/Pod/fake-pod-3-5mqp2": {}, + "/v1/default/Pod/fake-pod-3-5pvjm": {}, + "/v1/default/Pod/fake-pod-3-5q2qz": {}, + "/v1/default/Pod/fake-pod-3-5rpdm": {}, + "/v1/default/Pod/fake-pod-3-5wp6g": {}, + "/v1/default/Pod/fake-pod-3-64m69": {}, + "/v1/default/Pod/fake-pod-3-65pvr": {}, + "/v1/default/Pod/fake-pod-3-687gd": {}, + "/v1/default/Pod/fake-pod-3-6jvhx": {}, + "/v1/default/Pod/fake-pod-3-6lnxc": {}, + "/v1/default/Pod/fake-pod-3-6lt2f": {}, + "/v1/default/Pod/fake-pod-3-6nscj": {}, + "/v1/default/Pod/fake-pod-3-6p5tb": {}, + "/v1/default/Pod/fake-pod-3-6szcv": {}, + "/v1/default/Pod/fake-pod-3-6t7fz": {}, + "/v1/default/Pod/fake-pod-3-6vqt6": {}, + "/v1/default/Pod/fake-pod-3-6vvcg": {}, + "/v1/default/Pod/fake-pod-3-6z7cv": {}, + "/v1/default/Pod/fake-pod-3-77g8z": {}, + "/v1/default/Pod/fake-pod-3-7b8ml": {}, + "/v1/default/Pod/fake-pod-3-7db29": {}, + "/v1/default/Pod/fake-pod-3-7dch9": {}, + "/v1/default/Pod/fake-pod-3-7fxhb": {}, + "/v1/default/Pod/fake-pod-3-7h455": {}, + "/v1/default/Pod/fake-pod-3-7k4sl": {}, + "/v1/default/Pod/fake-pod-3-7lg67": {}, + "/v1/default/Pod/fake-pod-3-7wk9w": {}, + "/v1/default/Pod/fake-pod-3-82d22": {}, + "/v1/default/Pod/fake-pod-3-86fs2": {}, + "/v1/default/Pod/fake-pod-3-8f24m": {}, + "/v1/default/Pod/fake-pod-3-8f2gr": {}, + "/v1/default/Pod/fake-pod-3-8hv6n": {}, + "/v1/default/Pod/fake-pod-3-8jcgx": {}, + "/v1/default/Pod/fake-pod-3-8k2wr": {}, + "/v1/default/Pod/fake-pod-3-8knml": {}, + "/v1/default/Pod/fake-pod-3-8nl89": {}, + "/v1/default/Pod/fake-pod-3-8p77l": {}, + "/v1/default/Pod/fake-pod-3-8svfk": {}, + "/v1/default/Pod/fake-pod-3-8z4qk": {}, + "/v1/default/Pod/fake-pod-3-9cnn5": {}, + "/v1/default/Pod/fake-pod-3-9gxjq": {}, + "/v1/default/Pod/fake-pod-3-9jsw6": {}, + "/v1/default/Pod/fake-pod-3-9p6zw": {}, + "/v1/default/Pod/fake-pod-3-9pf7q": {}, + "/v1/default/Pod/fake-pod-3-9x4zk": {}, + "/v1/default/Pod/fake-pod-3-b7rnp": {}, + "/v1/default/Pod/fake-pod-3-bc6zw": {}, + "/v1/default/Pod/fake-pod-3-bfwx2": {}, + "/v1/default/Pod/fake-pod-3-bh2xt": {}, + "/v1/default/Pod/fake-pod-3-bj6bg": {}, + "/v1/default/Pod/fake-pod-3-bjpdh": {}, + "/v1/default/Pod/fake-pod-3-brjjk": {}, + "/v1/default/Pod/fake-pod-3-brrwd": {}, + "/v1/default/Pod/fake-pod-3-bx6mk": {}, + "/v1/default/Pod/fake-pod-3-bx8p7": {}, + "/v1/default/Pod/fake-pod-3-c2zhd": {}, + "/v1/default/Pod/fake-pod-3-c2zkl": {}, + "/v1/default/Pod/fake-pod-3-c88ss": {}, + "/v1/default/Pod/fake-pod-3-ch6fw": {}, + "/v1/default/Pod/fake-pod-3-ch9vj": {}, + "/v1/default/Pod/fake-pod-3-clfd6": {}, + "/v1/default/Pod/fake-pod-3-cpnfz": {}, + "/v1/default/Pod/fake-pod-3-ctz7n": {}, + "/v1/default/Pod/fake-pod-3-cwd55": {}, + "/v1/default/Pod/fake-pod-3-d2dk5": {}, + "/v1/default/Pod/fake-pod-3-d48tr": {}, + "/v1/default/Pod/fake-pod-3-d6dv6": {}, + "/v1/default/Pod/fake-pod-3-d8hlv": {}, + "/v1/default/Pod/fake-pod-3-dc2fg": {}, + "/v1/default/Pod/fake-pod-3-dg547": {}, + "/v1/default/Pod/fake-pod-3-dgh8q": {}, + "/v1/default/Pod/fake-pod-3-djdgh": {}, + "/v1/default/Pod/fake-pod-3-djnb5": {}, + "/v1/default/Pod/fake-pod-3-dtsbm": {}, + "/v1/default/Pod/fake-pod-3-dvdrk": {}, + "/v1/default/Pod/fake-pod-3-f42m4": {}, + "/v1/default/Pod/fake-pod-3-f4mkc": {}, + "/v1/default/Pod/fake-pod-3-f684p": {}, + "/v1/default/Pod/fake-pod-3-fblqq": {}, + "/v1/default/Pod/fake-pod-3-fbzg8": {}, + "/v1/default/Pod/fake-pod-3-fcf78": {}, + "/v1/default/Pod/fake-pod-3-ff4z8": {}, + "/v1/default/Pod/fake-pod-3-ff5hz": {}, + "/v1/default/Pod/fake-pod-3-fgfs4": {}, + "/v1/default/Pod/fake-pod-3-fh9f5": {}, + "/v1/default/Pod/fake-pod-3-fqf4s": {}, + "/v1/default/Pod/fake-pod-3-ftqhg": {}, + "/v1/default/Pod/fake-pod-3-fx4fp": {}, + "/v1/default/Pod/fake-pod-3-g2t5j": {}, + "/v1/default/Pod/fake-pod-3-g4wd9": {}, + "/v1/default/Pod/fake-pod-3-g5jgq": {}, + "/v1/default/Pod/fake-pod-3-g8kdd": {}, + "/v1/default/Pod/fake-pod-3-gd8gk": {}, + "/v1/default/Pod/fake-pod-3-gdrkf": {}, + "/v1/default/Pod/fake-pod-3-gjs2f": {}, + "/v1/default/Pod/fake-pod-3-gl95k": {}, + "/v1/default/Pod/fake-pod-3-gnszd": {}, + "/v1/default/Pod/fake-pod-3-h9kn4": {}, + "/v1/default/Pod/fake-pod-3-h9rbf": {}, + "/v1/default/Pod/fake-pod-3-hb5rp": {}, + "/v1/default/Pod/fake-pod-3-hfbwk": {}, + "/v1/default/Pod/fake-pod-3-hjwm6": {}, + "/v1/default/Pod/fake-pod-3-hkvms": {}, + "/v1/default/Pod/fake-pod-3-hmjcr": {}, + "/v1/default/Pod/fake-pod-3-hppgn": {}, + "/v1/default/Pod/fake-pod-3-hswch": {}, + "/v1/default/Pod/fake-pod-3-htlvb": {}, + "/v1/default/Pod/fake-pod-3-hvhm8": {}, + "/v1/default/Pod/fake-pod-3-hzgkl": {}, + "/v1/default/Pod/fake-pod-3-j5pn9": {}, + "/v1/default/Pod/fake-pod-3-jd85r": {}, + "/v1/default/Pod/fake-pod-3-jr27l": {}, + "/v1/default/Pod/fake-pod-3-jrd2b": {}, + "/v1/default/Pod/fake-pod-3-js29f": {}, + "/v1/default/Pod/fake-pod-3-jtzph": {}, + "/v1/default/Pod/fake-pod-3-k4fl5": {}, + "/v1/default/Pod/fake-pod-3-k78f9": {}, + "/v1/default/Pod/fake-pod-3-k9kns": {}, + "/v1/default/Pod/fake-pod-3-kb7zb": {}, + "/v1/default/Pod/fake-pod-3-kc55z": {}, + "/v1/default/Pod/fake-pod-3-kc856": {}, + "/v1/default/Pod/fake-pod-3-kknch": {}, + "/v1/default/Pod/fake-pod-3-klmvh": {}, + "/v1/default/Pod/fake-pod-3-kn7qb": {}, + "/v1/default/Pod/fake-pod-3-kngxh": {}, + "/v1/default/Pod/fake-pod-3-knwt5": {}, + "/v1/default/Pod/fake-pod-3-kpm4z": {}, + "/v1/default/Pod/fake-pod-3-kpp4m": {}, + "/v1/default/Pod/fake-pod-3-kqqv5": {}, + "/v1/default/Pod/fake-pod-3-kslnl": {}, + "/v1/default/Pod/fake-pod-3-kspg2": {}, + "/v1/default/Pod/fake-pod-3-ksw5c": {}, + "/v1/default/Pod/fake-pod-3-l7v8n": {}, + "/v1/default/Pod/fake-pod-3-l8mkh": {}, + "/v1/default/Pod/fake-pod-3-lcc9x": {}, + "/v1/default/Pod/fake-pod-3-lhvq9": {}, + "/v1/default/Pod/fake-pod-3-lt6vv": {}, + "/v1/default/Pod/fake-pod-3-ltdwl": {}, + "/v1/default/Pod/fake-pod-3-ltprv": {}, + "/v1/default/Pod/fake-pod-3-lvd8w": {}, + "/v1/default/Pod/fake-pod-3-lxmb5": {}, + "/v1/default/Pod/fake-pod-3-m7w5z": {}, + "/v1/default/Pod/fake-pod-3-mb2jz": {}, + "/v1/default/Pod/fake-pod-3-md8fq": {}, + "/v1/default/Pod/fake-pod-3-mlgqx": {}, + "/v1/default/Pod/fake-pod-3-mpbds": {}, + "/v1/default/Pod/fake-pod-3-mq6dl": {}, + "/v1/default/Pod/fake-pod-3-mqvwx": {}, + "/v1/default/Pod/fake-pod-3-mr6th": {}, + "/v1/default/Pod/fake-pod-3-msrx7": {}, + "/v1/default/Pod/fake-pod-3-mz4bg": {}, + "/v1/default/Pod/fake-pod-3-n4rcm": {}, + "/v1/default/Pod/fake-pod-3-n4vzr": {}, + "/v1/default/Pod/fake-pod-3-n68nq": {}, + "/v1/default/Pod/fake-pod-3-ncc6z": {}, + "/v1/default/Pod/fake-pod-3-ndmjp": {}, + "/v1/default/Pod/fake-pod-3-njlpj": {}, + "/v1/default/Pod/fake-pod-3-njz9v": {}, + "/v1/default/Pod/fake-pod-3-nlf78": {}, + "/v1/default/Pod/fake-pod-3-nlms2": {}, + "/v1/default/Pod/fake-pod-3-np87t": {}, + "/v1/default/Pod/fake-pod-3-nslt4": {}, + "/v1/default/Pod/fake-pod-3-ntfnx": {}, + "/v1/default/Pod/fake-pod-3-nvrfh": {}, + "/v1/default/Pod/fake-pod-3-nwrm5": {}, + "/v1/default/Pod/fake-pod-3-nzh74": {}, + "/v1/default/Pod/fake-pod-3-p5n4h": {}, + "/v1/default/Pod/fake-pod-3-p5rh2": {}, + "/v1/default/Pod/fake-pod-3-p5skj": {}, + "/v1/default/Pod/fake-pod-3-p5v8b": {}, + "/v1/default/Pod/fake-pod-3-p6v2j": {}, + "/v1/default/Pod/fake-pod-3-p8q4x": {}, + "/v1/default/Pod/fake-pod-3-pbw4h": {}, + "/v1/default/Pod/fake-pod-3-pbzf5": {}, + "/v1/default/Pod/fake-pod-3-pdd7v": {}, + "/v1/default/Pod/fake-pod-3-pdxpq": {}, + "/v1/default/Pod/fake-pod-3-pj8r6": {}, + "/v1/default/Pod/fake-pod-3-pnsdp": {}, + "/v1/default/Pod/fake-pod-3-pp5sv": {}, + "/v1/default/Pod/fake-pod-3-prztf": {}, + "/v1/default/Pod/fake-pod-3-pslgs": {}, + "/v1/default/Pod/fake-pod-3-psqq4": {}, + "/v1/default/Pod/fake-pod-3-pv5zj": {}, + "/v1/default/Pod/fake-pod-3-pwmst": {}, + "/v1/default/Pod/fake-pod-3-pwnxj": {}, + "/v1/default/Pod/fake-pod-3-q7z6c": {}, + "/v1/default/Pod/fake-pod-3-qcjrr": {}, + "/v1/default/Pod/fake-pod-3-qfdb4": {}, + "/v1/default/Pod/fake-pod-3-qgfn9": {}, + "/v1/default/Pod/fake-pod-3-qqcbh": {}, + "/v1/default/Pod/fake-pod-3-qqctz": {}, + "/v1/default/Pod/fake-pod-3-qrhvr": {}, + "/v1/default/Pod/fake-pod-3-qt9vn": {}, + "/v1/default/Pod/fake-pod-3-qwzt8": {}, + "/v1/default/Pod/fake-pod-3-qxgsv": {}, + "/v1/default/Pod/fake-pod-3-r6mhj": {}, + "/v1/default/Pod/fake-pod-3-r99l7": {}, + "/v1/default/Pod/fake-pod-3-rc6zs": {}, + "/v1/default/Pod/fake-pod-3-rcpvm": {}, + "/v1/default/Pod/fake-pod-3-rhn86": {}, + "/v1/default/Pod/fake-pod-3-rjjkc": {}, + "/v1/default/Pod/fake-pod-3-rlwwq": {}, + "/v1/default/Pod/fake-pod-3-rzvxq": {}, + "/v1/default/Pod/fake-pod-3-s6mtn": {}, + "/v1/default/Pod/fake-pod-3-s7knk": {}, + "/v1/default/Pod/fake-pod-3-s9tnj": {}, + "/v1/default/Pod/fake-pod-3-scktv": {}, + "/v1/default/Pod/fake-pod-3-sw5cm": {}, + "/v1/default/Pod/fake-pod-3-sxtmq": {}, + "/v1/default/Pod/fake-pod-3-szcv6": {}, + "/v1/default/Pod/fake-pod-3-szsrc": {}, + "/v1/default/Pod/fake-pod-3-t44d6": {}, + "/v1/default/Pod/fake-pod-3-t9dpl": {}, + "/v1/default/Pod/fake-pod-3-tc98z": {}, + "/v1/default/Pod/fake-pod-3-tdzzn": {}, + "/v1/default/Pod/fake-pod-3-tkxph": {}, + "/v1/default/Pod/fake-pod-3-tld6n": {}, + "/v1/default/Pod/fake-pod-3-tm5gs": {}, + "/v1/default/Pod/fake-pod-3-tm6hv": {}, + "/v1/default/Pod/fake-pod-3-tmj6x": {}, + "/v1/default/Pod/fake-pod-3-tzfhr": {}, + "/v1/default/Pod/fake-pod-3-v4gkl": {}, + "/v1/default/Pod/fake-pod-3-v4kcd": {}, + "/v1/default/Pod/fake-pod-3-v5b8q": {}, + "/v1/default/Pod/fake-pod-3-v7p25": {}, + "/v1/default/Pod/fake-pod-3-v96xb": {}, + "/v1/default/Pod/fake-pod-3-vd877": {}, + "/v1/default/Pod/fake-pod-3-vd8dg": {}, + "/v1/default/Pod/fake-pod-3-vf56q": {}, + "/v1/default/Pod/fake-pod-3-vlqhn": {}, + "/v1/default/Pod/fake-pod-3-vpn9q": {}, + "/v1/default/Pod/fake-pod-3-vq689": {}, + "/v1/default/Pod/fake-pod-3-vqhbt": {}, + "/v1/default/Pod/fake-pod-3-vqwth": {}, + "/v1/default/Pod/fake-pod-3-vr72x": {}, + "/v1/default/Pod/fake-pod-3-vvfqp": {}, + "/v1/default/Pod/fake-pod-3-w9zn5": {}, + "/v1/default/Pod/fake-pod-3-wb5c4": {}, + "/v1/default/Pod/fake-pod-3-wc68w": {}, + "/v1/default/Pod/fake-pod-3-wjf57": {}, + "/v1/default/Pod/fake-pod-3-wmg95": {}, + "/v1/default/Pod/fake-pod-3-wrrrg": {}, + "/v1/default/Pod/fake-pod-3-wv85g": {}, + "/v1/default/Pod/fake-pod-3-wwbwv": {}, + "/v1/default/Pod/fake-pod-3-wwlvx": {}, + "/v1/default/Pod/fake-pod-3-wwp98": {}, + "/v1/default/Pod/fake-pod-3-x75tx": {}, + "/v1/default/Pod/fake-pod-3-x8hmf": {}, + "/v1/default/Pod/fake-pod-3-xd6tq": {}, + "/v1/default/Pod/fake-pod-3-xfjnc": {}, + "/v1/default/Pod/fake-pod-3-xjl7p": {}, + "/v1/default/Pod/fake-pod-3-xlgst": {}, + "/v1/default/Pod/fake-pod-3-xm99f": {}, + "/v1/default/Pod/fake-pod-3-xm9p6": {}, + "/v1/default/Pod/fake-pod-3-xpv5h": {}, + "/v1/default/Pod/fake-pod-3-z6tsf": {}, + "/v1/default/Pod/fake-pod-3-z8tt8": {}, + "/v1/default/Pod/fake-pod-3-zh5mt": {}, + "/v1/default/Pod/fake-pod-3-zm5df": {}, + "/v1/default/Pod/fake-pod-3-zsrcz": {}, + "/v1/default/Pod/fake-pod-30-2fw2g": {}, + "/v1/default/Pod/fake-pod-30-2gtmj": {}, + "/v1/default/Pod/fake-pod-30-2h9j8": {}, + "/v1/default/Pod/fake-pod-30-2jvnc": {}, + "/v1/default/Pod/fake-pod-30-2kdgd": {}, + "/v1/default/Pod/fake-pod-30-2pnp4": {}, + "/v1/default/Pod/fake-pod-30-2r2k5": {}, + "/v1/default/Pod/fake-pod-30-2wb6p": {}, + "/v1/default/Pod/fake-pod-30-2wh6g": {}, + "/v1/default/Pod/fake-pod-30-4cn4l": {}, + "/v1/default/Pod/fake-pod-30-4dj6d": {}, + "/v1/default/Pod/fake-pod-30-4dmxm": {}, + "/v1/default/Pod/fake-pod-30-4fltt": {}, + "/v1/default/Pod/fake-pod-30-4j5wn": {}, + "/v1/default/Pod/fake-pod-30-4jdmm": {}, + "/v1/default/Pod/fake-pod-30-4jh7m": {}, + "/v1/default/Pod/fake-pod-30-4lg8c": {}, + "/v1/default/Pod/fake-pod-30-4mhbn": {}, + "/v1/default/Pod/fake-pod-30-4s4hp": {}, + "/v1/default/Pod/fake-pod-30-57ggq": {}, + "/v1/default/Pod/fake-pod-30-5drb4": {}, + "/v1/default/Pod/fake-pod-30-5fstk": {}, + "/v1/default/Pod/fake-pod-30-5j8gf": {}, + "/v1/default/Pod/fake-pod-30-5q8xg": {}, + "/v1/default/Pod/fake-pod-30-5qj8l": {}, + "/v1/default/Pod/fake-pod-30-5s8h5": {}, + "/v1/default/Pod/fake-pod-30-5swzn": {}, + "/v1/default/Pod/fake-pod-30-5w4gs": {}, + "/v1/default/Pod/fake-pod-30-64hbf": {}, + "/v1/default/Pod/fake-pod-30-67mfs": {}, + "/v1/default/Pod/fake-pod-30-686bj": {}, + "/v1/default/Pod/fake-pod-30-6cl56": {}, + "/v1/default/Pod/fake-pod-30-6jjvq": {}, + "/v1/default/Pod/fake-pod-30-6k2sl": {}, + "/v1/default/Pod/fake-pod-30-6lqrt": {}, + "/v1/default/Pod/fake-pod-30-6qcln": {}, + "/v1/default/Pod/fake-pod-30-6r55r": {}, + "/v1/default/Pod/fake-pod-30-6r5z7": {}, + "/v1/default/Pod/fake-pod-30-6sqc4": {}, + "/v1/default/Pod/fake-pod-30-6szdg": {}, + "/v1/default/Pod/fake-pod-30-6z5tr": {}, + "/v1/default/Pod/fake-pod-30-72s7v": {}, + "/v1/default/Pod/fake-pod-30-7857g": {}, + "/v1/default/Pod/fake-pod-30-7ckcm": {}, + "/v1/default/Pod/fake-pod-30-7hfp6": {}, + "/v1/default/Pod/fake-pod-30-7j9hc": {}, + "/v1/default/Pod/fake-pod-30-7jbsk": {}, + "/v1/default/Pod/fake-pod-30-7kkkc": {}, + "/v1/default/Pod/fake-pod-30-7l2m7": {}, + "/v1/default/Pod/fake-pod-30-7ng9z": {}, + "/v1/default/Pod/fake-pod-30-7txkd": {}, + "/v1/default/Pod/fake-pod-30-7w4v7": {}, + "/v1/default/Pod/fake-pod-30-7zzqv": {}, + "/v1/default/Pod/fake-pod-30-89c4m": {}, + "/v1/default/Pod/fake-pod-30-8bd9s": {}, + "/v1/default/Pod/fake-pod-30-8gl9j": {}, + "/v1/default/Pod/fake-pod-30-8k42w": {}, + "/v1/default/Pod/fake-pod-30-8l7bs": {}, + "/v1/default/Pod/fake-pod-30-8lbfv": {}, + "/v1/default/Pod/fake-pod-30-8sj9h": {}, + "/v1/default/Pod/fake-pod-30-925fl": {}, + "/v1/default/Pod/fake-pod-30-92r47": {}, + "/v1/default/Pod/fake-pod-30-95svn": {}, + "/v1/default/Pod/fake-pod-30-96ndp": {}, + "/v1/default/Pod/fake-pod-30-96vng": {}, + "/v1/default/Pod/fake-pod-30-9bx7s": {}, + "/v1/default/Pod/fake-pod-30-9jx4j": {}, + "/v1/default/Pod/fake-pod-30-9kvv9": {}, + "/v1/default/Pod/fake-pod-30-9lvbt": {}, + "/v1/default/Pod/fake-pod-30-9qwsj": {}, + "/v1/default/Pod/fake-pod-30-9sjgs": {}, + "/v1/default/Pod/fake-pod-30-b6r8d": {}, + "/v1/default/Pod/fake-pod-30-b8sl6": {}, + "/v1/default/Pod/fake-pod-30-bbdsx": {}, + "/v1/default/Pod/fake-pod-30-bd67m": {}, + "/v1/default/Pod/fake-pod-30-bg5lb": {}, + "/v1/default/Pod/fake-pod-30-bhg2x": {}, + "/v1/default/Pod/fake-pod-30-bqbdv": {}, + "/v1/default/Pod/fake-pod-30-brkgj": {}, + "/v1/default/Pod/fake-pod-30-bs7mx": {}, + "/v1/default/Pod/fake-pod-30-bzhpj": {}, + "/v1/default/Pod/fake-pod-30-c9dh6": {}, + "/v1/default/Pod/fake-pod-30-cfpjq": {}, + "/v1/default/Pod/fake-pod-30-clq47": {}, + "/v1/default/Pod/fake-pod-30-cp8xx": {}, + "/v1/default/Pod/fake-pod-30-d2x4k": {}, + "/v1/default/Pod/fake-pod-30-d42k9": {}, + "/v1/default/Pod/fake-pod-30-d5j9z": {}, + "/v1/default/Pod/fake-pod-30-d5rxm": {}, + "/v1/default/Pod/fake-pod-30-d672l": {}, + "/v1/default/Pod/fake-pod-30-d97df": {}, + "/v1/default/Pod/fake-pod-30-dccr9": {}, + "/v1/default/Pod/fake-pod-30-dcxtk": {}, + "/v1/default/Pod/fake-pod-30-ddk6d": {}, + "/v1/default/Pod/fake-pod-30-dghvn": {}, + "/v1/default/Pod/fake-pod-30-dtjd9": {}, + "/v1/default/Pod/fake-pod-30-dtxbj": {}, + "/v1/default/Pod/fake-pod-30-dzrww": {}, + "/v1/default/Pod/fake-pod-30-f2xrd": {}, + "/v1/default/Pod/fake-pod-30-f56v7": {}, + "/v1/default/Pod/fake-pod-30-ffd7m": {}, + "/v1/default/Pod/fake-pod-30-fgphw": {}, + "/v1/default/Pod/fake-pod-30-fhq8b": {}, + "/v1/default/Pod/fake-pod-30-fk864": {}, + "/v1/default/Pod/fake-pod-30-fpb7w": {}, + "/v1/default/Pod/fake-pod-30-frqqx": {}, + "/v1/default/Pod/fake-pod-30-fthk9": {}, + "/v1/default/Pod/fake-pod-30-fw8qb": {}, + "/v1/default/Pod/fake-pod-30-g2xmw": {}, + "/v1/default/Pod/fake-pod-30-g6tw2": {}, + "/v1/default/Pod/fake-pod-30-g9jbf": {}, + "/v1/default/Pod/fake-pod-30-g9jhv": {}, + "/v1/default/Pod/fake-pod-30-gb7kt": {}, + "/v1/default/Pod/fake-pod-30-gcrx9": {}, + "/v1/default/Pod/fake-pod-30-gm4f9": {}, + "/v1/default/Pod/fake-pod-30-gnxd2": {}, + "/v1/default/Pod/fake-pod-30-gp8rc": {}, + "/v1/default/Pod/fake-pod-30-gtqwb": {}, + "/v1/default/Pod/fake-pod-30-h25hd": {}, + "/v1/default/Pod/fake-pod-30-h4wnv": {}, + "/v1/default/Pod/fake-pod-30-h5jg6": {}, + "/v1/default/Pod/fake-pod-30-h5mtw": {}, + "/v1/default/Pod/fake-pod-30-h659p": {}, + "/v1/default/Pod/fake-pod-30-h664j": {}, + "/v1/default/Pod/fake-pod-30-hcfwg": {}, + "/v1/default/Pod/fake-pod-30-hdrkl": {}, + "/v1/default/Pod/fake-pod-30-hg8v8": {}, + "/v1/default/Pod/fake-pod-30-hjbtl": {}, + "/v1/default/Pod/fake-pod-30-hk2x4": {}, + "/v1/default/Pod/fake-pod-30-hkwpx": {}, + "/v1/default/Pod/fake-pod-30-hlbct": {}, + "/v1/default/Pod/fake-pod-30-hptlg": {}, + "/v1/default/Pod/fake-pod-30-hq5lr": {}, + "/v1/default/Pod/fake-pod-30-hqt9p": {}, + "/v1/default/Pod/fake-pod-30-hqwd9": {}, + "/v1/default/Pod/fake-pod-30-j84jh": {}, + "/v1/default/Pod/fake-pod-30-j9ht9": {}, + "/v1/default/Pod/fake-pod-30-jgsw7": {}, + "/v1/default/Pod/fake-pod-30-jm8xd": {}, + "/v1/default/Pod/fake-pod-30-jqfj4": {}, + "/v1/default/Pod/fake-pod-30-jv9kh": {}, + "/v1/default/Pod/fake-pod-30-jwjrt": {}, + "/v1/default/Pod/fake-pod-30-jzkjl": {}, + "/v1/default/Pod/fake-pod-30-k5vtx": {}, + "/v1/default/Pod/fake-pod-30-k647t": {}, + "/v1/default/Pod/fake-pod-30-k6rwx": {}, + "/v1/default/Pod/fake-pod-30-kdmm8": {}, + "/v1/default/Pod/fake-pod-30-kdmwl": {}, + "/v1/default/Pod/fake-pod-30-khg7g": {}, + "/v1/default/Pod/fake-pod-30-kl8hp": {}, + "/v1/default/Pod/fake-pod-30-krt77": {}, + "/v1/default/Pod/fake-pod-30-krvvv": {}, + "/v1/default/Pod/fake-pod-30-krz8n": {}, + "/v1/default/Pod/fake-pod-30-ktlnd": {}, + "/v1/default/Pod/fake-pod-30-kvmbm": {}, + "/v1/default/Pod/fake-pod-30-kwd2v": {}, + "/v1/default/Pod/fake-pod-30-lfdm7": {}, + "/v1/default/Pod/fake-pod-30-lgvxd": {}, + "/v1/default/Pod/fake-pod-30-lgxfb": {}, + "/v1/default/Pod/fake-pod-30-lkkd9": {}, + "/v1/default/Pod/fake-pod-30-ln7q6": {}, + "/v1/default/Pod/fake-pod-30-lnqx4": {}, + "/v1/default/Pod/fake-pod-30-lnsmc": {}, + "/v1/default/Pod/fake-pod-30-lnsnm": {}, + "/v1/default/Pod/fake-pod-30-lnzck": {}, + "/v1/default/Pod/fake-pod-30-lsbph": {}, + "/v1/default/Pod/fake-pod-30-lv4zt": {}, + "/v1/default/Pod/fake-pod-30-lvs56": {}, + "/v1/default/Pod/fake-pod-30-lx7wp": {}, + "/v1/default/Pod/fake-pod-30-lxzh4": {}, + "/v1/default/Pod/fake-pod-30-m45s6": {}, + "/v1/default/Pod/fake-pod-30-m58ww": {}, + "/v1/default/Pod/fake-pod-30-m8v5v": {}, + "/v1/default/Pod/fake-pod-30-m9rs9": {}, + "/v1/default/Pod/fake-pod-30-mbktf": {}, + "/v1/default/Pod/fake-pod-30-mftbq": {}, + "/v1/default/Pod/fake-pod-30-mgfnv": {}, + "/v1/default/Pod/fake-pod-30-mk8sc": {}, + "/v1/default/Pod/fake-pod-30-mp6zb": {}, + "/v1/default/Pod/fake-pod-30-mx448": {}, + "/v1/default/Pod/fake-pod-30-mznpl": {}, + "/v1/default/Pod/fake-pod-30-n5tdb": {}, + "/v1/default/Pod/fake-pod-30-n6t6z": {}, + "/v1/default/Pod/fake-pod-30-n87tk": {}, + "/v1/default/Pod/fake-pod-30-nbffl": {}, + "/v1/default/Pod/fake-pod-30-nckjv": {}, + "/v1/default/Pod/fake-pod-30-nfsgr": {}, + "/v1/default/Pod/fake-pod-30-ngzbf": {}, + "/v1/default/Pod/fake-pod-30-nqzzz": {}, + "/v1/default/Pod/fake-pod-30-nslsk": {}, + "/v1/default/Pod/fake-pod-30-nt44f": {}, + "/v1/default/Pod/fake-pod-30-nttkg": {}, + "/v1/default/Pod/fake-pod-30-nvqbc": {}, + "/v1/default/Pod/fake-pod-30-p4ns8": {}, + "/v1/default/Pod/fake-pod-30-p529h": {}, + "/v1/default/Pod/fake-pod-30-p75vv": {}, + "/v1/default/Pod/fake-pod-30-p7697": {}, + "/v1/default/Pod/fake-pod-30-p7fzt": {}, + "/v1/default/Pod/fake-pod-30-p8h47": {}, + "/v1/default/Pod/fake-pod-30-pgbxq": {}, + "/v1/default/Pod/fake-pod-30-pgdqg": {}, + "/v1/default/Pod/fake-pod-30-phjxc": {}, + "/v1/default/Pod/fake-pod-30-pjptc": {}, + "/v1/default/Pod/fake-pod-30-pksql": {}, + "/v1/default/Pod/fake-pod-30-plbx6": {}, + "/v1/default/Pod/fake-pod-30-psvrm": {}, + "/v1/default/Pod/fake-pod-30-pvt9h": {}, + "/v1/default/Pod/fake-pod-30-pvxn6": {}, + "/v1/default/Pod/fake-pod-30-pz2zp": {}, + "/v1/default/Pod/fake-pod-30-q2kjc": {}, + "/v1/default/Pod/fake-pod-30-q54ks": {}, + "/v1/default/Pod/fake-pod-30-q6j2p": {}, + "/v1/default/Pod/fake-pod-30-q7ng7": {}, + "/v1/default/Pod/fake-pod-30-q9f4w": {}, + "/v1/default/Pod/fake-pod-30-qhxx2": {}, + "/v1/default/Pod/fake-pod-30-qjxq7": {}, + "/v1/default/Pod/fake-pod-30-qljf7": {}, + "/v1/default/Pod/fake-pod-30-qr785": {}, + "/v1/default/Pod/fake-pod-30-qrmz6": {}, + "/v1/default/Pod/fake-pod-30-qshtq": {}, + "/v1/default/Pod/fake-pod-30-r2qrk": {}, + "/v1/default/Pod/fake-pod-30-r59pr": {}, + "/v1/default/Pod/fake-pod-30-r6ffn": {}, + "/v1/default/Pod/fake-pod-30-rfpwf": {}, + "/v1/default/Pod/fake-pod-30-rh79z": {}, + "/v1/default/Pod/fake-pod-30-rhnnw": {}, + "/v1/default/Pod/fake-pod-30-rjlpt": {}, + "/v1/default/Pod/fake-pod-30-rl8sv": {}, + "/v1/default/Pod/fake-pod-30-rlc5b": {}, + "/v1/default/Pod/fake-pod-30-rm8cg": {}, + "/v1/default/Pod/fake-pod-30-rmcql": {}, + "/v1/default/Pod/fake-pod-30-rmngs": {}, + "/v1/default/Pod/fake-pod-30-rn2jp": {}, + "/v1/default/Pod/fake-pod-30-rt5g5": {}, + "/v1/default/Pod/fake-pod-30-rtg24": {}, + "/v1/default/Pod/fake-pod-30-s4s5z": {}, + "/v1/default/Pod/fake-pod-30-s7scm": {}, + "/v1/default/Pod/fake-pod-30-s988r": {}, + "/v1/default/Pod/fake-pod-30-s9ddl": {}, + "/v1/default/Pod/fake-pod-30-sbprb": {}, + "/v1/default/Pod/fake-pod-30-scfgd": {}, + "/v1/default/Pod/fake-pod-30-sfgs5": {}, + "/v1/default/Pod/fake-pod-30-sg6js": {}, + "/v1/default/Pod/fake-pod-30-sj4t7": {}, + "/v1/default/Pod/fake-pod-30-slqf5": {}, + "/v1/default/Pod/fake-pod-30-sm4vg": {}, + "/v1/default/Pod/fake-pod-30-sptx6": {}, + "/v1/default/Pod/fake-pod-30-sq6pp": {}, + "/v1/default/Pod/fake-pod-30-sz7lq": {}, + "/v1/default/Pod/fake-pod-30-szkpw": {}, + "/v1/default/Pod/fake-pod-30-tcfjt": {}, + "/v1/default/Pod/fake-pod-30-tcr29": {}, + "/v1/default/Pod/fake-pod-30-tdmx5": {}, + "/v1/default/Pod/fake-pod-30-tlz8f": {}, + "/v1/default/Pod/fake-pod-30-tqsdr": {}, + "/v1/default/Pod/fake-pod-30-tttbc": {}, + "/v1/default/Pod/fake-pod-30-v2mxd": {}, + "/v1/default/Pod/fake-pod-30-v457r": {}, + "/v1/default/Pod/fake-pod-30-v4mhh": {}, + "/v1/default/Pod/fake-pod-30-v5h5b": {}, + "/v1/default/Pod/fake-pod-30-v5tq2": {}, + "/v1/default/Pod/fake-pod-30-v72vm": {}, + "/v1/default/Pod/fake-pod-30-v9vvn": {}, + "/v1/default/Pod/fake-pod-30-vcrbn": {}, + "/v1/default/Pod/fake-pod-30-vdnll": {}, + "/v1/default/Pod/fake-pod-30-vfmgv": {}, + "/v1/default/Pod/fake-pod-30-vlbbd": {}, + "/v1/default/Pod/fake-pod-30-vms7g": {}, + "/v1/default/Pod/fake-pod-30-vnbft": {}, + "/v1/default/Pod/fake-pod-30-vnstn": {}, + "/v1/default/Pod/fake-pod-30-vqtnx": {}, + "/v1/default/Pod/fake-pod-30-vrfkb": {}, + "/v1/default/Pod/fake-pod-30-vt5cv": {}, + "/v1/default/Pod/fake-pod-30-vxlj6": {}, + "/v1/default/Pod/fake-pod-30-vxxsc": {}, + "/v1/default/Pod/fake-pod-30-w4ltl": {}, + "/v1/default/Pod/fake-pod-30-w5qlf": {}, + "/v1/default/Pod/fake-pod-30-wjvz7": {}, + "/v1/default/Pod/fake-pod-30-wnnf2": {}, + "/v1/default/Pod/fake-pod-30-wpzrq": {}, + "/v1/default/Pod/fake-pod-30-wqqsm": {}, + "/v1/default/Pod/fake-pod-30-xcllt": {}, + "/v1/default/Pod/fake-pod-30-xd6vn": {}, + "/v1/default/Pod/fake-pod-30-xh4j6": {}, + "/v1/default/Pod/fake-pod-30-xkh2z": {}, + "/v1/default/Pod/fake-pod-30-xrll8": {}, + "/v1/default/Pod/fake-pod-30-xwcnr": {}, + "/v1/default/Pod/fake-pod-30-z2qnp": {}, + "/v1/default/Pod/fake-pod-30-z7qbk": {}, + "/v1/default/Pod/fake-pod-30-zgj29": {}, + "/v1/default/Pod/fake-pod-30-zjnf6": {}, + "/v1/default/Pod/fake-pod-30-zm2lg": {}, + "/v1/default/Pod/fake-pod-30-zt9jn": {}, + "/v1/default/Pod/fake-pod-30-zt9z5": {}, + "/v1/default/Pod/fake-pod-30-ztlzg": {}, + "/v1/default/Pod/fake-pod-30-ztrhn": {}, + "/v1/default/Pod/fake-pod-30-ztt27": {}, + "/v1/default/Pod/fake-pod-30-zvt5d": {}, + "/v1/default/Pod/fake-pod-30-zzdzh": {}, + "/v1/default/Pod/fake-pod-31-22cfn": {}, + "/v1/default/Pod/fake-pod-31-22qdn": {}, + "/v1/default/Pod/fake-pod-31-2g78c": {}, + "/v1/default/Pod/fake-pod-31-2jpz6": {}, + "/v1/default/Pod/fake-pod-31-2jt9v": {}, + "/v1/default/Pod/fake-pod-31-2jxqf": {}, + "/v1/default/Pod/fake-pod-31-2kpl8": {}, + "/v1/default/Pod/fake-pod-31-2lbs8": {}, + "/v1/default/Pod/fake-pod-31-2q4l7": {}, + "/v1/default/Pod/fake-pod-31-2szvc": {}, + "/v1/default/Pod/fake-pod-31-2vrt4": {}, + "/v1/default/Pod/fake-pod-31-2zk7t": {}, + "/v1/default/Pod/fake-pod-31-44jvt": {}, + "/v1/default/Pod/fake-pod-31-46l7t": {}, + "/v1/default/Pod/fake-pod-31-46xm2": {}, + "/v1/default/Pod/fake-pod-31-47jr8": {}, + "/v1/default/Pod/fake-pod-31-4cw2v": {}, + "/v1/default/Pod/fake-pod-31-4g7cn": {}, + "/v1/default/Pod/fake-pod-31-4hsvm": {}, + "/v1/default/Pod/fake-pod-31-4lbzj": {}, + "/v1/default/Pod/fake-pod-31-4t8vb": {}, + "/v1/default/Pod/fake-pod-31-4zd9m": {}, + "/v1/default/Pod/fake-pod-31-4zpcx": {}, + "/v1/default/Pod/fake-pod-31-56zxp": {}, + "/v1/default/Pod/fake-pod-31-596pl": {}, + "/v1/default/Pod/fake-pod-31-59nq5": {}, + "/v1/default/Pod/fake-pod-31-5bfhz": {}, + "/v1/default/Pod/fake-pod-31-5bqwv": {}, + "/v1/default/Pod/fake-pod-31-5d8cb": {}, + "/v1/default/Pod/fake-pod-31-5d8sh": {}, + "/v1/default/Pod/fake-pod-31-5fb2p": {}, + "/v1/default/Pod/fake-pod-31-5fdmc": {}, + "/v1/default/Pod/fake-pod-31-5gbhs": {}, + "/v1/default/Pod/fake-pod-31-5gxz4": {}, + "/v1/default/Pod/fake-pod-31-5k2nj": {}, + "/v1/default/Pod/fake-pod-31-5ktxt": {}, + "/v1/default/Pod/fake-pod-31-5mbbp": {}, + "/v1/default/Pod/fake-pod-31-5mztv": {}, + "/v1/default/Pod/fake-pod-31-5q7n5": {}, + "/v1/default/Pod/fake-pod-31-5tzd7": {}, + "/v1/default/Pod/fake-pod-31-5z2kl": {}, + "/v1/default/Pod/fake-pod-31-627gg": {}, + "/v1/default/Pod/fake-pod-31-67hgt": {}, + "/v1/default/Pod/fake-pod-31-6gn4x": {}, + "/v1/default/Pod/fake-pod-31-6mrkb": {}, + "/v1/default/Pod/fake-pod-31-6trlr": {}, + "/v1/default/Pod/fake-pod-31-6vxz9": {}, + "/v1/default/Pod/fake-pod-31-759dg": {}, + "/v1/default/Pod/fake-pod-31-79j96": {}, + "/v1/default/Pod/fake-pod-31-7kg7f": {}, + "/v1/default/Pod/fake-pod-31-7ph6g": {}, + "/v1/default/Pod/fake-pod-31-7qhct": {}, + "/v1/default/Pod/fake-pod-31-7zmt8": {}, + "/v1/default/Pod/fake-pod-31-8284c": {}, + "/v1/default/Pod/fake-pod-31-82kvz": {}, + "/v1/default/Pod/fake-pod-31-84lvc": {}, + "/v1/default/Pod/fake-pod-31-88hwr": {}, + "/v1/default/Pod/fake-pod-31-8bf2c": {}, + "/v1/default/Pod/fake-pod-31-8bn2r": {}, + "/v1/default/Pod/fake-pod-31-8bvbl": {}, + "/v1/default/Pod/fake-pod-31-8kgsj": {}, + "/v1/default/Pod/fake-pod-31-8l7mk": {}, + "/v1/default/Pod/fake-pod-31-8nh2n": {}, + "/v1/default/Pod/fake-pod-31-926ln": {}, + "/v1/default/Pod/fake-pod-31-9drkf": {}, + "/v1/default/Pod/fake-pod-31-9g59h": {}, + "/v1/default/Pod/fake-pod-31-9ghht": {}, + "/v1/default/Pod/fake-pod-31-9h76j": {}, + "/v1/default/Pod/fake-pod-31-9ks66": {}, + "/v1/default/Pod/fake-pod-31-9mxtg": {}, + "/v1/default/Pod/fake-pod-31-9rd6r": {}, + "/v1/default/Pod/fake-pod-31-9rhc2": {}, + "/v1/default/Pod/fake-pod-31-9v64c": {}, + "/v1/default/Pod/fake-pod-31-9w8m5": {}, + "/v1/default/Pod/fake-pod-31-b828d": {}, + "/v1/default/Pod/fake-pod-31-bjqkw": {}, + "/v1/default/Pod/fake-pod-31-bk6fw": {}, + "/v1/default/Pod/fake-pod-31-bkm84": {}, + "/v1/default/Pod/fake-pod-31-bpfnx": {}, + "/v1/default/Pod/fake-pod-31-bpsrf": {}, + "/v1/default/Pod/fake-pod-31-bq8cz": {}, + "/v1/default/Pod/fake-pod-31-bslvr": {}, + "/v1/default/Pod/fake-pod-31-btntw": {}, + "/v1/default/Pod/fake-pod-31-bvh9g": {}, + "/v1/default/Pod/fake-pod-31-bxd9h": {}, + "/v1/default/Pod/fake-pod-31-bzvpt": {}, + "/v1/default/Pod/fake-pod-31-c27s9": {}, + "/v1/default/Pod/fake-pod-31-c2m9l": {}, + "/v1/default/Pod/fake-pod-31-c4krv": {}, + "/v1/default/Pod/fake-pod-31-c59bk": {}, + "/v1/default/Pod/fake-pod-31-c6jtr": {}, + "/v1/default/Pod/fake-pod-31-c7w8s": {}, + "/v1/default/Pod/fake-pod-31-cdkf6": {}, + "/v1/default/Pod/fake-pod-31-clctd": {}, + "/v1/default/Pod/fake-pod-31-czpxn": {}, + "/v1/default/Pod/fake-pod-31-d2kv2": {}, + "/v1/default/Pod/fake-pod-31-d5xdw": {}, + "/v1/default/Pod/fake-pod-31-d74gp": {}, + "/v1/default/Pod/fake-pod-31-d754q": {}, + "/v1/default/Pod/fake-pod-31-d7m5d": {}, + "/v1/default/Pod/fake-pod-31-d85bz": {}, + "/v1/default/Pod/fake-pod-31-d8fcv": {}, + "/v1/default/Pod/fake-pod-31-dds2w": {}, + "/v1/default/Pod/fake-pod-31-dg5dt": {}, + "/v1/default/Pod/fake-pod-31-dhc4p": {}, + "/v1/default/Pod/fake-pod-31-djfbn": {}, + "/v1/default/Pod/fake-pod-31-dp2rp": {}, + "/v1/default/Pod/fake-pod-31-dtmlb": {}, + "/v1/default/Pod/fake-pod-31-f7smk": {}, + "/v1/default/Pod/fake-pod-31-f99fg": {}, + "/v1/default/Pod/fake-pod-31-f9pw2": {}, + "/v1/default/Pod/fake-pod-31-fcmqm": {}, + "/v1/default/Pod/fake-pod-31-fd7b8": {}, + "/v1/default/Pod/fake-pod-31-fgk56": {}, + "/v1/default/Pod/fake-pod-31-fqvsz": {}, + "/v1/default/Pod/fake-pod-31-fthtw": {}, + "/v1/default/Pod/fake-pod-31-fvghr": {}, + "/v1/default/Pod/fake-pod-31-fzcdh": {}, + "/v1/default/Pod/fake-pod-31-g227s": {}, + "/v1/default/Pod/fake-pod-31-g22xn": {}, + "/v1/default/Pod/fake-pod-31-g4nrm": {}, + "/v1/default/Pod/fake-pod-31-g4tsk": {}, + "/v1/default/Pod/fake-pod-31-g9l5l": {}, + "/v1/default/Pod/fake-pod-31-g9lfl": {}, + "/v1/default/Pod/fake-pod-31-gb59n": {}, + "/v1/default/Pod/fake-pod-31-gb8g4": {}, + "/v1/default/Pod/fake-pod-31-gc9tc": {}, + "/v1/default/Pod/fake-pod-31-gfknb": {}, + "/v1/default/Pod/fake-pod-31-glxns": {}, + "/v1/default/Pod/fake-pod-31-gns4g": {}, + "/v1/default/Pod/fake-pod-31-gnxb8": {}, + "/v1/default/Pod/fake-pod-31-gpsnw": {}, + "/v1/default/Pod/fake-pod-31-gwmp9": {}, + "/v1/default/Pod/fake-pod-31-gwsqg": {}, + "/v1/default/Pod/fake-pod-31-gz2bj": {}, + "/v1/default/Pod/fake-pod-31-h45c2": {}, + "/v1/default/Pod/fake-pod-31-h4kbc": {}, + "/v1/default/Pod/fake-pod-31-hcd8h": {}, + "/v1/default/Pod/fake-pod-31-hgkcx": {}, + "/v1/default/Pod/fake-pod-31-hjl5b": {}, + "/v1/default/Pod/fake-pod-31-hkmc9": {}, + "/v1/default/Pod/fake-pod-31-hlbk8": {}, + "/v1/default/Pod/fake-pod-31-hmxck": {}, + "/v1/default/Pod/fake-pod-31-hwxfx": {}, + "/v1/default/Pod/fake-pod-31-j4glr": {}, + "/v1/default/Pod/fake-pod-31-j7zp7": {}, + "/v1/default/Pod/fake-pod-31-jb7rb": {}, + "/v1/default/Pod/fake-pod-31-jbjvv": {}, + "/v1/default/Pod/fake-pod-31-jfx6m": {}, + "/v1/default/Pod/fake-pod-31-jg6sb": {}, + "/v1/default/Pod/fake-pod-31-jggmq": {}, + "/v1/default/Pod/fake-pod-31-jgzhj": {}, + "/v1/default/Pod/fake-pod-31-jh6v4": {}, + "/v1/default/Pod/fake-pod-31-jkk46": {}, + "/v1/default/Pod/fake-pod-31-jvbj7": {}, + "/v1/default/Pod/fake-pod-31-k49v9": {}, + "/v1/default/Pod/fake-pod-31-k4mdx": {}, + "/v1/default/Pod/fake-pod-31-k56b5": {}, + "/v1/default/Pod/fake-pod-31-k74qg": {}, + "/v1/default/Pod/fake-pod-31-k85sf": {}, + "/v1/default/Pod/fake-pod-31-k89q6": {}, + "/v1/default/Pod/fake-pod-31-kb6t8": {}, + "/v1/default/Pod/fake-pod-31-khzgv": {}, + "/v1/default/Pod/fake-pod-31-kjgjq": {}, + "/v1/default/Pod/fake-pod-31-kjxz4": {}, + "/v1/default/Pod/fake-pod-31-klg2l": {}, + "/v1/default/Pod/fake-pod-31-kr62q": {}, + "/v1/default/Pod/fake-pod-31-kw94v": {}, + "/v1/default/Pod/fake-pod-31-kxspz": {}, + "/v1/default/Pod/fake-pod-31-l6chn": {}, + "/v1/default/Pod/fake-pod-31-l8dmg": {}, + "/v1/default/Pod/fake-pod-31-l9h5x": {}, + "/v1/default/Pod/fake-pod-31-lbmxf": {}, + "/v1/default/Pod/fake-pod-31-lfw6b": {}, + "/v1/default/Pod/fake-pod-31-lg8fc": {}, + "/v1/default/Pod/fake-pod-31-lgqt9": {}, + "/v1/default/Pod/fake-pod-31-ljb2v": {}, + "/v1/default/Pod/fake-pod-31-lmcvp": {}, + "/v1/default/Pod/fake-pod-31-lq9wk": {}, + "/v1/default/Pod/fake-pod-31-ls27g": {}, + "/v1/default/Pod/fake-pod-31-lsnlt": {}, + "/v1/default/Pod/fake-pod-31-ltl6j": {}, + "/v1/default/Pod/fake-pod-31-lx2zq": {}, + "/v1/default/Pod/fake-pod-31-m6sz6": {}, + "/v1/default/Pod/fake-pod-31-m885n": {}, + "/v1/default/Pod/fake-pod-31-m9298": {}, + "/v1/default/Pod/fake-pod-31-m9dwz": {}, + "/v1/default/Pod/fake-pod-31-mbhkl": {}, + "/v1/default/Pod/fake-pod-31-md6qk": {}, + "/v1/default/Pod/fake-pod-31-mf99k": {}, + "/v1/default/Pod/fake-pod-31-mhfln": {}, + "/v1/default/Pod/fake-pod-31-mpwxn": {}, + "/v1/default/Pod/fake-pod-31-mrt2k": {}, + "/v1/default/Pod/fake-pod-31-ms5b7": {}, + "/v1/default/Pod/fake-pod-31-mtw5b": {}, + "/v1/default/Pod/fake-pod-31-n6g77": {}, + "/v1/default/Pod/fake-pod-31-n95hb": {}, + "/v1/default/Pod/fake-pod-31-ncpjv": {}, + "/v1/default/Pod/fake-pod-31-ndbph": {}, + "/v1/default/Pod/fake-pod-31-ndnbw": {}, + "/v1/default/Pod/fake-pod-31-nfp8c": {}, + "/v1/default/Pod/fake-pod-31-nkh5t": {}, + "/v1/default/Pod/fake-pod-31-nnd7q": {}, + "/v1/default/Pod/fake-pod-31-nwgpj": {}, + "/v1/default/Pod/fake-pod-31-nx58f": {}, + "/v1/default/Pod/fake-pod-31-p2bd4": {}, + "/v1/default/Pod/fake-pod-31-pgbhf": {}, + "/v1/default/Pod/fake-pod-31-pk76n": {}, + "/v1/default/Pod/fake-pod-31-pkg74": {}, + "/v1/default/Pod/fake-pod-31-pkkc8": {}, + "/v1/default/Pod/fake-pod-31-pll2m": {}, + "/v1/default/Pod/fake-pod-31-pltw9": {}, + "/v1/default/Pod/fake-pod-31-pn974": {}, + "/v1/default/Pod/fake-pod-31-ptgcn": {}, + "/v1/default/Pod/fake-pod-31-pv5mp": {}, + "/v1/default/Pod/fake-pod-31-pzbf5": {}, + "/v1/default/Pod/fake-pod-31-q49r8": {}, + "/v1/default/Pod/fake-pod-31-q49z4": {}, + "/v1/default/Pod/fake-pod-31-q66xx": {}, + "/v1/default/Pod/fake-pod-31-q72nc": {}, + "/v1/default/Pod/fake-pod-31-q8xvc": {}, + "/v1/default/Pod/fake-pod-31-q954s": {}, + "/v1/default/Pod/fake-pod-31-qdk84": {}, + "/v1/default/Pod/fake-pod-31-qgnsm": {}, + "/v1/default/Pod/fake-pod-31-qjznp": {}, + "/v1/default/Pod/fake-pod-31-qn8z8": {}, + "/v1/default/Pod/fake-pod-31-qngnn": {}, + "/v1/default/Pod/fake-pod-31-qp6k2": {}, + "/v1/default/Pod/fake-pod-31-qqmc6": {}, + "/v1/default/Pod/fake-pod-31-qwmfn": {}, + "/v1/default/Pod/fake-pod-31-qwqcd": {}, + "/v1/default/Pod/fake-pod-31-r28ch": {}, + "/v1/default/Pod/fake-pod-31-r2n9l": {}, + "/v1/default/Pod/fake-pod-31-r5n7p": {}, + "/v1/default/Pod/fake-pod-31-r5skm": {}, + "/v1/default/Pod/fake-pod-31-rcd9j": {}, + "/v1/default/Pod/fake-pod-31-rmjqd": {}, + "/v1/default/Pod/fake-pod-31-rt2mf": {}, + "/v1/default/Pod/fake-pod-31-rx7sq": {}, + "/v1/default/Pod/fake-pod-31-rxbd9": {}, + "/v1/default/Pod/fake-pod-31-s4x9z": {}, + "/v1/default/Pod/fake-pod-31-s5crd": {}, + "/v1/default/Pod/fake-pod-31-s66v9": {}, + "/v1/default/Pod/fake-pod-31-scp66": {}, + "/v1/default/Pod/fake-pod-31-sjl6p": {}, + "/v1/default/Pod/fake-pod-31-slpsv": {}, + "/v1/default/Pod/fake-pod-31-smwt5": {}, + "/v1/default/Pod/fake-pod-31-srtzd": {}, + "/v1/default/Pod/fake-pod-31-ss5ll": {}, + "/v1/default/Pod/fake-pod-31-stb2s": {}, + "/v1/default/Pod/fake-pod-31-t4j2d": {}, + "/v1/default/Pod/fake-pod-31-t8zsg": {}, + "/v1/default/Pod/fake-pod-31-tc78l": {}, + "/v1/default/Pod/fake-pod-31-tjqm9": {}, + "/v1/default/Pod/fake-pod-31-tkzc5": {}, + "/v1/default/Pod/fake-pod-31-tlr44": {}, + "/v1/default/Pod/fake-pod-31-tmkt4": {}, + "/v1/default/Pod/fake-pod-31-tngxn": {}, + "/v1/default/Pod/fake-pod-31-tnxp9": {}, + "/v1/default/Pod/fake-pod-31-v49cv": {}, + "/v1/default/Pod/fake-pod-31-v6n56": {}, + "/v1/default/Pod/fake-pod-31-v6v7q": {}, + "/v1/default/Pod/fake-pod-31-v87q6": {}, + "/v1/default/Pod/fake-pod-31-v87zp": {}, + "/v1/default/Pod/fake-pod-31-vbwvn": {}, + "/v1/default/Pod/fake-pod-31-vjwjf": {}, + "/v1/default/Pod/fake-pod-31-vmjfp": {}, + "/v1/default/Pod/fake-pod-31-vnc5x": {}, + "/v1/default/Pod/fake-pod-31-vr5vq": {}, + "/v1/default/Pod/fake-pod-31-w2fgb": {}, + "/v1/default/Pod/fake-pod-31-w6p2j": {}, + "/v1/default/Pod/fake-pod-31-w75dr": {}, + "/v1/default/Pod/fake-pod-31-wcwvx": {}, + "/v1/default/Pod/fake-pod-31-wpk2b": {}, + "/v1/default/Pod/fake-pod-31-ws5nw": {}, + "/v1/default/Pod/fake-pod-31-x4n5j": {}, + "/v1/default/Pod/fake-pod-31-x68lc": {}, + "/v1/default/Pod/fake-pod-31-x6kll": {}, + "/v1/default/Pod/fake-pod-31-x7lk2": {}, + "/v1/default/Pod/fake-pod-31-xcjc7": {}, + "/v1/default/Pod/fake-pod-31-xhvjd": {}, + "/v1/default/Pod/fake-pod-31-xlg7w": {}, + "/v1/default/Pod/fake-pod-31-xvdjk": {}, + "/v1/default/Pod/fake-pod-31-xz6rk": {}, + "/v1/default/Pod/fake-pod-31-xzzlq": {}, + "/v1/default/Pod/fake-pod-31-z46gj": {}, + "/v1/default/Pod/fake-pod-31-z67cf": {}, + "/v1/default/Pod/fake-pod-31-zb55p": {}, + "/v1/default/Pod/fake-pod-31-zgsqh": {}, + "/v1/default/Pod/fake-pod-31-zhk75": {}, + "/v1/default/Pod/fake-pod-31-zj66x": {}, + "/v1/default/Pod/fake-pod-31-zkmb4": {}, + "/v1/default/Pod/fake-pod-31-zn769": {}, + "/v1/default/Pod/fake-pod-31-zpgnd": {}, + "/v1/default/Pod/fake-pod-31-zqsfx": {}, + "/v1/default/Pod/fake-pod-31-zqww4": {}, + "/v1/default/Pod/fake-pod-31-zsvc8": {}, + "/v1/default/Pod/fake-pod-31-zt2ch": {}, + "/v1/default/Pod/fake-pod-31-zxtns": {}, + "/v1/default/Pod/fake-pod-32-245tx": {}, + "/v1/default/Pod/fake-pod-32-2848f": {}, + "/v1/default/Pod/fake-pod-32-2bd88": {}, + "/v1/default/Pod/fake-pod-32-2bgdl": {}, + "/v1/default/Pod/fake-pod-32-2gkpq": {}, + "/v1/default/Pod/fake-pod-32-2hv8b": {}, + "/v1/default/Pod/fake-pod-32-2jwsx": {}, + "/v1/default/Pod/fake-pod-32-2nhqz": {}, + "/v1/default/Pod/fake-pod-32-2p8hz": {}, + "/v1/default/Pod/fake-pod-32-2vs4b": {}, + "/v1/default/Pod/fake-pod-32-2vw8v": {}, + "/v1/default/Pod/fake-pod-32-2xvbs": {}, + "/v1/default/Pod/fake-pod-32-42gmf": {}, + "/v1/default/Pod/fake-pod-32-446tk": {}, + "/v1/default/Pod/fake-pod-32-446vg": {}, + "/v1/default/Pod/fake-pod-32-44t2s": {}, + "/v1/default/Pod/fake-pod-32-4bgjx": {}, + "/v1/default/Pod/fake-pod-32-4mvsr": {}, + "/v1/default/Pod/fake-pod-32-4nk8h": {}, + "/v1/default/Pod/fake-pod-32-4pngz": {}, + "/v1/default/Pod/fake-pod-32-4qnfx": {}, + "/v1/default/Pod/fake-pod-32-4r94h": {}, + "/v1/default/Pod/fake-pod-32-4rdwt": {}, + "/v1/default/Pod/fake-pod-32-4srk8": {}, + "/v1/default/Pod/fake-pod-32-4v64k": {}, + "/v1/default/Pod/fake-pod-32-55278": {}, + "/v1/default/Pod/fake-pod-32-55cg8": {}, + "/v1/default/Pod/fake-pod-32-595qk": {}, + "/v1/default/Pod/fake-pod-32-5jjkp": {}, + "/v1/default/Pod/fake-pod-32-5lgb4": {}, + "/v1/default/Pod/fake-pod-32-5s4xn": {}, + "/v1/default/Pod/fake-pod-32-5s9xx": {}, + "/v1/default/Pod/fake-pod-32-5xhd9": {}, + "/v1/default/Pod/fake-pod-32-64h22": {}, + "/v1/default/Pod/fake-pod-32-64rjr": {}, + "/v1/default/Pod/fake-pod-32-66lkf": {}, + "/v1/default/Pod/fake-pod-32-67mqq": {}, + "/v1/default/Pod/fake-pod-32-6fcd5": {}, + "/v1/default/Pod/fake-pod-32-6gdln": {}, + "/v1/default/Pod/fake-pod-32-6rj2x": {}, + "/v1/default/Pod/fake-pod-32-6sd2w": {}, + "/v1/default/Pod/fake-pod-32-6v8jl": {}, + "/v1/default/Pod/fake-pod-32-6vs2x": {}, + "/v1/default/Pod/fake-pod-32-6xpvt": {}, + "/v1/default/Pod/fake-pod-32-6z877": {}, + "/v1/default/Pod/fake-pod-32-6zbkk": {}, + "/v1/default/Pod/fake-pod-32-77t2t": {}, + "/v1/default/Pod/fake-pod-32-7fhcj": {}, + "/v1/default/Pod/fake-pod-32-7jhlm": {}, + "/v1/default/Pod/fake-pod-32-7q7vk": {}, + "/v1/default/Pod/fake-pod-32-7rbqn": {}, + "/v1/default/Pod/fake-pod-32-7rk7c": {}, + "/v1/default/Pod/fake-pod-32-7vd6f": {}, + "/v1/default/Pod/fake-pod-32-82722": {}, + "/v1/default/Pod/fake-pod-32-854kh": {}, + "/v1/default/Pod/fake-pod-32-8652s": {}, + "/v1/default/Pod/fake-pod-32-86pd7": {}, + "/v1/default/Pod/fake-pod-32-87v4x": {}, + "/v1/default/Pod/fake-pod-32-8bwvc": {}, + "/v1/default/Pod/fake-pod-32-8c4xr": {}, + "/v1/default/Pod/fake-pod-32-8cmps": {}, + "/v1/default/Pod/fake-pod-32-8csgs": {}, + "/v1/default/Pod/fake-pod-32-8f89k": {}, + "/v1/default/Pod/fake-pod-32-8fr5l": {}, + "/v1/default/Pod/fake-pod-32-8gzj7": {}, + "/v1/default/Pod/fake-pod-32-8hhzk": {}, + "/v1/default/Pod/fake-pod-32-8sn2r": {}, + "/v1/default/Pod/fake-pod-32-8ss68": {}, + "/v1/default/Pod/fake-pod-32-8wt9z": {}, + "/v1/default/Pod/fake-pod-32-8zs2w": {}, + "/v1/default/Pod/fake-pod-32-92ncv": {}, + "/v1/default/Pod/fake-pod-32-92pp9": {}, + "/v1/default/Pod/fake-pod-32-94xww": {}, + "/v1/default/Pod/fake-pod-32-96cx9": {}, + "/v1/default/Pod/fake-pod-32-99xf2": {}, + "/v1/default/Pod/fake-pod-32-9lg8t": {}, + "/v1/default/Pod/fake-pod-32-9mfbw": {}, + "/v1/default/Pod/fake-pod-32-9pqrl": {}, + "/v1/default/Pod/fake-pod-32-9r6ml": {}, + "/v1/default/Pod/fake-pod-32-b7ckl": {}, + "/v1/default/Pod/fake-pod-32-b7x2b": {}, + "/v1/default/Pod/fake-pod-32-b9ftd": {}, + "/v1/default/Pod/fake-pod-32-bbtn4": {}, + "/v1/default/Pod/fake-pod-32-bk49t": {}, + "/v1/default/Pod/fake-pod-32-bkk29": {}, + "/v1/default/Pod/fake-pod-32-bp625": {}, + "/v1/default/Pod/fake-pod-32-c25kc": {}, + "/v1/default/Pod/fake-pod-32-c4ggx": {}, + "/v1/default/Pod/fake-pod-32-c4src": {}, + "/v1/default/Pod/fake-pod-32-c5k72": {}, + "/v1/default/Pod/fake-pod-32-c8mx6": {}, + "/v1/default/Pod/fake-pod-32-cbgjp": {}, + "/v1/default/Pod/fake-pod-32-cdln2": {}, + "/v1/default/Pod/fake-pod-32-cfvnm": {}, + "/v1/default/Pod/fake-pod-32-cfzsp": {}, + "/v1/default/Pod/fake-pod-32-ckq29": {}, + "/v1/default/Pod/fake-pod-32-cqgrj": {}, + "/v1/default/Pod/fake-pod-32-cth47": {}, + "/v1/default/Pod/fake-pod-32-cxdj9": {}, + "/v1/default/Pod/fake-pod-32-d5z5w": {}, + "/v1/default/Pod/fake-pod-32-d7f9x": {}, + "/v1/default/Pod/fake-pod-32-dc97c": {}, + "/v1/default/Pod/fake-pod-32-dg4nh": {}, + "/v1/default/Pod/fake-pod-32-dg7cs": {}, + "/v1/default/Pod/fake-pod-32-dhvkd": {}, + "/v1/default/Pod/fake-pod-32-djjjx": {}, + "/v1/default/Pod/fake-pod-32-dkjfj": {}, + "/v1/default/Pod/fake-pod-32-drdmp": {}, + "/v1/default/Pod/fake-pod-32-dtb24": {}, + "/v1/default/Pod/fake-pod-32-f4lpz": {}, + "/v1/default/Pod/fake-pod-32-f6hws": {}, + "/v1/default/Pod/fake-pod-32-f9znb": {}, + "/v1/default/Pod/fake-pod-32-fd7rs": {}, + "/v1/default/Pod/fake-pod-32-fds79": {}, + "/v1/default/Pod/fake-pod-32-ffcvj": {}, + "/v1/default/Pod/fake-pod-32-fgl7r": {}, + "/v1/default/Pod/fake-pod-32-fhv5z": {}, + "/v1/default/Pod/fake-pod-32-fk6pl": {}, + "/v1/default/Pod/fake-pod-32-ftlwt": {}, + "/v1/default/Pod/fake-pod-32-fzmnm": {}, + "/v1/default/Pod/fake-pod-32-fzvfj": {}, + "/v1/default/Pod/fake-pod-32-g6zm5": {}, + "/v1/default/Pod/fake-pod-32-g75lq": {}, + "/v1/default/Pod/fake-pod-32-gfkpk": {}, + "/v1/default/Pod/fake-pod-32-gfvnp": {}, + "/v1/default/Pod/fake-pod-32-ggtlr": {}, + "/v1/default/Pod/fake-pod-32-gh5fx": {}, + "/v1/default/Pod/fake-pod-32-ghlv4": {}, + "/v1/default/Pod/fake-pod-32-glj5g": {}, + "/v1/default/Pod/fake-pod-32-gn25v": {}, + "/v1/default/Pod/fake-pod-32-gnrvr": {}, + "/v1/default/Pod/fake-pod-32-gsxtt": {}, + "/v1/default/Pod/fake-pod-32-gvns4": {}, + "/v1/default/Pod/fake-pod-32-h2ncm": {}, + "/v1/default/Pod/fake-pod-32-h7txn": {}, + "/v1/default/Pod/fake-pod-32-h8bfc": {}, + "/v1/default/Pod/fake-pod-32-h8d77": {}, + "/v1/default/Pod/fake-pod-32-hcbqf": {}, + "/v1/default/Pod/fake-pod-32-hcgmj": {}, + "/v1/default/Pod/fake-pod-32-hcnbn": {}, + "/v1/default/Pod/fake-pod-32-hfjk7": {}, + "/v1/default/Pod/fake-pod-32-hgfh6": {}, + "/v1/default/Pod/fake-pod-32-hkn2z": {}, + "/v1/default/Pod/fake-pod-32-hp97z": {}, + "/v1/default/Pod/fake-pod-32-ht7k7": {}, + "/v1/default/Pod/fake-pod-32-hvt9w": {}, + "/v1/default/Pod/fake-pod-32-hzcfm": {}, + "/v1/default/Pod/fake-pod-32-j4qlf": {}, + "/v1/default/Pod/fake-pod-32-j4rpl": {}, + "/v1/default/Pod/fake-pod-32-j6n5r": {}, + "/v1/default/Pod/fake-pod-32-j6s4b": {}, + "/v1/default/Pod/fake-pod-32-j8wmn": {}, + "/v1/default/Pod/fake-pod-32-jbv5w": {}, + "/v1/default/Pod/fake-pod-32-jftjg": {}, + "/v1/default/Pod/fake-pod-32-jfz6t": {}, + "/v1/default/Pod/fake-pod-32-jgmq8": {}, + "/v1/default/Pod/fake-pod-32-jgp8z": {}, + "/v1/default/Pod/fake-pod-32-jhnvx": {}, + "/v1/default/Pod/fake-pod-32-jp6zz": {}, + "/v1/default/Pod/fake-pod-32-jt56k": {}, + "/v1/default/Pod/fake-pod-32-jtjjp": {}, + "/v1/default/Pod/fake-pod-32-jxbqj": {}, + "/v1/default/Pod/fake-pod-32-jxngn": {}, + "/v1/default/Pod/fake-pod-32-k96bk": {}, + "/v1/default/Pod/fake-pod-32-k9t9x": {}, + "/v1/default/Pod/fake-pod-32-kbssk": {}, + "/v1/default/Pod/fake-pod-32-kcvcp": {}, + "/v1/default/Pod/fake-pod-32-kdsfp": {}, + "/v1/default/Pod/fake-pod-32-kfcw8": {}, + "/v1/default/Pod/fake-pod-32-kgpx7": {}, + "/v1/default/Pod/fake-pod-32-kj9jd": {}, + "/v1/default/Pod/fake-pod-32-kjsdv": {}, + "/v1/default/Pod/fake-pod-32-kkjcn": {}, + "/v1/default/Pod/fake-pod-32-kkmbc": {}, + "/v1/default/Pod/fake-pod-32-kmc62": {}, + "/v1/default/Pod/fake-pod-32-kmchq": {}, + "/v1/default/Pod/fake-pod-32-kmvpp": {}, + "/v1/default/Pod/fake-pod-32-kvgmm": {}, + "/v1/default/Pod/fake-pod-32-kw5ps": {}, + "/v1/default/Pod/fake-pod-32-kzzhv": {}, + "/v1/default/Pod/fake-pod-32-l2lcn": {}, + "/v1/default/Pod/fake-pod-32-l8zsq": {}, + "/v1/default/Pod/fake-pod-32-l9dxj": {}, + "/v1/default/Pod/fake-pod-32-lb5hr": {}, + "/v1/default/Pod/fake-pod-32-lcpw4": {}, + "/v1/default/Pod/fake-pod-32-llt4j": {}, + "/v1/default/Pod/fake-pod-32-ltxhn": {}, + "/v1/default/Pod/fake-pod-32-lxh2g": {}, + "/v1/default/Pod/fake-pod-32-m2vq5": {}, + "/v1/default/Pod/fake-pod-32-mbn2k": {}, + "/v1/default/Pod/fake-pod-32-mbxvd": {}, + "/v1/default/Pod/fake-pod-32-md2zv": {}, + "/v1/default/Pod/fake-pod-32-mdl2p": {}, + "/v1/default/Pod/fake-pod-32-mf7wj": {}, + "/v1/default/Pod/fake-pod-32-mfj2x": {}, + "/v1/default/Pod/fake-pod-32-mkxgg": {}, + "/v1/default/Pod/fake-pod-32-ml2dz": {}, + "/v1/default/Pod/fake-pod-32-mn7q2": {}, + "/v1/default/Pod/fake-pod-32-n62ms": {}, + "/v1/default/Pod/fake-pod-32-n7hpr": {}, + "/v1/default/Pod/fake-pod-32-n8t9r": {}, + "/v1/default/Pod/fake-pod-32-nb6m8": {}, + "/v1/default/Pod/fake-pod-32-nfhxm": {}, + "/v1/default/Pod/fake-pod-32-nm2xb": {}, + "/v1/default/Pod/fake-pod-32-nm7tp": {}, + "/v1/default/Pod/fake-pod-32-nthmq": {}, + "/v1/default/Pod/fake-pod-32-ntw2k": {}, + "/v1/default/Pod/fake-pod-32-ntwkf": {}, + "/v1/default/Pod/fake-pod-32-nzv9f": {}, + "/v1/default/Pod/fake-pod-32-p4xph": {}, + "/v1/default/Pod/fake-pod-32-p8wl5": {}, + "/v1/default/Pod/fake-pod-32-p9vsb": {}, + "/v1/default/Pod/fake-pod-32-pgjx5": {}, + "/v1/default/Pod/fake-pod-32-pjc8q": {}, + "/v1/default/Pod/fake-pod-32-pjv8d": {}, + "/v1/default/Pod/fake-pod-32-pkxtt": {}, + "/v1/default/Pod/fake-pod-32-pmll2": {}, + "/v1/default/Pod/fake-pod-32-przkd": {}, + "/v1/default/Pod/fake-pod-32-q2ckt": {}, + "/v1/default/Pod/fake-pod-32-qcsxk": {}, + "/v1/default/Pod/fake-pod-32-qctww": {}, + "/v1/default/Pod/fake-pod-32-qdrwv": {}, + "/v1/default/Pod/fake-pod-32-ql7d9": {}, + "/v1/default/Pod/fake-pod-32-qlkq9": {}, + "/v1/default/Pod/fake-pod-32-qq87g": {}, + "/v1/default/Pod/fake-pod-32-qqz2t": {}, + "/v1/default/Pod/fake-pod-32-qrwqw": {}, + "/v1/default/Pod/fake-pod-32-qx5xn": {}, + "/v1/default/Pod/fake-pod-32-qxwjf": {}, + "/v1/default/Pod/fake-pod-32-qzppv": {}, + "/v1/default/Pod/fake-pod-32-r2tzv": {}, + "/v1/default/Pod/fake-pod-32-r4rxl": {}, + "/v1/default/Pod/fake-pod-32-r5b44": {}, + "/v1/default/Pod/fake-pod-32-r7r4n": {}, + "/v1/default/Pod/fake-pod-32-rdh9z": {}, + "/v1/default/Pod/fake-pod-32-rg6r6": {}, + "/v1/default/Pod/fake-pod-32-rgkjg": {}, + "/v1/default/Pod/fake-pod-32-rnpgz": {}, + "/v1/default/Pod/fake-pod-32-s2cr9": {}, + "/v1/default/Pod/fake-pod-32-s2sf7": {}, + "/v1/default/Pod/fake-pod-32-s4xlg": {}, + "/v1/default/Pod/fake-pod-32-s7nfw": {}, + "/v1/default/Pod/fake-pod-32-s8tdc": {}, + "/v1/default/Pod/fake-pod-32-sb4xp": {}, + "/v1/default/Pod/fake-pod-32-sfpnt": {}, + "/v1/default/Pod/fake-pod-32-skmx2": {}, + "/v1/default/Pod/fake-pod-32-stxwn": {}, + "/v1/default/Pod/fake-pod-32-sw2lb": {}, + "/v1/default/Pod/fake-pod-32-t2g6c": {}, + "/v1/default/Pod/fake-pod-32-t4s9k": {}, + "/v1/default/Pod/fake-pod-32-tgp8s": {}, + "/v1/default/Pod/fake-pod-32-tm7s2": {}, + "/v1/default/Pod/fake-pod-32-tmr8s": {}, + "/v1/default/Pod/fake-pod-32-v4npg": {}, + "/v1/default/Pod/fake-pod-32-v4r4s": {}, + "/v1/default/Pod/fake-pod-32-v6n8g": {}, + "/v1/default/Pod/fake-pod-32-vk88k": {}, + "/v1/default/Pod/fake-pod-32-vm68f": {}, + "/v1/default/Pod/fake-pod-32-vqf5p": {}, + "/v1/default/Pod/fake-pod-32-vqr7m": {}, + "/v1/default/Pod/fake-pod-32-vs4wf": {}, + "/v1/default/Pod/fake-pod-32-vvv7k": {}, + "/v1/default/Pod/fake-pod-32-vwqg4": {}, + "/v1/default/Pod/fake-pod-32-vxd5p": {}, + "/v1/default/Pod/fake-pod-32-w6bpd": {}, + "/v1/default/Pod/fake-pod-32-w6srj": {}, + "/v1/default/Pod/fake-pod-32-w9mtt": {}, + "/v1/default/Pod/fake-pod-32-w9tht": {}, + "/v1/default/Pod/fake-pod-32-wc5d5": {}, + "/v1/default/Pod/fake-pod-32-wdwn2": {}, + "/v1/default/Pod/fake-pod-32-wqn6g": {}, + "/v1/default/Pod/fake-pod-32-wrr8x": {}, + "/v1/default/Pod/fake-pod-32-ws978": {}, + "/v1/default/Pod/fake-pod-32-wvvx5": {}, + "/v1/default/Pod/fake-pod-32-wzlt5": {}, + "/v1/default/Pod/fake-pod-32-xbvmp": {}, + "/v1/default/Pod/fake-pod-32-xfpw5": {}, + "/v1/default/Pod/fake-pod-32-xhwk5": {}, + "/v1/default/Pod/fake-pod-32-xlhjq": {}, + "/v1/default/Pod/fake-pod-32-xr7th": {}, + "/v1/default/Pod/fake-pod-32-xrp5r": {}, + "/v1/default/Pod/fake-pod-32-xshbq": {}, + "/v1/default/Pod/fake-pod-32-xt6l7": {}, + "/v1/default/Pod/fake-pod-32-xtpjw": {}, + "/v1/default/Pod/fake-pod-32-xvqc7": {}, + "/v1/default/Pod/fake-pod-32-z2k4l": {}, + "/v1/default/Pod/fake-pod-32-z4m85": {}, + "/v1/default/Pod/fake-pod-32-z7zkr": {}, + "/v1/default/Pod/fake-pod-32-z87fs": {}, + "/v1/default/Pod/fake-pod-32-zbk54": {}, + "/v1/default/Pod/fake-pod-32-zcr2f": {}, + "/v1/default/Pod/fake-pod-32-zfws9": {}, + "/v1/default/Pod/fake-pod-32-zj4km": {}, + "/v1/default/Pod/fake-pod-32-zkxsc": {}, + "/v1/default/Pod/fake-pod-32-zlfxg": {}, + "/v1/default/Pod/fake-pod-32-zm8cg": {}, + "/v1/default/Pod/fake-pod-32-ztdj8": {}, + "/v1/default/Pod/fake-pod-32-zvtkq": {}, + "/v1/default/Pod/fake-pod-32-zxpng": {}, + "/v1/default/Pod/fake-pod-33-2262c": {}, + "/v1/default/Pod/fake-pod-33-22wkv": {}, + "/v1/default/Pod/fake-pod-33-25trg": {}, + "/v1/default/Pod/fake-pod-33-2cxjn": {}, + "/v1/default/Pod/fake-pod-33-2hhdz": {}, + "/v1/default/Pod/fake-pod-33-422hd": {}, + "/v1/default/Pod/fake-pod-33-4czn4": {}, + "/v1/default/Pod/fake-pod-33-4f9g5": {}, + "/v1/default/Pod/fake-pod-33-4ksmw": {}, + "/v1/default/Pod/fake-pod-33-4xc89": {}, + "/v1/default/Pod/fake-pod-33-54gb9": {}, + "/v1/default/Pod/fake-pod-33-562wl": {}, + "/v1/default/Pod/fake-pod-33-56642": {}, + "/v1/default/Pod/fake-pod-33-5bq5p": {}, + "/v1/default/Pod/fake-pod-33-5dwvh": {}, + "/v1/default/Pod/fake-pod-33-5h76r": {}, + "/v1/default/Pod/fake-pod-33-5kg9q": {}, + "/v1/default/Pod/fake-pod-33-5kkhg": {}, + "/v1/default/Pod/fake-pod-33-5l2t5": {}, + "/v1/default/Pod/fake-pod-33-5q747": {}, + "/v1/default/Pod/fake-pod-33-5r7n9": {}, + "/v1/default/Pod/fake-pod-33-5rfrc": {}, + "/v1/default/Pod/fake-pod-33-5rhfs": {}, + "/v1/default/Pod/fake-pod-33-5s6nk": {}, + "/v1/default/Pod/fake-pod-33-5xjb8": {}, + "/v1/default/Pod/fake-pod-33-65bv2": {}, + "/v1/default/Pod/fake-pod-33-65kmr": {}, + "/v1/default/Pod/fake-pod-33-68z6z": {}, + "/v1/default/Pod/fake-pod-33-6f2v4": {}, + "/v1/default/Pod/fake-pod-33-6ff7h": {}, + "/v1/default/Pod/fake-pod-33-6h79s": {}, + "/v1/default/Pod/fake-pod-33-6jnw4": {}, + "/v1/default/Pod/fake-pod-33-6nwct": {}, + "/v1/default/Pod/fake-pod-33-6rf62": {}, + "/v1/default/Pod/fake-pod-33-6sgpl": {}, + "/v1/default/Pod/fake-pod-33-6vcww": {}, + "/v1/default/Pod/fake-pod-33-6w5d2": {}, + "/v1/default/Pod/fake-pod-33-6x9pg": {}, + "/v1/default/Pod/fake-pod-33-6zdv4": {}, + "/v1/default/Pod/fake-pod-33-749db": {}, + "/v1/default/Pod/fake-pod-33-76cg5": {}, + "/v1/default/Pod/fake-pod-33-777j6": {}, + "/v1/default/Pod/fake-pod-33-796cp": {}, + "/v1/default/Pod/fake-pod-33-7f8bb": {}, + "/v1/default/Pod/fake-pod-33-7r27n": {}, + "/v1/default/Pod/fake-pod-33-7vcwv": {}, + "/v1/default/Pod/fake-pod-33-7wm5r": {}, + "/v1/default/Pod/fake-pod-33-7xjzn": {}, + "/v1/default/Pod/fake-pod-33-7ztzs": {}, + "/v1/default/Pod/fake-pod-33-82vpv": {}, + "/v1/default/Pod/fake-pod-33-85fk4": {}, + "/v1/default/Pod/fake-pod-33-86p5k": {}, + "/v1/default/Pod/fake-pod-33-88xzn": {}, + "/v1/default/Pod/fake-pod-33-8f6s5": {}, + "/v1/default/Pod/fake-pod-33-8h5l9": {}, + "/v1/default/Pod/fake-pod-33-8hdm7": {}, + "/v1/default/Pod/fake-pod-33-8j8sn": {}, + "/v1/default/Pod/fake-pod-33-8jjbs": {}, + "/v1/default/Pod/fake-pod-33-8rv2c": {}, + "/v1/default/Pod/fake-pod-33-96db5": {}, + "/v1/default/Pod/fake-pod-33-98xq5": {}, + "/v1/default/Pod/fake-pod-33-9g22h": {}, + "/v1/default/Pod/fake-pod-33-9ldw7": {}, + "/v1/default/Pod/fake-pod-33-9v898": {}, + "/v1/default/Pod/fake-pod-33-9wb7f": {}, + "/v1/default/Pod/fake-pod-33-9wdwd": {}, + "/v1/default/Pod/fake-pod-33-9zh68": {}, + "/v1/default/Pod/fake-pod-33-b29fl": {}, + "/v1/default/Pod/fake-pod-33-b2nj6": {}, + "/v1/default/Pod/fake-pod-33-b56xc": {}, + "/v1/default/Pod/fake-pod-33-b8kwx": {}, + "/v1/default/Pod/fake-pod-33-b8qxx": {}, + "/v1/default/Pod/fake-pod-33-bkqcr": {}, + "/v1/default/Pod/fake-pod-33-bszvw": {}, + "/v1/default/Pod/fake-pod-33-bwkbb": {}, + "/v1/default/Pod/fake-pod-33-bzfpc": {}, + "/v1/default/Pod/fake-pod-33-cb7ds": {}, + "/v1/default/Pod/fake-pod-33-ccn4m": {}, + "/v1/default/Pod/fake-pod-33-cdqff": {}, + "/v1/default/Pod/fake-pod-33-chjk7": {}, + "/v1/default/Pod/fake-pod-33-clnfh": {}, + "/v1/default/Pod/fake-pod-33-cn895": {}, + "/v1/default/Pod/fake-pod-33-cnqz9": {}, + "/v1/default/Pod/fake-pod-33-cq7bz": {}, + "/v1/default/Pod/fake-pod-33-csjsf": {}, + "/v1/default/Pod/fake-pod-33-cslxj": {}, + "/v1/default/Pod/fake-pod-33-czmcm": {}, + "/v1/default/Pod/fake-pod-33-dff8c": {}, + "/v1/default/Pod/fake-pod-33-dh4pl": {}, + "/v1/default/Pod/fake-pod-33-djznx": {}, + "/v1/default/Pod/fake-pod-33-dlwlm": {}, + "/v1/default/Pod/fake-pod-33-dlxqg": {}, + "/v1/default/Pod/fake-pod-33-dpxjf": {}, + "/v1/default/Pod/fake-pod-33-dqjbc": {}, + "/v1/default/Pod/fake-pod-33-dsqqg": {}, + "/v1/default/Pod/fake-pod-33-dwgg5": {}, + "/v1/default/Pod/fake-pod-33-dxr5d": {}, + "/v1/default/Pod/fake-pod-33-f2p4z": {}, + "/v1/default/Pod/fake-pod-33-f2wtj": {}, + "/v1/default/Pod/fake-pod-33-f469r": {}, + "/v1/default/Pod/fake-pod-33-f4z28": {}, + "/v1/default/Pod/fake-pod-33-f5c7d": {}, + "/v1/default/Pod/fake-pod-33-fc95x": {}, + "/v1/default/Pod/fake-pod-33-ffmdh": {}, + "/v1/default/Pod/fake-pod-33-fjfsk": {}, + "/v1/default/Pod/fake-pod-33-fjgrq": {}, + "/v1/default/Pod/fake-pod-33-fjqzw": {}, + "/v1/default/Pod/fake-pod-33-fmc2d": {}, + "/v1/default/Pod/fake-pod-33-fnjvz": {}, + "/v1/default/Pod/fake-pod-33-fpdcn": {}, + "/v1/default/Pod/fake-pod-33-fqdr8": {}, + "/v1/default/Pod/fake-pod-33-fqwvs": {}, + "/v1/default/Pod/fake-pod-33-fvn56": {}, + "/v1/default/Pod/fake-pod-33-fzzjh": {}, + "/v1/default/Pod/fake-pod-33-g4qgd": {}, + "/v1/default/Pod/fake-pod-33-g59zm": {}, + "/v1/default/Pod/fake-pod-33-g5ggc": {}, + "/v1/default/Pod/fake-pod-33-g85f5": {}, + "/v1/default/Pod/fake-pod-33-g8xkd": {}, + "/v1/default/Pod/fake-pod-33-gd5kv": {}, + "/v1/default/Pod/fake-pod-33-ggfkb": {}, + "/v1/default/Pod/fake-pod-33-ggp7b": {}, + "/v1/default/Pod/fake-pod-33-ggs8w": {}, + "/v1/default/Pod/fake-pod-33-ghzpj": {}, + "/v1/default/Pod/fake-pod-33-gldwh": {}, + "/v1/default/Pod/fake-pod-33-gw77n": {}, + "/v1/default/Pod/fake-pod-33-gwsgk": {}, + "/v1/default/Pod/fake-pod-33-gxgkh": {}, + "/v1/default/Pod/fake-pod-33-gzjv6": {}, + "/v1/default/Pod/fake-pod-33-gzq29": {}, + "/v1/default/Pod/fake-pod-33-h2tlm": {}, + "/v1/default/Pod/fake-pod-33-h4qvt": {}, + "/v1/default/Pod/fake-pod-33-h5txc": {}, + "/v1/default/Pod/fake-pod-33-h89l5": {}, + "/v1/default/Pod/fake-pod-33-h979b": {}, + "/v1/default/Pod/fake-pod-33-hbqrg": {}, + "/v1/default/Pod/fake-pod-33-hqdhk": {}, + "/v1/default/Pod/fake-pod-33-hrsbt": {}, + "/v1/default/Pod/fake-pod-33-hs752": {}, + "/v1/default/Pod/fake-pod-33-hskxc": {}, + "/v1/default/Pod/fake-pod-33-hw5f4": {}, + "/v1/default/Pod/fake-pod-33-j5pg2": {}, + "/v1/default/Pod/fake-pod-33-j5q5r": {}, + "/v1/default/Pod/fake-pod-33-j5tqv": {}, + "/v1/default/Pod/fake-pod-33-j788t": {}, + "/v1/default/Pod/fake-pod-33-j7sh7": {}, + "/v1/default/Pod/fake-pod-33-jhp2h": {}, + "/v1/default/Pod/fake-pod-33-jjn44": {}, + "/v1/default/Pod/fake-pod-33-jnh26": {}, + "/v1/default/Pod/fake-pod-33-jrq5r": {}, + "/v1/default/Pod/fake-pod-33-jvkmh": {}, + "/v1/default/Pod/fake-pod-33-jwlj5": {}, + "/v1/default/Pod/fake-pod-33-kbhdh": {}, + "/v1/default/Pod/fake-pod-33-kh6zc": {}, + "/v1/default/Pod/fake-pod-33-khg8v": {}, + "/v1/default/Pod/fake-pod-33-khlvc": {}, + "/v1/default/Pod/fake-pod-33-kngd6": {}, + "/v1/default/Pod/fake-pod-33-kp28p": {}, + "/v1/default/Pod/fake-pod-33-l4g5z": {}, + "/v1/default/Pod/fake-pod-33-l58gn": {}, + "/v1/default/Pod/fake-pod-33-lbbm6": {}, + "/v1/default/Pod/fake-pod-33-lp4wj": {}, + "/v1/default/Pod/fake-pod-33-ls67l": {}, + "/v1/default/Pod/fake-pod-33-ltp64": {}, + "/v1/default/Pod/fake-pod-33-ltpqq": {}, + "/v1/default/Pod/fake-pod-33-lz4bd": {}, + "/v1/default/Pod/fake-pod-33-lzht2": {}, + "/v1/default/Pod/fake-pod-33-lzmvx": {}, + "/v1/default/Pod/fake-pod-33-m6k9v": {}, + "/v1/default/Pod/fake-pod-33-m75k5": {}, + "/v1/default/Pod/fake-pod-33-m9b69": {}, + "/v1/default/Pod/fake-pod-33-mg4ml": {}, + "/v1/default/Pod/fake-pod-33-mjc56": {}, + "/v1/default/Pod/fake-pod-33-mkcwn": {}, + "/v1/default/Pod/fake-pod-33-mn2jp": {}, + "/v1/default/Pod/fake-pod-33-mprs9": {}, + "/v1/default/Pod/fake-pod-33-msv5x": {}, + "/v1/default/Pod/fake-pod-33-mv8lm": {}, + "/v1/default/Pod/fake-pod-33-mvvvs": {}, + "/v1/default/Pod/fake-pod-33-mwbqt": {}, + "/v1/default/Pod/fake-pod-33-mzrtj": {}, + "/v1/default/Pod/fake-pod-33-n4fd5": {}, + "/v1/default/Pod/fake-pod-33-nbv9d": {}, + "/v1/default/Pod/fake-pod-33-nfkxp": {}, + "/v1/default/Pod/fake-pod-33-nhvts": {}, + "/v1/default/Pod/fake-pod-33-npppn": {}, + "/v1/default/Pod/fake-pod-33-nqqqg": {}, + "/v1/default/Pod/fake-pod-33-nsxfv": {}, + "/v1/default/Pod/fake-pod-33-ntwpl": {}, + "/v1/default/Pod/fake-pod-33-nxpp5": {}, + "/v1/default/Pod/fake-pod-33-nzw6k": {}, + "/v1/default/Pod/fake-pod-33-p57bl": {}, + "/v1/default/Pod/fake-pod-33-p7frx": {}, + "/v1/default/Pod/fake-pod-33-pfn9q": {}, + "/v1/default/Pod/fake-pod-33-pls2t": {}, + "/v1/default/Pod/fake-pod-33-prfh4": {}, + "/v1/default/Pod/fake-pod-33-pwc9b": {}, + "/v1/default/Pod/fake-pod-33-pxhz6": {}, + "/v1/default/Pod/fake-pod-33-q4k7n": {}, + "/v1/default/Pod/fake-pod-33-q6hzv": {}, + "/v1/default/Pod/fake-pod-33-q7lfq": {}, + "/v1/default/Pod/fake-pod-33-q7w2q": {}, + "/v1/default/Pod/fake-pod-33-q9dtl": {}, + "/v1/default/Pod/fake-pod-33-q9dxz": {}, + "/v1/default/Pod/fake-pod-33-qbhtk": {}, + "/v1/default/Pod/fake-pod-33-qcmc6": {}, + "/v1/default/Pod/fake-pod-33-qdt7b": {}, + "/v1/default/Pod/fake-pod-33-qfrlf": {}, + "/v1/default/Pod/fake-pod-33-qhf2r": {}, + "/v1/default/Pod/fake-pod-33-qjh25": {}, + "/v1/default/Pod/fake-pod-33-qpnbv": {}, + "/v1/default/Pod/fake-pod-33-qtz5f": {}, + "/v1/default/Pod/fake-pod-33-qx9mz": {}, + "/v1/default/Pod/fake-pod-33-qz29l": {}, + "/v1/default/Pod/fake-pod-33-qzv45": {}, + "/v1/default/Pod/fake-pod-33-r226h": {}, + "/v1/default/Pod/fake-pod-33-r2gc7": {}, + "/v1/default/Pod/fake-pod-33-r44wl": {}, + "/v1/default/Pod/fake-pod-33-r46qb": {}, + "/v1/default/Pod/fake-pod-33-r4mdp": {}, + "/v1/default/Pod/fake-pod-33-r54kg": {}, + "/v1/default/Pod/fake-pod-33-r59sr": {}, + "/v1/default/Pod/fake-pod-33-r64sb": {}, + "/v1/default/Pod/fake-pod-33-r7642": {}, + "/v1/default/Pod/fake-pod-33-r7ph8": {}, + "/v1/default/Pod/fake-pod-33-r82mn": {}, + "/v1/default/Pod/fake-pod-33-r8pfl": {}, + "/v1/default/Pod/fake-pod-33-rdmth": {}, + "/v1/default/Pod/fake-pod-33-rftrr": {}, + "/v1/default/Pod/fake-pod-33-rjrjk": {}, + "/v1/default/Pod/fake-pod-33-rnj8c": {}, + "/v1/default/Pod/fake-pod-33-rxmqp": {}, + "/v1/default/Pod/fake-pod-33-rxx7w": {}, + "/v1/default/Pod/fake-pod-33-rzqtw": {}, + "/v1/default/Pod/fake-pod-33-s854q": {}, + "/v1/default/Pod/fake-pod-33-sbdqv": {}, + "/v1/default/Pod/fake-pod-33-sqqjv": {}, + "/v1/default/Pod/fake-pod-33-ssm5j": {}, + "/v1/default/Pod/fake-pod-33-ssz2c": {}, + "/v1/default/Pod/fake-pod-33-stcbv": {}, + "/v1/default/Pod/fake-pod-33-sxhd8": {}, + "/v1/default/Pod/fake-pod-33-sxj6x": {}, + "/v1/default/Pod/fake-pod-33-tdjf7": {}, + "/v1/default/Pod/fake-pod-33-tg5pp": {}, + "/v1/default/Pod/fake-pod-33-tgn8m": {}, + "/v1/default/Pod/fake-pod-33-tkm8s": {}, + "/v1/default/Pod/fake-pod-33-tkrd9": {}, + "/v1/default/Pod/fake-pod-33-tmsz5": {}, + "/v1/default/Pod/fake-pod-33-tmzcl": {}, + "/v1/default/Pod/fake-pod-33-trt8l": {}, + "/v1/default/Pod/fake-pod-33-tx7hb": {}, + "/v1/default/Pod/fake-pod-33-v9vj2": {}, + "/v1/default/Pod/fake-pod-33-vf5m2": {}, + "/v1/default/Pod/fake-pod-33-vfkxd": {}, + "/v1/default/Pod/fake-pod-33-vg22n": {}, + "/v1/default/Pod/fake-pod-33-vg44p": {}, + "/v1/default/Pod/fake-pod-33-vg825": {}, + "/v1/default/Pod/fake-pod-33-vmlch": {}, + "/v1/default/Pod/fake-pod-33-vr5q6": {}, + "/v1/default/Pod/fake-pod-33-vrm4g": {}, + "/v1/default/Pod/fake-pod-33-vrm7s": {}, + "/v1/default/Pod/fake-pod-33-vv85l": {}, + "/v1/default/Pod/fake-pod-33-vw5fk": {}, + "/v1/default/Pod/fake-pod-33-vwtrt": {}, + "/v1/default/Pod/fake-pod-33-vz4m5": {}, + "/v1/default/Pod/fake-pod-33-vzhmq": {}, + "/v1/default/Pod/fake-pod-33-vzzwb": {}, + "/v1/default/Pod/fake-pod-33-w7xgw": {}, + "/v1/default/Pod/fake-pod-33-w9zvg": {}, + "/v1/default/Pod/fake-pod-33-wf74q": {}, + "/v1/default/Pod/fake-pod-33-wlnmx": {}, + "/v1/default/Pod/fake-pod-33-wn29r": {}, + "/v1/default/Pod/fake-pod-33-wnwwl": {}, + "/v1/default/Pod/fake-pod-33-wq5jr": {}, + "/v1/default/Pod/fake-pod-33-wqz9h": {}, + "/v1/default/Pod/fake-pod-33-wrxmq": {}, + "/v1/default/Pod/fake-pod-33-wv598": {}, + "/v1/default/Pod/fake-pod-33-wv78g": {}, + "/v1/default/Pod/fake-pod-33-wvb64": {}, + "/v1/default/Pod/fake-pod-33-x264d": {}, + "/v1/default/Pod/fake-pod-33-x45rb": {}, + "/v1/default/Pod/fake-pod-33-xb6rr": {}, + "/v1/default/Pod/fake-pod-33-xhxv2": {}, + "/v1/default/Pod/fake-pod-33-xkskw": {}, + "/v1/default/Pod/fake-pod-33-xlfg5": {}, + "/v1/default/Pod/fake-pod-33-xndhj": {}, + "/v1/default/Pod/fake-pod-33-xnjbk": {}, + "/v1/default/Pod/fake-pod-33-xrc98": {}, + "/v1/default/Pod/fake-pod-33-xtzzj": {}, + "/v1/default/Pod/fake-pod-33-xv2qn": {}, + "/v1/default/Pod/fake-pod-33-xvsqj": {}, + "/v1/default/Pod/fake-pod-33-xwlmr": {}, + "/v1/default/Pod/fake-pod-33-z4sqk": {}, + "/v1/default/Pod/fake-pod-33-z8xcj": {}, + "/v1/default/Pod/fake-pod-33-zd65v": {}, + "/v1/default/Pod/fake-pod-33-zlqf2": {}, + "/v1/default/Pod/fake-pod-33-zr5z6": {}, + "/v1/default/Pod/fake-pod-33-zst47": {}, + "/v1/default/Pod/fake-pod-33-ztxkq": {}, + "/v1/default/Pod/fake-pod-34-225g5": {}, + "/v1/default/Pod/fake-pod-34-22njs": {}, + "/v1/default/Pod/fake-pod-34-26282": {}, + "/v1/default/Pod/fake-pod-34-26hvb": {}, + "/v1/default/Pod/fake-pod-34-29v6h": {}, + "/v1/default/Pod/fake-pod-34-2bwlc": {}, + "/v1/default/Pod/fake-pod-34-2glrc": {}, + "/v1/default/Pod/fake-pod-34-2kcj2": {}, + "/v1/default/Pod/fake-pod-34-2krh9": {}, + "/v1/default/Pod/fake-pod-34-2n4pp": {}, + "/v1/default/Pod/fake-pod-34-2phpj": {}, + "/v1/default/Pod/fake-pod-34-2pj46": {}, + "/v1/default/Pod/fake-pod-34-2x9d5": {}, + "/v1/default/Pod/fake-pod-34-44mj2": {}, + "/v1/default/Pod/fake-pod-34-44wkq": {}, + "/v1/default/Pod/fake-pod-34-45dxn": {}, + "/v1/default/Pod/fake-pod-34-45mcb": {}, + "/v1/default/Pod/fake-pod-34-46jhb": {}, + "/v1/default/Pod/fake-pod-34-49mt9": {}, + "/v1/default/Pod/fake-pod-34-49vtg": {}, + "/v1/default/Pod/fake-pod-34-4bdd5": {}, + "/v1/default/Pod/fake-pod-34-4h6ll": {}, + "/v1/default/Pod/fake-pod-34-4jszk": {}, + "/v1/default/Pod/fake-pod-34-4l7zg": {}, + "/v1/default/Pod/fake-pod-34-4mxtr": {}, + "/v1/default/Pod/fake-pod-34-4ncfc": {}, + "/v1/default/Pod/fake-pod-34-4q44n": {}, + "/v1/default/Pod/fake-pod-34-4qc4s": {}, + "/v1/default/Pod/fake-pod-34-4rnns": {}, + "/v1/default/Pod/fake-pod-34-4s9sd": {}, + "/v1/default/Pod/fake-pod-34-4xvmd": {}, + "/v1/default/Pod/fake-pod-34-549q6": {}, + "/v1/default/Pod/fake-pod-34-55962": {}, + "/v1/default/Pod/fake-pod-34-55gml": {}, + "/v1/default/Pod/fake-pod-34-566sz": {}, + "/v1/default/Pod/fake-pod-34-57pc7": {}, + "/v1/default/Pod/fake-pod-34-58cf8": {}, + "/v1/default/Pod/fake-pod-34-58dbq": {}, + "/v1/default/Pod/fake-pod-34-5fz8r": {}, + "/v1/default/Pod/fake-pod-34-5g2kr": {}, + "/v1/default/Pod/fake-pod-34-5g9xx": {}, + "/v1/default/Pod/fake-pod-34-5jjjl": {}, + "/v1/default/Pod/fake-pod-34-5ngk7": {}, + "/v1/default/Pod/fake-pod-34-5v9md": {}, + "/v1/default/Pod/fake-pod-34-5wvrz": {}, + "/v1/default/Pod/fake-pod-34-62b9w": {}, + "/v1/default/Pod/fake-pod-34-66v75": {}, + "/v1/default/Pod/fake-pod-34-6cj8m": {}, + "/v1/default/Pod/fake-pod-34-6jlv9": {}, + "/v1/default/Pod/fake-pod-34-6m5wz": {}, + "/v1/default/Pod/fake-pod-34-6mxpr": {}, + "/v1/default/Pod/fake-pod-34-74gr2": {}, + "/v1/default/Pod/fake-pod-34-74msh": {}, + "/v1/default/Pod/fake-pod-34-76jpn": {}, + "/v1/default/Pod/fake-pod-34-78jcf": {}, + "/v1/default/Pod/fake-pod-34-7c2qh": {}, + "/v1/default/Pod/fake-pod-34-7jswr": {}, + "/v1/default/Pod/fake-pod-34-7kq9v": {}, + "/v1/default/Pod/fake-pod-34-7l5ql": {}, + "/v1/default/Pod/fake-pod-34-7ms6w": {}, + "/v1/default/Pod/fake-pod-34-7nkd4": {}, + "/v1/default/Pod/fake-pod-34-7nttl": {}, + "/v1/default/Pod/fake-pod-34-7p2nf": {}, + "/v1/default/Pod/fake-pod-34-7p5m5": {}, + "/v1/default/Pod/fake-pod-34-7qdqq": {}, + "/v1/default/Pod/fake-pod-34-7rcfj": {}, + "/v1/default/Pod/fake-pod-34-7sprw": {}, + "/v1/default/Pod/fake-pod-34-7tkp7": {}, + "/v1/default/Pod/fake-pod-34-85vvd": {}, + "/v1/default/Pod/fake-pod-34-8b86q": {}, + "/v1/default/Pod/fake-pod-34-8g9j2": {}, + "/v1/default/Pod/fake-pod-34-8gcc7": {}, + "/v1/default/Pod/fake-pod-34-8ghqz": {}, + "/v1/default/Pod/fake-pod-34-8gtfp": {}, + "/v1/default/Pod/fake-pod-34-8hbmw": {}, + "/v1/default/Pod/fake-pod-34-8j29p": {}, + "/v1/default/Pod/fake-pod-34-8j4m4": {}, + "/v1/default/Pod/fake-pod-34-8ljkr": {}, + "/v1/default/Pod/fake-pod-34-8nx7m": {}, + "/v1/default/Pod/fake-pod-34-8t599": {}, + "/v1/default/Pod/fake-pod-34-8t89q": {}, + "/v1/default/Pod/fake-pod-34-8zj9w": {}, + "/v1/default/Pod/fake-pod-34-95whh": {}, + "/v1/default/Pod/fake-pod-34-96t9x": {}, + "/v1/default/Pod/fake-pod-34-98q27": {}, + "/v1/default/Pod/fake-pod-34-9dl7k": {}, + "/v1/default/Pod/fake-pod-34-9g8qr": {}, + "/v1/default/Pod/fake-pod-34-9h9z6": {}, + "/v1/default/Pod/fake-pod-34-9hj9w": {}, + "/v1/default/Pod/fake-pod-34-9p74w": {}, + "/v1/default/Pod/fake-pod-34-9pdnw": {}, + "/v1/default/Pod/fake-pod-34-9qdbx": {}, + "/v1/default/Pod/fake-pod-34-9wtmn": {}, + "/v1/default/Pod/fake-pod-34-b4t6p": {}, + "/v1/default/Pod/fake-pod-34-b87n7": {}, + "/v1/default/Pod/fake-pod-34-bbs8c": {}, + "/v1/default/Pod/fake-pod-34-bddw6": {}, + "/v1/default/Pod/fake-pod-34-bg8wk": {}, + "/v1/default/Pod/fake-pod-34-bmzc6": {}, + "/v1/default/Pod/fake-pod-34-bpp4n": {}, + "/v1/default/Pod/fake-pod-34-bx52g": {}, + "/v1/default/Pod/fake-pod-34-bxbr9": {}, + "/v1/default/Pod/fake-pod-34-bzj6s": {}, + "/v1/default/Pod/fake-pod-34-c7rzz": {}, + "/v1/default/Pod/fake-pod-34-c7zh5": {}, + "/v1/default/Pod/fake-pod-34-c85q6": {}, + "/v1/default/Pod/fake-pod-34-c9zbf": {}, + "/v1/default/Pod/fake-pod-34-cg4z9": {}, + "/v1/default/Pod/fake-pod-34-cjxdz": {}, + "/v1/default/Pod/fake-pod-34-ckjrk": {}, + "/v1/default/Pod/fake-pod-34-cknfb": {}, + "/v1/default/Pod/fake-pod-34-cmdh6": {}, + "/v1/default/Pod/fake-pod-34-cmr2x": {}, + "/v1/default/Pod/fake-pod-34-cp86f": {}, + "/v1/default/Pod/fake-pod-34-cr6ld": {}, + "/v1/default/Pod/fake-pod-34-czvxl": {}, + "/v1/default/Pod/fake-pod-34-d6drr": {}, + "/v1/default/Pod/fake-pod-34-d6j4s": {}, + "/v1/default/Pod/fake-pod-34-d6kcq": {}, + "/v1/default/Pod/fake-pod-34-dht8t": {}, + "/v1/default/Pod/fake-pod-34-dl9th": {}, + "/v1/default/Pod/fake-pod-34-dm4gh": {}, + "/v1/default/Pod/fake-pod-34-dsns6": {}, + "/v1/default/Pod/fake-pod-34-dspx6": {}, + "/v1/default/Pod/fake-pod-34-f58wz": {}, + "/v1/default/Pod/fake-pod-34-f72c9": {}, + "/v1/default/Pod/fake-pod-34-fdlpq": {}, + "/v1/default/Pod/fake-pod-34-ff6cf": {}, + "/v1/default/Pod/fake-pod-34-flxpf": {}, + "/v1/default/Pod/fake-pod-34-fmdst": {}, + "/v1/default/Pod/fake-pod-34-fttwk": {}, + "/v1/default/Pod/fake-pod-34-fw9r8": {}, + "/v1/default/Pod/fake-pod-34-fxbsk": {}, + "/v1/default/Pod/fake-pod-34-g88wl": {}, + "/v1/default/Pod/fake-pod-34-g8z7n": {}, + "/v1/default/Pod/fake-pod-34-g97nh": {}, + "/v1/default/Pod/fake-pod-34-g9jkr": {}, + "/v1/default/Pod/fake-pod-34-gfscd": {}, + "/v1/default/Pod/fake-pod-34-ggtqb": {}, + "/v1/default/Pod/fake-pod-34-gjs2m": {}, + "/v1/default/Pod/fake-pod-34-gk4p7": {}, + "/v1/default/Pod/fake-pod-34-gq79z": {}, + "/v1/default/Pod/fake-pod-34-gz6hc": {}, + "/v1/default/Pod/fake-pod-34-h2p4j": {}, + "/v1/default/Pod/fake-pod-34-h4kkb": {}, + "/v1/default/Pod/fake-pod-34-h5ksb": {}, + "/v1/default/Pod/fake-pod-34-h5xvz": {}, + "/v1/default/Pod/fake-pod-34-h7p6r": {}, + "/v1/default/Pod/fake-pod-34-h8zpp": {}, + "/v1/default/Pod/fake-pod-34-hbtns": {}, + "/v1/default/Pod/fake-pod-34-hczvz": {}, + "/v1/default/Pod/fake-pod-34-hhpnq": {}, + "/v1/default/Pod/fake-pod-34-hjczb": {}, + "/v1/default/Pod/fake-pod-34-hjd64": {}, + "/v1/default/Pod/fake-pod-34-hp9cj": {}, + "/v1/default/Pod/fake-pod-34-hq9jb": {}, + "/v1/default/Pod/fake-pod-34-htvbn": {}, + "/v1/default/Pod/fake-pod-34-hzwwt": {}, + "/v1/default/Pod/fake-pod-34-j2lll": {}, + "/v1/default/Pod/fake-pod-34-jd2xt": {}, + "/v1/default/Pod/fake-pod-34-jmnbx": {}, + "/v1/default/Pod/fake-pod-34-jr45b": {}, + "/v1/default/Pod/fake-pod-34-jw5xs": {}, + "/v1/default/Pod/fake-pod-34-jxpgx": {}, + "/v1/default/Pod/fake-pod-34-jxz4v": {}, + "/v1/default/Pod/fake-pod-34-jzlg4": {}, + "/v1/default/Pod/fake-pod-34-k2xwg": {}, + "/v1/default/Pod/fake-pod-34-kcp9b": {}, + "/v1/default/Pod/fake-pod-34-kcqhd": {}, + "/v1/default/Pod/fake-pod-34-kj8x9": {}, + "/v1/default/Pod/fake-pod-34-kvd4w": {}, + "/v1/default/Pod/fake-pod-34-l2h7f": {}, + "/v1/default/Pod/fake-pod-34-l64dp": {}, + "/v1/default/Pod/fake-pod-34-l6n94": {}, + "/v1/default/Pod/fake-pod-34-l8sq2": {}, + "/v1/default/Pod/fake-pod-34-l8stc": {}, + "/v1/default/Pod/fake-pod-34-lbwsj": {}, + "/v1/default/Pod/fake-pod-34-lq75x": {}, + "/v1/default/Pod/fake-pod-34-lrrgt": {}, + "/v1/default/Pod/fake-pod-34-lt8bf": {}, + "/v1/default/Pod/fake-pod-34-ltxl7": {}, + "/v1/default/Pod/fake-pod-34-lzr8w": {}, + "/v1/default/Pod/fake-pod-34-m8x4c": {}, + "/v1/default/Pod/fake-pod-34-mb74x": {}, + "/v1/default/Pod/fake-pod-34-mgddt": {}, + "/v1/default/Pod/fake-pod-34-mlfxm": {}, + "/v1/default/Pod/fake-pod-34-mqfjx": {}, + "/v1/default/Pod/fake-pod-34-mvmc9": {}, + "/v1/default/Pod/fake-pod-34-n5wqb": {}, + "/v1/default/Pod/fake-pod-34-n668b": {}, + "/v1/default/Pod/fake-pod-34-n879h": {}, + "/v1/default/Pod/fake-pod-34-n8gnp": {}, + "/v1/default/Pod/fake-pod-34-n8kwh": {}, + "/v1/default/Pod/fake-pod-34-nbqc9": {}, + "/v1/default/Pod/fake-pod-34-nckfn": {}, + "/v1/default/Pod/fake-pod-34-nflhs": {}, + "/v1/default/Pod/fake-pod-34-nhb2j": {}, + "/v1/default/Pod/fake-pod-34-nn2xl": {}, + "/v1/default/Pod/fake-pod-34-npbf4": {}, + "/v1/default/Pod/fake-pod-34-nr4mz": {}, + "/v1/default/Pod/fake-pod-34-nrs5q": {}, + "/v1/default/Pod/fake-pod-34-nwdtn": {}, + "/v1/default/Pod/fake-pod-34-nx4vc": {}, + "/v1/default/Pod/fake-pod-34-nxllv": {}, + "/v1/default/Pod/fake-pod-34-p7fmw": {}, + "/v1/default/Pod/fake-pod-34-pb5zg": {}, + "/v1/default/Pod/fake-pod-34-pdhr6": {}, + "/v1/default/Pod/fake-pod-34-pdjdw": {}, + "/v1/default/Pod/fake-pod-34-pg4xh": {}, + "/v1/default/Pod/fake-pod-34-pj4ms": {}, + "/v1/default/Pod/fake-pod-34-pkrcp": {}, + "/v1/default/Pod/fake-pod-34-ppx5f": {}, + "/v1/default/Pod/fake-pod-34-pqnrx": {}, + "/v1/default/Pod/fake-pod-34-prx5l": {}, + "/v1/default/Pod/fake-pod-34-pv8dr": {}, + "/v1/default/Pod/fake-pod-34-pwj7w": {}, + "/v1/default/Pod/fake-pod-34-q27gd": {}, + "/v1/default/Pod/fake-pod-34-q8trq": {}, + "/v1/default/Pod/fake-pod-34-q92jt": {}, + "/v1/default/Pod/fake-pod-34-qg4ts": {}, + "/v1/default/Pod/fake-pod-34-qhw66": {}, + "/v1/default/Pod/fake-pod-34-qjfbp": {}, + "/v1/default/Pod/fake-pod-34-qnhgh": {}, + "/v1/default/Pod/fake-pod-34-qpgzb": {}, + "/v1/default/Pod/fake-pod-34-qrjnv": {}, + "/v1/default/Pod/fake-pod-34-qzl4p": {}, + "/v1/default/Pod/fake-pod-34-r994j": {}, + "/v1/default/Pod/fake-pod-34-rg2jh": {}, + "/v1/default/Pod/fake-pod-34-rhk58": {}, + "/v1/default/Pod/fake-pod-34-rm7x9": {}, + "/v1/default/Pod/fake-pod-34-rm86r": {}, + "/v1/default/Pod/fake-pod-34-rqpgz": {}, + "/v1/default/Pod/fake-pod-34-rsds4": {}, + "/v1/default/Pod/fake-pod-34-rtszm": {}, + "/v1/default/Pod/fake-pod-34-rw2zj": {}, + "/v1/default/Pod/fake-pod-34-rxnfw": {}, + "/v1/default/Pod/fake-pod-34-rxtmg": {}, + "/v1/default/Pod/fake-pod-34-rzb4x": {}, + "/v1/default/Pod/fake-pod-34-s2d5r": {}, + "/v1/default/Pod/fake-pod-34-s5v9t": {}, + "/v1/default/Pod/fake-pod-34-s6pcx": {}, + "/v1/default/Pod/fake-pod-34-s722v": {}, + "/v1/default/Pod/fake-pod-34-s7dgn": {}, + "/v1/default/Pod/fake-pod-34-s7w6j": {}, + "/v1/default/Pod/fake-pod-34-sbgfk": {}, + "/v1/default/Pod/fake-pod-34-scbhw": {}, + "/v1/default/Pod/fake-pod-34-sghrz": {}, + "/v1/default/Pod/fake-pod-34-sqz8x": {}, + "/v1/default/Pod/fake-pod-34-ssgxq": {}, + "/v1/default/Pod/fake-pod-34-stqwj": {}, + "/v1/default/Pod/fake-pod-34-szbgq": {}, + "/v1/default/Pod/fake-pod-34-sznrm": {}, + "/v1/default/Pod/fake-pod-34-t89bm": {}, + "/v1/default/Pod/fake-pod-34-tbq8n": {}, + "/v1/default/Pod/fake-pod-34-tf8ml": {}, + "/v1/default/Pod/fake-pod-34-tkslc": {}, + "/v1/default/Pod/fake-pod-34-tkw4b": {}, + "/v1/default/Pod/fake-pod-34-ttrhx": {}, + "/v1/default/Pod/fake-pod-34-tv4c6": {}, + "/v1/default/Pod/fake-pod-34-tx6gl": {}, + "/v1/default/Pod/fake-pod-34-v2f9r": {}, + "/v1/default/Pod/fake-pod-34-v4pfp": {}, + "/v1/default/Pod/fake-pod-34-v6hnr": {}, + "/v1/default/Pod/fake-pod-34-v729g": {}, + "/v1/default/Pod/fake-pod-34-v797w": {}, + "/v1/default/Pod/fake-pod-34-v7tt8": {}, + "/v1/default/Pod/fake-pod-34-vbc2p": {}, + "/v1/default/Pod/fake-pod-34-vd8m2": {}, + "/v1/default/Pod/fake-pod-34-vf4cs": {}, + "/v1/default/Pod/fake-pod-34-vf6xc": {}, + "/v1/default/Pod/fake-pod-34-vgsdz": {}, + "/v1/default/Pod/fake-pod-34-vkll9": {}, + "/v1/default/Pod/fake-pod-34-vlb96": {}, + "/v1/default/Pod/fake-pod-34-vmt7q": {}, + "/v1/default/Pod/fake-pod-34-vsf6g": {}, + "/v1/default/Pod/fake-pod-34-vssbp": {}, + "/v1/default/Pod/fake-pod-34-w8bwm": {}, + "/v1/default/Pod/fake-pod-34-wj77j": {}, + "/v1/default/Pod/fake-pod-34-wmnpd": {}, + "/v1/default/Pod/fake-pod-34-wndck": {}, + "/v1/default/Pod/fake-pod-34-wqct9": {}, + "/v1/default/Pod/fake-pod-34-x42hp": {}, + "/v1/default/Pod/fake-pod-34-x4vv6": {}, + "/v1/default/Pod/fake-pod-34-x66jz": {}, + "/v1/default/Pod/fake-pod-34-xbgh5": {}, + "/v1/default/Pod/fake-pod-34-xcqmw": {}, + "/v1/default/Pod/fake-pod-34-xcw8z": {}, + "/v1/default/Pod/fake-pod-34-xdndh": {}, + "/v1/default/Pod/fake-pod-34-xdrrk": {}, + "/v1/default/Pod/fake-pod-34-xjnfg": {}, + "/v1/default/Pod/fake-pod-34-xqrff": {}, + "/v1/default/Pod/fake-pod-34-xz2qd": {}, + "/v1/default/Pod/fake-pod-34-z4n7j": {}, + "/v1/default/Pod/fake-pod-34-zcfzh": {}, + "/v1/default/Pod/fake-pod-34-zcmtx": {}, + "/v1/default/Pod/fake-pod-34-zlwpx": {}, + "/v1/default/Pod/fake-pod-34-zmlzg": {}, + "/v1/default/Pod/fake-pod-34-zp7mc": {}, + "/v1/default/Pod/fake-pod-34-ztc7s": {}, + "/v1/default/Pod/fake-pod-35-22qzz": {}, + "/v1/default/Pod/fake-pod-35-24gr2": {}, + "/v1/default/Pod/fake-pod-35-26llj": {}, + "/v1/default/Pod/fake-pod-35-27pnp": {}, + "/v1/default/Pod/fake-pod-35-28kv7": {}, + "/v1/default/Pod/fake-pod-35-2bxwn": {}, + "/v1/default/Pod/fake-pod-35-2c8mz": {}, + "/v1/default/Pod/fake-pod-35-2j8xz": {}, + "/v1/default/Pod/fake-pod-35-2nr2j": {}, + "/v1/default/Pod/fake-pod-35-2qf5b": {}, + "/v1/default/Pod/fake-pod-35-2sbdf": {}, + "/v1/default/Pod/fake-pod-35-2v256": {}, + "/v1/default/Pod/fake-pod-35-2v4f2": {}, + "/v1/default/Pod/fake-pod-35-2wdqz": {}, + "/v1/default/Pod/fake-pod-35-47pf9": {}, + "/v1/default/Pod/fake-pod-35-49jrm": {}, + "/v1/default/Pod/fake-pod-35-49tfk": {}, + "/v1/default/Pod/fake-pod-35-4f66c": {}, + "/v1/default/Pod/fake-pod-35-4htlk": {}, + "/v1/default/Pod/fake-pod-35-4jntm": {}, + "/v1/default/Pod/fake-pod-35-4pddm": {}, + "/v1/default/Pod/fake-pod-35-4zhzh": {}, + "/v1/default/Pod/fake-pod-35-4zwjq": {}, + "/v1/default/Pod/fake-pod-35-57nhr": {}, + "/v1/default/Pod/fake-pod-35-57pwj": {}, + "/v1/default/Pod/fake-pod-35-58dwm": {}, + "/v1/default/Pod/fake-pod-35-5h5xc": {}, + "/v1/default/Pod/fake-pod-35-5hgkf": {}, + "/v1/default/Pod/fake-pod-35-5j86s": {}, + "/v1/default/Pod/fake-pod-35-5qf76": {}, + "/v1/default/Pod/fake-pod-35-5vdkz": {}, + "/v1/default/Pod/fake-pod-35-5z7sz": {}, + "/v1/default/Pod/fake-pod-35-5z8qc": {}, + "/v1/default/Pod/fake-pod-35-5zrfk": {}, + "/v1/default/Pod/fake-pod-35-694xr": {}, + "/v1/default/Pod/fake-pod-35-6blj9": {}, + "/v1/default/Pod/fake-pod-35-6bxlc": {}, + "/v1/default/Pod/fake-pod-35-6glzm": {}, + "/v1/default/Pod/fake-pod-35-6gmcm": {}, + "/v1/default/Pod/fake-pod-35-6pjs9": {}, + "/v1/default/Pod/fake-pod-35-6r5jg": {}, + "/v1/default/Pod/fake-pod-35-6w7lp": {}, + "/v1/default/Pod/fake-pod-35-6x2mn": {}, + "/v1/default/Pod/fake-pod-35-6x7b7": {}, + "/v1/default/Pod/fake-pod-35-7556n": {}, + "/v1/default/Pod/fake-pod-35-75bfn": {}, + "/v1/default/Pod/fake-pod-35-76hlt": {}, + "/v1/default/Pod/fake-pod-35-7dtgz": {}, + "/v1/default/Pod/fake-pod-35-7hkv5": {}, + "/v1/default/Pod/fake-pod-35-7kpw2": {}, + "/v1/default/Pod/fake-pod-35-7krfh": {}, + "/v1/default/Pod/fake-pod-35-7qpw2": {}, + "/v1/default/Pod/fake-pod-35-7s74v": {}, + "/v1/default/Pod/fake-pod-35-7sj88": {}, + "/v1/default/Pod/fake-pod-35-7tnq4": {}, + "/v1/default/Pod/fake-pod-35-7zsg6": {}, + "/v1/default/Pod/fake-pod-35-84nr5": {}, + "/v1/default/Pod/fake-pod-35-84rrg": {}, + "/v1/default/Pod/fake-pod-35-85msc": {}, + "/v1/default/Pod/fake-pod-35-892ts": {}, + "/v1/default/Pod/fake-pod-35-897w6": {}, + "/v1/default/Pod/fake-pod-35-89fjw": {}, + "/v1/default/Pod/fake-pod-35-8c765": {}, + "/v1/default/Pod/fake-pod-35-8cn6n": {}, + "/v1/default/Pod/fake-pod-35-8dvjt": {}, + "/v1/default/Pod/fake-pod-35-8hztj": {}, + "/v1/default/Pod/fake-pod-35-8j2j7": {}, + "/v1/default/Pod/fake-pod-35-8lrgk": {}, + "/v1/default/Pod/fake-pod-35-95hqx": {}, + "/v1/default/Pod/fake-pod-35-95nbg": {}, + "/v1/default/Pod/fake-pod-35-99fjx": {}, + "/v1/default/Pod/fake-pod-35-9cwwf": {}, + "/v1/default/Pod/fake-pod-35-9g5s6": {}, + "/v1/default/Pod/fake-pod-35-9gf7v": {}, + "/v1/default/Pod/fake-pod-35-9j7fm": {}, + "/v1/default/Pod/fake-pod-35-9k6d4": {}, + "/v1/default/Pod/fake-pod-35-9knjl": {}, + "/v1/default/Pod/fake-pod-35-9lwf9": {}, + "/v1/default/Pod/fake-pod-35-9mzdp": {}, + "/v1/default/Pod/fake-pod-35-9spkj": {}, + "/v1/default/Pod/fake-pod-35-9tjvm": {}, + "/v1/default/Pod/fake-pod-35-9zfmw": {}, + "/v1/default/Pod/fake-pod-35-b2ct2": {}, + "/v1/default/Pod/fake-pod-35-b4hr6": {}, + "/v1/default/Pod/fake-pod-35-b7z9g": {}, + "/v1/default/Pod/fake-pod-35-b8cvn": {}, + "/v1/default/Pod/fake-pod-35-b94xl": {}, + "/v1/default/Pod/fake-pod-35-b9rqq": {}, + "/v1/default/Pod/fake-pod-35-bcngt": {}, + "/v1/default/Pod/fake-pod-35-bfdfw": {}, + "/v1/default/Pod/fake-pod-35-bg95b": {}, + "/v1/default/Pod/fake-pod-35-bggsg": {}, + "/v1/default/Pod/fake-pod-35-bld95": {}, + "/v1/default/Pod/fake-pod-35-bllxq": {}, + "/v1/default/Pod/fake-pod-35-bqwvl": {}, + "/v1/default/Pod/fake-pod-35-bsfpf": {}, + "/v1/default/Pod/fake-pod-35-bsjdn": {}, + "/v1/default/Pod/fake-pod-35-bt2wr": {}, + "/v1/default/Pod/fake-pod-35-bvrwz": {}, + "/v1/default/Pod/fake-pod-35-c54nw": {}, + "/v1/default/Pod/fake-pod-35-c762x": {}, + "/v1/default/Pod/fake-pod-35-c8gnq": {}, + "/v1/default/Pod/fake-pod-35-cfz44": {}, + "/v1/default/Pod/fake-pod-35-cnqsx": {}, + "/v1/default/Pod/fake-pod-35-ctvqz": {}, + "/v1/default/Pod/fake-pod-35-ctx75": {}, + "/v1/default/Pod/fake-pod-35-d5d5c": {}, + "/v1/default/Pod/fake-pod-35-d79sb": {}, + "/v1/default/Pod/fake-pod-35-d7mph": {}, + "/v1/default/Pod/fake-pod-35-dbsd9": {}, + "/v1/default/Pod/fake-pod-35-dhj92": {}, + "/v1/default/Pod/fake-pod-35-dk2xn": {}, + "/v1/default/Pod/fake-pod-35-dpttl": {}, + "/v1/default/Pod/fake-pod-35-dwxtz": {}, + "/v1/default/Pod/fake-pod-35-f46p7": {}, + "/v1/default/Pod/fake-pod-35-f8w54": {}, + "/v1/default/Pod/fake-pod-35-f9xp5": {}, + "/v1/default/Pod/fake-pod-35-fbl46": {}, + "/v1/default/Pod/fake-pod-35-fjczb": {}, + "/v1/default/Pod/fake-pod-35-fn4t4": {}, + "/v1/default/Pod/fake-pod-35-ft6rt": {}, + "/v1/default/Pod/fake-pod-35-fvtb7": {}, + "/v1/default/Pod/fake-pod-35-fvxbm": {}, + "/v1/default/Pod/fake-pod-35-fw25w": {}, + "/v1/default/Pod/fake-pod-35-fxn7v": {}, + "/v1/default/Pod/fake-pod-35-g4jtl": {}, + "/v1/default/Pod/fake-pod-35-g4nrz": {}, + "/v1/default/Pod/fake-pod-35-g54zt": {}, + "/v1/default/Pod/fake-pod-35-g6766": {}, + "/v1/default/Pod/fake-pod-35-gjftr": {}, + "/v1/default/Pod/fake-pod-35-gmk67": {}, + "/v1/default/Pod/fake-pod-35-gqcbl": {}, + "/v1/default/Pod/fake-pod-35-gzn7r": {}, + "/v1/default/Pod/fake-pod-35-h2nh2": {}, + "/v1/default/Pod/fake-pod-35-h4qk7": {}, + "/v1/default/Pod/fake-pod-35-hfrwh": {}, + "/v1/default/Pod/fake-pod-35-hhbq5": {}, + "/v1/default/Pod/fake-pod-35-hhkfr": {}, + "/v1/default/Pod/fake-pod-35-hk5ms": {}, + "/v1/default/Pod/fake-pod-35-hpnql": {}, + "/v1/default/Pod/fake-pod-35-hqchx": {}, + "/v1/default/Pod/fake-pod-35-htqvr": {}, + "/v1/default/Pod/fake-pod-35-hx4gf": {}, + "/v1/default/Pod/fake-pod-35-j4rgn": {}, + "/v1/default/Pod/fake-pod-35-j6g59": {}, + "/v1/default/Pod/fake-pod-35-j6pl7": {}, + "/v1/default/Pod/fake-pod-35-j746q": {}, + "/v1/default/Pod/fake-pod-35-j7cxq": {}, + "/v1/default/Pod/fake-pod-35-j86qj": {}, + "/v1/default/Pod/fake-pod-35-j8pzq": {}, + "/v1/default/Pod/fake-pod-35-j9xqg": {}, + "/v1/default/Pod/fake-pod-35-jcqr7": {}, + "/v1/default/Pod/fake-pod-35-jkgfp": {}, + "/v1/default/Pod/fake-pod-35-jlnsh": {}, + "/v1/default/Pod/fake-pod-35-jmmpv": {}, + "/v1/default/Pod/fake-pod-35-jz9bt": {}, + "/v1/default/Pod/fake-pod-35-jznsn": {}, + "/v1/default/Pod/fake-pod-35-k2zjl": {}, + "/v1/default/Pod/fake-pod-35-k757w": {}, + "/v1/default/Pod/fake-pod-35-k7hjm": {}, + "/v1/default/Pod/fake-pod-35-kfj7c": {}, + "/v1/default/Pod/fake-pod-35-kr9p4": {}, + "/v1/default/Pod/fake-pod-35-ktp8d": {}, + "/v1/default/Pod/fake-pod-35-l48hq": {}, + "/v1/default/Pod/fake-pod-35-l6gz8": {}, + "/v1/default/Pod/fake-pod-35-lcddh": {}, + "/v1/default/Pod/fake-pod-35-ld8ts": {}, + "/v1/default/Pod/fake-pod-35-lnxnr": {}, + "/v1/default/Pod/fake-pod-35-ltbbt": {}, + "/v1/default/Pod/fake-pod-35-m5n8j": {}, + "/v1/default/Pod/fake-pod-35-mfb88": {}, + "/v1/default/Pod/fake-pod-35-mfcc6": {}, + "/v1/default/Pod/fake-pod-35-mgt5f": {}, + "/v1/default/Pod/fake-pod-35-mkg7r": {}, + "/v1/default/Pod/fake-pod-35-mm49f": {}, + "/v1/default/Pod/fake-pod-35-mmq4z": {}, + "/v1/default/Pod/fake-pod-35-mnqmm": {}, + "/v1/default/Pod/fake-pod-35-mrgtx": {}, + "/v1/default/Pod/fake-pod-35-mvmbr": {}, + "/v1/default/Pod/fake-pod-35-n2cf9": {}, + "/v1/default/Pod/fake-pod-35-n8jx9": {}, + "/v1/default/Pod/fake-pod-35-n8kg2": {}, + "/v1/default/Pod/fake-pod-35-nbznm": {}, + "/v1/default/Pod/fake-pod-35-ncqvk": {}, + "/v1/default/Pod/fake-pod-35-ncxfx": {}, + "/v1/default/Pod/fake-pod-35-nglxv": {}, + "/v1/default/Pod/fake-pod-35-nj92k": {}, + "/v1/default/Pod/fake-pod-35-nshcc": {}, + "/v1/default/Pod/fake-pod-35-nzzbj": {}, + "/v1/default/Pod/fake-pod-35-p24x9": {}, + "/v1/default/Pod/fake-pod-35-p46th": {}, + "/v1/default/Pod/fake-pod-35-p4bnw": {}, + "/v1/default/Pod/fake-pod-35-p5jbk": {}, + "/v1/default/Pod/fake-pod-35-p8tzz": {}, + "/v1/default/Pod/fake-pod-35-pc59t": {}, + "/v1/default/Pod/fake-pod-35-pc6kc": {}, + "/v1/default/Pod/fake-pod-35-pcd5m": {}, + "/v1/default/Pod/fake-pod-35-plzkk": {}, + "/v1/default/Pod/fake-pod-35-ps6bt": {}, + "/v1/default/Pod/fake-pod-35-pw9gs": {}, + "/v1/default/Pod/fake-pod-35-pxsnq": {}, + "/v1/default/Pod/fake-pod-35-pzj5d": {}, + "/v1/default/Pod/fake-pod-35-q8j2r": {}, + "/v1/default/Pod/fake-pod-35-qdmn9": {}, + "/v1/default/Pod/fake-pod-35-qh2qj": {}, + "/v1/default/Pod/fake-pod-35-qhl8p": {}, + "/v1/default/Pod/fake-pod-35-qjzs6": {}, + "/v1/default/Pod/fake-pod-35-qpbrp": {}, + "/v1/default/Pod/fake-pod-35-qrddg": {}, + "/v1/default/Pod/fake-pod-35-qscgs": {}, + "/v1/default/Pod/fake-pod-35-qsl9d": {}, + "/v1/default/Pod/fake-pod-35-qt965": {}, + "/v1/default/Pod/fake-pod-35-qz482": {}, + "/v1/default/Pod/fake-pod-35-r8dth": {}, + "/v1/default/Pod/fake-pod-35-rhpvv": {}, + "/v1/default/Pod/fake-pod-35-rncxn": {}, + "/v1/default/Pod/fake-pod-35-rnhjv": {}, + "/v1/default/Pod/fake-pod-35-rxc6n": {}, + "/v1/default/Pod/fake-pod-35-s8l9q": {}, + "/v1/default/Pod/fake-pod-35-skcf7": {}, + "/v1/default/Pod/fake-pod-35-skk5w": {}, + "/v1/default/Pod/fake-pod-35-smjnt": {}, + "/v1/default/Pod/fake-pod-35-sp4hq": {}, + "/v1/default/Pod/fake-pod-35-sp7t9": {}, + "/v1/default/Pod/fake-pod-35-sqhcq": {}, + "/v1/default/Pod/fake-pod-35-svg6p": {}, + "/v1/default/Pod/fake-pod-35-swkc4": {}, + "/v1/default/Pod/fake-pod-35-t9zwd": {}, + "/v1/default/Pod/fake-pod-35-tbdmz": {}, + "/v1/default/Pod/fake-pod-35-tf65v": {}, + "/v1/default/Pod/fake-pod-35-tkbhf": {}, + "/v1/default/Pod/fake-pod-35-tlbt2": {}, + "/v1/default/Pod/fake-pod-35-tlkfp": {}, + "/v1/default/Pod/fake-pod-35-tp2pw": {}, + "/v1/default/Pod/fake-pod-35-tqxnm": {}, + "/v1/default/Pod/fake-pod-35-tskrh": {}, + "/v1/default/Pod/fake-pod-35-tt4rt": {}, + "/v1/default/Pod/fake-pod-35-ttznc": {}, + "/v1/default/Pod/fake-pod-35-tvxwg": {}, + "/v1/default/Pod/fake-pod-35-v2mkg": {}, + "/v1/default/Pod/fake-pod-35-v2zkk": {}, + "/v1/default/Pod/fake-pod-35-v4jqs": {}, + "/v1/default/Pod/fake-pod-35-v5nwx": {}, + "/v1/default/Pod/fake-pod-35-v9d8f": {}, + "/v1/default/Pod/fake-pod-35-vjl9b": {}, + "/v1/default/Pod/fake-pod-35-vjqvx": {}, + "/v1/default/Pod/fake-pod-35-vldxr": {}, + "/v1/default/Pod/fake-pod-35-vpnx7": {}, + "/v1/default/Pod/fake-pod-35-vsklb": {}, + "/v1/default/Pod/fake-pod-35-vtd7b": {}, + "/v1/default/Pod/fake-pod-35-vv56k": {}, + "/v1/default/Pod/fake-pod-35-vvzhz": {}, + "/v1/default/Pod/fake-pod-35-vxczh": {}, + "/v1/default/Pod/fake-pod-35-w4ps9": {}, + "/v1/default/Pod/fake-pod-35-w55fw": {}, + "/v1/default/Pod/fake-pod-35-wdcwt": {}, + "/v1/default/Pod/fake-pod-35-wf2gc": {}, + "/v1/default/Pod/fake-pod-35-wgsnj": {}, + "/v1/default/Pod/fake-pod-35-wgt84": {}, + "/v1/default/Pod/fake-pod-35-wjt5b": {}, + "/v1/default/Pod/fake-pod-35-wk9gq": {}, + "/v1/default/Pod/fake-pod-35-wkflx": {}, + "/v1/default/Pod/fake-pod-35-wns2v": {}, + "/v1/default/Pod/fake-pod-35-wp67r": {}, + "/v1/default/Pod/fake-pod-35-wpqxj": {}, + "/v1/default/Pod/fake-pod-35-wqnqs": {}, + "/v1/default/Pod/fake-pod-35-wtx76": {}, + "/v1/default/Pod/fake-pod-35-wwd8j": {}, + "/v1/default/Pod/fake-pod-35-x4cxc": {}, + "/v1/default/Pod/fake-pod-35-x5bcz": {}, + "/v1/default/Pod/fake-pod-35-xb8z9": {}, + "/v1/default/Pod/fake-pod-35-xbrtw": {}, + "/v1/default/Pod/fake-pod-35-xh5nx": {}, + "/v1/default/Pod/fake-pod-35-xj7th": {}, + "/v1/default/Pod/fake-pod-35-xl5w8": {}, + "/v1/default/Pod/fake-pod-35-xmmbc": {}, + "/v1/default/Pod/fake-pod-35-xnx2d": {}, + "/v1/default/Pod/fake-pod-35-xnzsx": {}, + "/v1/default/Pod/fake-pod-35-xq8g9": {}, + "/v1/default/Pod/fake-pod-35-xqpfd": {}, + "/v1/default/Pod/fake-pod-35-xrwlf": {}, + "/v1/default/Pod/fake-pod-35-xsjsw": {}, + "/v1/default/Pod/fake-pod-35-xv896": {}, + "/v1/default/Pod/fake-pod-35-xwp78": {}, + "/v1/default/Pod/fake-pod-35-xwvz5": {}, + "/v1/default/Pod/fake-pod-35-xx9ll": {}, + "/v1/default/Pod/fake-pod-35-xxc5j": {}, + "/v1/default/Pod/fake-pod-35-z4qb7": {}, + "/v1/default/Pod/fake-pod-35-z4wgv": {}, + "/v1/default/Pod/fake-pod-35-z69j5": {}, + "/v1/default/Pod/fake-pod-35-z6kg4": {}, + "/v1/default/Pod/fake-pod-35-zb9fw": {}, + "/v1/default/Pod/fake-pod-35-zblnj": {}, + "/v1/default/Pod/fake-pod-35-zdgvq": {}, + "/v1/default/Pod/fake-pod-35-zkw29": {}, + "/v1/default/Pod/fake-pod-35-zmd75": {}, + "/v1/default/Pod/fake-pod-35-zpbwj": {}, + "/v1/default/Pod/fake-pod-35-ztgtn": {}, + "/v1/default/Pod/fake-pod-35-zvgkh": {}, + "/v1/default/Pod/fake-pod-36-27vq2": {}, + "/v1/default/Pod/fake-pod-36-27zd7": {}, + "/v1/default/Pod/fake-pod-36-2842x": {}, + "/v1/default/Pod/fake-pod-36-2cgvm": {}, + "/v1/default/Pod/fake-pod-36-2dt2v": {}, + "/v1/default/Pod/fake-pod-36-2g8v4": {}, + "/v1/default/Pod/fake-pod-36-2gpxv": {}, + "/v1/default/Pod/fake-pod-36-2k7vf": {}, + "/v1/default/Pod/fake-pod-36-2zmz9": {}, + "/v1/default/Pod/fake-pod-36-2zz7q": {}, + "/v1/default/Pod/fake-pod-36-42qdj": {}, + "/v1/default/Pod/fake-pod-36-444jb": {}, + "/v1/default/Pod/fake-pod-36-487s8": {}, + "/v1/default/Pod/fake-pod-36-4bw9n": {}, + "/v1/default/Pod/fake-pod-36-4d2gj": {}, + "/v1/default/Pod/fake-pod-36-4hr8k": {}, + "/v1/default/Pod/fake-pod-36-4kfx6": {}, + "/v1/default/Pod/fake-pod-36-4khg5": {}, + "/v1/default/Pod/fake-pod-36-4klvf": {}, + "/v1/default/Pod/fake-pod-36-4kv7t": {}, + "/v1/default/Pod/fake-pod-36-4tkrr": {}, + "/v1/default/Pod/fake-pod-36-4zjxf": {}, + "/v1/default/Pod/fake-pod-36-4ztgw": {}, + "/v1/default/Pod/fake-pod-36-52bdv": {}, + "/v1/default/Pod/fake-pod-36-587x2": {}, + "/v1/default/Pod/fake-pod-36-5c99t": {}, + "/v1/default/Pod/fake-pod-36-5d9m5": {}, + "/v1/default/Pod/fake-pod-36-5dxck": {}, + "/v1/default/Pod/fake-pod-36-5dzj7": {}, + "/v1/default/Pod/fake-pod-36-5fxc4": {}, + "/v1/default/Pod/fake-pod-36-5hvht": {}, + "/v1/default/Pod/fake-pod-36-5j6fq": {}, + "/v1/default/Pod/fake-pod-36-5j8pc": {}, + "/v1/default/Pod/fake-pod-36-5l2bb": {}, + "/v1/default/Pod/fake-pod-36-5lmqq": {}, + "/v1/default/Pod/fake-pod-36-5qk44": {}, + "/v1/default/Pod/fake-pod-36-5qnx2": {}, + "/v1/default/Pod/fake-pod-36-5tppz": {}, + "/v1/default/Pod/fake-pod-36-5v8ph": {}, + "/v1/default/Pod/fake-pod-36-5xm59": {}, + "/v1/default/Pod/fake-pod-36-5z9bz": {}, + "/v1/default/Pod/fake-pod-36-69phw": {}, + "/v1/default/Pod/fake-pod-36-69qdb": {}, + "/v1/default/Pod/fake-pod-36-6frdn": {}, + "/v1/default/Pod/fake-pod-36-6k9tf": {}, + "/v1/default/Pod/fake-pod-36-6lw7l": {}, + "/v1/default/Pod/fake-pod-36-6pcz6": {}, + "/v1/default/Pod/fake-pod-36-6vdvd": {}, + "/v1/default/Pod/fake-pod-36-6vvwh": {}, + "/v1/default/Pod/fake-pod-36-72zq8": {}, + "/v1/default/Pod/fake-pod-36-79f7k": {}, + "/v1/default/Pod/fake-pod-36-7dnd6": {}, + "/v1/default/Pod/fake-pod-36-7fhfw": {}, + "/v1/default/Pod/fake-pod-36-7jpsz": {}, + "/v1/default/Pod/fake-pod-36-7l856": {}, + "/v1/default/Pod/fake-pod-36-7sptr": {}, + "/v1/default/Pod/fake-pod-36-7sspf": {}, + "/v1/default/Pod/fake-pod-36-7t6fb": {}, + "/v1/default/Pod/fake-pod-36-7w4g4": {}, + "/v1/default/Pod/fake-pod-36-85msd": {}, + "/v1/default/Pod/fake-pod-36-879d9": {}, + "/v1/default/Pod/fake-pod-36-88qv7": {}, + "/v1/default/Pod/fake-pod-36-8fm6l": {}, + "/v1/default/Pod/fake-pod-36-8fs2p": {}, + "/v1/default/Pod/fake-pod-36-8fscb": {}, + "/v1/default/Pod/fake-pod-36-8hhwd": {}, + "/v1/default/Pod/fake-pod-36-8hxmv": {}, + "/v1/default/Pod/fake-pod-36-8lxk6": {}, + "/v1/default/Pod/fake-pod-36-8m74h": {}, + "/v1/default/Pod/fake-pod-36-8tg5t": {}, + "/v1/default/Pod/fake-pod-36-926hb": {}, + "/v1/default/Pod/fake-pod-36-96rvc": {}, + "/v1/default/Pod/fake-pod-36-97gn5": {}, + "/v1/default/Pod/fake-pod-36-99zkv": {}, + "/v1/default/Pod/fake-pod-36-9b8bv": {}, + "/v1/default/Pod/fake-pod-36-9fvvk": {}, + "/v1/default/Pod/fake-pod-36-9j875": {}, + "/v1/default/Pod/fake-pod-36-9rjzs": {}, + "/v1/default/Pod/fake-pod-36-9tt5w": {}, + "/v1/default/Pod/fake-pod-36-9x7l2": {}, + "/v1/default/Pod/fake-pod-36-9xqjg": {}, + "/v1/default/Pod/fake-pod-36-9z7wx": {}, + "/v1/default/Pod/fake-pod-36-bfw9d": {}, + "/v1/default/Pod/fake-pod-36-bhkmp": {}, + "/v1/default/Pod/fake-pod-36-bhkn2": {}, + "/v1/default/Pod/fake-pod-36-bhqfc": {}, + "/v1/default/Pod/fake-pod-36-bkfk2": {}, + "/v1/default/Pod/fake-pod-36-bkkk9": {}, + "/v1/default/Pod/fake-pod-36-bvmtl": {}, + "/v1/default/Pod/fake-pod-36-bw8zv": {}, + "/v1/default/Pod/fake-pod-36-bwt4t": {}, + "/v1/default/Pod/fake-pod-36-bx2ts": {}, + "/v1/default/Pod/fake-pod-36-bxd6h": {}, + "/v1/default/Pod/fake-pod-36-bxwrn": {}, + "/v1/default/Pod/fake-pod-36-bz8m5": {}, + "/v1/default/Pod/fake-pod-36-bznl4": {}, + "/v1/default/Pod/fake-pod-36-c84dz": {}, + "/v1/default/Pod/fake-pod-36-c8grs": {}, + "/v1/default/Pod/fake-pod-36-cdxpx": {}, + "/v1/default/Pod/fake-pod-36-cgrdt": {}, + "/v1/default/Pod/fake-pod-36-clq68": {}, + "/v1/default/Pod/fake-pod-36-ct5pn": {}, + "/v1/default/Pod/fake-pod-36-ctcd9": {}, + "/v1/default/Pod/fake-pod-36-ctswv": {}, + "/v1/default/Pod/fake-pod-36-ctvk2": {}, + "/v1/default/Pod/fake-pod-36-cxkph": {}, + "/v1/default/Pod/fake-pod-36-cxkvj": {}, + "/v1/default/Pod/fake-pod-36-d6ntr": {}, + "/v1/default/Pod/fake-pod-36-dc8s7": {}, + "/v1/default/Pod/fake-pod-36-ddx67": {}, + "/v1/default/Pod/fake-pod-36-dq75h": {}, + "/v1/default/Pod/fake-pod-36-dqksk": {}, + "/v1/default/Pod/fake-pod-36-drt6s": {}, + "/v1/default/Pod/fake-pod-36-dtgjb": {}, + "/v1/default/Pod/fake-pod-36-dzgtd": {}, + "/v1/default/Pod/fake-pod-36-f2ljs": {}, + "/v1/default/Pod/fake-pod-36-f469m": {}, + "/v1/default/Pod/fake-pod-36-f4s27": {}, + "/v1/default/Pod/fake-pod-36-f5mwz": {}, + "/v1/default/Pod/fake-pod-36-f6nr2": {}, + "/v1/default/Pod/fake-pod-36-fb9q6": {}, + "/v1/default/Pod/fake-pod-36-fc2g6": {}, + "/v1/default/Pod/fake-pod-36-ffgfl": {}, + "/v1/default/Pod/fake-pod-36-fh9db": {}, + "/v1/default/Pod/fake-pod-36-fkrbs": {}, + "/v1/default/Pod/fake-pod-36-fm99q": {}, + "/v1/default/Pod/fake-pod-36-fq4vb": {}, + "/v1/default/Pod/fake-pod-36-fsl6q": {}, + "/v1/default/Pod/fake-pod-36-fsmt7": {}, + "/v1/default/Pod/fake-pod-36-fx7zk": {}, + "/v1/default/Pod/fake-pod-36-g6s7z": {}, + "/v1/default/Pod/fake-pod-36-gbchc": {}, + "/v1/default/Pod/fake-pod-36-gbrnz": {}, + "/v1/default/Pod/fake-pod-36-ghdxs": {}, + "/v1/default/Pod/fake-pod-36-glrbz": {}, + "/v1/default/Pod/fake-pod-36-gqc5l": {}, + "/v1/default/Pod/fake-pod-36-gt5jd": {}, + "/v1/default/Pod/fake-pod-36-gvs8m": {}, + "/v1/default/Pod/fake-pod-36-gw77l": {}, + "/v1/default/Pod/fake-pod-36-gxflg": {}, + "/v1/default/Pod/fake-pod-36-h224g": {}, + "/v1/default/Pod/fake-pod-36-h2d8w": {}, + "/v1/default/Pod/fake-pod-36-h2sql": {}, + "/v1/default/Pod/fake-pod-36-h5vx4": {}, + "/v1/default/Pod/fake-pod-36-h8d5t": {}, + "/v1/default/Pod/fake-pod-36-hb576": {}, + "/v1/default/Pod/fake-pod-36-hlnk9": {}, + "/v1/default/Pod/fake-pod-36-hp54f": {}, + "/v1/default/Pod/fake-pod-36-hpw67": {}, + "/v1/default/Pod/fake-pod-36-jd2dh": {}, + "/v1/default/Pod/fake-pod-36-jl4x2": {}, + "/v1/default/Pod/fake-pod-36-jlkl8": {}, + "/v1/default/Pod/fake-pod-36-jprrm": {}, + "/v1/default/Pod/fake-pod-36-jwtwd": {}, + "/v1/default/Pod/fake-pod-36-jzkfc": {}, + "/v1/default/Pod/fake-pod-36-k7bkm": {}, + "/v1/default/Pod/fake-pod-36-k7xpk": {}, + "/v1/default/Pod/fake-pod-36-kbf5v": {}, + "/v1/default/Pod/fake-pod-36-kdjrj": {}, + "/v1/default/Pod/fake-pod-36-kkxbd": {}, + "/v1/default/Pod/fake-pod-36-kp6j4": {}, + "/v1/default/Pod/fake-pod-36-kpf4c": {}, + "/v1/default/Pod/fake-pod-36-kwn8x": {}, + "/v1/default/Pod/fake-pod-36-kzs2v": {}, + "/v1/default/Pod/fake-pod-36-l22k4": {}, + "/v1/default/Pod/fake-pod-36-l5zxm": {}, + "/v1/default/Pod/fake-pod-36-l95zh": {}, + "/v1/default/Pod/fake-pod-36-l9jsf": {}, + "/v1/default/Pod/fake-pod-36-l9qm6": {}, + "/v1/default/Pod/fake-pod-36-lm2r7": {}, + "/v1/default/Pod/fake-pod-36-lm2tv": {}, + "/v1/default/Pod/fake-pod-36-lmchq": {}, + "/v1/default/Pod/fake-pod-36-lpfzq": {}, + "/v1/default/Pod/fake-pod-36-lq9gj": {}, + "/v1/default/Pod/fake-pod-36-lqz59": {}, + "/v1/default/Pod/fake-pod-36-lwbz9": {}, + "/v1/default/Pod/fake-pod-36-lzd7h": {}, + "/v1/default/Pod/fake-pod-36-m56hv": {}, + "/v1/default/Pod/fake-pod-36-m62jf": {}, + "/v1/default/Pod/fake-pod-36-mh2b7": {}, + "/v1/default/Pod/fake-pod-36-mjjgd": {}, + "/v1/default/Pod/fake-pod-36-mjmzb": {}, + "/v1/default/Pod/fake-pod-36-mn64q": {}, + "/v1/default/Pod/fake-pod-36-mqmgl": {}, + "/v1/default/Pod/fake-pod-36-mrts2": {}, + "/v1/default/Pod/fake-pod-36-mshph": {}, + "/v1/default/Pod/fake-pod-36-mt4ds": {}, + "/v1/default/Pod/fake-pod-36-mv6g2": {}, + "/v1/default/Pod/fake-pod-36-n28mn": {}, + "/v1/default/Pod/fake-pod-36-n52jm": {}, + "/v1/default/Pod/fake-pod-36-n6zlp": {}, + "/v1/default/Pod/fake-pod-36-ncn4x": {}, + "/v1/default/Pod/fake-pod-36-nfkzr": {}, + "/v1/default/Pod/fake-pod-36-nfl9m": {}, + "/v1/default/Pod/fake-pod-36-nhtsb": {}, + "/v1/default/Pod/fake-pod-36-njb9p": {}, + "/v1/default/Pod/fake-pod-36-nnkzc": {}, + "/v1/default/Pod/fake-pod-36-nvpxn": {}, + "/v1/default/Pod/fake-pod-36-p4mns": {}, + "/v1/default/Pod/fake-pod-36-pmkjx": {}, + "/v1/default/Pod/fake-pod-36-pp24z": {}, + "/v1/default/Pod/fake-pod-36-pplfv": {}, + "/v1/default/Pod/fake-pod-36-ppv8p": {}, + "/v1/default/Pod/fake-pod-36-pql9c": {}, + "/v1/default/Pod/fake-pod-36-ps2jp": {}, + "/v1/default/Pod/fake-pod-36-pwc67": {}, + "/v1/default/Pod/fake-pod-36-pxqm6": {}, + "/v1/default/Pod/fake-pod-36-pzqmc": {}, + "/v1/default/Pod/fake-pod-36-q25dz": {}, + "/v1/default/Pod/fake-pod-36-q2s56": {}, + "/v1/default/Pod/fake-pod-36-q2xb9": {}, + "/v1/default/Pod/fake-pod-36-qf4wk": {}, + "/v1/default/Pod/fake-pod-36-qmj6b": {}, + "/v1/default/Pod/fake-pod-36-qpxrf": {}, + "/v1/default/Pod/fake-pod-36-qsmxk": {}, + "/v1/default/Pod/fake-pod-36-qz4mj": {}, + "/v1/default/Pod/fake-pod-36-r28mh": {}, + "/v1/default/Pod/fake-pod-36-r4pvp": {}, + "/v1/default/Pod/fake-pod-36-rdkcs": {}, + "/v1/default/Pod/fake-pod-36-rdktb": {}, + "/v1/default/Pod/fake-pod-36-rdt4r": {}, + "/v1/default/Pod/fake-pod-36-rg5mh": {}, + "/v1/default/Pod/fake-pod-36-rh8sb": {}, + "/v1/default/Pod/fake-pod-36-rjs85": {}, + "/v1/default/Pod/fake-pod-36-rlknq": {}, + "/v1/default/Pod/fake-pod-36-rnqtv": {}, + "/v1/default/Pod/fake-pod-36-rrl62": {}, + "/v1/default/Pod/fake-pod-36-rw8tf": {}, + "/v1/default/Pod/fake-pod-36-rwc99": {}, + "/v1/default/Pod/fake-pod-36-s7d5z": {}, + "/v1/default/Pod/fake-pod-36-s8h9d": {}, + "/v1/default/Pod/fake-pod-36-sbz2b": {}, + "/v1/default/Pod/fake-pod-36-sf5hz": {}, + "/v1/default/Pod/fake-pod-36-sjvzf": {}, + "/v1/default/Pod/fake-pod-36-skz2x": {}, + "/v1/default/Pod/fake-pod-36-sl869": {}, + "/v1/default/Pod/fake-pod-36-slt6d": {}, + "/v1/default/Pod/fake-pod-36-slx4r": {}, + "/v1/default/Pod/fake-pod-36-smm5d": {}, + "/v1/default/Pod/fake-pod-36-snp79": {}, + "/v1/default/Pod/fake-pod-36-sp59n": {}, + "/v1/default/Pod/fake-pod-36-spbfb": {}, + "/v1/default/Pod/fake-pod-36-svn9q": {}, + "/v1/default/Pod/fake-pod-36-svsh7": {}, + "/v1/default/Pod/fake-pod-36-svtrf": {}, + "/v1/default/Pod/fake-pod-36-sx9b9": {}, + "/v1/default/Pod/fake-pod-36-sxp7n": {}, + "/v1/default/Pod/fake-pod-36-t24v2": {}, + "/v1/default/Pod/fake-pod-36-tc6hk": {}, + "/v1/default/Pod/fake-pod-36-tgdlw": {}, + "/v1/default/Pod/fake-pod-36-tgxcx": {}, + "/v1/default/Pod/fake-pod-36-tgxnk": {}, + "/v1/default/Pod/fake-pod-36-thd62": {}, + "/v1/default/Pod/fake-pod-36-tpfdh": {}, + "/v1/default/Pod/fake-pod-36-tqbdt": {}, + "/v1/default/Pod/fake-pod-36-tqdbq": {}, + "/v1/default/Pod/fake-pod-36-trbfm": {}, + "/v1/default/Pod/fake-pod-36-tsjxk": {}, + "/v1/default/Pod/fake-pod-36-ttqk2": {}, + "/v1/default/Pod/fake-pod-36-tz22c": {}, + "/v1/default/Pod/fake-pod-36-v7qcp": {}, + "/v1/default/Pod/fake-pod-36-v7v5h": {}, + "/v1/default/Pod/fake-pod-36-v9wgh": {}, + "/v1/default/Pod/fake-pod-36-vbd7j": {}, + "/v1/default/Pod/fake-pod-36-vcsls": {}, + "/v1/default/Pod/fake-pod-36-vdgsg": {}, + "/v1/default/Pod/fake-pod-36-vdvtl": {}, + "/v1/default/Pod/fake-pod-36-vnhj4": {}, + "/v1/default/Pod/fake-pod-36-vpkcz": {}, + "/v1/default/Pod/fake-pod-36-vr8bk": {}, + "/v1/default/Pod/fake-pod-36-vs62l": {}, + "/v1/default/Pod/fake-pod-36-vt8ds": {}, + "/v1/default/Pod/fake-pod-36-vxq45": {}, + "/v1/default/Pod/fake-pod-36-vxxrj": {}, + "/v1/default/Pod/fake-pod-36-w2xw7": {}, + "/v1/default/Pod/fake-pod-36-w79tz": {}, + "/v1/default/Pod/fake-pod-36-w7f79": {}, + "/v1/default/Pod/fake-pod-36-w8zdx": {}, + "/v1/default/Pod/fake-pod-36-wdv2q": {}, + "/v1/default/Pod/fake-pod-36-wj9xk": {}, + "/v1/default/Pod/fake-pod-36-wmbhk": {}, + "/v1/default/Pod/fake-pod-36-wnd46": {}, + "/v1/default/Pod/fake-pod-36-wth88": {}, + "/v1/default/Pod/fake-pod-36-ww2t8": {}, + "/v1/default/Pod/fake-pod-36-x6x57": {}, + "/v1/default/Pod/fake-pod-36-xl8wd": {}, + "/v1/default/Pod/fake-pod-36-xthj9": {}, + "/v1/default/Pod/fake-pod-36-z2svk": {}, + "/v1/default/Pod/fake-pod-36-z57tl": {}, + "/v1/default/Pod/fake-pod-36-z9vkb": {}, + "/v1/default/Pod/fake-pod-36-zflxl": {}, + "/v1/default/Pod/fake-pod-36-zg4cb": {}, + "/v1/default/Pod/fake-pod-36-zkzhs": {}, + "/v1/default/Pod/fake-pod-36-zl89l": {}, + "/v1/default/Pod/fake-pod-36-zr5js": {}, + "/v1/default/Pod/fake-pod-36-zw6tg": {}, + "/v1/default/Pod/fake-pod-36-zxdnq": {}, + "/v1/default/Pod/fake-pod-36-zzlt4": {}, + "/v1/default/Pod/fake-pod-36-zzq8t": {}, + "/v1/default/Pod/fake-pod-37-292b6": {}, + "/v1/default/Pod/fake-pod-37-2hg2d": {}, + "/v1/default/Pod/fake-pod-37-2hwjv": {}, + "/v1/default/Pod/fake-pod-37-2jw5s": {}, + "/v1/default/Pod/fake-pod-37-2q9lb": {}, + "/v1/default/Pod/fake-pod-37-2t7hn": {}, + "/v1/default/Pod/fake-pod-37-2vkbp": {}, + "/v1/default/Pod/fake-pod-37-2vmh5": {}, + "/v1/default/Pod/fake-pod-37-4fjmw": {}, + "/v1/default/Pod/fake-pod-37-4sm6b": {}, + "/v1/default/Pod/fake-pod-37-4wtfd": {}, + "/v1/default/Pod/fake-pod-37-5czx5": {}, + "/v1/default/Pod/fake-pod-37-5ggx5": {}, + "/v1/default/Pod/fake-pod-37-5kfk2": {}, + "/v1/default/Pod/fake-pod-37-5ksl6": {}, + "/v1/default/Pod/fake-pod-37-5qcms": {}, + "/v1/default/Pod/fake-pod-37-5s5xx": {}, + "/v1/default/Pod/fake-pod-37-5s6nq": {}, + "/v1/default/Pod/fake-pod-37-5sbpr": {}, + "/v1/default/Pod/fake-pod-37-5zx7r": {}, + "/v1/default/Pod/fake-pod-37-62h7n": {}, + "/v1/default/Pod/fake-pod-37-64gzr": {}, + "/v1/default/Pod/fake-pod-37-65gvv": {}, + "/v1/default/Pod/fake-pod-37-65wv7": {}, + "/v1/default/Pod/fake-pod-37-6bhhh": {}, + "/v1/default/Pod/fake-pod-37-6bmxp": {}, + "/v1/default/Pod/fake-pod-37-6ckk7": {}, + "/v1/default/Pod/fake-pod-37-6ktdc": {}, + "/v1/default/Pod/fake-pod-37-6lfxz": {}, + "/v1/default/Pod/fake-pod-37-6mqlz": {}, + "/v1/default/Pod/fake-pod-37-6nmlt": {}, + "/v1/default/Pod/fake-pod-37-6pdrw": {}, + "/v1/default/Pod/fake-pod-37-6pqwb": {}, + "/v1/default/Pod/fake-pod-37-6rwqd": {}, + "/v1/default/Pod/fake-pod-37-77jhs": {}, + "/v1/default/Pod/fake-pod-37-78tzw": {}, + "/v1/default/Pod/fake-pod-37-794rb": {}, + "/v1/default/Pod/fake-pod-37-7cc2g": {}, + "/v1/default/Pod/fake-pod-37-7h448": {}, + "/v1/default/Pod/fake-pod-37-7h7wc": {}, + "/v1/default/Pod/fake-pod-37-7lmjv": {}, + "/v1/default/Pod/fake-pod-37-7nnb2": {}, + "/v1/default/Pod/fake-pod-37-7rmgl": {}, + "/v1/default/Pod/fake-pod-37-7vht6": {}, + "/v1/default/Pod/fake-pod-37-7z5c2": {}, + "/v1/default/Pod/fake-pod-37-84qn7": {}, + "/v1/default/Pod/fake-pod-37-85trk": {}, + "/v1/default/Pod/fake-pod-37-85w2c": {}, + "/v1/default/Pod/fake-pod-37-86g6l": {}, + "/v1/default/Pod/fake-pod-37-89tkl": {}, + "/v1/default/Pod/fake-pod-37-8c68k": {}, + "/v1/default/Pod/fake-pod-37-8dtzl": {}, + "/v1/default/Pod/fake-pod-37-8ghqp": {}, + "/v1/default/Pod/fake-pod-37-8jfcm": {}, + "/v1/default/Pod/fake-pod-37-8msdk": {}, + "/v1/default/Pod/fake-pod-37-8p2j2": {}, + "/v1/default/Pod/fake-pod-37-8qbmt": {}, + "/v1/default/Pod/fake-pod-37-8t9s9": {}, + "/v1/default/Pod/fake-pod-37-8znk5": {}, + "/v1/default/Pod/fake-pod-37-94cs5": {}, + "/v1/default/Pod/fake-pod-37-97qcb": {}, + "/v1/default/Pod/fake-pod-37-98qm7": {}, + "/v1/default/Pod/fake-pod-37-98znj": {}, + "/v1/default/Pod/fake-pod-37-9gkz4": {}, + "/v1/default/Pod/fake-pod-37-9j5l7": {}, + "/v1/default/Pod/fake-pod-37-9j796": {}, + "/v1/default/Pod/fake-pod-37-9slrw": {}, + "/v1/default/Pod/fake-pod-37-9x4n5": {}, + "/v1/default/Pod/fake-pod-37-9xflk": {}, + "/v1/default/Pod/fake-pod-37-b4mmv": {}, + "/v1/default/Pod/fake-pod-37-b5hww": {}, + "/v1/default/Pod/fake-pod-37-bhlt6": {}, + "/v1/default/Pod/fake-pod-37-bhnjg": {}, + "/v1/default/Pod/fake-pod-37-bjc2x": {}, + "/v1/default/Pod/fake-pod-37-btml8": {}, + "/v1/default/Pod/fake-pod-37-bvdwc": {}, + "/v1/default/Pod/fake-pod-37-bvzvz": {}, + "/v1/default/Pod/fake-pod-37-bwbz6": {}, + "/v1/default/Pod/fake-pod-37-c29mf": {}, + "/v1/default/Pod/fake-pod-37-c5cwd": {}, + "/v1/default/Pod/fake-pod-37-c659k": {}, + "/v1/default/Pod/fake-pod-37-c877f": {}, + "/v1/default/Pod/fake-pod-37-c9nnn": {}, + "/v1/default/Pod/fake-pod-37-cd7tq": {}, + "/v1/default/Pod/fake-pod-37-cfhrd": {}, + "/v1/default/Pod/fake-pod-37-ckx5q": {}, + "/v1/default/Pod/fake-pod-37-cl8gd": {}, + "/v1/default/Pod/fake-pod-37-clznq": {}, + "/v1/default/Pod/fake-pod-37-cmd4s": {}, + "/v1/default/Pod/fake-pod-37-cnrf7": {}, + "/v1/default/Pod/fake-pod-37-cqvqr": {}, + "/v1/default/Pod/fake-pod-37-cschw": {}, + "/v1/default/Pod/fake-pod-37-csr45": {}, + "/v1/default/Pod/fake-pod-37-cw7t7": {}, + "/v1/default/Pod/fake-pod-37-cwb4k": {}, + "/v1/default/Pod/fake-pod-37-cwg8x": {}, + "/v1/default/Pod/fake-pod-37-d2p27": {}, + "/v1/default/Pod/fake-pod-37-d47lc": {}, + "/v1/default/Pod/fake-pod-37-d5rsh": {}, + "/v1/default/Pod/fake-pod-37-d72xj": {}, + "/v1/default/Pod/fake-pod-37-d8d9t": {}, + "/v1/default/Pod/fake-pod-37-d94n4": {}, + "/v1/default/Pod/fake-pod-37-ddbph": {}, + "/v1/default/Pod/fake-pod-37-djcgr": {}, + "/v1/default/Pod/fake-pod-37-dn9gf": {}, + "/v1/default/Pod/fake-pod-37-dw58q": {}, + "/v1/default/Pod/fake-pod-37-dwjrf": {}, + "/v1/default/Pod/fake-pod-37-dwv8k": {}, + "/v1/default/Pod/fake-pod-37-f2c5t": {}, + "/v1/default/Pod/fake-pod-37-f46dn": {}, + "/v1/default/Pod/fake-pod-37-f6wzf": {}, + "/v1/default/Pod/fake-pod-37-f98nd": {}, + "/v1/default/Pod/fake-pod-37-f9nlm": {}, + "/v1/default/Pod/fake-pod-37-fggjh": {}, + "/v1/default/Pod/fake-pod-37-fh676": {}, + "/v1/default/Pod/fake-pod-37-fp8db": {}, + "/v1/default/Pod/fake-pod-37-fqqnb": {}, + "/v1/default/Pod/fake-pod-37-frcfm": {}, + "/v1/default/Pod/fake-pod-37-g8nrh": {}, + "/v1/default/Pod/fake-pod-37-gbnmt": {}, + "/v1/default/Pod/fake-pod-37-gpcmn": {}, + "/v1/default/Pod/fake-pod-37-gqwwp": {}, + "/v1/default/Pod/fake-pod-37-gr2rh": {}, + "/v1/default/Pod/fake-pod-37-gzd2k": {}, + "/v1/default/Pod/fake-pod-37-gzrlv": {}, + "/v1/default/Pod/fake-pod-37-h288z": {}, + "/v1/default/Pod/fake-pod-37-h2zj4": {}, + "/v1/default/Pod/fake-pod-37-h46vj": {}, + "/v1/default/Pod/fake-pod-37-h5wjz": {}, + "/v1/default/Pod/fake-pod-37-h6q7f": {}, + "/v1/default/Pod/fake-pod-37-h87ks": {}, + "/v1/default/Pod/fake-pod-37-hbgmc": {}, + "/v1/default/Pod/fake-pod-37-hdhxx": {}, + "/v1/default/Pod/fake-pod-37-hg2j5": {}, + "/v1/default/Pod/fake-pod-37-hggmp": {}, + "/v1/default/Pod/fake-pod-37-hj9p2": {}, + "/v1/default/Pod/fake-pod-37-hndq2": {}, + "/v1/default/Pod/fake-pod-37-hrkfv": {}, + "/v1/default/Pod/fake-pod-37-hrp7q": {}, + "/v1/default/Pod/fake-pod-37-htc9w": {}, + "/v1/default/Pod/fake-pod-37-hzblb": {}, + "/v1/default/Pod/fake-pod-37-j657b": {}, + "/v1/default/Pod/fake-pod-37-j846n": {}, + "/v1/default/Pod/fake-pod-37-jb8cb": {}, + "/v1/default/Pod/fake-pod-37-jf82h": {}, + "/v1/default/Pod/fake-pod-37-jfrb5": {}, + "/v1/default/Pod/fake-pod-37-jk9wb": {}, + "/v1/default/Pod/fake-pod-37-jmbmp": {}, + "/v1/default/Pod/fake-pod-37-jrdkn": {}, + "/v1/default/Pod/fake-pod-37-jrtkx": {}, + "/v1/default/Pod/fake-pod-37-k4h8h": {}, + "/v1/default/Pod/fake-pod-37-k7fx2": {}, + "/v1/default/Pod/fake-pod-37-k8k6h": {}, + "/v1/default/Pod/fake-pod-37-kc7bl": {}, + "/v1/default/Pod/fake-pod-37-kdmsm": {}, + "/v1/default/Pod/fake-pod-37-kkj2v": {}, + "/v1/default/Pod/fake-pod-37-kr8kh": {}, + "/v1/default/Pod/fake-pod-37-krltg": {}, + "/v1/default/Pod/fake-pod-37-ksml9": {}, + "/v1/default/Pod/fake-pod-37-kvsgm": {}, + "/v1/default/Pod/fake-pod-37-kwrc5": {}, + "/v1/default/Pod/fake-pod-37-l2wrn": {}, + "/v1/default/Pod/fake-pod-37-l7cm9": {}, + "/v1/default/Pod/fake-pod-37-l7w99": {}, + "/v1/default/Pod/fake-pod-37-l9775": {}, + "/v1/default/Pod/fake-pod-37-l9kg6": {}, + "/v1/default/Pod/fake-pod-37-l9t2l": {}, + "/v1/default/Pod/fake-pod-37-lmfzz": {}, + "/v1/default/Pod/fake-pod-37-lw4jr": {}, + "/v1/default/Pod/fake-pod-37-lz276": {}, + "/v1/default/Pod/fake-pod-37-m29xv": {}, + "/v1/default/Pod/fake-pod-37-m8czk": {}, + "/v1/default/Pod/fake-pod-37-mfbp2": {}, + "/v1/default/Pod/fake-pod-37-mfpft": {}, + "/v1/default/Pod/fake-pod-37-mgfqm": {}, + "/v1/default/Pod/fake-pod-37-mh8r6": {}, + "/v1/default/Pod/fake-pod-37-mljqg": {}, + "/v1/default/Pod/fake-pod-37-mp5g8": {}, + "/v1/default/Pod/fake-pod-37-mt7f8": {}, + "/v1/default/Pod/fake-pod-37-mx24j": {}, + "/v1/default/Pod/fake-pod-37-mx2qx": {}, + "/v1/default/Pod/fake-pod-37-mxqbm": {}, + "/v1/default/Pod/fake-pod-37-mzlbc": {}, + "/v1/default/Pod/fake-pod-37-n2jw6": {}, + "/v1/default/Pod/fake-pod-37-n4gd2": {}, + "/v1/default/Pod/fake-pod-37-n86wq": {}, + "/v1/default/Pod/fake-pod-37-ngdwp": {}, + "/v1/default/Pod/fake-pod-37-nkfgk": {}, + "/v1/default/Pod/fake-pod-37-nmrl4": {}, + "/v1/default/Pod/fake-pod-37-nt79l": {}, + "/v1/default/Pod/fake-pod-37-ntcv8": {}, + "/v1/default/Pod/fake-pod-37-ntkqg": {}, + "/v1/default/Pod/fake-pod-37-nw86z": {}, + "/v1/default/Pod/fake-pod-37-nwd9n": {}, + "/v1/default/Pod/fake-pod-37-nwn4h": {}, + "/v1/default/Pod/fake-pod-37-nzhvb": {}, + "/v1/default/Pod/fake-pod-37-nzmvg": {}, + "/v1/default/Pod/fake-pod-37-p4mhf": {}, + "/v1/default/Pod/fake-pod-37-p58gd": {}, + "/v1/default/Pod/fake-pod-37-p5qv6": {}, + "/v1/default/Pod/fake-pod-37-p66xg": {}, + "/v1/default/Pod/fake-pod-37-p68cn": {}, + "/v1/default/Pod/fake-pod-37-p87zc": {}, + "/v1/default/Pod/fake-pod-37-ph5wh": {}, + "/v1/default/Pod/fake-pod-37-pjpcw": {}, + "/v1/default/Pod/fake-pod-37-pk4gp": {}, + "/v1/default/Pod/fake-pod-37-q4qg6": {}, + "/v1/default/Pod/fake-pod-37-q6vqh": {}, + "/v1/default/Pod/fake-pod-37-qbs6d": {}, + "/v1/default/Pod/fake-pod-37-qcttt": {}, + "/v1/default/Pod/fake-pod-37-qhckw": {}, + "/v1/default/Pod/fake-pod-37-qkcbj": {}, + "/v1/default/Pod/fake-pod-37-qkks2": {}, + "/v1/default/Pod/fake-pod-37-qpcb4": {}, + "/v1/default/Pod/fake-pod-37-qpkqd": {}, + "/v1/default/Pod/fake-pod-37-qpsgx": {}, + "/v1/default/Pod/fake-pod-37-qx6gf": {}, + "/v1/default/Pod/fake-pod-37-r5dg8": {}, + "/v1/default/Pod/fake-pod-37-r6fb8": {}, + "/v1/default/Pod/fake-pod-37-r8p6p": {}, + "/v1/default/Pod/fake-pod-37-rc2z4": {}, + "/v1/default/Pod/fake-pod-37-rclqq": {}, + "/v1/default/Pod/fake-pod-37-rdsvf": {}, + "/v1/default/Pod/fake-pod-37-rgmtm": {}, + "/v1/default/Pod/fake-pod-37-rlxnj": {}, + "/v1/default/Pod/fake-pod-37-rmwn4": {}, + "/v1/default/Pod/fake-pod-37-rnssq": {}, + "/v1/default/Pod/fake-pod-37-rv7kl": {}, + "/v1/default/Pod/fake-pod-37-s2vhz": {}, + "/v1/default/Pod/fake-pod-37-s7jbd": {}, + "/v1/default/Pod/fake-pod-37-sfmw7": {}, + "/v1/default/Pod/fake-pod-37-sgn2z": {}, + "/v1/default/Pod/fake-pod-37-sh7zf": {}, + "/v1/default/Pod/fake-pod-37-shwsm": {}, + "/v1/default/Pod/fake-pod-37-sjdx7": {}, + "/v1/default/Pod/fake-pod-37-smc7j": {}, + "/v1/default/Pod/fake-pod-37-sqqfb": {}, + "/v1/default/Pod/fake-pod-37-svdnv": {}, + "/v1/default/Pod/fake-pod-37-t4fs9": {}, + "/v1/default/Pod/fake-pod-37-t5zmf": {}, + "/v1/default/Pod/fake-pod-37-t8k9f": {}, + "/v1/default/Pod/fake-pod-37-t9vvd": {}, + "/v1/default/Pod/fake-pod-37-tfdrh": {}, + "/v1/default/Pod/fake-pod-37-tg85b": {}, + "/v1/default/Pod/fake-pod-37-tgkgt": {}, + "/v1/default/Pod/fake-pod-37-tjtg4": {}, + "/v1/default/Pod/fake-pod-37-tlrnk": {}, + "/v1/default/Pod/fake-pod-37-tpnkq": {}, + "/v1/default/Pod/fake-pod-37-ttjps": {}, + "/v1/default/Pod/fake-pod-37-tx4pj": {}, + "/v1/default/Pod/fake-pod-37-v4vp8": {}, + "/v1/default/Pod/fake-pod-37-v5bk8": {}, + "/v1/default/Pod/fake-pod-37-vcsc6": {}, + "/v1/default/Pod/fake-pod-37-vh9js": {}, + "/v1/default/Pod/fake-pod-37-vj46j": {}, + "/v1/default/Pod/fake-pod-37-vn5t8": {}, + "/v1/default/Pod/fake-pod-37-vpc66": {}, + "/v1/default/Pod/fake-pod-37-vrv9d": {}, + "/v1/default/Pod/fake-pod-37-vsmhm": {}, + "/v1/default/Pod/fake-pod-37-vtvtl": {}, + "/v1/default/Pod/fake-pod-37-w4c2t": {}, + "/v1/default/Pod/fake-pod-37-w4nc7": {}, + "/v1/default/Pod/fake-pod-37-w7k7w": {}, + "/v1/default/Pod/fake-pod-37-w9ltc": {}, + "/v1/default/Pod/fake-pod-37-w9xcl": {}, + "/v1/default/Pod/fake-pod-37-wb54j": {}, + "/v1/default/Pod/fake-pod-37-wf9zj": {}, + "/v1/default/Pod/fake-pod-37-wfdrn": {}, + "/v1/default/Pod/fake-pod-37-wgnp9": {}, + "/v1/default/Pod/fake-pod-37-wgspn": {}, + "/v1/default/Pod/fake-pod-37-wk5sp": {}, + "/v1/default/Pod/fake-pod-37-wkl64": {}, + "/v1/default/Pod/fake-pod-37-wktxw": {}, + "/v1/default/Pod/fake-pod-37-wm6x8": {}, + "/v1/default/Pod/fake-pod-37-wtfgx": {}, + "/v1/default/Pod/fake-pod-37-ww55s": {}, + "/v1/default/Pod/fake-pod-37-wztvh": {}, + "/v1/default/Pod/fake-pod-37-x454w": {}, + "/v1/default/Pod/fake-pod-37-xcff4": {}, + "/v1/default/Pod/fake-pod-37-xcwcm": {}, + "/v1/default/Pod/fake-pod-37-xfqwt": {}, + "/v1/default/Pod/fake-pod-37-xkjt8": {}, + "/v1/default/Pod/fake-pod-37-xrzh5": {}, + "/v1/default/Pod/fake-pod-37-xsd46": {}, + "/v1/default/Pod/fake-pod-37-xtpv4": {}, + "/v1/default/Pod/fake-pod-37-xtv8g": {}, + "/v1/default/Pod/fake-pod-37-xwtwt": {}, + "/v1/default/Pod/fake-pod-37-xx7hv": {}, + "/v1/default/Pod/fake-pod-37-z4868": {}, + "/v1/default/Pod/fake-pod-37-z5vpr": {}, + "/v1/default/Pod/fake-pod-37-zcfcd": {}, + "/v1/default/Pod/fake-pod-37-zdmpf": {}, + "/v1/default/Pod/fake-pod-37-zdrhr": {}, + "/v1/default/Pod/fake-pod-37-zf5q2": {}, + "/v1/default/Pod/fake-pod-37-zhnw2": {}, + "/v1/default/Pod/fake-pod-37-zlstb": {}, + "/v1/default/Pod/fake-pod-37-zmltm": {}, + "/v1/default/Pod/fake-pod-37-zr4dm": {}, + "/v1/default/Pod/fake-pod-37-ztqqq": {}, + "/v1/default/Pod/fake-pod-38-24x7b": {}, + "/v1/default/Pod/fake-pod-38-26kl6": {}, + "/v1/default/Pod/fake-pod-38-26zn9": {}, + "/v1/default/Pod/fake-pod-38-2hpf5": {}, + "/v1/default/Pod/fake-pod-38-2jckk": {}, + "/v1/default/Pod/fake-pod-38-2kwmr": {}, + "/v1/default/Pod/fake-pod-38-2p2wb": {}, + "/v1/default/Pod/fake-pod-38-2rcgq": {}, + "/v1/default/Pod/fake-pod-38-2rhf2": {}, + "/v1/default/Pod/fake-pod-38-2rlw4": {}, + "/v1/default/Pod/fake-pod-38-2tpx9": {}, + "/v1/default/Pod/fake-pod-38-2vcmf": {}, + "/v1/default/Pod/fake-pod-38-2vk9z": {}, + "/v1/default/Pod/fake-pod-38-459pc": {}, + "/v1/default/Pod/fake-pod-38-45t28": {}, + "/v1/default/Pod/fake-pod-38-4cb6m": {}, + "/v1/default/Pod/fake-pod-38-4fqrk": {}, + "/v1/default/Pod/fake-pod-38-4jnwg": {}, + "/v1/default/Pod/fake-pod-38-4m9sb": {}, + "/v1/default/Pod/fake-pod-38-4nxxl": {}, + "/v1/default/Pod/fake-pod-38-4trqn": {}, + "/v1/default/Pod/fake-pod-38-4w9sf": {}, + "/v1/default/Pod/fake-pod-38-54rct": {}, + "/v1/default/Pod/fake-pod-38-55sp9": {}, + "/v1/default/Pod/fake-pod-38-5fh8c": {}, + "/v1/default/Pod/fake-pod-38-5fns2": {}, + "/v1/default/Pod/fake-pod-38-5j2sl": {}, + "/v1/default/Pod/fake-pod-38-5jm4z": {}, + "/v1/default/Pod/fake-pod-38-5kr2z": {}, + "/v1/default/Pod/fake-pod-38-5kzcl": {}, + "/v1/default/Pod/fake-pod-38-5nn2c": {}, + "/v1/default/Pod/fake-pod-38-5r6fp": {}, + "/v1/default/Pod/fake-pod-38-65nrw": {}, + "/v1/default/Pod/fake-pod-38-69fzh": {}, + "/v1/default/Pod/fake-pod-38-6btrw": {}, + "/v1/default/Pod/fake-pod-38-6bwtk": {}, + "/v1/default/Pod/fake-pod-38-6kgzz": {}, + "/v1/default/Pod/fake-pod-38-6kjbd": {}, + "/v1/default/Pod/fake-pod-38-6tcqg": {}, + "/v1/default/Pod/fake-pod-38-6wkbd": {}, + "/v1/default/Pod/fake-pod-38-6zzfw": {}, + "/v1/default/Pod/fake-pod-38-79ksk": {}, + "/v1/default/Pod/fake-pod-38-7b79r": {}, + "/v1/default/Pod/fake-pod-38-7fp8c": {}, + "/v1/default/Pod/fake-pod-38-7gvbr": {}, + "/v1/default/Pod/fake-pod-38-7jdgp": {}, + "/v1/default/Pod/fake-pod-38-7nngp": {}, + "/v1/default/Pod/fake-pod-38-7psmc": {}, + "/v1/default/Pod/fake-pod-38-7wvr9": {}, + "/v1/default/Pod/fake-pod-38-84znw": {}, + "/v1/default/Pod/fake-pod-38-872dm": {}, + "/v1/default/Pod/fake-pod-38-89sqj": {}, + "/v1/default/Pod/fake-pod-38-8g7b2": {}, + "/v1/default/Pod/fake-pod-38-8gkxs": {}, + "/v1/default/Pod/fake-pod-38-8jphs": {}, + "/v1/default/Pod/fake-pod-38-8mjkt": {}, + "/v1/default/Pod/fake-pod-38-8pgtt": {}, + "/v1/default/Pod/fake-pod-38-8q9hk": {}, + "/v1/default/Pod/fake-pod-38-8s8pq": {}, + "/v1/default/Pod/fake-pod-38-8xtpc": {}, + "/v1/default/Pod/fake-pod-38-95zmf": {}, + "/v1/default/Pod/fake-pod-38-9bfjw": {}, + "/v1/default/Pod/fake-pod-38-9btgc": {}, + "/v1/default/Pod/fake-pod-38-9fkbj": {}, + "/v1/default/Pod/fake-pod-38-9fq7t": {}, + "/v1/default/Pod/fake-pod-38-9pq9p": {}, + "/v1/default/Pod/fake-pod-38-9qvpp": {}, + "/v1/default/Pod/fake-pod-38-9rn7z": {}, + "/v1/default/Pod/fake-pod-38-b2mgw": {}, + "/v1/default/Pod/fake-pod-38-bbcqp": {}, + "/v1/default/Pod/fake-pod-38-bbfsp": {}, + "/v1/default/Pod/fake-pod-38-bbkxl": {}, + "/v1/default/Pod/fake-pod-38-bbql5": {}, + "/v1/default/Pod/fake-pod-38-bcb58": {}, + "/v1/default/Pod/fake-pod-38-bdnr2": {}, + "/v1/default/Pod/fake-pod-38-bfbzw": {}, + "/v1/default/Pod/fake-pod-38-bj9r4": {}, + "/v1/default/Pod/fake-pod-38-bkfqv": {}, + "/v1/default/Pod/fake-pod-38-bq8kp": {}, + "/v1/default/Pod/fake-pod-38-bs5wd": {}, + "/v1/default/Pod/fake-pod-38-btc7h": {}, + "/v1/default/Pod/fake-pod-38-bvxhf": {}, + "/v1/default/Pod/fake-pod-38-bwwv2": {}, + "/v1/default/Pod/fake-pod-38-cbg97": {}, + "/v1/default/Pod/fake-pod-38-chc98": {}, + "/v1/default/Pod/fake-pod-38-cl6vt": {}, + "/v1/default/Pod/fake-pod-38-cprks": {}, + "/v1/default/Pod/fake-pod-38-crw6g": {}, + "/v1/default/Pod/fake-pod-38-ct5kb": {}, + "/v1/default/Pod/fake-pod-38-cwmwl": {}, + "/v1/default/Pod/fake-pod-38-cx897": {}, + "/v1/default/Pod/fake-pod-38-cx8n6": {}, + "/v1/default/Pod/fake-pod-38-czczb": {}, + "/v1/default/Pod/fake-pod-38-d58j2": {}, + "/v1/default/Pod/fake-pod-38-dbvdx": {}, + "/v1/default/Pod/fake-pod-38-dgm6w": {}, + "/v1/default/Pod/fake-pod-38-dpddw": {}, + "/v1/default/Pod/fake-pod-38-dqsjh": {}, + "/v1/default/Pod/fake-pod-38-drpp8": {}, + "/v1/default/Pod/fake-pod-38-dvzdp": {}, + "/v1/default/Pod/fake-pod-38-dxh5s": {}, + "/v1/default/Pod/fake-pod-38-f5qth": {}, + "/v1/default/Pod/fake-pod-38-f6lvv": {}, + "/v1/default/Pod/fake-pod-38-f9hgb": {}, + "/v1/default/Pod/fake-pod-38-fc4mv": {}, + "/v1/default/Pod/fake-pod-38-fcklz": {}, + "/v1/default/Pod/fake-pod-38-fd9s7": {}, + "/v1/default/Pod/fake-pod-38-fhbnb": {}, + "/v1/default/Pod/fake-pod-38-fhgg5": {}, + "/v1/default/Pod/fake-pod-38-fsbqg": {}, + "/v1/default/Pod/fake-pod-38-ft79x": {}, + "/v1/default/Pod/fake-pod-38-ftssl": {}, + "/v1/default/Pod/fake-pod-38-fx4jb": {}, + "/v1/default/Pod/fake-pod-38-fxzqh": {}, + "/v1/default/Pod/fake-pod-38-g89sf": {}, + "/v1/default/Pod/fake-pod-38-gbcg8": {}, + "/v1/default/Pod/fake-pod-38-gcsmh": {}, + "/v1/default/Pod/fake-pod-38-ggwtz": {}, + "/v1/default/Pod/fake-pod-38-ghb5m": {}, + "/v1/default/Pod/fake-pod-38-gjhr9": {}, + "/v1/default/Pod/fake-pod-38-gq66l": {}, + "/v1/default/Pod/fake-pod-38-gszv5": {}, + "/v1/default/Pod/fake-pod-38-gt2zc": {}, + "/v1/default/Pod/fake-pod-38-gtfvc": {}, + "/v1/default/Pod/fake-pod-38-gw9xl": {}, + "/v1/default/Pod/fake-pod-38-gzw6k": {}, + "/v1/default/Pod/fake-pod-38-h2m25": {}, + "/v1/default/Pod/fake-pod-38-h4vwx": {}, + "/v1/default/Pod/fake-pod-38-h57c7": {}, + "/v1/default/Pod/fake-pod-38-hcdcs": {}, + "/v1/default/Pod/fake-pod-38-hkzfk": {}, + "/v1/default/Pod/fake-pod-38-hq8wc": {}, + "/v1/default/Pod/fake-pod-38-hqvkw": {}, + "/v1/default/Pod/fake-pod-38-ht79w": {}, + "/v1/default/Pod/fake-pod-38-htjwt": {}, + "/v1/default/Pod/fake-pod-38-hvhpp": {}, + "/v1/default/Pod/fake-pod-38-j2htf": {}, + "/v1/default/Pod/fake-pod-38-j4b5m": {}, + "/v1/default/Pod/fake-pod-38-j88hr": {}, + "/v1/default/Pod/fake-pod-38-j8bhl": {}, + "/v1/default/Pod/fake-pod-38-jf84m": {}, + "/v1/default/Pod/fake-pod-38-jjl5h": {}, + "/v1/default/Pod/fake-pod-38-jmrnd": {}, + "/v1/default/Pod/fake-pod-38-jnbfq": {}, + "/v1/default/Pod/fake-pod-38-jt2jk": {}, + "/v1/default/Pod/fake-pod-38-jt5s2": {}, + "/v1/default/Pod/fake-pod-38-jzqkc": {}, + "/v1/default/Pod/fake-pod-38-k2np7": {}, + "/v1/default/Pod/fake-pod-38-k55p7": {}, + "/v1/default/Pod/fake-pod-38-k5rvl": {}, + "/v1/default/Pod/fake-pod-38-k6gdr": {}, + "/v1/default/Pod/fake-pod-38-kdh6d": {}, + "/v1/default/Pod/fake-pod-38-kh4tz": {}, + "/v1/default/Pod/fake-pod-38-khjxf": {}, + "/v1/default/Pod/fake-pod-38-kj9wm": {}, + "/v1/default/Pod/fake-pod-38-kkxk6": {}, + "/v1/default/Pod/fake-pod-38-kmlwp": {}, + "/v1/default/Pod/fake-pod-38-kqczg": {}, + "/v1/default/Pod/fake-pod-38-kqhxz": {}, + "/v1/default/Pod/fake-pod-38-kt989": {}, + "/v1/default/Pod/fake-pod-38-kwt2w": {}, + "/v1/default/Pod/fake-pod-38-l6rdx": {}, + "/v1/default/Pod/fake-pod-38-l8w6v": {}, + "/v1/default/Pod/fake-pod-38-l9vjf": {}, + "/v1/default/Pod/fake-pod-38-lfxnh": {}, + "/v1/default/Pod/fake-pod-38-lhmhd": {}, + "/v1/default/Pod/fake-pod-38-ljp9q": {}, + "/v1/default/Pod/fake-pod-38-lkvcs": {}, + "/v1/default/Pod/fake-pod-38-lkxjd": {}, + "/v1/default/Pod/fake-pod-38-llkgr": {}, + "/v1/default/Pod/fake-pod-38-ln8lb": {}, + "/v1/default/Pod/fake-pod-38-m578d": {}, + "/v1/default/Pod/fake-pod-38-mkhd7": {}, + "/v1/default/Pod/fake-pod-38-mvv2r": {}, + "/v1/default/Pod/fake-pod-38-mzgfh": {}, + "/v1/default/Pod/fake-pod-38-n4lnv": {}, + "/v1/default/Pod/fake-pod-38-n4z2v": {}, + "/v1/default/Pod/fake-pod-38-n56kz": {}, + "/v1/default/Pod/fake-pod-38-n7cvh": {}, + "/v1/default/Pod/fake-pod-38-n7h9t": {}, + "/v1/default/Pod/fake-pod-38-n94c7": {}, + "/v1/default/Pod/fake-pod-38-nbhl7": {}, + "/v1/default/Pod/fake-pod-38-nbt74": {}, + "/v1/default/Pod/fake-pod-38-nfp6l": {}, + "/v1/default/Pod/fake-pod-38-nkgl6": {}, + "/v1/default/Pod/fake-pod-38-nv482": {}, + "/v1/default/Pod/fake-pod-38-nvnjg": {}, + "/v1/default/Pod/fake-pod-38-nxnbg": {}, + "/v1/default/Pod/fake-pod-38-p2n9h": {}, + "/v1/default/Pod/fake-pod-38-p54tm": {}, + "/v1/default/Pod/fake-pod-38-p5nhf": {}, + "/v1/default/Pod/fake-pod-38-p5t9p": {}, + "/v1/default/Pod/fake-pod-38-p6mfz": {}, + "/v1/default/Pod/fake-pod-38-p7hw2": {}, + "/v1/default/Pod/fake-pod-38-p966c": {}, + "/v1/default/Pod/fake-pod-38-pb5x8": {}, + "/v1/default/Pod/fake-pod-38-pbgh2": {}, + "/v1/default/Pod/fake-pod-38-pdqpn": {}, + "/v1/default/Pod/fake-pod-38-pf95b": {}, + "/v1/default/Pod/fake-pod-38-phj27": {}, + "/v1/default/Pod/fake-pod-38-pjfzf": {}, + "/v1/default/Pod/fake-pod-38-ppr2p": {}, + "/v1/default/Pod/fake-pod-38-ppw8r": {}, + "/v1/default/Pod/fake-pod-38-prrmm": {}, + "/v1/default/Pod/fake-pod-38-pxdzf": {}, + "/v1/default/Pod/fake-pod-38-pxq2g": {}, + "/v1/default/Pod/fake-pod-38-q2dz2": {}, + "/v1/default/Pod/fake-pod-38-q85hb": {}, + "/v1/default/Pod/fake-pod-38-qbwgp": {}, + "/v1/default/Pod/fake-pod-38-qbx45": {}, + "/v1/default/Pod/fake-pod-38-qcjk8": {}, + "/v1/default/Pod/fake-pod-38-qltdl": {}, + "/v1/default/Pod/fake-pod-38-qmzfm": {}, + "/v1/default/Pod/fake-pod-38-qtwtc": {}, + "/v1/default/Pod/fake-pod-38-qznx5": {}, + "/v1/default/Pod/fake-pod-38-r66mb": {}, + "/v1/default/Pod/fake-pod-38-r7tc8": {}, + "/v1/default/Pod/fake-pod-38-r9r5x": {}, + "/v1/default/Pod/fake-pod-38-rbb22": {}, + "/v1/default/Pod/fake-pod-38-rbhbk": {}, + "/v1/default/Pod/fake-pod-38-rfcgt": {}, + "/v1/default/Pod/fake-pod-38-rhcts": {}, + "/v1/default/Pod/fake-pod-38-rjvkt": {}, + "/v1/default/Pod/fake-pod-38-rn67l": {}, + "/v1/default/Pod/fake-pod-38-rnp6m": {}, + "/v1/default/Pod/fake-pod-38-rpv79": {}, + "/v1/default/Pod/fake-pod-38-rqzvc": {}, + "/v1/default/Pod/fake-pod-38-rv2w4": {}, + "/v1/default/Pod/fake-pod-38-rz8vg": {}, + "/v1/default/Pod/fake-pod-38-s2ztx": {}, + "/v1/default/Pod/fake-pod-38-s4ghg": {}, + "/v1/default/Pod/fake-pod-38-s4q7h": {}, + "/v1/default/Pod/fake-pod-38-scjwf": {}, + "/v1/default/Pod/fake-pod-38-sclzb": {}, + "/v1/default/Pod/fake-pod-38-sdxgk": {}, + "/v1/default/Pod/fake-pod-38-sjgqk": {}, + "/v1/default/Pod/fake-pod-38-slr5s": {}, + "/v1/default/Pod/fake-pod-38-sm488": {}, + "/v1/default/Pod/fake-pod-38-snvp8": {}, + "/v1/default/Pod/fake-pod-38-stxch": {}, + "/v1/default/Pod/fake-pod-38-sz2z2": {}, + "/v1/default/Pod/fake-pod-38-t2dcw": {}, + "/v1/default/Pod/fake-pod-38-t4jkd": {}, + "/v1/default/Pod/fake-pod-38-tfrpk": {}, + "/v1/default/Pod/fake-pod-38-tfwms": {}, + "/v1/default/Pod/fake-pod-38-tg8fh": {}, + "/v1/default/Pod/fake-pod-38-tggfd": {}, + "/v1/default/Pod/fake-pod-38-thpvh": {}, + "/v1/default/Pod/fake-pod-38-tl6sf": {}, + "/v1/default/Pod/fake-pod-38-tlnpb": {}, + "/v1/default/Pod/fake-pod-38-tplbc": {}, + "/v1/default/Pod/fake-pod-38-tq7cf": {}, + "/v1/default/Pod/fake-pod-38-tsg8c": {}, + "/v1/default/Pod/fake-pod-38-txmbc": {}, + "/v1/default/Pod/fake-pod-38-tzj5l": {}, + "/v1/default/Pod/fake-pod-38-v22vj": {}, + "/v1/default/Pod/fake-pod-38-v2hdd": {}, + "/v1/default/Pod/fake-pod-38-v2vd5": {}, + "/v1/default/Pod/fake-pod-38-v2ztl": {}, + "/v1/default/Pod/fake-pod-38-vgd9k": {}, + "/v1/default/Pod/fake-pod-38-vh9mc": {}, + "/v1/default/Pod/fake-pod-38-vhfr8": {}, + "/v1/default/Pod/fake-pod-38-vjglg": {}, + "/v1/default/Pod/fake-pod-38-vk2tq": {}, + "/v1/default/Pod/fake-pod-38-vkxn7": {}, + "/v1/default/Pod/fake-pod-38-vmwc4": {}, + "/v1/default/Pod/fake-pod-38-vn2cv": {}, + "/v1/default/Pod/fake-pod-38-vp5rf": {}, + "/v1/default/Pod/fake-pod-38-vr8jr": {}, + "/v1/default/Pod/fake-pod-38-vsmxj": {}, + "/v1/default/Pod/fake-pod-38-vw7n5": {}, + "/v1/default/Pod/fake-pod-38-vwk2d": {}, + "/v1/default/Pod/fake-pod-38-w5dt8": {}, + "/v1/default/Pod/fake-pod-38-wv28t": {}, + "/v1/default/Pod/fake-pod-38-x4xz7": {}, + "/v1/default/Pod/fake-pod-38-x6q8f": {}, + "/v1/default/Pod/fake-pod-38-xf7wp": {}, + "/v1/default/Pod/fake-pod-38-xgggp": {}, + "/v1/default/Pod/fake-pod-38-xh9fv": {}, + "/v1/default/Pod/fake-pod-38-xjks7": {}, + "/v1/default/Pod/fake-pod-38-xkc4n": {}, + "/v1/default/Pod/fake-pod-38-xlv8h": {}, + "/v1/default/Pod/fake-pod-38-xmb64": {}, + "/v1/default/Pod/fake-pod-38-xmmhc": {}, + "/v1/default/Pod/fake-pod-38-xntql": {}, + "/v1/default/Pod/fake-pod-38-xsdqz": {}, + "/v1/default/Pod/fake-pod-38-z2xrf": {}, + "/v1/default/Pod/fake-pod-38-z4w7k": {}, + "/v1/default/Pod/fake-pod-38-z9kqw": {}, + "/v1/default/Pod/fake-pod-38-z9pbx": {}, + "/v1/default/Pod/fake-pod-38-zggfb": {}, + "/v1/default/Pod/fake-pod-38-zhhkd": {}, + "/v1/default/Pod/fake-pod-38-zhrzc": {}, + "/v1/default/Pod/fake-pod-38-zjk8d": {}, + "/v1/default/Pod/fake-pod-38-zmfwg": {}, + "/v1/default/Pod/fake-pod-38-zpzsb": {}, + "/v1/default/Pod/fake-pod-38-zq4gq": {}, + "/v1/default/Pod/fake-pod-38-zr8n7": {}, + "/v1/default/Pod/fake-pod-38-zrt27": {}, + "/v1/default/Pod/fake-pod-39-25tqm": {}, + "/v1/default/Pod/fake-pod-39-26fgz": {}, + "/v1/default/Pod/fake-pod-39-27zrc": {}, + "/v1/default/Pod/fake-pod-39-29wb7": {}, + "/v1/default/Pod/fake-pod-39-2cpkf": {}, + "/v1/default/Pod/fake-pod-39-2ctqc": {}, + "/v1/default/Pod/fake-pod-39-2gsmb": {}, + "/v1/default/Pod/fake-pod-39-2mzqz": {}, + "/v1/default/Pod/fake-pod-39-2qcj9": {}, + "/v1/default/Pod/fake-pod-39-2tvp2": {}, + "/v1/default/Pod/fake-pod-39-462p8": {}, + "/v1/default/Pod/fake-pod-39-49tb6": {}, + "/v1/default/Pod/fake-pod-39-4bnm2": {}, + "/v1/default/Pod/fake-pod-39-4fjcm": {}, + "/v1/default/Pod/fake-pod-39-4gnvj": {}, + "/v1/default/Pod/fake-pod-39-4gxrf": {}, + "/v1/default/Pod/fake-pod-39-4hdmp": {}, + "/v1/default/Pod/fake-pod-39-4n7xt": {}, + "/v1/default/Pod/fake-pod-39-4nbqs": {}, + "/v1/default/Pod/fake-pod-39-4ts5b": {}, + "/v1/default/Pod/fake-pod-39-4vdhb": {}, + "/v1/default/Pod/fake-pod-39-4x2dn": {}, + "/v1/default/Pod/fake-pod-39-549vj": {}, + "/v1/default/Pod/fake-pod-39-5588p": {}, + "/v1/default/Pod/fake-pod-39-5bdgr": {}, + "/v1/default/Pod/fake-pod-39-5c6js": {}, + "/v1/default/Pod/fake-pod-39-5g6n7": {}, + "/v1/default/Pod/fake-pod-39-5jxpf": {}, + "/v1/default/Pod/fake-pod-39-5nk56": {}, + "/v1/default/Pod/fake-pod-39-5r8bv": {}, + "/v1/default/Pod/fake-pod-39-5tzk8": {}, + "/v1/default/Pod/fake-pod-39-5x8h9": {}, + "/v1/default/Pod/fake-pod-39-5z7gn": {}, + "/v1/default/Pod/fake-pod-39-62vmc": {}, + "/v1/default/Pod/fake-pod-39-64hc9": {}, + "/v1/default/Pod/fake-pod-39-65zm5": {}, + "/v1/default/Pod/fake-pod-39-67cwb": {}, + "/v1/default/Pod/fake-pod-39-6f72j": {}, + "/v1/default/Pod/fake-pod-39-6gzjr": {}, + "/v1/default/Pod/fake-pod-39-6h2x9": {}, + "/v1/default/Pod/fake-pod-39-6jkhq": {}, + "/v1/default/Pod/fake-pod-39-6k5px": {}, + "/v1/default/Pod/fake-pod-39-6ph9r": {}, + "/v1/default/Pod/fake-pod-39-6r6jp": {}, + "/v1/default/Pod/fake-pod-39-6tpzp": {}, + "/v1/default/Pod/fake-pod-39-6trqx": {}, + "/v1/default/Pod/fake-pod-39-6v844": {}, + "/v1/default/Pod/fake-pod-39-6z6br": {}, + "/v1/default/Pod/fake-pod-39-72q8h": {}, + "/v1/default/Pod/fake-pod-39-745p4": {}, + "/v1/default/Pod/fake-pod-39-74p48": {}, + "/v1/default/Pod/fake-pod-39-79sqm": {}, + "/v1/default/Pod/fake-pod-39-7b84n": {}, + "/v1/default/Pod/fake-pod-39-7hwjm": {}, + "/v1/default/Pod/fake-pod-39-7lhws": {}, + "/v1/default/Pod/fake-pod-39-7lwgd": {}, + "/v1/default/Pod/fake-pod-39-7q2ck": {}, + "/v1/default/Pod/fake-pod-39-7q5jq": {}, + "/v1/default/Pod/fake-pod-39-7q7fz": {}, + "/v1/default/Pod/fake-pod-39-7tksg": {}, + "/v1/default/Pod/fake-pod-39-7vbh9": {}, + "/v1/default/Pod/fake-pod-39-856w6": {}, + "/v1/default/Pod/fake-pod-39-8b42h": {}, + "/v1/default/Pod/fake-pod-39-8f8sl": {}, + "/v1/default/Pod/fake-pod-39-8l22b": {}, + "/v1/default/Pod/fake-pod-39-8rh4f": {}, + "/v1/default/Pod/fake-pod-39-8wc7h": {}, + "/v1/default/Pod/fake-pod-39-8zppq": {}, + "/v1/default/Pod/fake-pod-39-92lqp": {}, + "/v1/default/Pod/fake-pod-39-92nwd": {}, + "/v1/default/Pod/fake-pod-39-9679v": {}, + "/v1/default/Pod/fake-pod-39-97x5c": {}, + "/v1/default/Pod/fake-pod-39-9b8wx": {}, + "/v1/default/Pod/fake-pod-39-9bvpj": {}, + "/v1/default/Pod/fake-pod-39-9d6bx": {}, + "/v1/default/Pod/fake-pod-39-9f94j": {}, + "/v1/default/Pod/fake-pod-39-9jznf": {}, + "/v1/default/Pod/fake-pod-39-9lf97": {}, + "/v1/default/Pod/fake-pod-39-9lq65": {}, + "/v1/default/Pod/fake-pod-39-9r6vp": {}, + "/v1/default/Pod/fake-pod-39-9sxgt": {}, + "/v1/default/Pod/fake-pod-39-9vmbd": {}, + "/v1/default/Pod/fake-pod-39-9vtn2": {}, + "/v1/default/Pod/fake-pod-39-9wtf8": {}, + "/v1/default/Pod/fake-pod-39-b2xxr": {}, + "/v1/default/Pod/fake-pod-39-b5p8g": {}, + "/v1/default/Pod/fake-pod-39-b647n": {}, + "/v1/default/Pod/fake-pod-39-b6wt6": {}, + "/v1/default/Pod/fake-pod-39-b99km": {}, + "/v1/default/Pod/fake-pod-39-b9n7b": {}, + "/v1/default/Pod/fake-pod-39-b9txc": {}, + "/v1/default/Pod/fake-pod-39-bgrmw": {}, + "/v1/default/Pod/fake-pod-39-bjfkc": {}, + "/v1/default/Pod/fake-pod-39-bjp2h": {}, + "/v1/default/Pod/fake-pod-39-blbtr": {}, + "/v1/default/Pod/fake-pod-39-bp76q": {}, + "/v1/default/Pod/fake-pod-39-bpdd7": {}, + "/v1/default/Pod/fake-pod-39-br5tj": {}, + "/v1/default/Pod/fake-pod-39-bvdvq": {}, + "/v1/default/Pod/fake-pod-39-bwgsn": {}, + "/v1/default/Pod/fake-pod-39-bzkxj": {}, + "/v1/default/Pod/fake-pod-39-c45cn": {}, + "/v1/default/Pod/fake-pod-39-c6k59": {}, + "/v1/default/Pod/fake-pod-39-c7s7j": {}, + "/v1/default/Pod/fake-pod-39-cll8w": {}, + "/v1/default/Pod/fake-pod-39-cmbmk": {}, + "/v1/default/Pod/fake-pod-39-cnpzv": {}, + "/v1/default/Pod/fake-pod-39-ctwlg": {}, + "/v1/default/Pod/fake-pod-39-dk7wm": {}, + "/v1/default/Pod/fake-pod-39-dlfqn": {}, + "/v1/default/Pod/fake-pod-39-dpt4t": {}, + "/v1/default/Pod/fake-pod-39-dqpzg": {}, + "/v1/default/Pod/fake-pod-39-drhrp": {}, + "/v1/default/Pod/fake-pod-39-dtd4g": {}, + "/v1/default/Pod/fake-pod-39-f26v7": {}, + "/v1/default/Pod/fake-pod-39-f29kb": {}, + "/v1/default/Pod/fake-pod-39-f8s6r": {}, + "/v1/default/Pod/fake-pod-39-fbdtc": {}, + "/v1/default/Pod/fake-pod-39-fkdfk": {}, + "/v1/default/Pod/fake-pod-39-fkvg9": {}, + "/v1/default/Pod/fake-pod-39-fzf5f": {}, + "/v1/default/Pod/fake-pod-39-fzrp7": {}, + "/v1/default/Pod/fake-pod-39-g4znm": {}, + "/v1/default/Pod/fake-pod-39-g6dzh": {}, + "/v1/default/Pod/fake-pod-39-gb78t": {}, + "/v1/default/Pod/fake-pod-39-gd7cf": {}, + "/v1/default/Pod/fake-pod-39-gljjs": {}, + "/v1/default/Pod/fake-pod-39-gnt8l": {}, + "/v1/default/Pod/fake-pod-39-gpjjg": {}, + "/v1/default/Pod/fake-pod-39-gq47j": {}, + "/v1/default/Pod/fake-pod-39-gqjdc": {}, + "/v1/default/Pod/fake-pod-39-gql2b": {}, + "/v1/default/Pod/fake-pod-39-gs526": {}, + "/v1/default/Pod/fake-pod-39-gs579": {}, + "/v1/default/Pod/fake-pod-39-gv279": {}, + "/v1/default/Pod/fake-pod-39-gxw8l": {}, + "/v1/default/Pod/fake-pod-39-gz8qf": {}, + "/v1/default/Pod/fake-pod-39-gzg2f": {}, + "/v1/default/Pod/fake-pod-39-h6ss9": {}, + "/v1/default/Pod/fake-pod-39-h6wj5": {}, + "/v1/default/Pod/fake-pod-39-h9mc5": {}, + "/v1/default/Pod/fake-pod-39-hjt59": {}, + "/v1/default/Pod/fake-pod-39-hr9ww": {}, + "/v1/default/Pod/fake-pod-39-hrpvf": {}, + "/v1/default/Pod/fake-pod-39-ht6tq": {}, + "/v1/default/Pod/fake-pod-39-hvj88": {}, + "/v1/default/Pod/fake-pod-39-hwzs4": {}, + "/v1/default/Pod/fake-pod-39-hzp7g": {}, + "/v1/default/Pod/fake-pod-39-j4p2q": {}, + "/v1/default/Pod/fake-pod-39-j9xkn": {}, + "/v1/default/Pod/fake-pod-39-jbdwd": {}, + "/v1/default/Pod/fake-pod-39-jbxfl": {}, + "/v1/default/Pod/fake-pod-39-jfgch": {}, + "/v1/default/Pod/fake-pod-39-k44xh": {}, + "/v1/default/Pod/fake-pod-39-k4jk2": {}, + "/v1/default/Pod/fake-pod-39-k5hkx": {}, + "/v1/default/Pod/fake-pod-39-k5n64": {}, + "/v1/default/Pod/fake-pod-39-k5qgt": {}, + "/v1/default/Pod/fake-pod-39-k8fdb": {}, + "/v1/default/Pod/fake-pod-39-k8jsc": {}, + "/v1/default/Pod/fake-pod-39-k8kn7": {}, + "/v1/default/Pod/fake-pod-39-k8lxg": {}, + "/v1/default/Pod/fake-pod-39-kfxfc": {}, + "/v1/default/Pod/fake-pod-39-kkzph": {}, + "/v1/default/Pod/fake-pod-39-kn7dr": {}, + "/v1/default/Pod/fake-pod-39-ksg79": {}, + "/v1/default/Pod/fake-pod-39-kt9j2": {}, + "/v1/default/Pod/fake-pod-39-kvp9r": {}, + "/v1/default/Pod/fake-pod-39-l6z5f": {}, + "/v1/default/Pod/fake-pod-39-l8bfr": {}, + "/v1/default/Pod/fake-pod-39-l92nc": {}, + "/v1/default/Pod/fake-pod-39-l99jb": {}, + "/v1/default/Pod/fake-pod-39-l9wlp": {}, + "/v1/default/Pod/fake-pod-39-lh9f7": {}, + "/v1/default/Pod/fake-pod-39-lhq99": {}, + "/v1/default/Pod/fake-pod-39-lj7d5": {}, + "/v1/default/Pod/fake-pod-39-lkltq": {}, + "/v1/default/Pod/fake-pod-39-lzml7": {}, + "/v1/default/Pod/fake-pod-39-m25tb": {}, + "/v1/default/Pod/fake-pod-39-m8mgc": {}, + "/v1/default/Pod/fake-pod-39-m9flt": {}, + "/v1/default/Pod/fake-pod-39-mchcq": {}, + "/v1/default/Pod/fake-pod-39-mmp9t": {}, + "/v1/default/Pod/fake-pod-39-mprw6": {}, + "/v1/default/Pod/fake-pod-39-mtrj7": {}, + "/v1/default/Pod/fake-pod-39-mx8xx": {}, + "/v1/default/Pod/fake-pod-39-n2dhh": {}, + "/v1/default/Pod/fake-pod-39-n2qmc": {}, + "/v1/default/Pod/fake-pod-39-n4tgx": {}, + "/v1/default/Pod/fake-pod-39-n5dw5": {}, + "/v1/default/Pod/fake-pod-39-n5wv4": {}, + "/v1/default/Pod/fake-pod-39-n69m7": {}, + "/v1/default/Pod/fake-pod-39-n6nfd": {}, + "/v1/default/Pod/fake-pod-39-n7ppn": {}, + "/v1/default/Pod/fake-pod-39-n7v94": {}, + "/v1/default/Pod/fake-pod-39-n8cjw": {}, + "/v1/default/Pod/fake-pod-39-nfcjx": {}, + "/v1/default/Pod/fake-pod-39-nh776": {}, + "/v1/default/Pod/fake-pod-39-nk4qt": {}, + "/v1/default/Pod/fake-pod-39-nl8fs": {}, + "/v1/default/Pod/fake-pod-39-nlkkd": {}, + "/v1/default/Pod/fake-pod-39-nzx8t": {}, + "/v1/default/Pod/fake-pod-39-p2jd2": {}, + "/v1/default/Pod/fake-pod-39-p5cq6": {}, + "/v1/default/Pod/fake-pod-39-pbnkt": {}, + "/v1/default/Pod/fake-pod-39-pg7ww": {}, + "/v1/default/Pod/fake-pod-39-pgz89": {}, + "/v1/default/Pod/fake-pod-39-phbjr": {}, + "/v1/default/Pod/fake-pod-39-pjb29": {}, + "/v1/default/Pod/fake-pod-39-pjtqx": {}, + "/v1/default/Pod/fake-pod-39-ppjs9": {}, + "/v1/default/Pod/fake-pod-39-prspb": {}, + "/v1/default/Pod/fake-pod-39-q4489": {}, + "/v1/default/Pod/fake-pod-39-qbqdl": {}, + "/v1/default/Pod/fake-pod-39-qlknn": {}, + "/v1/default/Pod/fake-pod-39-qmsqg": {}, + "/v1/default/Pod/fake-pod-39-qsjqf": {}, + "/v1/default/Pod/fake-pod-39-qt8zr": {}, + "/v1/default/Pod/fake-pod-39-qxnkq": {}, + "/v1/default/Pod/fake-pod-39-r8gzf": {}, + "/v1/default/Pod/fake-pod-39-r97g4": {}, + "/v1/default/Pod/fake-pod-39-rfd2p": {}, + "/v1/default/Pod/fake-pod-39-rg9w4": {}, + "/v1/default/Pod/fake-pod-39-rjk85": {}, + "/v1/default/Pod/fake-pod-39-rlqsm": {}, + "/v1/default/Pod/fake-pod-39-rpmvv": {}, + "/v1/default/Pod/fake-pod-39-rr4z6": {}, + "/v1/default/Pod/fake-pod-39-s2vmx": {}, + "/v1/default/Pod/fake-pod-39-sgng2": {}, + "/v1/default/Pod/fake-pod-39-sjsw5": {}, + "/v1/default/Pod/fake-pod-39-sl56g": {}, + "/v1/default/Pod/fake-pod-39-sl8w9": {}, + "/v1/default/Pod/fake-pod-39-smz59": {}, + "/v1/default/Pod/fake-pod-39-sq99q": {}, + "/v1/default/Pod/fake-pod-39-ss64q": {}, + "/v1/default/Pod/fake-pod-39-stfbd": {}, + "/v1/default/Pod/fake-pod-39-t8g8x": {}, + "/v1/default/Pod/fake-pod-39-t8swh": {}, + "/v1/default/Pod/fake-pod-39-tc65k": {}, + "/v1/default/Pod/fake-pod-39-ttcb6": {}, + "/v1/default/Pod/fake-pod-39-v25bk": {}, + "/v1/default/Pod/fake-pod-39-v4q5h": {}, + "/v1/default/Pod/fake-pod-39-v6qx2": {}, + "/v1/default/Pod/fake-pod-39-v724t": {}, + "/v1/default/Pod/fake-pod-39-v7j4j": {}, + "/v1/default/Pod/fake-pod-39-v8d6g": {}, + "/v1/default/Pod/fake-pod-39-vc6wf": {}, + "/v1/default/Pod/fake-pod-39-vcz5m": {}, + "/v1/default/Pod/fake-pod-39-vg4s4": {}, + "/v1/default/Pod/fake-pod-39-vhkng": {}, + "/v1/default/Pod/fake-pod-39-vjj65": {}, + "/v1/default/Pod/fake-pod-39-vlmmr": {}, + "/v1/default/Pod/fake-pod-39-vp96l": {}, + "/v1/default/Pod/fake-pod-39-vr59x": {}, + "/v1/default/Pod/fake-pod-39-vwh8g": {}, + "/v1/default/Pod/fake-pod-39-w42d9": {}, + "/v1/default/Pod/fake-pod-39-w65t6": {}, + "/v1/default/Pod/fake-pod-39-w6g6c": {}, + "/v1/default/Pod/fake-pod-39-w7h58": {}, + "/v1/default/Pod/fake-pod-39-wd4gx": {}, + "/v1/default/Pod/fake-pod-39-wdr2x": {}, + "/v1/default/Pod/fake-pod-39-wg96k": {}, + "/v1/default/Pod/fake-pod-39-wgqht": {}, + "/v1/default/Pod/fake-pod-39-wj5tn": {}, + "/v1/default/Pod/fake-pod-39-wl9bz": {}, + "/v1/default/Pod/fake-pod-39-wnpsn": {}, + "/v1/default/Pod/fake-pod-39-wqwbz": {}, + "/v1/default/Pod/fake-pod-39-wszzr": {}, + "/v1/default/Pod/fake-pod-39-wwr8m": {}, + "/v1/default/Pod/fake-pod-39-wwvj9": {}, + "/v1/default/Pod/fake-pod-39-x2v6w": {}, + "/v1/default/Pod/fake-pod-39-x4fbb": {}, + "/v1/default/Pod/fake-pod-39-x4rc9": {}, + "/v1/default/Pod/fake-pod-39-x4tds": {}, + "/v1/default/Pod/fake-pod-39-x54k6": {}, + "/v1/default/Pod/fake-pod-39-x6z9c": {}, + "/v1/default/Pod/fake-pod-39-x7j65": {}, + "/v1/default/Pod/fake-pod-39-x9q59": {}, + "/v1/default/Pod/fake-pod-39-xb2gz": {}, + "/v1/default/Pod/fake-pod-39-xbf78": {}, + "/v1/default/Pod/fake-pod-39-xdj6w": {}, + "/v1/default/Pod/fake-pod-39-xf5nm": {}, + "/v1/default/Pod/fake-pod-39-xfjcf": {}, + "/v1/default/Pod/fake-pod-39-xft65": {}, + "/v1/default/Pod/fake-pod-39-xm2tk": {}, + "/v1/default/Pod/fake-pod-39-xmqtx": {}, + "/v1/default/Pod/fake-pod-39-xs5hm": {}, + "/v1/default/Pod/fake-pod-39-xtdv5": {}, + "/v1/default/Pod/fake-pod-39-xw9f4": {}, + "/v1/default/Pod/fake-pod-39-z2mm7": {}, + "/v1/default/Pod/fake-pod-39-z4mjx": {}, + "/v1/default/Pod/fake-pod-39-z5x7v": {}, + "/v1/default/Pod/fake-pod-39-z67cr": {}, + "/v1/default/Pod/fake-pod-39-z84hv": {}, + "/v1/default/Pod/fake-pod-39-zmtj2": {}, + "/v1/default/Pod/fake-pod-39-zp72n": {}, + "/v1/default/Pod/fake-pod-39-zqwn2": {}, + "/v1/default/Pod/fake-pod-39-zv4s7": {}, + "/v1/default/Pod/fake-pod-39-zzfbr": {}, + "/v1/default/Pod/fake-pod-4-22dlk": {}, + "/v1/default/Pod/fake-pod-4-275qp": {}, + "/v1/default/Pod/fake-pod-4-28px2": {}, + "/v1/default/Pod/fake-pod-4-2dmhg": {}, + "/v1/default/Pod/fake-pod-4-2dvr5": {}, + "/v1/default/Pod/fake-pod-4-2frkb": {}, + "/v1/default/Pod/fake-pod-4-2qswc": {}, + "/v1/default/Pod/fake-pod-4-42rtz": {}, + "/v1/default/Pod/fake-pod-4-444wh": {}, + "/v1/default/Pod/fake-pod-4-46hjj": {}, + "/v1/default/Pod/fake-pod-4-46sqs": {}, + "/v1/default/Pod/fake-pod-4-4j5qz": {}, + "/v1/default/Pod/fake-pod-4-4jsms": {}, + "/v1/default/Pod/fake-pod-4-4lslp": {}, + "/v1/default/Pod/fake-pod-4-4lvq4": {}, + "/v1/default/Pod/fake-pod-4-4qfvt": {}, + "/v1/default/Pod/fake-pod-4-4sf68": {}, + "/v1/default/Pod/fake-pod-4-4ssfs": {}, + "/v1/default/Pod/fake-pod-4-4zr6b": {}, + "/v1/default/Pod/fake-pod-4-54tk7": {}, + "/v1/default/Pod/fake-pod-4-5b4kg": {}, + "/v1/default/Pod/fake-pod-4-5glsp": {}, + "/v1/default/Pod/fake-pod-4-5lc5g": {}, + "/v1/default/Pod/fake-pod-4-5m7fz": {}, + "/v1/default/Pod/fake-pod-4-5nk8f": {}, + "/v1/default/Pod/fake-pod-4-5qcxx": {}, + "/v1/default/Pod/fake-pod-4-5vzgg": {}, + "/v1/default/Pod/fake-pod-4-62wxh": {}, + "/v1/default/Pod/fake-pod-4-64nwz": {}, + "/v1/default/Pod/fake-pod-4-65qdw": {}, + "/v1/default/Pod/fake-pod-4-68zfm": {}, + "/v1/default/Pod/fake-pod-4-695mt": {}, + "/v1/default/Pod/fake-pod-4-6nr4l": {}, + "/v1/default/Pod/fake-pod-4-6nvd4": {}, + "/v1/default/Pod/fake-pod-4-6tvkx": {}, + "/v1/default/Pod/fake-pod-4-6zzl9": {}, + "/v1/default/Pod/fake-pod-4-769gq": {}, + "/v1/default/Pod/fake-pod-4-769q4": {}, + "/v1/default/Pod/fake-pod-4-76scz": {}, + "/v1/default/Pod/fake-pod-4-76t7d": {}, + "/v1/default/Pod/fake-pod-4-7cpzm": {}, + "/v1/default/Pod/fake-pod-4-7fx4d": {}, + "/v1/default/Pod/fake-pod-4-7fxzv": {}, + "/v1/default/Pod/fake-pod-4-7k5cw": {}, + "/v1/default/Pod/fake-pod-4-7lvf4": {}, + "/v1/default/Pod/fake-pod-4-7tql8": {}, + "/v1/default/Pod/fake-pod-4-7vrth": {}, + "/v1/default/Pod/fake-pod-4-7wks2": {}, + "/v1/default/Pod/fake-pod-4-7zq27": {}, + "/v1/default/Pod/fake-pod-4-829dt": {}, + "/v1/default/Pod/fake-pod-4-86hls": {}, + "/v1/default/Pod/fake-pod-4-86xdt": {}, + "/v1/default/Pod/fake-pod-4-88fmt": {}, + "/v1/default/Pod/fake-pod-4-8hwdt": {}, + "/v1/default/Pod/fake-pod-4-8lhr9": {}, + "/v1/default/Pod/fake-pod-4-8m8fn": {}, + "/v1/default/Pod/fake-pod-4-8mwbk": {}, + "/v1/default/Pod/fake-pod-4-8nxwt": {}, + "/v1/default/Pod/fake-pod-4-8pc7l": {}, + "/v1/default/Pod/fake-pod-4-8pmxb": {}, + "/v1/default/Pod/fake-pod-4-8pnd4": {}, + "/v1/default/Pod/fake-pod-4-8qsx9": {}, + "/v1/default/Pod/fake-pod-4-8rr94": {}, + "/v1/default/Pod/fake-pod-4-8tdjh": {}, + "/v1/default/Pod/fake-pod-4-8w58r": {}, + "/v1/default/Pod/fake-pod-4-8wvd5": {}, + "/v1/default/Pod/fake-pod-4-8xxhc": {}, + "/v1/default/Pod/fake-pod-4-92k2t": {}, + "/v1/default/Pod/fake-pod-4-97dsd": {}, + "/v1/default/Pod/fake-pod-4-99s4d": {}, + "/v1/default/Pod/fake-pod-4-99snj": {}, + "/v1/default/Pod/fake-pod-4-9kvq5": {}, + "/v1/default/Pod/fake-pod-4-9ngwb": {}, + "/v1/default/Pod/fake-pod-4-9qrck": {}, + "/v1/default/Pod/fake-pod-4-9s6zj": {}, + "/v1/default/Pod/fake-pod-4-9shcm": {}, + "/v1/default/Pod/fake-pod-4-9sr9g": {}, + "/v1/default/Pod/fake-pod-4-9tts2": {}, + "/v1/default/Pod/fake-pod-4-9vbq5": {}, + "/v1/default/Pod/fake-pod-4-9w677": {}, + "/v1/default/Pod/fake-pod-4-9wj5s": {}, + "/v1/default/Pod/fake-pod-4-9wnnz": {}, + "/v1/default/Pod/fake-pod-4-9xr4h": {}, + "/v1/default/Pod/fake-pod-4-9xz2t": {}, + "/v1/default/Pod/fake-pod-4-9zlrt": {}, + "/v1/default/Pod/fake-pod-4-b67hw": {}, + "/v1/default/Pod/fake-pod-4-b6w2j": {}, + "/v1/default/Pod/fake-pod-4-bb6f6": {}, + "/v1/default/Pod/fake-pod-4-bclgw": {}, + "/v1/default/Pod/fake-pod-4-bm96m": {}, + "/v1/default/Pod/fake-pod-4-bn2nr": {}, + "/v1/default/Pod/fake-pod-4-bvxwx": {}, + "/v1/default/Pod/fake-pod-4-bxlcf": {}, + "/v1/default/Pod/fake-pod-4-c4htb": {}, + "/v1/default/Pod/fake-pod-4-c5cfg": {}, + "/v1/default/Pod/fake-pod-4-c6hlx": {}, + "/v1/default/Pod/fake-pod-4-cbvcx": {}, + "/v1/default/Pod/fake-pod-4-cddhq": {}, + "/v1/default/Pod/fake-pod-4-cr4tx": {}, + "/v1/default/Pod/fake-pod-4-cv59d": {}, + "/v1/default/Pod/fake-pod-4-d4qmb": {}, + "/v1/default/Pod/fake-pod-4-d4tf9": {}, + "/v1/default/Pod/fake-pod-4-d7svq": {}, + "/v1/default/Pod/fake-pod-4-dc2lp": {}, + "/v1/default/Pod/fake-pod-4-dc5mt": {}, + "/v1/default/Pod/fake-pod-4-dk2tr": {}, + "/v1/default/Pod/fake-pod-4-dqb4z": {}, + "/v1/default/Pod/fake-pod-4-dr2rl": {}, + "/v1/default/Pod/fake-pod-4-dvkb7": {}, + "/v1/default/Pod/fake-pod-4-fgj6z": {}, + "/v1/default/Pod/fake-pod-4-fgnm5": {}, + "/v1/default/Pod/fake-pod-4-fhj79": {}, + "/v1/default/Pod/fake-pod-4-fmfk7": {}, + "/v1/default/Pod/fake-pod-4-fn878": {}, + "/v1/default/Pod/fake-pod-4-fnpvl": {}, + "/v1/default/Pod/fake-pod-4-fqpdx": {}, + "/v1/default/Pod/fake-pod-4-fr2nm": {}, + "/v1/default/Pod/fake-pod-4-fsjvm": {}, + "/v1/default/Pod/fake-pod-4-fskbt": {}, + "/v1/default/Pod/fake-pod-4-g6xgx": {}, + "/v1/default/Pod/fake-pod-4-gcf4v": {}, + "/v1/default/Pod/fake-pod-4-gdgh6": {}, + "/v1/default/Pod/fake-pod-4-gh5hq": {}, + "/v1/default/Pod/fake-pod-4-gk7k6": {}, + "/v1/default/Pod/fake-pod-4-gm5wc": {}, + "/v1/default/Pod/fake-pod-4-gp759": {}, + "/v1/default/Pod/fake-pod-4-gqwqn": {}, + "/v1/default/Pod/fake-pod-4-gsbx6": {}, + "/v1/default/Pod/fake-pod-4-gtp5x": {}, + "/v1/default/Pod/fake-pod-4-gvfqt": {}, + "/v1/default/Pod/fake-pod-4-gwztt": {}, + "/v1/default/Pod/fake-pod-4-h27s8": {}, + "/v1/default/Pod/fake-pod-4-h5z7n": {}, + "/v1/default/Pod/fake-pod-4-h8sjk": {}, + "/v1/default/Pod/fake-pod-4-hcz67": {}, + "/v1/default/Pod/fake-pod-4-hh4v9": {}, + "/v1/default/Pod/fake-pod-4-hhbhd": {}, + "/v1/default/Pod/fake-pod-4-hq2b5": {}, + "/v1/default/Pod/fake-pod-4-hxznp": {}, + "/v1/default/Pod/fake-pod-4-hzjnq": {}, + "/v1/default/Pod/fake-pod-4-j2jsx": {}, + "/v1/default/Pod/fake-pod-4-j2tq2": {}, + "/v1/default/Pod/fake-pod-4-j5b28": {}, + "/v1/default/Pod/fake-pod-4-j6m9x": {}, + "/v1/default/Pod/fake-pod-4-j8gjl": {}, + "/v1/default/Pod/fake-pod-4-jhjqh": {}, + "/v1/default/Pod/fake-pod-4-jjqn7": {}, + "/v1/default/Pod/fake-pod-4-jl9j9": {}, + "/v1/default/Pod/fake-pod-4-jlqvs": {}, + "/v1/default/Pod/fake-pod-4-jqcx7": {}, + "/v1/default/Pod/fake-pod-4-jzxs5": {}, + "/v1/default/Pod/fake-pod-4-k4zsd": {}, + "/v1/default/Pod/fake-pod-4-k7kqb": {}, + "/v1/default/Pod/fake-pod-4-k8hln": {}, + "/v1/default/Pod/fake-pod-4-k9xgw": {}, + "/v1/default/Pod/fake-pod-4-kb6m9": {}, + "/v1/default/Pod/fake-pod-4-kfv54": {}, + "/v1/default/Pod/fake-pod-4-kjf8p": {}, + "/v1/default/Pod/fake-pod-4-kjqkh": {}, + "/v1/default/Pod/fake-pod-4-kk2bp": {}, + "/v1/default/Pod/fake-pod-4-kkkt6": {}, + "/v1/default/Pod/fake-pod-4-kn2z6": {}, + "/v1/default/Pod/fake-pod-4-kw4sj": {}, + "/v1/default/Pod/fake-pod-4-kxxc6": {}, + "/v1/default/Pod/fake-pod-4-l6gpn": {}, + "/v1/default/Pod/fake-pod-4-l82dv": {}, + "/v1/default/Pod/fake-pod-4-l8b9f": {}, + "/v1/default/Pod/fake-pod-4-l8hbx": {}, + "/v1/default/Pod/fake-pod-4-l8zkk": {}, + "/v1/default/Pod/fake-pod-4-l9r9h": {}, + "/v1/default/Pod/fake-pod-4-lcpdz": {}, + "/v1/default/Pod/fake-pod-4-lk9sq": {}, + "/v1/default/Pod/fake-pod-4-lkj7h": {}, + "/v1/default/Pod/fake-pod-4-llbqm": {}, + "/v1/default/Pod/fake-pod-4-lqcn8": {}, + "/v1/default/Pod/fake-pod-4-lrt7z": {}, + "/v1/default/Pod/fake-pod-4-m5ksq": {}, + "/v1/default/Pod/fake-pod-4-m8cw5": {}, + "/v1/default/Pod/fake-pod-4-m9x8w": {}, + "/v1/default/Pod/fake-pod-4-mgcjn": {}, + "/v1/default/Pod/fake-pod-4-mr2wk": {}, + "/v1/default/Pod/fake-pod-4-mvhs5": {}, + "/v1/default/Pod/fake-pod-4-mx54d": {}, + "/v1/default/Pod/fake-pod-4-mzvsp": {}, + "/v1/default/Pod/fake-pod-4-n2btj": {}, + "/v1/default/Pod/fake-pod-4-n6mmm": {}, + "/v1/default/Pod/fake-pod-4-n7fm5": {}, + "/v1/default/Pod/fake-pod-4-n98md": {}, + "/v1/default/Pod/fake-pod-4-n98tb": {}, + "/v1/default/Pod/fake-pod-4-nf7wh": {}, + "/v1/default/Pod/fake-pod-4-nght8": {}, + "/v1/default/Pod/fake-pod-4-nklvj": {}, + "/v1/default/Pod/fake-pod-4-nkm59": {}, + "/v1/default/Pod/fake-pod-4-nkvd8": {}, + "/v1/default/Pod/fake-pod-4-nm7lb": {}, + "/v1/default/Pod/fake-pod-4-nmkbh": {}, + "/v1/default/Pod/fake-pod-4-nps45": {}, + "/v1/default/Pod/fake-pod-4-nrcmx": {}, + "/v1/default/Pod/fake-pod-4-nvc9x": {}, + "/v1/default/Pod/fake-pod-4-nxqdr": {}, + "/v1/default/Pod/fake-pod-4-nzb7g": {}, + "/v1/default/Pod/fake-pod-4-p7nq2": {}, + "/v1/default/Pod/fake-pod-4-p8gk7": {}, + "/v1/default/Pod/fake-pod-4-p8h7q": {}, + "/v1/default/Pod/fake-pod-4-p8s2c": {}, + "/v1/default/Pod/fake-pod-4-pc2t5": {}, + "/v1/default/Pod/fake-pod-4-ph9wl": {}, + "/v1/default/Pod/fake-pod-4-pphpd": {}, + "/v1/default/Pod/fake-pod-4-psqf4": {}, + "/v1/default/Pod/fake-pod-4-pv2jf": {}, + "/v1/default/Pod/fake-pod-4-pzc4s": {}, + "/v1/default/Pod/fake-pod-4-q7hs4": {}, + "/v1/default/Pod/fake-pod-4-q929x": {}, + "/v1/default/Pod/fake-pod-4-qf2zx": {}, + "/v1/default/Pod/fake-pod-4-qhbzb": {}, + "/v1/default/Pod/fake-pod-4-qq888": {}, + "/v1/default/Pod/fake-pod-4-qs5pg": {}, + "/v1/default/Pod/fake-pod-4-qtd96": {}, + "/v1/default/Pod/fake-pod-4-qvjc5": {}, + "/v1/default/Pod/fake-pod-4-qvl75": {}, + "/v1/default/Pod/fake-pod-4-r2hmk": {}, + "/v1/default/Pod/fake-pod-4-r7gxs": {}, + "/v1/default/Pod/fake-pod-4-r7l9g": {}, + "/v1/default/Pod/fake-pod-4-r9z7f": {}, + "/v1/default/Pod/fake-pod-4-rbjrt": {}, + "/v1/default/Pod/fake-pod-4-rbm2z": {}, + "/v1/default/Pod/fake-pod-4-rg8qj": {}, + "/v1/default/Pod/fake-pod-4-rk54s": {}, + "/v1/default/Pod/fake-pod-4-rml59": {}, + "/v1/default/Pod/fake-pod-4-rmngc": {}, + "/v1/default/Pod/fake-pod-4-rq6xv": {}, + "/v1/default/Pod/fake-pod-4-rqvwx": {}, + "/v1/default/Pod/fake-pod-4-rr2tm": {}, + "/v1/default/Pod/fake-pod-4-rtbqb": {}, + "/v1/default/Pod/fake-pod-4-rz5bs": {}, + "/v1/default/Pod/fake-pod-4-s722v": {}, + "/v1/default/Pod/fake-pod-4-s7c9l": {}, + "/v1/default/Pod/fake-pod-4-s8rz7": {}, + "/v1/default/Pod/fake-pod-4-sb77p": {}, + "/v1/default/Pod/fake-pod-4-shlvz": {}, + "/v1/default/Pod/fake-pod-4-shxsd": {}, + "/v1/default/Pod/fake-pod-4-sj4js": {}, + "/v1/default/Pod/fake-pod-4-sjj6g": {}, + "/v1/default/Pod/fake-pod-4-sjvxz": {}, + "/v1/default/Pod/fake-pod-4-slwb2": {}, + "/v1/default/Pod/fake-pod-4-ss7r4": {}, + "/v1/default/Pod/fake-pod-4-ssmz8": {}, + "/v1/default/Pod/fake-pod-4-t5hsg": {}, + "/v1/default/Pod/fake-pod-4-t679b": {}, + "/v1/default/Pod/fake-pod-4-t94tp": {}, + "/v1/default/Pod/fake-pod-4-t9z4j": {}, + "/v1/default/Pod/fake-pod-4-tbfj4": {}, + "/v1/default/Pod/fake-pod-4-tc784": {}, + "/v1/default/Pod/fake-pod-4-tkqwq": {}, + "/v1/default/Pod/fake-pod-4-tlbs9": {}, + "/v1/default/Pod/fake-pod-4-tnk57": {}, + "/v1/default/Pod/fake-pod-4-tnqkq": {}, + "/v1/default/Pod/fake-pod-4-tv79x": {}, + "/v1/default/Pod/fake-pod-4-tw29d": {}, + "/v1/default/Pod/fake-pod-4-v2mmj": {}, + "/v1/default/Pod/fake-pod-4-v5r29": {}, + "/v1/default/Pod/fake-pod-4-vhdz8": {}, + "/v1/default/Pod/fake-pod-4-vpldc": {}, + "/v1/default/Pod/fake-pod-4-vrzb7": {}, + "/v1/default/Pod/fake-pod-4-vvbhc": {}, + "/v1/default/Pod/fake-pod-4-vw9q8": {}, + "/v1/default/Pod/fake-pod-4-vzd6k": {}, + "/v1/default/Pod/fake-pod-4-w4cm8": {}, + "/v1/default/Pod/fake-pod-4-w5gdm": {}, + "/v1/default/Pod/fake-pod-4-w7sd4": {}, + "/v1/default/Pod/fake-pod-4-w7vnt": {}, + "/v1/default/Pod/fake-pod-4-wbvzl": {}, + "/v1/default/Pod/fake-pod-4-whjhz": {}, + "/v1/default/Pod/fake-pod-4-wkvv7": {}, + "/v1/default/Pod/fake-pod-4-wvw5l": {}, + "/v1/default/Pod/fake-pod-4-wwxhc": {}, + "/v1/default/Pod/fake-pod-4-x5t2p": {}, + "/v1/default/Pod/fake-pod-4-x927q": {}, + "/v1/default/Pod/fake-pod-4-xbgwz": {}, + "/v1/default/Pod/fake-pod-4-xcrt8": {}, + "/v1/default/Pod/fake-pod-4-xd8fd": {}, + "/v1/default/Pod/fake-pod-4-xddr5": {}, + "/v1/default/Pod/fake-pod-4-xk8gh": {}, + "/v1/default/Pod/fake-pod-4-xmvzw": {}, + "/v1/default/Pod/fake-pod-4-xmz88": {}, + "/v1/default/Pod/fake-pod-4-xs6w9": {}, + "/v1/default/Pod/fake-pod-4-xz9gl": {}, + "/v1/default/Pod/fake-pod-4-xzj6f": {}, + "/v1/default/Pod/fake-pod-4-z6sz4": {}, + "/v1/default/Pod/fake-pod-4-zd5ld": {}, + "/v1/default/Pod/fake-pod-4-zh8dg": {}, + "/v1/default/Pod/fake-pod-4-zjgsq": {}, + "/v1/default/Pod/fake-pod-4-zjt5w": {}, + "/v1/default/Pod/fake-pod-4-zjzvs": {}, + "/v1/default/Pod/fake-pod-4-zkjlk": {}, + "/v1/default/Pod/fake-pod-4-zl4h6": {}, + "/v1/default/Pod/fake-pod-4-zw77d": {}, + "/v1/default/Pod/fake-pod-4-zxkfv": {}, + "/v1/default/Pod/fake-pod-4-zzlfz": {}, + "/v1/default/Pod/fake-pod-40-29m6v": {}, + "/v1/default/Pod/fake-pod-40-2cj7z": {}, + "/v1/default/Pod/fake-pod-40-2dz74": {}, + "/v1/default/Pod/fake-pod-40-2j4qj": {}, + "/v1/default/Pod/fake-pod-40-2n4vz": {}, + "/v1/default/Pod/fake-pod-40-2vjlw": {}, + "/v1/default/Pod/fake-pod-40-2w62w": {}, + "/v1/default/Pod/fake-pod-40-425n4": {}, + "/v1/default/Pod/fake-pod-40-42bd8": {}, + "/v1/default/Pod/fake-pod-40-42r9d": {}, + "/v1/default/Pod/fake-pod-40-4dcx4": {}, + "/v1/default/Pod/fake-pod-40-4gxd6": {}, + "/v1/default/Pod/fake-pod-40-4mpfj": {}, + "/v1/default/Pod/fake-pod-40-4tf6p": {}, + "/v1/default/Pod/fake-pod-40-4x9q2": {}, + "/v1/default/Pod/fake-pod-40-4zfth": {}, + "/v1/default/Pod/fake-pod-40-54dnc": {}, + "/v1/default/Pod/fake-pod-40-54txr": {}, + "/v1/default/Pod/fake-pod-40-58kct": {}, + "/v1/default/Pod/fake-pod-40-5d6lc": {}, + "/v1/default/Pod/fake-pod-40-5dgpb": {}, + "/v1/default/Pod/fake-pod-40-5fcgb": {}, + "/v1/default/Pod/fake-pod-40-5gs95": {}, + "/v1/default/Pod/fake-pod-40-5h6nv": {}, + "/v1/default/Pod/fake-pod-40-5kjkj": {}, + "/v1/default/Pod/fake-pod-40-5nm6s": {}, + "/v1/default/Pod/fake-pod-40-5p9vj": {}, + "/v1/default/Pod/fake-pod-40-5plgp": {}, + "/v1/default/Pod/fake-pod-40-5rg56": {}, + "/v1/default/Pod/fake-pod-40-5x5dq": {}, + "/v1/default/Pod/fake-pod-40-5x9bf": {}, + "/v1/default/Pod/fake-pod-40-5z867": {}, + "/v1/default/Pod/fake-pod-40-5zq8w": {}, + "/v1/default/Pod/fake-pod-40-5zsjf": {}, + "/v1/default/Pod/fake-pod-40-62jhr": {}, + "/v1/default/Pod/fake-pod-40-652b2": {}, + "/v1/default/Pod/fake-pod-40-65q9m": {}, + "/v1/default/Pod/fake-pod-40-66h9t": {}, + "/v1/default/Pod/fake-pod-40-6885w": {}, + "/v1/default/Pod/fake-pod-40-68vpg": {}, + "/v1/default/Pod/fake-pod-40-6g5rg": {}, + "/v1/default/Pod/fake-pod-40-6hktv": {}, + "/v1/default/Pod/fake-pod-40-6jmlw": {}, + "/v1/default/Pod/fake-pod-40-6jzv8": {}, + "/v1/default/Pod/fake-pod-40-6rnb2": {}, + "/v1/default/Pod/fake-pod-40-6vllh": {}, + "/v1/default/Pod/fake-pod-40-6wnnb": {}, + "/v1/default/Pod/fake-pod-40-6zb74": {}, + "/v1/default/Pod/fake-pod-40-745zn": {}, + "/v1/default/Pod/fake-pod-40-77bdf": {}, + "/v1/default/Pod/fake-pod-40-7899g": {}, + "/v1/default/Pod/fake-pod-40-78g84": {}, + "/v1/default/Pod/fake-pod-40-79tq8": {}, + "/v1/default/Pod/fake-pod-40-7f8xj": {}, + "/v1/default/Pod/fake-pod-40-7lh22": {}, + "/v1/default/Pod/fake-pod-40-7md6v": {}, + "/v1/default/Pod/fake-pod-40-7mkp5": {}, + "/v1/default/Pod/fake-pod-40-7nn7g": {}, + "/v1/default/Pod/fake-pod-40-7pb86": {}, + "/v1/default/Pod/fake-pod-40-7xdbk": {}, + "/v1/default/Pod/fake-pod-40-845fv": {}, + "/v1/default/Pod/fake-pod-40-85nsf": {}, + "/v1/default/Pod/fake-pod-40-8dlqd": {}, + "/v1/default/Pod/fake-pod-40-8dswg": {}, + "/v1/default/Pod/fake-pod-40-8ggw5": {}, + "/v1/default/Pod/fake-pod-40-8gxct": {}, + "/v1/default/Pod/fake-pod-40-8l8hd": {}, + "/v1/default/Pod/fake-pod-40-8llbp": {}, + "/v1/default/Pod/fake-pod-40-8m9g8": {}, + "/v1/default/Pod/fake-pod-40-8n8fr": {}, + "/v1/default/Pod/fake-pod-40-8nf89": {}, + "/v1/default/Pod/fake-pod-40-8p6sw": {}, + "/v1/default/Pod/fake-pod-40-8sfn4": {}, + "/v1/default/Pod/fake-pod-40-8snt4": {}, + "/v1/default/Pod/fake-pod-40-8sshc": {}, + "/v1/default/Pod/fake-pod-40-8thbq": {}, + "/v1/default/Pod/fake-pod-40-8zxjb": {}, + "/v1/default/Pod/fake-pod-40-928dg": {}, + "/v1/default/Pod/fake-pod-40-942pl": {}, + "/v1/default/Pod/fake-pod-40-95sgq": {}, + "/v1/default/Pod/fake-pod-40-99bk6": {}, + "/v1/default/Pod/fake-pod-40-99hrp": {}, + "/v1/default/Pod/fake-pod-40-9dgkk": {}, + "/v1/default/Pod/fake-pod-40-9f6lt": {}, + "/v1/default/Pod/fake-pod-40-9fz5c": {}, + "/v1/default/Pod/fake-pod-40-9k96b": {}, + "/v1/default/Pod/fake-pod-40-9nw8b": {}, + "/v1/default/Pod/fake-pod-40-9qkn9": {}, + "/v1/default/Pod/fake-pod-40-b889q": {}, + "/v1/default/Pod/fake-pod-40-b947f": {}, + "/v1/default/Pod/fake-pod-40-b9svl": {}, + "/v1/default/Pod/fake-pod-40-bg99b": {}, + "/v1/default/Pod/fake-pod-40-bkd8q": {}, + "/v1/default/Pod/fake-pod-40-bkp8s": {}, + "/v1/default/Pod/fake-pod-40-bp8s9": {}, + "/v1/default/Pod/fake-pod-40-bqprf": {}, + "/v1/default/Pod/fake-pod-40-brfsn": {}, + "/v1/default/Pod/fake-pod-40-brghq": {}, + "/v1/default/Pod/fake-pod-40-bsvrn": {}, + "/v1/default/Pod/fake-pod-40-btws7": {}, + "/v1/default/Pod/fake-pod-40-bvq6h": {}, + "/v1/default/Pod/fake-pod-40-bx89c": {}, + "/v1/default/Pod/fake-pod-40-bzhjb": {}, + "/v1/default/Pod/fake-pod-40-c6cqp": {}, + "/v1/default/Pod/fake-pod-40-c7tvd": {}, + "/v1/default/Pod/fake-pod-40-cdhhl": {}, + "/v1/default/Pod/fake-pod-40-cfcxc": {}, + "/v1/default/Pod/fake-pod-40-cltds": {}, + "/v1/default/Pod/fake-pod-40-csbq2": {}, + "/v1/default/Pod/fake-pod-40-cwh4s": {}, + "/v1/default/Pod/fake-pod-40-cx8l6": {}, + "/v1/default/Pod/fake-pod-40-d2psp": {}, + "/v1/default/Pod/fake-pod-40-d4zxk": {}, + "/v1/default/Pod/fake-pod-40-d7lhs": {}, + "/v1/default/Pod/fake-pod-40-ddd6g": {}, + "/v1/default/Pod/fake-pod-40-ddskz": {}, + "/v1/default/Pod/fake-pod-40-djzl6": {}, + "/v1/default/Pod/fake-pod-40-dl4wz": {}, + "/v1/default/Pod/fake-pod-40-dm54p": {}, + "/v1/default/Pod/fake-pod-40-drd4p": {}, + "/v1/default/Pod/fake-pod-40-dthk5": {}, + "/v1/default/Pod/fake-pod-40-dvvr6": {}, + "/v1/default/Pod/fake-pod-40-dx2bq": {}, + "/v1/default/Pod/fake-pod-40-f2wnw": {}, + "/v1/default/Pod/fake-pod-40-f4bcz": {}, + "/v1/default/Pod/fake-pod-40-f4jd5": {}, + "/v1/default/Pod/fake-pod-40-fcdcp": {}, + "/v1/default/Pod/fake-pod-40-fcdhq": {}, + "/v1/default/Pod/fake-pod-40-ffzt7": {}, + "/v1/default/Pod/fake-pod-40-fg7k7": {}, + "/v1/default/Pod/fake-pod-40-fkbfg": {}, + "/v1/default/Pod/fake-pod-40-fkmk6": {}, + "/v1/default/Pod/fake-pod-40-fkzgb": {}, + "/v1/default/Pod/fake-pod-40-fp8j2": {}, + "/v1/default/Pod/fake-pod-40-fskcp": {}, + "/v1/default/Pod/fake-pod-40-g2m7l": {}, + "/v1/default/Pod/fake-pod-40-g4nqw": {}, + "/v1/default/Pod/fake-pod-40-g4v9d": {}, + "/v1/default/Pod/fake-pod-40-g562n": {}, + "/v1/default/Pod/fake-pod-40-g7k8l": {}, + "/v1/default/Pod/fake-pod-40-gbtnv": {}, + "/v1/default/Pod/fake-pod-40-gfrc8": {}, + "/v1/default/Pod/fake-pod-40-ghgtc": {}, + "/v1/default/Pod/fake-pod-40-gzp8h": {}, + "/v1/default/Pod/fake-pod-40-gzswt": {}, + "/v1/default/Pod/fake-pod-40-h2647": {}, + "/v1/default/Pod/fake-pod-40-hgpzb": {}, + "/v1/default/Pod/fake-pod-40-hhwxm": {}, + "/v1/default/Pod/fake-pod-40-hjrbq": {}, + "/v1/default/Pod/fake-pod-40-hkslz": {}, + "/v1/default/Pod/fake-pod-40-hqhzm": {}, + "/v1/default/Pod/fake-pod-40-hrjrm": {}, + "/v1/default/Pod/fake-pod-40-hvlx6": {}, + "/v1/default/Pod/fake-pod-40-hzpq7": {}, + "/v1/default/Pod/fake-pod-40-hztpb": {}, + "/v1/default/Pod/fake-pod-40-j5dmp": {}, + "/v1/default/Pod/fake-pod-40-j699g": {}, + "/v1/default/Pod/fake-pod-40-j6fhl": {}, + "/v1/default/Pod/fake-pod-40-j9rcm": {}, + "/v1/default/Pod/fake-pod-40-jbvzd": {}, + "/v1/default/Pod/fake-pod-40-jcjmp": {}, + "/v1/default/Pod/fake-pod-40-jd596": {}, + "/v1/default/Pod/fake-pod-40-jfrxr": {}, + "/v1/default/Pod/fake-pod-40-jlf7x": {}, + "/v1/default/Pod/fake-pod-40-jlr78": {}, + "/v1/default/Pod/fake-pod-40-jn6tl": {}, + "/v1/default/Pod/fake-pod-40-jphr6": {}, + "/v1/default/Pod/fake-pod-40-jqql9": {}, + "/v1/default/Pod/fake-pod-40-jrx5m": {}, + "/v1/default/Pod/fake-pod-40-jtx95": {}, + "/v1/default/Pod/fake-pod-40-jz6cl": {}, + "/v1/default/Pod/fake-pod-40-k5dmq": {}, + "/v1/default/Pod/fake-pod-40-k5dvg": {}, + "/v1/default/Pod/fake-pod-40-k98v2": {}, + "/v1/default/Pod/fake-pod-40-kb5xl": {}, + "/v1/default/Pod/fake-pod-40-kb99l": {}, + "/v1/default/Pod/fake-pod-40-ks24h": {}, + "/v1/default/Pod/fake-pod-40-l4695": {}, + "/v1/default/Pod/fake-pod-40-l6x66": {}, + "/v1/default/Pod/fake-pod-40-l8q54": {}, + "/v1/default/Pod/fake-pod-40-l94rn": {}, + "/v1/default/Pod/fake-pod-40-ldfjp": {}, + "/v1/default/Pod/fake-pod-40-lf84p": {}, + "/v1/default/Pod/fake-pod-40-lfp8r": {}, + "/v1/default/Pod/fake-pod-40-lhkht": {}, + "/v1/default/Pod/fake-pod-40-lhmzb": {}, + "/v1/default/Pod/fake-pod-40-lj55j": {}, + "/v1/default/Pod/fake-pod-40-lnpqg": {}, + "/v1/default/Pod/fake-pod-40-lr8qw": {}, + "/v1/default/Pod/fake-pod-40-lrf6x": {}, + "/v1/default/Pod/fake-pod-40-lxmnq": {}, + "/v1/default/Pod/fake-pod-40-lzpzr": {}, + "/v1/default/Pod/fake-pod-40-lzvfv": {}, + "/v1/default/Pod/fake-pod-40-m2xwv": {}, + "/v1/default/Pod/fake-pod-40-m684t": {}, + "/v1/default/Pod/fake-pod-40-mc6hr": {}, + "/v1/default/Pod/fake-pod-40-mh6l9": {}, + "/v1/default/Pod/fake-pod-40-mhnwk": {}, + "/v1/default/Pod/fake-pod-40-ml4nn": {}, + "/v1/default/Pod/fake-pod-40-mnxlk": {}, + "/v1/default/Pod/fake-pod-40-n4mb2": {}, + "/v1/default/Pod/fake-pod-40-n4tbz": {}, + "/v1/default/Pod/fake-pod-40-n5phd": {}, + "/v1/default/Pod/fake-pod-40-n9mf7": {}, + "/v1/default/Pod/fake-pod-40-n9z6h": {}, + "/v1/default/Pod/fake-pod-40-nhqx8": {}, + "/v1/default/Pod/fake-pod-40-nmfpz": {}, + "/v1/default/Pod/fake-pod-40-nq4p5": {}, + "/v1/default/Pod/fake-pod-40-ns8hr": {}, + "/v1/default/Pod/fake-pod-40-nv797": {}, + "/v1/default/Pod/fake-pod-40-nwtm2": {}, + "/v1/default/Pod/fake-pod-40-nz5c6": {}, + "/v1/default/Pod/fake-pod-40-p67wt": {}, + "/v1/default/Pod/fake-pod-40-p9n6x": {}, + "/v1/default/Pod/fake-pod-40-pdszm": {}, + "/v1/default/Pod/fake-pod-40-php89": {}, + "/v1/default/Pod/fake-pod-40-plcz9": {}, + "/v1/default/Pod/fake-pod-40-pptqk": {}, + "/v1/default/Pod/fake-pod-40-ptf9q": {}, + "/v1/default/Pod/fake-pod-40-pvjsd": {}, + "/v1/default/Pod/fake-pod-40-pxz6t": {}, + "/v1/default/Pod/fake-pod-40-pzf9b": {}, + "/v1/default/Pod/fake-pod-40-q4pl2": {}, + "/v1/default/Pod/fake-pod-40-q7l8k": {}, + "/v1/default/Pod/fake-pod-40-qtd5k": {}, + "/v1/default/Pod/fake-pod-40-qvzwc": {}, + "/v1/default/Pod/fake-pod-40-qwtjl": {}, + "/v1/default/Pod/fake-pod-40-r5c6x": {}, + "/v1/default/Pod/fake-pod-40-r6m77": {}, + "/v1/default/Pod/fake-pod-40-r75m2": {}, + "/v1/default/Pod/fake-pod-40-r9sw2": {}, + "/v1/default/Pod/fake-pod-40-rbkfk": {}, + "/v1/default/Pod/fake-pod-40-rh6fn": {}, + "/v1/default/Pod/fake-pod-40-rl7ps": {}, + "/v1/default/Pod/fake-pod-40-rpd7n": {}, + "/v1/default/Pod/fake-pod-40-rpnf9": {}, + "/v1/default/Pod/fake-pod-40-rs54d": {}, + "/v1/default/Pod/fake-pod-40-rvm6n": {}, + "/v1/default/Pod/fake-pod-40-s6wm2": {}, + "/v1/default/Pod/fake-pod-40-sdph8": {}, + "/v1/default/Pod/fake-pod-40-sk99z": {}, + "/v1/default/Pod/fake-pod-40-sm72f": {}, + "/v1/default/Pod/fake-pod-40-svqxb": {}, + "/v1/default/Pod/fake-pod-40-sw7h5": {}, + "/v1/default/Pod/fake-pod-40-szzjv": {}, + "/v1/default/Pod/fake-pod-40-t4jwp": {}, + "/v1/default/Pod/fake-pod-40-t7n7q": {}, + "/v1/default/Pod/fake-pod-40-tgmnk": {}, + "/v1/default/Pod/fake-pod-40-tkjk7": {}, + "/v1/default/Pod/fake-pod-40-trrzt": {}, + "/v1/default/Pod/fake-pod-40-twj95": {}, + "/v1/default/Pod/fake-pod-40-v2jw5": {}, + "/v1/default/Pod/fake-pod-40-vcm6x": {}, + "/v1/default/Pod/fake-pod-40-vf6lt": {}, + "/v1/default/Pod/fake-pod-40-vj28t": {}, + "/v1/default/Pod/fake-pod-40-vlxck": {}, + "/v1/default/Pod/fake-pod-40-vn58s": {}, + "/v1/default/Pod/fake-pod-40-vn6n5": {}, + "/v1/default/Pod/fake-pod-40-vndsn": {}, + "/v1/default/Pod/fake-pod-40-vnfc5": {}, + "/v1/default/Pod/fake-pod-40-vnj56": {}, + "/v1/default/Pod/fake-pod-40-vt5tw": {}, + "/v1/default/Pod/fake-pod-40-vv4xg": {}, + "/v1/default/Pod/fake-pod-40-vwrn5": {}, + "/v1/default/Pod/fake-pod-40-vxpr2": {}, + "/v1/default/Pod/fake-pod-40-w5gfz": {}, + "/v1/default/Pod/fake-pod-40-w5jt2": {}, + "/v1/default/Pod/fake-pod-40-w7qsq": {}, + "/v1/default/Pod/fake-pod-40-w85v5": {}, + "/v1/default/Pod/fake-pod-40-w8654": {}, + "/v1/default/Pod/fake-pod-40-w8x8t": {}, + "/v1/default/Pod/fake-pod-40-wfsbv": {}, + "/v1/default/Pod/fake-pod-40-wg6cp": {}, + "/v1/default/Pod/fake-pod-40-wmmjn": {}, + "/v1/default/Pod/fake-pod-40-wnz9c": {}, + "/v1/default/Pod/fake-pod-40-wqlxc": {}, + "/v1/default/Pod/fake-pod-40-wqxx9": {}, + "/v1/default/Pod/fake-pod-40-wx7t8": {}, + "/v1/default/Pod/fake-pod-40-x5n45": {}, + "/v1/default/Pod/fake-pod-40-x5sw6": {}, + "/v1/default/Pod/fake-pod-40-x8vwg": {}, + "/v1/default/Pod/fake-pod-40-xbq6j": {}, + "/v1/default/Pod/fake-pod-40-xjnfw": {}, + "/v1/default/Pod/fake-pod-40-xk5tk": {}, + "/v1/default/Pod/fake-pod-40-xp64p": {}, + "/v1/default/Pod/fake-pod-40-xs9tl": {}, + "/v1/default/Pod/fake-pod-40-xwncc": {}, + "/v1/default/Pod/fake-pod-40-xwnfz": {}, + "/v1/default/Pod/fake-pod-40-xxwx8": {}, + "/v1/default/Pod/fake-pod-40-xzhwd": {}, + "/v1/default/Pod/fake-pod-40-xzmdn": {}, + "/v1/default/Pod/fake-pod-40-xznsh": {}, + "/v1/default/Pod/fake-pod-40-z44ls": {}, + "/v1/default/Pod/fake-pod-40-z8xdb": {}, + "/v1/default/Pod/fake-pod-40-zbc2k": {}, + "/v1/default/Pod/fake-pod-40-zbkng": {}, + "/v1/default/Pod/fake-pod-40-zqst6": {}, + "/v1/default/Pod/fake-pod-40-zqwnz": {}, + "/v1/default/Pod/fake-pod-40-zrlk6": {}, + "/v1/default/Pod/fake-pod-41-28wdj": {}, + "/v1/default/Pod/fake-pod-41-2fqkf": {}, + "/v1/default/Pod/fake-pod-41-2gttq": {}, + "/v1/default/Pod/fake-pod-41-2hc2q": {}, + "/v1/default/Pod/fake-pod-41-2hdqz": {}, + "/v1/default/Pod/fake-pod-41-2n2j8": {}, + "/v1/default/Pod/fake-pod-41-2pq79": {}, + "/v1/default/Pod/fake-pod-41-2thn4": {}, + "/v1/default/Pod/fake-pod-41-42cnq": {}, + "/v1/default/Pod/fake-pod-41-49b8x": {}, + "/v1/default/Pod/fake-pod-41-4b5bm": {}, + "/v1/default/Pod/fake-pod-41-4cq9c": {}, + "/v1/default/Pod/fake-pod-41-4f88v": {}, + "/v1/default/Pod/fake-pod-41-4jnsk": {}, + "/v1/default/Pod/fake-pod-41-4kzjf": {}, + "/v1/default/Pod/fake-pod-41-4lgz6": {}, + "/v1/default/Pod/fake-pod-41-4m5c6": {}, + "/v1/default/Pod/fake-pod-41-4m8mf": {}, + "/v1/default/Pod/fake-pod-41-4qg9h": {}, + "/v1/default/Pod/fake-pod-41-55zwp": {}, + "/v1/default/Pod/fake-pod-41-56j6k": {}, + "/v1/default/Pod/fake-pod-41-5744p": {}, + "/v1/default/Pod/fake-pod-41-57gmj": {}, + "/v1/default/Pod/fake-pod-41-5dg87": {}, + "/v1/default/Pod/fake-pod-41-5dgmr": {}, + "/v1/default/Pod/fake-pod-41-5dtmt": {}, + "/v1/default/Pod/fake-pod-41-5fxzv": {}, + "/v1/default/Pod/fake-pod-41-5knpg": {}, + "/v1/default/Pod/fake-pod-41-5mqlz": {}, + "/v1/default/Pod/fake-pod-41-5mthn": {}, + "/v1/default/Pod/fake-pod-41-5qnt6": {}, + "/v1/default/Pod/fake-pod-41-5smn7": {}, + "/v1/default/Pod/fake-pod-41-69lmp": {}, + "/v1/default/Pod/fake-pod-41-6fmq2": {}, + "/v1/default/Pod/fake-pod-41-6g49b": {}, + "/v1/default/Pod/fake-pod-41-6hpvv": {}, + "/v1/default/Pod/fake-pod-41-6jqks": {}, + "/v1/default/Pod/fake-pod-41-6kc9q": {}, + "/v1/default/Pod/fake-pod-41-6kz48": {}, + "/v1/default/Pod/fake-pod-41-6v9z8": {}, + "/v1/default/Pod/fake-pod-41-74r5m": {}, + "/v1/default/Pod/fake-pod-41-7779s": {}, + "/v1/default/Pod/fake-pod-41-7gs4m": {}, + "/v1/default/Pod/fake-pod-41-7j22k": {}, + "/v1/default/Pod/fake-pod-41-7kvq9": {}, + "/v1/default/Pod/fake-pod-41-7lwcx": {}, + "/v1/default/Pod/fake-pod-41-7rt6k": {}, + "/v1/default/Pod/fake-pod-41-7rww7": {}, + "/v1/default/Pod/fake-pod-41-7slq7": {}, + "/v1/default/Pod/fake-pod-41-7sr6c": {}, + "/v1/default/Pod/fake-pod-41-7w6rl": {}, + "/v1/default/Pod/fake-pod-41-7w9hg": {}, + "/v1/default/Pod/fake-pod-41-87mr9": {}, + "/v1/default/Pod/fake-pod-41-8cccl": {}, + "/v1/default/Pod/fake-pod-41-8f54q": {}, + "/v1/default/Pod/fake-pod-41-8h6fg": {}, + "/v1/default/Pod/fake-pod-41-8lqrj": {}, + "/v1/default/Pod/fake-pod-41-8sf5f": {}, + "/v1/default/Pod/fake-pod-41-8sssh": {}, + "/v1/default/Pod/fake-pod-41-8vqtq": {}, + "/v1/default/Pod/fake-pod-41-9474w": {}, + "/v1/default/Pod/fake-pod-41-95m4w": {}, + "/v1/default/Pod/fake-pod-41-96lls": {}, + "/v1/default/Pod/fake-pod-41-976nf": {}, + "/v1/default/Pod/fake-pod-41-9b2vh": {}, + "/v1/default/Pod/fake-pod-41-9b89m": {}, + "/v1/default/Pod/fake-pod-41-9dfhh": {}, + "/v1/default/Pod/fake-pod-41-9frlj": {}, + "/v1/default/Pod/fake-pod-41-9h79r": {}, + "/v1/default/Pod/fake-pod-41-9hvrm": {}, + "/v1/default/Pod/fake-pod-41-9kmjj": {}, + "/v1/default/Pod/fake-pod-41-9ljb6": {}, + "/v1/default/Pod/fake-pod-41-9m44r": {}, + "/v1/default/Pod/fake-pod-41-9n8z2": {}, + "/v1/default/Pod/fake-pod-41-9nzn6": {}, + "/v1/default/Pod/fake-pod-41-9xb8g": {}, + "/v1/default/Pod/fake-pod-41-b2jqm": {}, + "/v1/default/Pod/fake-pod-41-b45kf": {}, + "/v1/default/Pod/fake-pod-41-bcsjn": {}, + "/v1/default/Pod/fake-pod-41-bkgk9": {}, + "/v1/default/Pod/fake-pod-41-bmgwp": {}, + "/v1/default/Pod/fake-pod-41-bmnt9": {}, + "/v1/default/Pod/fake-pod-41-bwjr5": {}, + "/v1/default/Pod/fake-pod-41-bx4qv": {}, + "/v1/default/Pod/fake-pod-41-bxwq5": {}, + "/v1/default/Pod/fake-pod-41-c2jl6": {}, + "/v1/default/Pod/fake-pod-41-c6xdm": {}, + "/v1/default/Pod/fake-pod-41-c7vk5": {}, + "/v1/default/Pod/fake-pod-41-c8shz": {}, + "/v1/default/Pod/fake-pod-41-c965c": {}, + "/v1/default/Pod/fake-pod-41-c98rp": {}, + "/v1/default/Pod/fake-pod-41-c9zvv": {}, + "/v1/default/Pod/fake-pod-41-cbjrv": {}, + "/v1/default/Pod/fake-pod-41-cchth": {}, + "/v1/default/Pod/fake-pod-41-ccqtk": {}, + "/v1/default/Pod/fake-pod-41-cfgm2": {}, + "/v1/default/Pod/fake-pod-41-cgvsw": {}, + "/v1/default/Pod/fake-pod-41-chdnb": {}, + "/v1/default/Pod/fake-pod-41-cjv94": {}, + "/v1/default/Pod/fake-pod-41-clg9p": {}, + "/v1/default/Pod/fake-pod-41-cmxht": {}, + "/v1/default/Pod/fake-pod-41-cptdl": {}, + "/v1/default/Pod/fake-pod-41-csbrf": {}, + "/v1/default/Pod/fake-pod-41-csll6": {}, + "/v1/default/Pod/fake-pod-41-cwqt5": {}, + "/v1/default/Pod/fake-pod-41-cz76k": {}, + "/v1/default/Pod/fake-pod-41-czmpt": {}, + "/v1/default/Pod/fake-pod-41-d5cl8": {}, + "/v1/default/Pod/fake-pod-41-d8p7p": {}, + "/v1/default/Pod/fake-pod-41-d9cx7": {}, + "/v1/default/Pod/fake-pod-41-dc9dl": {}, + "/v1/default/Pod/fake-pod-41-ddcb6": {}, + "/v1/default/Pod/fake-pod-41-df4wc": {}, + "/v1/default/Pod/fake-pod-41-dhvq2": {}, + "/v1/default/Pod/fake-pod-41-dmtrk": {}, + "/v1/default/Pod/fake-pod-41-dpk94": {}, + "/v1/default/Pod/fake-pod-41-dqtf4": {}, + "/v1/default/Pod/fake-pod-41-f2tr7": {}, + "/v1/default/Pod/fake-pod-41-f895t": {}, + "/v1/default/Pod/fake-pod-41-fjgmn": {}, + "/v1/default/Pod/fake-pod-41-fjwnt": {}, + "/v1/default/Pod/fake-pod-41-fvstk": {}, + "/v1/default/Pod/fake-pod-41-fw6r2": {}, + "/v1/default/Pod/fake-pod-41-fznqx": {}, + "/v1/default/Pod/fake-pod-41-g7s2w": {}, + "/v1/default/Pod/fake-pod-41-g8tnl": {}, + "/v1/default/Pod/fake-pod-41-gdc77": {}, + "/v1/default/Pod/fake-pod-41-gfwbr": {}, + "/v1/default/Pod/fake-pod-41-ghckm": {}, + "/v1/default/Pod/fake-pod-41-gjndw": {}, + "/v1/default/Pod/fake-pod-41-gkrl8": {}, + "/v1/default/Pod/fake-pod-41-gp4fz": {}, + "/v1/default/Pod/fake-pod-41-gp9l7": {}, + "/v1/default/Pod/fake-pod-41-gtz42": {}, + "/v1/default/Pod/fake-pod-41-gw75z": {}, + "/v1/default/Pod/fake-pod-41-gxjbs": {}, + "/v1/default/Pod/fake-pod-41-gz5kn": {}, + "/v1/default/Pod/fake-pod-41-gzfmc": {}, + "/v1/default/Pod/fake-pod-41-h52kx": {}, + "/v1/default/Pod/fake-pod-41-h7rq6": {}, + "/v1/default/Pod/fake-pod-41-h9vmv": {}, + "/v1/default/Pod/fake-pod-41-hkbz4": {}, + "/v1/default/Pod/fake-pod-41-hkksz": {}, + "/v1/default/Pod/fake-pod-41-hl625": {}, + "/v1/default/Pod/fake-pod-41-hn7nr": {}, + "/v1/default/Pod/fake-pod-41-hs4z8": {}, + "/v1/default/Pod/fake-pod-41-hv7f6": {}, + "/v1/default/Pod/fake-pod-41-hztqb": {}, + "/v1/default/Pod/fake-pod-41-jc55f": {}, + "/v1/default/Pod/fake-pod-41-jc8pq": {}, + "/v1/default/Pod/fake-pod-41-jdfw9": {}, + "/v1/default/Pod/fake-pod-41-jm48q": {}, + "/v1/default/Pod/fake-pod-41-jmcbt": {}, + "/v1/default/Pod/fake-pod-41-jp29t": {}, + "/v1/default/Pod/fake-pod-41-jpgc6": {}, + "/v1/default/Pod/fake-pod-41-jsbhr": {}, + "/v1/default/Pod/fake-pod-41-jtbm7": {}, + "/v1/default/Pod/fake-pod-41-jzmtq": {}, + "/v1/default/Pod/fake-pod-41-k2dh7": {}, + "/v1/default/Pod/fake-pod-41-k82ht": {}, + "/v1/default/Pod/fake-pod-41-kgsxq": {}, + "/v1/default/Pod/fake-pod-41-kk85v": {}, + "/v1/default/Pod/fake-pod-41-kn7r8": {}, + "/v1/default/Pod/fake-pod-41-ksrs4": {}, + "/v1/default/Pod/fake-pod-41-ktdjc": {}, + "/v1/default/Pod/fake-pod-41-kwmnj": {}, + "/v1/default/Pod/fake-pod-41-kwxgt": {}, + "/v1/default/Pod/fake-pod-41-kz6lg": {}, + "/v1/default/Pod/fake-pod-41-lb9cl": {}, + "/v1/default/Pod/fake-pod-41-lc4jt": {}, + "/v1/default/Pod/fake-pod-41-ldbmm": {}, + "/v1/default/Pod/fake-pod-41-lfslq": {}, + "/v1/default/Pod/fake-pod-41-lfswh": {}, + "/v1/default/Pod/fake-pod-41-lh6bh": {}, + "/v1/default/Pod/fake-pod-41-lhv6j": {}, + "/v1/default/Pod/fake-pod-41-llzqq": {}, + "/v1/default/Pod/fake-pod-41-lsvf6": {}, + "/v1/default/Pod/fake-pod-41-lw5q8": {}, + "/v1/default/Pod/fake-pod-41-lxzf2": {}, + "/v1/default/Pod/fake-pod-41-m28rd": {}, + "/v1/default/Pod/fake-pod-41-m6zzm": {}, + "/v1/default/Pod/fake-pod-41-mbsxf": {}, + "/v1/default/Pod/fake-pod-41-mf7vv": {}, + "/v1/default/Pod/fake-pod-41-mg9cq": {}, + "/v1/default/Pod/fake-pod-41-mkrpj": {}, + "/v1/default/Pod/fake-pod-41-mr2cj": {}, + "/v1/default/Pod/fake-pod-41-mrxt4": {}, + "/v1/default/Pod/fake-pod-41-mswsh": {}, + "/v1/default/Pod/fake-pod-41-mwxmc": {}, + "/v1/default/Pod/fake-pod-41-n2dpb": {}, + "/v1/default/Pod/fake-pod-41-n5ns8": {}, + "/v1/default/Pod/fake-pod-41-n9gln": {}, + "/v1/default/Pod/fake-pod-41-n9h92": {}, + "/v1/default/Pod/fake-pod-41-nc2n7": {}, + "/v1/default/Pod/fake-pod-41-ncjch": {}, + "/v1/default/Pod/fake-pod-41-nf9l4": {}, + "/v1/default/Pod/fake-pod-41-nh984": {}, + "/v1/default/Pod/fake-pod-41-nsdw4": {}, + "/v1/default/Pod/fake-pod-41-p4lbk": {}, + "/v1/default/Pod/fake-pod-41-p5wpr": {}, + "/v1/default/Pod/fake-pod-41-p6rvz": {}, + "/v1/default/Pod/fake-pod-41-p765l": {}, + "/v1/default/Pod/fake-pod-41-p9d8t": {}, + "/v1/default/Pod/fake-pod-41-p9r5n": {}, + "/v1/default/Pod/fake-pod-41-pdtgl": {}, + "/v1/default/Pod/fake-pod-41-phb6d": {}, + "/v1/default/Pod/fake-pod-41-plcws": {}, + "/v1/default/Pod/fake-pod-41-pmfj4": {}, + "/v1/default/Pod/fake-pod-41-pmxfd": {}, + "/v1/default/Pod/fake-pod-41-ppb2s": {}, + "/v1/default/Pod/fake-pod-41-pq9g8": {}, + "/v1/default/Pod/fake-pod-41-pvszz": {}, + "/v1/default/Pod/fake-pod-41-q2rq8": {}, + "/v1/default/Pod/fake-pod-41-qd55k": {}, + "/v1/default/Pod/fake-pod-41-qm987": {}, + "/v1/default/Pod/fake-pod-41-qp8pb": {}, + "/v1/default/Pod/fake-pod-41-qsjtq": {}, + "/v1/default/Pod/fake-pod-41-qsl69": {}, + "/v1/default/Pod/fake-pod-41-qspmn": {}, + "/v1/default/Pod/fake-pod-41-qtbhz": {}, + "/v1/default/Pod/fake-pod-41-r2ds4": {}, + "/v1/default/Pod/fake-pod-41-r2q6s": {}, + "/v1/default/Pod/fake-pod-41-rbc7j": {}, + "/v1/default/Pod/fake-pod-41-rgs7j": {}, + "/v1/default/Pod/fake-pod-41-rhtjl": {}, + "/v1/default/Pod/fake-pod-41-rksjw": {}, + "/v1/default/Pod/fake-pod-41-rv7dk": {}, + "/v1/default/Pod/fake-pod-41-rvwcb": {}, + "/v1/default/Pod/fake-pod-41-rwkkn": {}, + "/v1/default/Pod/fake-pod-41-rzk5b": {}, + "/v1/default/Pod/fake-pod-41-s25tr": {}, + "/v1/default/Pod/fake-pod-41-s87p6": {}, + "/v1/default/Pod/fake-pod-41-s8x5r": {}, + "/v1/default/Pod/fake-pod-41-s9smx": {}, + "/v1/default/Pod/fake-pod-41-sknzr": {}, + "/v1/default/Pod/fake-pod-41-sstcb": {}, + "/v1/default/Pod/fake-pod-41-ssxnc": {}, + "/v1/default/Pod/fake-pod-41-stfvh": {}, + "/v1/default/Pod/fake-pod-41-sx5zt": {}, + "/v1/default/Pod/fake-pod-41-sxvfr": {}, + "/v1/default/Pod/fake-pod-41-sxwbw": {}, + "/v1/default/Pod/fake-pod-41-szr26": {}, + "/v1/default/Pod/fake-pod-41-szv78": {}, + "/v1/default/Pod/fake-pod-41-t722t": {}, + "/v1/default/Pod/fake-pod-41-t8jh9": {}, + "/v1/default/Pod/fake-pod-41-t9rr2": {}, + "/v1/default/Pod/fake-pod-41-td66s": {}, + "/v1/default/Pod/fake-pod-41-tfxbr": {}, + "/v1/default/Pod/fake-pod-41-tmbf7": {}, + "/v1/default/Pod/fake-pod-41-tq46n": {}, + "/v1/default/Pod/fake-pod-41-tvvdd": {}, + "/v1/default/Pod/fake-pod-41-txmjl": {}, + "/v1/default/Pod/fake-pod-41-tzbcj": {}, + "/v1/default/Pod/fake-pod-41-v2d9s": {}, + "/v1/default/Pod/fake-pod-41-v2st9": {}, + "/v1/default/Pod/fake-pod-41-v4sxz": {}, + "/v1/default/Pod/fake-pod-41-v4v9m": {}, + "/v1/default/Pod/fake-pod-41-v9jkj": {}, + "/v1/default/Pod/fake-pod-41-v9skc": {}, + "/v1/default/Pod/fake-pod-41-vb2dp": {}, + "/v1/default/Pod/fake-pod-41-vl62g": {}, + "/v1/default/Pod/fake-pod-41-vvtdl": {}, + "/v1/default/Pod/fake-pod-41-vw4gk": {}, + "/v1/default/Pod/fake-pod-41-vx9rs": {}, + "/v1/default/Pod/fake-pod-41-vxh5s": {}, + "/v1/default/Pod/fake-pod-41-w78mr": {}, + "/v1/default/Pod/fake-pod-41-w7zns": {}, + "/v1/default/Pod/fake-pod-41-w9gmd": {}, + "/v1/default/Pod/fake-pod-41-wcvhd": {}, + "/v1/default/Pod/fake-pod-41-wj28q": {}, + "/v1/default/Pod/fake-pod-41-wjpfm": {}, + "/v1/default/Pod/fake-pod-41-wkqs6": {}, + "/v1/default/Pod/fake-pod-41-wm9lt": {}, + "/v1/default/Pod/fake-pod-41-wmg5n": {}, + "/v1/default/Pod/fake-pod-41-wnq2w": {}, + "/v1/default/Pod/fake-pod-41-wnrbs": {}, + "/v1/default/Pod/fake-pod-41-wqndj": {}, + "/v1/default/Pod/fake-pod-41-wt84l": {}, + "/v1/default/Pod/fake-pod-41-wtwbj": {}, + "/v1/default/Pod/fake-pod-41-wxfhq": {}, + "/v1/default/Pod/fake-pod-41-x7wbv": {}, + "/v1/default/Pod/fake-pod-41-xb585": {}, + "/v1/default/Pod/fake-pod-41-xd5qq": {}, + "/v1/default/Pod/fake-pod-41-xhkbj": {}, + "/v1/default/Pod/fake-pod-41-xm89j": {}, + "/v1/default/Pod/fake-pod-41-xmxsn": {}, + "/v1/default/Pod/fake-pod-41-xw67v": {}, + "/v1/default/Pod/fake-pod-41-xzmn9": {}, + "/v1/default/Pod/fake-pod-41-z78j2": {}, + "/v1/default/Pod/fake-pod-41-zc8bz": {}, + "/v1/default/Pod/fake-pod-41-zcwvj": {}, + "/v1/default/Pod/fake-pod-41-zjpf8": {}, + "/v1/default/Pod/fake-pod-41-zmsl7": {}, + "/v1/default/Pod/fake-pod-41-znwhj": {}, + "/v1/default/Pod/fake-pod-41-zpvkb": {}, + "/v1/default/Pod/fake-pod-41-zr4lk": {}, + "/v1/default/Pod/fake-pod-41-zsgmh": {}, + "/v1/default/Pod/fake-pod-41-ztb6b": {}, + "/v1/default/Pod/fake-pod-41-zwhsf": {}, + "/v1/default/Pod/fake-pod-42-22xtd": {}, + "/v1/default/Pod/fake-pod-42-25mpg": {}, + "/v1/default/Pod/fake-pod-42-272js": {}, + "/v1/default/Pod/fake-pod-42-272m5": {}, + "/v1/default/Pod/fake-pod-42-284vn": {}, + "/v1/default/Pod/fake-pod-42-2bc7s": {}, + "/v1/default/Pod/fake-pod-42-2bzmf": {}, + "/v1/default/Pod/fake-pod-42-2g4bd": {}, + "/v1/default/Pod/fake-pod-42-2m224": {}, + "/v1/default/Pod/fake-pod-42-2mrm8": {}, + "/v1/default/Pod/fake-pod-42-2vshx": {}, + "/v1/default/Pod/fake-pod-42-4246b": {}, + "/v1/default/Pod/fake-pod-42-46skg": {}, + "/v1/default/Pod/fake-pod-42-492gj": {}, + "/v1/default/Pod/fake-pod-42-4bbkf": {}, + "/v1/default/Pod/fake-pod-42-4bth6": {}, + "/v1/default/Pod/fake-pod-42-4drnk": {}, + "/v1/default/Pod/fake-pod-42-4f5wr": {}, + "/v1/default/Pod/fake-pod-42-4gcln": {}, + "/v1/default/Pod/fake-pod-42-4hmx8": {}, + "/v1/default/Pod/fake-pod-42-4kd99": {}, + "/v1/default/Pod/fake-pod-42-4kgr4": {}, + "/v1/default/Pod/fake-pod-42-4qdb9": {}, + "/v1/default/Pod/fake-pod-42-4qx5x": {}, + "/v1/default/Pod/fake-pod-42-525hr": {}, + "/v1/default/Pod/fake-pod-42-5j8m6": {}, + "/v1/default/Pod/fake-pod-42-5mh85": {}, + "/v1/default/Pod/fake-pod-42-5mxnz": {}, + "/v1/default/Pod/fake-pod-42-5nrbv": {}, + "/v1/default/Pod/fake-pod-42-5tdrn": {}, + "/v1/default/Pod/fake-pod-42-5vdh2": {}, + "/v1/default/Pod/fake-pod-42-5vgt7": {}, + "/v1/default/Pod/fake-pod-42-5vsnp": {}, + "/v1/default/Pod/fake-pod-42-5vvhz": {}, + "/v1/default/Pod/fake-pod-42-5z858": {}, + "/v1/default/Pod/fake-pod-42-5zdnq": {}, + "/v1/default/Pod/fake-pod-42-66n9g": {}, + "/v1/default/Pod/fake-pod-42-679td": {}, + "/v1/default/Pod/fake-pod-42-69jsk": {}, + "/v1/default/Pod/fake-pod-42-6bs4k": {}, + "/v1/default/Pod/fake-pod-42-6cvvl": {}, + "/v1/default/Pod/fake-pod-42-6fbqd": {}, + "/v1/default/Pod/fake-pod-42-6fmtb": {}, + "/v1/default/Pod/fake-pod-42-6fv89": {}, + "/v1/default/Pod/fake-pod-42-6hbgz": {}, + "/v1/default/Pod/fake-pod-42-6ll4h": {}, + "/v1/default/Pod/fake-pod-42-6mbs5": {}, + "/v1/default/Pod/fake-pod-42-6nvjq": {}, + "/v1/default/Pod/fake-pod-42-6rz9h": {}, + "/v1/default/Pod/fake-pod-42-79fd2": {}, + "/v1/default/Pod/fake-pod-42-7dvfl": {}, + "/v1/default/Pod/fake-pod-42-7jr8m": {}, + "/v1/default/Pod/fake-pod-42-7nfdw": {}, + "/v1/default/Pod/fake-pod-42-7pwkw": {}, + "/v1/default/Pod/fake-pod-42-7qgcg": {}, + "/v1/default/Pod/fake-pod-42-7rkzk": {}, + "/v1/default/Pod/fake-pod-42-7x7fz": {}, + "/v1/default/Pod/fake-pod-42-7zb5h": {}, + "/v1/default/Pod/fake-pod-42-8255c": {}, + "/v1/default/Pod/fake-pod-42-82sdz": {}, + "/v1/default/Pod/fake-pod-42-85xmn": {}, + "/v1/default/Pod/fake-pod-42-86qhs": {}, + "/v1/default/Pod/fake-pod-42-8khf6": {}, + "/v1/default/Pod/fake-pod-42-8qvxr": {}, + "/v1/default/Pod/fake-pod-42-8rr6r": {}, + "/v1/default/Pod/fake-pod-42-8ts6v": {}, + "/v1/default/Pod/fake-pod-42-8vv2t": {}, + "/v1/default/Pod/fake-pod-42-8wnkm": {}, + "/v1/default/Pod/fake-pod-42-8xrww": {}, + "/v1/default/Pod/fake-pod-42-944nm": {}, + "/v1/default/Pod/fake-pod-42-96bd4": {}, + "/v1/default/Pod/fake-pod-42-9725p": {}, + "/v1/default/Pod/fake-pod-42-9bsrq": {}, + "/v1/default/Pod/fake-pod-42-9cd8c": {}, + "/v1/default/Pod/fake-pod-42-9cw4p": {}, + "/v1/default/Pod/fake-pod-42-9hrdq": {}, + "/v1/default/Pod/fake-pod-42-9hw5b": {}, + "/v1/default/Pod/fake-pod-42-9jwkk": {}, + "/v1/default/Pod/fake-pod-42-9qlpx": {}, + "/v1/default/Pod/fake-pod-42-9rlw6": {}, + "/v1/default/Pod/fake-pod-42-9sg9z": {}, + "/v1/default/Pod/fake-pod-42-9zlqb": {}, + "/v1/default/Pod/fake-pod-42-b2nc7": {}, + "/v1/default/Pod/fake-pod-42-b4nhw": {}, + "/v1/default/Pod/fake-pod-42-b52pb": {}, + "/v1/default/Pod/fake-pod-42-b6274": {}, + "/v1/default/Pod/fake-pod-42-b66k8": {}, + "/v1/default/Pod/fake-pod-42-b7pvt": {}, + "/v1/default/Pod/fake-pod-42-b8q6w": {}, + "/v1/default/Pod/fake-pod-42-b92cl": {}, + "/v1/default/Pod/fake-pod-42-bhs8b": {}, + "/v1/default/Pod/fake-pod-42-bkjgd": {}, + "/v1/default/Pod/fake-pod-42-bnpmh": {}, + "/v1/default/Pod/fake-pod-42-bt2q4": {}, + "/v1/default/Pod/fake-pod-42-bt9tx": {}, + "/v1/default/Pod/fake-pod-42-bvxdn": {}, + "/v1/default/Pod/fake-pod-42-c6ntf": {}, + "/v1/default/Pod/fake-pod-42-c6skh": {}, + "/v1/default/Pod/fake-pod-42-cfljm": {}, + "/v1/default/Pod/fake-pod-42-cg5sv": {}, + "/v1/default/Pod/fake-pod-42-chh4c": {}, + "/v1/default/Pod/fake-pod-42-cj5x7": {}, + "/v1/default/Pod/fake-pod-42-cjvgd": {}, + "/v1/default/Pod/fake-pod-42-ck57g": {}, + "/v1/default/Pod/fake-pod-42-cmk5c": {}, + "/v1/default/Pod/fake-pod-42-cvz54": {}, + "/v1/default/Pod/fake-pod-42-cwj8w": {}, + "/v1/default/Pod/fake-pod-42-cww6v": {}, + "/v1/default/Pod/fake-pod-42-d782l": {}, + "/v1/default/Pod/fake-pod-42-d7q98": {}, + "/v1/default/Pod/fake-pod-42-d9t47": {}, + "/v1/default/Pod/fake-pod-42-dgqb8": {}, + "/v1/default/Pod/fake-pod-42-dkxfh": {}, + "/v1/default/Pod/fake-pod-42-dn5w7": {}, + "/v1/default/Pod/fake-pod-42-dnw9b": {}, + "/v1/default/Pod/fake-pod-42-dqbr2": {}, + "/v1/default/Pod/fake-pod-42-dtx9x": {}, + "/v1/default/Pod/fake-pod-42-dvfrp": {}, + "/v1/default/Pod/fake-pod-42-dvg5q": {}, + "/v1/default/Pod/fake-pod-42-dwm5b": {}, + "/v1/default/Pod/fake-pod-42-f4444": {}, + "/v1/default/Pod/fake-pod-42-f489t": {}, + "/v1/default/Pod/fake-pod-42-f4ct8": {}, + "/v1/default/Pod/fake-pod-42-f79tf": {}, + "/v1/default/Pod/fake-pod-42-fhbv5": {}, + "/v1/default/Pod/fake-pod-42-fk27j": {}, + "/v1/default/Pod/fake-pod-42-fl5mx": {}, + "/v1/default/Pod/fake-pod-42-ftv65": {}, + "/v1/default/Pod/fake-pod-42-g7mrz": {}, + "/v1/default/Pod/fake-pod-42-gl799": {}, + "/v1/default/Pod/fake-pod-42-glh2n": {}, + "/v1/default/Pod/fake-pod-42-gmlvc": {}, + "/v1/default/Pod/fake-pod-42-gmzq6": {}, + "/v1/default/Pod/fake-pod-42-gpnrn": {}, + "/v1/default/Pod/fake-pod-42-gvk6c": {}, + "/v1/default/Pod/fake-pod-42-gwglb": {}, + "/v1/default/Pod/fake-pod-42-gx4zt": {}, + "/v1/default/Pod/fake-pod-42-gz2fv": {}, + "/v1/default/Pod/fake-pod-42-h4wx7": {}, + "/v1/default/Pod/fake-pod-42-h56sd": {}, + "/v1/default/Pod/fake-pod-42-hb8cs": {}, + "/v1/default/Pod/fake-pod-42-hbcxv": {}, + "/v1/default/Pod/fake-pod-42-hckgb": {}, + "/v1/default/Pod/fake-pod-42-hf9pz": {}, + "/v1/default/Pod/fake-pod-42-hfq4s": {}, + "/v1/default/Pod/fake-pod-42-hgj59": {}, + "/v1/default/Pod/fake-pod-42-hl8jg": {}, + "/v1/default/Pod/fake-pod-42-hn2mq": {}, + "/v1/default/Pod/fake-pod-42-hr9g5": {}, + "/v1/default/Pod/fake-pod-42-htswk": {}, + "/v1/default/Pod/fake-pod-42-hv4qj": {}, + "/v1/default/Pod/fake-pod-42-hxzjb": {}, + "/v1/default/Pod/fake-pod-42-j6zjf": {}, + "/v1/default/Pod/fake-pod-42-j6zqj": {}, + "/v1/default/Pod/fake-pod-42-j84fz": {}, + "/v1/default/Pod/fake-pod-42-j8jvb": {}, + "/v1/default/Pod/fake-pod-42-jcczp": {}, + "/v1/default/Pod/fake-pod-42-jdp89": {}, + "/v1/default/Pod/fake-pod-42-jfw75": {}, + "/v1/default/Pod/fake-pod-42-jhvl7": {}, + "/v1/default/Pod/fake-pod-42-jhvz7": {}, + "/v1/default/Pod/fake-pod-42-jldsn": {}, + "/v1/default/Pod/fake-pod-42-jtdlr": {}, + "/v1/default/Pod/fake-pod-42-jtl68": {}, + "/v1/default/Pod/fake-pod-42-k8c7t": {}, + "/v1/default/Pod/fake-pod-42-k9dnb": {}, + "/v1/default/Pod/fake-pod-42-kbv66": {}, + "/v1/default/Pod/fake-pod-42-kcrvz": {}, + "/v1/default/Pod/fake-pod-42-khfk5": {}, + "/v1/default/Pod/fake-pod-42-kpn57": {}, + "/v1/default/Pod/fake-pod-42-krss6": {}, + "/v1/default/Pod/fake-pod-42-l2qp5": {}, + "/v1/default/Pod/fake-pod-42-l5sq5": {}, + "/v1/default/Pod/fake-pod-42-l77qn": {}, + "/v1/default/Pod/fake-pod-42-l7bj2": {}, + "/v1/default/Pod/fake-pod-42-l9zr9": {}, + "/v1/default/Pod/fake-pod-42-lclx6": {}, + "/v1/default/Pod/fake-pod-42-lf2cs": {}, + "/v1/default/Pod/fake-pod-42-lg2hh": {}, + "/v1/default/Pod/fake-pod-42-lgnbs": {}, + "/v1/default/Pod/fake-pod-42-lw77t": {}, + "/v1/default/Pod/fake-pod-42-lwxd5": {}, + "/v1/default/Pod/fake-pod-42-lxx8n": {}, + "/v1/default/Pod/fake-pod-42-m47th": {}, + "/v1/default/Pod/fake-pod-42-m62dc": {}, + "/v1/default/Pod/fake-pod-42-m657j": {}, + "/v1/default/Pod/fake-pod-42-m94px": {}, + "/v1/default/Pod/fake-pod-42-m9qwp": {}, + "/v1/default/Pod/fake-pod-42-mb564": {}, + "/v1/default/Pod/fake-pod-42-mf56g": {}, + "/v1/default/Pod/fake-pod-42-mmns7": {}, + "/v1/default/Pod/fake-pod-42-mvw4g": {}, + "/v1/default/Pod/fake-pod-42-mxhwd": {}, + "/v1/default/Pod/fake-pod-42-n99kw": {}, + "/v1/default/Pod/fake-pod-42-ncpj7": {}, + "/v1/default/Pod/fake-pod-42-p7hbh": {}, + "/v1/default/Pod/fake-pod-42-pcgzd": {}, + "/v1/default/Pod/fake-pod-42-pdzkb": {}, + "/v1/default/Pod/fake-pod-42-pkwln": {}, + "/v1/default/Pod/fake-pod-42-pmzpx": {}, + "/v1/default/Pod/fake-pod-42-pnqns": {}, + "/v1/default/Pod/fake-pod-42-prs2t": {}, + "/v1/default/Pod/fake-pod-42-ptjfv": {}, + "/v1/default/Pod/fake-pod-42-ptzgx": {}, + "/v1/default/Pod/fake-pod-42-pzgh6": {}, + "/v1/default/Pod/fake-pod-42-q2spr": {}, + "/v1/default/Pod/fake-pod-42-q8vbt": {}, + "/v1/default/Pod/fake-pod-42-qh4gc": {}, + "/v1/default/Pod/fake-pod-42-qhpzz": {}, + "/v1/default/Pod/fake-pod-42-qjdl5": {}, + "/v1/default/Pod/fake-pod-42-qkqk7": {}, + "/v1/default/Pod/fake-pod-42-qm92v": {}, + "/v1/default/Pod/fake-pod-42-qq7nh": {}, + "/v1/default/Pod/fake-pod-42-qrcvk": {}, + "/v1/default/Pod/fake-pod-42-qrfjv": {}, + "/v1/default/Pod/fake-pod-42-qs5vv": {}, + "/v1/default/Pod/fake-pod-42-qxtxt": {}, + "/v1/default/Pod/fake-pod-42-r4ckd": {}, + "/v1/default/Pod/fake-pod-42-r8nkw": {}, + "/v1/default/Pod/fake-pod-42-r8nvm": {}, + "/v1/default/Pod/fake-pod-42-r9c4w": {}, + "/v1/default/Pod/fake-pod-42-rn9dd": {}, + "/v1/default/Pod/fake-pod-42-rnb9l": {}, + "/v1/default/Pod/fake-pod-42-rngt7": {}, + "/v1/default/Pod/fake-pod-42-rqjk9": {}, + "/v1/default/Pod/fake-pod-42-rt7mr": {}, + "/v1/default/Pod/fake-pod-42-rw79x": {}, + "/v1/default/Pod/fake-pod-42-s2tbb": {}, + "/v1/default/Pod/fake-pod-42-s2xm8": {}, + "/v1/default/Pod/fake-pod-42-s4cff": {}, + "/v1/default/Pod/fake-pod-42-sbn2v": {}, + "/v1/default/Pod/fake-pod-42-sdm9q": {}, + "/v1/default/Pod/fake-pod-42-sgsdz": {}, + "/v1/default/Pod/fake-pod-42-sh22v": {}, + "/v1/default/Pod/fake-pod-42-sh4b2": {}, + "/v1/default/Pod/fake-pod-42-svkwd": {}, + "/v1/default/Pod/fake-pod-42-t5rjx": {}, + "/v1/default/Pod/fake-pod-42-tcfgr": {}, + "/v1/default/Pod/fake-pod-42-tdwfz": {}, + "/v1/default/Pod/fake-pod-42-tjgx2": {}, + "/v1/default/Pod/fake-pod-42-tl25m": {}, + "/v1/default/Pod/fake-pod-42-tl2kb": {}, + "/v1/default/Pod/fake-pod-42-tlq96": {}, + "/v1/default/Pod/fake-pod-42-tmxdq": {}, + "/v1/default/Pod/fake-pod-42-twgm7": {}, + "/v1/default/Pod/fake-pod-42-v5s7g": {}, + "/v1/default/Pod/fake-pod-42-vbgz6": {}, + "/v1/default/Pod/fake-pod-42-vc5p2": {}, + "/v1/default/Pod/fake-pod-42-vc7mf": {}, + "/v1/default/Pod/fake-pod-42-vc847": {}, + "/v1/default/Pod/fake-pod-42-vfbzw": {}, + "/v1/default/Pod/fake-pod-42-vgfld": {}, + "/v1/default/Pod/fake-pod-42-vjdhk": {}, + "/v1/default/Pod/fake-pod-42-vjr4p": {}, + "/v1/default/Pod/fake-pod-42-vkv7r": {}, + "/v1/default/Pod/fake-pod-42-vnjjw": {}, + "/v1/default/Pod/fake-pod-42-vth5j": {}, + "/v1/default/Pod/fake-pod-42-vvr9m": {}, + "/v1/default/Pod/fake-pod-42-w44fr": {}, + "/v1/default/Pod/fake-pod-42-w49xp": {}, + "/v1/default/Pod/fake-pod-42-w4pkm": {}, + "/v1/default/Pod/fake-pod-42-w7vth": {}, + "/v1/default/Pod/fake-pod-42-w7vw4": {}, + "/v1/default/Pod/fake-pod-42-wb4ws": {}, + "/v1/default/Pod/fake-pod-42-wbmhl": {}, + "/v1/default/Pod/fake-pod-42-wd6wg": {}, + "/v1/default/Pod/fake-pod-42-wgkp6": {}, + "/v1/default/Pod/fake-pod-42-wj2mp": {}, + "/v1/default/Pod/fake-pod-42-wk6st": {}, + "/v1/default/Pod/fake-pod-42-wm5xq": {}, + "/v1/default/Pod/fake-pod-42-wq8zn": {}, + "/v1/default/Pod/fake-pod-42-ws8qs": {}, + "/v1/default/Pod/fake-pod-42-wss4h": {}, + "/v1/default/Pod/fake-pod-42-wt2zd": {}, + "/v1/default/Pod/fake-pod-42-wtwtq": {}, + "/v1/default/Pod/fake-pod-42-x7976": {}, + "/v1/default/Pod/fake-pod-42-x79cq": {}, + "/v1/default/Pod/fake-pod-42-xdpx6": {}, + "/v1/default/Pod/fake-pod-42-xl8n7": {}, + "/v1/default/Pod/fake-pod-42-xm7vl": {}, + "/v1/default/Pod/fake-pod-42-xqszv": {}, + "/v1/default/Pod/fake-pod-42-xsbsm": {}, + "/v1/default/Pod/fake-pod-42-xskjz": {}, + "/v1/default/Pod/fake-pod-42-xx4jv": {}, + "/v1/default/Pod/fake-pod-42-z2blj": {}, + "/v1/default/Pod/fake-pod-42-z2d4k": {}, + "/v1/default/Pod/fake-pod-42-z7h8p": {}, + "/v1/default/Pod/fake-pod-42-z8jbl": {}, + "/v1/default/Pod/fake-pod-42-zf5j4": {}, + "/v1/default/Pod/fake-pod-42-zf5tc": {}, + "/v1/default/Pod/fake-pod-42-zh2lk": {}, + "/v1/default/Pod/fake-pod-42-zjcqr": {}, + "/v1/default/Pod/fake-pod-42-zjxgx": {}, + "/v1/default/Pod/fake-pod-42-zq7dt": {}, + "/v1/default/Pod/fake-pod-42-zqkpw": {}, + "/v1/default/Pod/fake-pod-42-zrxkn": {}, + "/v1/default/Pod/fake-pod-42-zvsvg": {}, + "/v1/default/Pod/fake-pod-42-zvz5w": {}, + "/v1/default/Pod/fake-pod-42-zzqft": {}, + "/v1/default/Pod/fake-pod-43-22j8h": {}, + "/v1/default/Pod/fake-pod-43-25g6b": {}, + "/v1/default/Pod/fake-pod-43-26h5h": {}, + "/v1/default/Pod/fake-pod-43-29fj2": {}, + "/v1/default/Pod/fake-pod-43-2cc67": {}, + "/v1/default/Pod/fake-pod-43-2lj7c": {}, + "/v1/default/Pod/fake-pod-43-2m5zt": {}, + "/v1/default/Pod/fake-pod-43-2rrgl": {}, + "/v1/default/Pod/fake-pod-43-2zhmc": {}, + "/v1/default/Pod/fake-pod-43-2zqxw": {}, + "/v1/default/Pod/fake-pod-43-422zt": {}, + "/v1/default/Pod/fake-pod-43-45hgt": {}, + "/v1/default/Pod/fake-pod-43-47dst": {}, + "/v1/default/Pod/fake-pod-43-48kb5": {}, + "/v1/default/Pod/fake-pod-43-48m2n": {}, + "/v1/default/Pod/fake-pod-43-49k5c": {}, + "/v1/default/Pod/fake-pod-43-4b2gs": {}, + "/v1/default/Pod/fake-pod-43-4fnr2": {}, + "/v1/default/Pod/fake-pod-43-4shtt": {}, + "/v1/default/Pod/fake-pod-43-4wqsd": {}, + "/v1/default/Pod/fake-pod-43-54ncq": {}, + "/v1/default/Pod/fake-pod-43-56mt2": {}, + "/v1/default/Pod/fake-pod-43-56n87": {}, + "/v1/default/Pod/fake-pod-43-59m6c": {}, + "/v1/default/Pod/fake-pod-43-5cqh2": {}, + "/v1/default/Pod/fake-pod-43-5ghgj": {}, + "/v1/default/Pod/fake-pod-43-5n79m": {}, + "/v1/default/Pod/fake-pod-43-5pf4j": {}, + "/v1/default/Pod/fake-pod-43-5pqc7": {}, + "/v1/default/Pod/fake-pod-43-5t29p": {}, + "/v1/default/Pod/fake-pod-43-5x4zl": {}, + "/v1/default/Pod/fake-pod-43-6ckj6": {}, + "/v1/default/Pod/fake-pod-43-6jmvj": {}, + "/v1/default/Pod/fake-pod-43-6m6vq": {}, + "/v1/default/Pod/fake-pod-43-6nltd": {}, + "/v1/default/Pod/fake-pod-43-6p2fn": {}, + "/v1/default/Pod/fake-pod-43-6pkt7": {}, + "/v1/default/Pod/fake-pod-43-6rb5v": {}, + "/v1/default/Pod/fake-pod-43-6rfqr": {}, + "/v1/default/Pod/fake-pod-43-6v5hd": {}, + "/v1/default/Pod/fake-pod-43-6vl6f": {}, + "/v1/default/Pod/fake-pod-43-6wgzb": {}, + "/v1/default/Pod/fake-pod-43-74vms": {}, + "/v1/default/Pod/fake-pod-43-7552s": {}, + "/v1/default/Pod/fake-pod-43-76xcw": {}, + "/v1/default/Pod/fake-pod-43-78x92": {}, + "/v1/default/Pod/fake-pod-43-7bdlz": {}, + "/v1/default/Pod/fake-pod-43-7c4w6": {}, + "/v1/default/Pod/fake-pod-43-7czsf": {}, + "/v1/default/Pod/fake-pod-43-7hdp4": {}, + "/v1/default/Pod/fake-pod-43-7kvr9": {}, + "/v1/default/Pod/fake-pod-43-7pzpw": {}, + "/v1/default/Pod/fake-pod-43-7sbkw": {}, + "/v1/default/Pod/fake-pod-43-7spxk": {}, + "/v1/default/Pod/fake-pod-43-7xhsh": {}, + "/v1/default/Pod/fake-pod-43-89jlc": {}, + "/v1/default/Pod/fake-pod-43-8bxcd": {}, + "/v1/default/Pod/fake-pod-43-8gdpl": {}, + "/v1/default/Pod/fake-pod-43-8gk8s": {}, + "/v1/default/Pod/fake-pod-43-8jg42": {}, + "/v1/default/Pod/fake-pod-43-8lrv7": {}, + "/v1/default/Pod/fake-pod-43-8q7hs": {}, + "/v1/default/Pod/fake-pod-43-8z22t": {}, + "/v1/default/Pod/fake-pod-43-92kjz": {}, + "/v1/default/Pod/fake-pod-43-98f4l": {}, + "/v1/default/Pod/fake-pod-43-9bmsv": {}, + "/v1/default/Pod/fake-pod-43-9c8zg": {}, + "/v1/default/Pod/fake-pod-43-9dl8r": {}, + "/v1/default/Pod/fake-pod-43-9k9j7": {}, + "/v1/default/Pod/fake-pod-43-9lskq": {}, + "/v1/default/Pod/fake-pod-43-9pwjf": {}, + "/v1/default/Pod/fake-pod-43-9vkn6": {}, + "/v1/default/Pod/fake-pod-43-9wkpf": {}, + "/v1/default/Pod/fake-pod-43-9x5ps": {}, + "/v1/default/Pod/fake-pod-43-b82tw": {}, + "/v1/default/Pod/fake-pod-43-b9pks": {}, + "/v1/default/Pod/fake-pod-43-bcdpx": {}, + "/v1/default/Pod/fake-pod-43-bcmgv": {}, + "/v1/default/Pod/fake-pod-43-bdk2x": {}, + "/v1/default/Pod/fake-pod-43-bft8g": {}, + "/v1/default/Pod/fake-pod-43-bgmtk": {}, + "/v1/default/Pod/fake-pod-43-bh44p": {}, + "/v1/default/Pod/fake-pod-43-bh6vw": {}, + "/v1/default/Pod/fake-pod-43-bl45q": {}, + "/v1/default/Pod/fake-pod-43-bm8s5": {}, + "/v1/default/Pod/fake-pod-43-bqhd2": {}, + "/v1/default/Pod/fake-pod-43-brph4": {}, + "/v1/default/Pod/fake-pod-43-bs2qq": {}, + "/v1/default/Pod/fake-pod-43-btcz2": {}, + "/v1/default/Pod/fake-pod-43-bx8dx": {}, + "/v1/default/Pod/fake-pod-43-bz2xr": {}, + "/v1/default/Pod/fake-pod-43-bzd75": {}, + "/v1/default/Pod/fake-pod-43-c4pd7": {}, + "/v1/default/Pod/fake-pod-43-c567k": {}, + "/v1/default/Pod/fake-pod-43-c5xsd": {}, + "/v1/default/Pod/fake-pod-43-c88sd": {}, + "/v1/default/Pod/fake-pod-43-c8mbd": {}, + "/v1/default/Pod/fake-pod-43-cfm78": {}, + "/v1/default/Pod/fake-pod-43-cgm7c": {}, + "/v1/default/Pod/fake-pod-43-ck8zl": {}, + "/v1/default/Pod/fake-pod-43-clgpg": {}, + "/v1/default/Pod/fake-pod-43-cmjlj": {}, + "/v1/default/Pod/fake-pod-43-cqw27": {}, + "/v1/default/Pod/fake-pod-43-cvhd6": {}, + "/v1/default/Pod/fake-pod-43-cwm5z": {}, + "/v1/default/Pod/fake-pod-43-d44cl": {}, + "/v1/default/Pod/fake-pod-43-d5j7l": {}, + "/v1/default/Pod/fake-pod-43-d7cq9": {}, + "/v1/default/Pod/fake-pod-43-dbf2s": {}, + "/v1/default/Pod/fake-pod-43-dc7mg": {}, + "/v1/default/Pod/fake-pod-43-dchp5": {}, + "/v1/default/Pod/fake-pod-43-dctq7": {}, + "/v1/default/Pod/fake-pod-43-dcvt2": {}, + "/v1/default/Pod/fake-pod-43-dr7cz": {}, + "/v1/default/Pod/fake-pod-43-drqlr": {}, + "/v1/default/Pod/fake-pod-43-dvxh7": {}, + "/v1/default/Pod/fake-pod-43-dw2wk": {}, + "/v1/default/Pod/fake-pod-43-dx9rm": {}, + "/v1/default/Pod/fake-pod-43-dzdm7": {}, + "/v1/default/Pod/fake-pod-43-ffb2v": {}, + "/v1/default/Pod/fake-pod-43-ffwgt": {}, + "/v1/default/Pod/fake-pod-43-fgdfd": {}, + "/v1/default/Pod/fake-pod-43-flcfh": {}, + "/v1/default/Pod/fake-pod-43-fmh8v": {}, + "/v1/default/Pod/fake-pod-43-fqjc9": {}, + "/v1/default/Pod/fake-pod-43-ftm2t": {}, + "/v1/default/Pod/fake-pod-43-fzckj": {}, + "/v1/default/Pod/fake-pod-43-g9qcx": {}, + "/v1/default/Pod/fake-pod-43-gb9sf": {}, + "/v1/default/Pod/fake-pod-43-gcvrx": {}, + "/v1/default/Pod/fake-pod-43-gcxd4": {}, + "/v1/default/Pod/fake-pod-43-gd5fw": {}, + "/v1/default/Pod/fake-pod-43-gf4q9": {}, + "/v1/default/Pod/fake-pod-43-ghbbz": {}, + "/v1/default/Pod/fake-pod-43-gj9k7": {}, + "/v1/default/Pod/fake-pod-43-glrs8": {}, + "/v1/default/Pod/fake-pod-43-gmrlb": {}, + "/v1/default/Pod/fake-pod-43-gx2g9": {}, + "/v1/default/Pod/fake-pod-43-gxvqq": {}, + "/v1/default/Pod/fake-pod-43-hctt4": {}, + "/v1/default/Pod/fake-pod-43-hj2sk": {}, + "/v1/default/Pod/fake-pod-43-hm2jw": {}, + "/v1/default/Pod/fake-pod-43-hmf6j": {}, + "/v1/default/Pod/fake-pod-43-hs74d": {}, + "/v1/default/Pod/fake-pod-43-ht589": {}, + "/v1/default/Pod/fake-pod-43-hzl9m": {}, + "/v1/default/Pod/fake-pod-43-j4sw6": {}, + "/v1/default/Pod/fake-pod-43-j4wnq": {}, + "/v1/default/Pod/fake-pod-43-jbh6d": {}, + "/v1/default/Pod/fake-pod-43-jcd5w": {}, + "/v1/default/Pod/fake-pod-43-jg22b": {}, + "/v1/default/Pod/fake-pod-43-jggvb": {}, + "/v1/default/Pod/fake-pod-43-jnws6": {}, + "/v1/default/Pod/fake-pod-43-jp5cj": {}, + "/v1/default/Pod/fake-pod-43-jppjx": {}, + "/v1/default/Pod/fake-pod-43-jvpq6": {}, + "/v1/default/Pod/fake-pod-43-k97l9": {}, + "/v1/default/Pod/fake-pod-43-kbqm9": {}, + "/v1/default/Pod/fake-pod-43-kcknr": {}, + "/v1/default/Pod/fake-pod-43-kh87k": {}, + "/v1/default/Pod/fake-pod-43-km2tt": {}, + "/v1/default/Pod/fake-pod-43-knmb5": {}, + "/v1/default/Pod/fake-pod-43-kq7nq": {}, + "/v1/default/Pod/fake-pod-43-krrl6": {}, + "/v1/default/Pod/fake-pod-43-kttqd": {}, + "/v1/default/Pod/fake-pod-43-kvww9": {}, + "/v1/default/Pod/fake-pod-43-kz5js": {}, + "/v1/default/Pod/fake-pod-43-l26bw": {}, + "/v1/default/Pod/fake-pod-43-l4l6r": {}, + "/v1/default/Pod/fake-pod-43-l8vhn": {}, + "/v1/default/Pod/fake-pod-43-ldb74": {}, + "/v1/default/Pod/fake-pod-43-lf2qs": {}, + "/v1/default/Pod/fake-pod-43-lmmkg": {}, + "/v1/default/Pod/fake-pod-43-lnmvf": {}, + "/v1/default/Pod/fake-pod-43-lnv74": {}, + "/v1/default/Pod/fake-pod-43-lpf6d": {}, + "/v1/default/Pod/fake-pod-43-lrk2h": {}, + "/v1/default/Pod/fake-pod-43-lrnmn": {}, + "/v1/default/Pod/fake-pod-43-ltzhx": {}, + "/v1/default/Pod/fake-pod-43-lvj4n": {}, + "/v1/default/Pod/fake-pod-43-lvjdp": {}, + "/v1/default/Pod/fake-pod-43-lwj7j": {}, + "/v1/default/Pod/fake-pod-43-lzznj": {}, + "/v1/default/Pod/fake-pod-43-m27d7": {}, + "/v1/default/Pod/fake-pod-43-m2bpl": {}, + "/v1/default/Pod/fake-pod-43-m2h54": {}, + "/v1/default/Pod/fake-pod-43-mf28p": {}, + "/v1/default/Pod/fake-pod-43-mhrm4": {}, + "/v1/default/Pod/fake-pod-43-mtvbl": {}, + "/v1/default/Pod/fake-pod-43-mwbhq": {}, + "/v1/default/Pod/fake-pod-43-mx76l": {}, + "/v1/default/Pod/fake-pod-43-n5gfb": {}, + "/v1/default/Pod/fake-pod-43-n67vd": {}, + "/v1/default/Pod/fake-pod-43-n8tng": {}, + "/v1/default/Pod/fake-pod-43-n976x": {}, + "/v1/default/Pod/fake-pod-43-nc7pp": {}, + "/v1/default/Pod/fake-pod-43-ndsc8": {}, + "/v1/default/Pod/fake-pod-43-ns7t7": {}, + "/v1/default/Pod/fake-pod-43-nv562": {}, + "/v1/default/Pod/fake-pod-43-p6tvk": {}, + "/v1/default/Pod/fake-pod-43-p7tbw": {}, + "/v1/default/Pod/fake-pod-43-p8jdt": {}, + "/v1/default/Pod/fake-pod-43-p8n7z": {}, + "/v1/default/Pod/fake-pod-43-pdn88": {}, + "/v1/default/Pod/fake-pod-43-phtw6": {}, + "/v1/default/Pod/fake-pod-43-pk9nk": {}, + "/v1/default/Pod/fake-pod-43-pmskr": {}, + "/v1/default/Pod/fake-pod-43-pnqkh": {}, + "/v1/default/Pod/fake-pod-43-pr2w9": {}, + "/v1/default/Pod/fake-pod-43-q7vz6": {}, + "/v1/default/Pod/fake-pod-43-q7z56": {}, + "/v1/default/Pod/fake-pod-43-qj2mv": {}, + "/v1/default/Pod/fake-pod-43-qj7tb": {}, + "/v1/default/Pod/fake-pod-43-qktfx": {}, + "/v1/default/Pod/fake-pod-43-qlsnj": {}, + "/v1/default/Pod/fake-pod-43-r4b7q": {}, + "/v1/default/Pod/fake-pod-43-r4jrp": {}, + "/v1/default/Pod/fake-pod-43-r5zc4": {}, + "/v1/default/Pod/fake-pod-43-rcchr": {}, + "/v1/default/Pod/fake-pod-43-rdpjt": {}, + "/v1/default/Pod/fake-pod-43-rgr8s": {}, + "/v1/default/Pod/fake-pod-43-rm2hn": {}, + "/v1/default/Pod/fake-pod-43-rn4wd": {}, + "/v1/default/Pod/fake-pod-43-rnlr6": {}, + "/v1/default/Pod/fake-pod-43-s2lkk": {}, + "/v1/default/Pod/fake-pod-43-s4v9n": {}, + "/v1/default/Pod/fake-pod-43-s62w2": {}, + "/v1/default/Pod/fake-pod-43-s7jqd": {}, + "/v1/default/Pod/fake-pod-43-s8dxt": {}, + "/v1/default/Pod/fake-pod-43-s8whn": {}, + "/v1/default/Pod/fake-pod-43-s97wv": {}, + "/v1/default/Pod/fake-pod-43-scvrs": {}, + "/v1/default/Pod/fake-pod-43-sfhxb": {}, + "/v1/default/Pod/fake-pod-43-sftp7": {}, + "/v1/default/Pod/fake-pod-43-shw59": {}, + "/v1/default/Pod/fake-pod-43-shwtf": {}, + "/v1/default/Pod/fake-pod-43-sk5dm": {}, + "/v1/default/Pod/fake-pod-43-skfx5": {}, + "/v1/default/Pod/fake-pod-43-smfjd": {}, + "/v1/default/Pod/fake-pod-43-spsp4": {}, + "/v1/default/Pod/fake-pod-43-sq4s9": {}, + "/v1/default/Pod/fake-pod-43-src8k": {}, + "/v1/default/Pod/fake-pod-43-sx82q": {}, + "/v1/default/Pod/fake-pod-43-t7tkq": {}, + "/v1/default/Pod/fake-pod-43-t7wdb": {}, + "/v1/default/Pod/fake-pod-43-tfdqq": {}, + "/v1/default/Pod/fake-pod-43-tfzzv": {}, + "/v1/default/Pod/fake-pod-43-tgd2z": {}, + "/v1/default/Pod/fake-pod-43-tj2gv": {}, + "/v1/default/Pod/fake-pod-43-tj98t": {}, + "/v1/default/Pod/fake-pod-43-tlksr": {}, + "/v1/default/Pod/fake-pod-43-trzf5": {}, + "/v1/default/Pod/fake-pod-43-tv726": {}, + "/v1/default/Pod/fake-pod-43-txzj9": {}, + "/v1/default/Pod/fake-pod-43-v7kd5": {}, + "/v1/default/Pod/fake-pod-43-vd54g": {}, + "/v1/default/Pod/fake-pod-43-vdxv7": {}, + "/v1/default/Pod/fake-pod-43-vg5wk": {}, + "/v1/default/Pod/fake-pod-43-vg7m2": {}, + "/v1/default/Pod/fake-pod-43-vhgl7": {}, + "/v1/default/Pod/fake-pod-43-vm5p4": {}, + "/v1/default/Pod/fake-pod-43-vqdpl": {}, + "/v1/default/Pod/fake-pod-43-vxlzs": {}, + "/v1/default/Pod/fake-pod-43-wbgtx": {}, + "/v1/default/Pod/fake-pod-43-wc5wh": {}, + "/v1/default/Pod/fake-pod-43-wcqbt": {}, + "/v1/default/Pod/fake-pod-43-wd6sx": {}, + "/v1/default/Pod/fake-pod-43-wfctg": {}, + "/v1/default/Pod/fake-pod-43-wfwws": {}, + "/v1/default/Pod/fake-pod-43-wjr6z": {}, + "/v1/default/Pod/fake-pod-43-wpkww": {}, + "/v1/default/Pod/fake-pod-43-wsfjw": {}, + "/v1/default/Pod/fake-pod-43-x2j2x": {}, + "/v1/default/Pod/fake-pod-43-x8swd": {}, + "/v1/default/Pod/fake-pod-43-xfg4m": {}, + "/v1/default/Pod/fake-pod-43-xfgfq": {}, + "/v1/default/Pod/fake-pod-43-xfjfq": {}, + "/v1/default/Pod/fake-pod-43-xg5j2": {}, + "/v1/default/Pod/fake-pod-43-xgq9s": {}, + "/v1/default/Pod/fake-pod-43-xj57h": {}, + "/v1/default/Pod/fake-pod-43-xjjk4": {}, + "/v1/default/Pod/fake-pod-43-xlcdg": {}, + "/v1/default/Pod/fake-pod-43-xlmbw": {}, + "/v1/default/Pod/fake-pod-43-xq4jv": {}, + "/v1/default/Pod/fake-pod-43-xtdfs": {}, + "/v1/default/Pod/fake-pod-43-xtljh": {}, + "/v1/default/Pod/fake-pod-43-xw5bd": {}, + "/v1/default/Pod/fake-pod-43-xwkp6": {}, + "/v1/default/Pod/fake-pod-43-z6d4n": {}, + "/v1/default/Pod/fake-pod-43-z6v6w": {}, + "/v1/default/Pod/fake-pod-43-z8nlf": {}, + "/v1/default/Pod/fake-pod-43-zb4b4": {}, + "/v1/default/Pod/fake-pod-43-zc54f": {}, + "/v1/default/Pod/fake-pod-43-zdbtj": {}, + "/v1/default/Pod/fake-pod-43-zdljh": {}, + "/v1/default/Pod/fake-pod-43-zghbv": {}, + "/v1/default/Pod/fake-pod-43-zwmnz": {}, + "/v1/default/Pod/fake-pod-43-zxkkh": {}, + "/v1/default/Pod/fake-pod-43-zzddr": {}, + "/v1/default/Pod/fake-pod-44-22fxq": {}, + "/v1/default/Pod/fake-pod-44-27qqd": {}, + "/v1/default/Pod/fake-pod-44-2cmtz": {}, + "/v1/default/Pod/fake-pod-44-2f97c": {}, + "/v1/default/Pod/fake-pod-44-2ggbb": {}, + "/v1/default/Pod/fake-pod-44-2ncpj": {}, + "/v1/default/Pod/fake-pod-44-2vkjz": {}, + "/v1/default/Pod/fake-pod-44-2z59g": {}, + "/v1/default/Pod/fake-pod-44-46qcz": {}, + "/v1/default/Pod/fake-pod-44-47mvt": {}, + "/v1/default/Pod/fake-pod-44-4czbb": {}, + "/v1/default/Pod/fake-pod-44-4gcgk": {}, + "/v1/default/Pod/fake-pod-44-4pjhx": {}, + "/v1/default/Pod/fake-pod-44-4qpgs": {}, + "/v1/default/Pod/fake-pod-44-4rwz7": {}, + "/v1/default/Pod/fake-pod-44-54qll": {}, + "/v1/default/Pod/fake-pod-44-55cp9": {}, + "/v1/default/Pod/fake-pod-44-55zmz": {}, + "/v1/default/Pod/fake-pod-44-56xgz": {}, + "/v1/default/Pod/fake-pod-44-59d78": {}, + "/v1/default/Pod/fake-pod-44-59hrv": {}, + "/v1/default/Pod/fake-pod-44-5fjw7": {}, + "/v1/default/Pod/fake-pod-44-5fsz8": {}, + "/v1/default/Pod/fake-pod-44-5kdlz": {}, + "/v1/default/Pod/fake-pod-44-5kfct": {}, + "/v1/default/Pod/fake-pod-44-5mbhd": {}, + "/v1/default/Pod/fake-pod-44-5mw29": {}, + "/v1/default/Pod/fake-pod-44-5nk8w": {}, + "/v1/default/Pod/fake-pod-44-5pmkl": {}, + "/v1/default/Pod/fake-pod-44-5rq5k": {}, + "/v1/default/Pod/fake-pod-44-5rxqc": {}, + "/v1/default/Pod/fake-pod-44-5xgs6": {}, + "/v1/default/Pod/fake-pod-44-5z492": {}, + "/v1/default/Pod/fake-pod-44-68rhm": {}, + "/v1/default/Pod/fake-pod-44-6bqdp": {}, + "/v1/default/Pod/fake-pod-44-6hqql": {}, + "/v1/default/Pod/fake-pod-44-6n7s2": {}, + "/v1/default/Pod/fake-pod-44-7292w": {}, + "/v1/default/Pod/fake-pod-44-72j22": {}, + "/v1/default/Pod/fake-pod-44-7bk5p": {}, + "/v1/default/Pod/fake-pod-44-7cnwl": {}, + "/v1/default/Pod/fake-pod-44-7kcxt": {}, + "/v1/default/Pod/fake-pod-44-7ns8k": {}, + "/v1/default/Pod/fake-pod-44-7t2vp": {}, + "/v1/default/Pod/fake-pod-44-7vsc6": {}, + "/v1/default/Pod/fake-pod-44-7z4br": {}, + "/v1/default/Pod/fake-pod-44-87dpl": {}, + "/v1/default/Pod/fake-pod-44-8jgq4": {}, + "/v1/default/Pod/fake-pod-44-8n7zq": {}, + "/v1/default/Pod/fake-pod-44-8ntj8": {}, + "/v1/default/Pod/fake-pod-44-8tls4": {}, + "/v1/default/Pod/fake-pod-44-8v455": {}, + "/v1/default/Pod/fake-pod-44-8vjs2": {}, + "/v1/default/Pod/fake-pod-44-95z9k": {}, + "/v1/default/Pod/fake-pod-44-972xb": {}, + "/v1/default/Pod/fake-pod-44-97j4g": {}, + "/v1/default/Pod/fake-pod-44-9b259": {}, + "/v1/default/Pod/fake-pod-44-9b962": {}, + "/v1/default/Pod/fake-pod-44-9bnst": {}, + "/v1/default/Pod/fake-pod-44-9dcwv": {}, + "/v1/default/Pod/fake-pod-44-9h24m": {}, + "/v1/default/Pod/fake-pod-44-9h6t4": {}, + "/v1/default/Pod/fake-pod-44-9kklv": {}, + "/v1/default/Pod/fake-pod-44-9mcgw": {}, + "/v1/default/Pod/fake-pod-44-9nxd5": {}, + "/v1/default/Pod/fake-pod-44-9p8f6": {}, + "/v1/default/Pod/fake-pod-44-b4ms8": {}, + "/v1/default/Pod/fake-pod-44-b5jgq": {}, + "/v1/default/Pod/fake-pod-44-b6mrm": {}, + "/v1/default/Pod/fake-pod-44-b9fp8": {}, + "/v1/default/Pod/fake-pod-44-b9hjq": {}, + "/v1/default/Pod/fake-pod-44-b9mb9": {}, + "/v1/default/Pod/fake-pod-44-bb2dv": {}, + "/v1/default/Pod/fake-pod-44-bb4kh": {}, + "/v1/default/Pod/fake-pod-44-bd4bz": {}, + "/v1/default/Pod/fake-pod-44-bfjp7": {}, + "/v1/default/Pod/fake-pod-44-bkr78": {}, + "/v1/default/Pod/fake-pod-44-bmwxr": {}, + "/v1/default/Pod/fake-pod-44-bpcj5": {}, + "/v1/default/Pod/fake-pod-44-bpnqm": {}, + "/v1/default/Pod/fake-pod-44-bqkqm": {}, + "/v1/default/Pod/fake-pod-44-bz75p": {}, + "/v1/default/Pod/fake-pod-44-bzb9k": {}, + "/v1/default/Pod/fake-pod-44-bzl46": {}, + "/v1/default/Pod/fake-pod-44-c4s98": {}, + "/v1/default/Pod/fake-pod-44-c5z6w": {}, + "/v1/default/Pod/fake-pod-44-c8n96": {}, + "/v1/default/Pod/fake-pod-44-cdptr": {}, + "/v1/default/Pod/fake-pod-44-cgfpg": {}, + "/v1/default/Pod/fake-pod-44-ck5nl": {}, + "/v1/default/Pod/fake-pod-44-ckjmk": {}, + "/v1/default/Pod/fake-pod-44-cknpf": {}, + "/v1/default/Pod/fake-pod-44-cmgrr": {}, + "/v1/default/Pod/fake-pod-44-cmv6v": {}, + "/v1/default/Pod/fake-pod-44-cn6m2": {}, + "/v1/default/Pod/fake-pod-44-cwtn6": {}, + "/v1/default/Pod/fake-pod-44-d662t": {}, + "/v1/default/Pod/fake-pod-44-dbfdt": {}, + "/v1/default/Pod/fake-pod-44-dg7j2": {}, + "/v1/default/Pod/fake-pod-44-dgf92": {}, + "/v1/default/Pod/fake-pod-44-djvhq": {}, + "/v1/default/Pod/fake-pod-44-dn9fb": {}, + "/v1/default/Pod/fake-pod-44-dpr56": {}, + "/v1/default/Pod/fake-pod-44-drzz6": {}, + "/v1/default/Pod/fake-pod-44-dtk94": {}, + "/v1/default/Pod/fake-pod-44-dxw6j": {}, + "/v1/default/Pod/fake-pod-44-f4rvj": {}, + "/v1/default/Pod/fake-pod-44-f6zn5": {}, + "/v1/default/Pod/fake-pod-44-f85bh": {}, + "/v1/default/Pod/fake-pod-44-f99b4": {}, + "/v1/default/Pod/fake-pod-44-fbn4h": {}, + "/v1/default/Pod/fake-pod-44-fbt7p": {}, + "/v1/default/Pod/fake-pod-44-fcb84": {}, + "/v1/default/Pod/fake-pod-44-fcp9b": {}, + "/v1/default/Pod/fake-pod-44-fd6mx": {}, + "/v1/default/Pod/fake-pod-44-fddzg": {}, + "/v1/default/Pod/fake-pod-44-ffn9n": {}, + "/v1/default/Pod/fake-pod-44-fh4dp": {}, + "/v1/default/Pod/fake-pod-44-fh8xd": {}, + "/v1/default/Pod/fake-pod-44-fhz7h": {}, + "/v1/default/Pod/fake-pod-44-fjdmx": {}, + "/v1/default/Pod/fake-pod-44-fjq2t": {}, + "/v1/default/Pod/fake-pod-44-fks2w": {}, + "/v1/default/Pod/fake-pod-44-fmvvq": {}, + "/v1/default/Pod/fake-pod-44-fmvzj": {}, + "/v1/default/Pod/fake-pod-44-fr5vp": {}, + "/v1/default/Pod/fake-pod-44-frh5h": {}, + "/v1/default/Pod/fake-pod-44-fsf2k": {}, + "/v1/default/Pod/fake-pod-44-fsv72": {}, + "/v1/default/Pod/fake-pod-44-fwbxw": {}, + "/v1/default/Pod/fake-pod-44-fz5sj": {}, + "/v1/default/Pod/fake-pod-44-g56rm": {}, + "/v1/default/Pod/fake-pod-44-g68tc": {}, + "/v1/default/Pod/fake-pod-44-g7g78": {}, + "/v1/default/Pod/fake-pod-44-gcjds": {}, + "/v1/default/Pod/fake-pod-44-gfbmf": {}, + "/v1/default/Pod/fake-pod-44-gg4zc": {}, + "/v1/default/Pod/fake-pod-44-ggthp": {}, + "/v1/default/Pod/fake-pod-44-gmbhr": {}, + "/v1/default/Pod/fake-pod-44-gp9m2": {}, + "/v1/default/Pod/fake-pod-44-gqqcf": {}, + "/v1/default/Pod/fake-pod-44-gzwwd": {}, + "/v1/default/Pod/fake-pod-44-h475c": {}, + "/v1/default/Pod/fake-pod-44-h4hjt": {}, + "/v1/default/Pod/fake-pod-44-h56lk": {}, + "/v1/default/Pod/fake-pod-44-h6fj7": {}, + "/v1/default/Pod/fake-pod-44-h8dm8": {}, + "/v1/default/Pod/fake-pod-44-hbz5g": {}, + "/v1/default/Pod/fake-pod-44-hfxj6": {}, + "/v1/default/Pod/fake-pod-44-hg5kk": {}, + "/v1/default/Pod/fake-pod-44-hj4pr": {}, + "/v1/default/Pod/fake-pod-44-hlpfr": {}, + "/v1/default/Pod/fake-pod-44-hmsrp": {}, + "/v1/default/Pod/fake-pod-44-hp6kk": {}, + "/v1/default/Pod/fake-pod-44-hqkws": {}, + "/v1/default/Pod/fake-pod-44-hr7nt": {}, + "/v1/default/Pod/fake-pod-44-hsgp9": {}, + "/v1/default/Pod/fake-pod-44-hvb9m": {}, + "/v1/default/Pod/fake-pod-44-j7fsf": {}, + "/v1/default/Pod/fake-pod-44-j9sm2": {}, + "/v1/default/Pod/fake-pod-44-jkh5s": {}, + "/v1/default/Pod/fake-pod-44-jlwlj": {}, + "/v1/default/Pod/fake-pod-44-jpnxg": {}, + "/v1/default/Pod/fake-pod-44-jpsn5": {}, + "/v1/default/Pod/fake-pod-44-jqldr": {}, + "/v1/default/Pod/fake-pod-44-js4kz": {}, + "/v1/default/Pod/fake-pod-44-jsg55": {}, + "/v1/default/Pod/fake-pod-44-jsgb8": {}, + "/v1/default/Pod/fake-pod-44-jzbj6": {}, + "/v1/default/Pod/fake-pod-44-k44w2": {}, + "/v1/default/Pod/fake-pod-44-k6xzz": {}, + "/v1/default/Pod/fake-pod-44-k7xfd": {}, + "/v1/default/Pod/fake-pod-44-k8lrd": {}, + "/v1/default/Pod/fake-pod-44-k8slj": {}, + "/v1/default/Pod/fake-pod-44-k9zxw": {}, + "/v1/default/Pod/fake-pod-44-kdcvm": {}, + "/v1/default/Pod/fake-pod-44-kgtdk": {}, + "/v1/default/Pod/fake-pod-44-khpv4": {}, + "/v1/default/Pod/fake-pod-44-l2n9z": {}, + "/v1/default/Pod/fake-pod-44-l4csj": {}, + "/v1/default/Pod/fake-pod-44-l7pw9": {}, + "/v1/default/Pod/fake-pod-44-l8ngd": {}, + "/v1/default/Pod/fake-pod-44-lhckm": {}, + "/v1/default/Pod/fake-pod-44-lj8fk": {}, + "/v1/default/Pod/fake-pod-44-lm6n7": {}, + "/v1/default/Pod/fake-pod-44-lmjx2": {}, + "/v1/default/Pod/fake-pod-44-lmtm4": {}, + "/v1/default/Pod/fake-pod-44-lp4cx": {}, + "/v1/default/Pod/fake-pod-44-lrd8f": {}, + "/v1/default/Pod/fake-pod-44-ls2pz": {}, + "/v1/default/Pod/fake-pod-44-lw5gz": {}, + "/v1/default/Pod/fake-pod-44-m2bkx": {}, + "/v1/default/Pod/fake-pod-44-m8kdc": {}, + "/v1/default/Pod/fake-pod-44-mdtnv": {}, + "/v1/default/Pod/fake-pod-44-mfvsv": {}, + "/v1/default/Pod/fake-pod-44-mmllf": {}, + "/v1/default/Pod/fake-pod-44-mmzjs": {}, + "/v1/default/Pod/fake-pod-44-mnqx8": {}, + "/v1/default/Pod/fake-pod-44-mr2br": {}, + "/v1/default/Pod/fake-pod-44-mtx67": {}, + "/v1/default/Pod/fake-pod-44-mvwjp": {}, + "/v1/default/Pod/fake-pod-44-mw77p": {}, + "/v1/default/Pod/fake-pod-44-n6fdv": {}, + "/v1/default/Pod/fake-pod-44-n6zkr": {}, + "/v1/default/Pod/fake-pod-44-nd9t7": {}, + "/v1/default/Pod/fake-pod-44-nv2r8": {}, + "/v1/default/Pod/fake-pod-44-nw7nw": {}, + "/v1/default/Pod/fake-pod-44-nwmnx": {}, + "/v1/default/Pod/fake-pod-44-p2zfg": {}, + "/v1/default/Pod/fake-pod-44-p4mcm": {}, + "/v1/default/Pod/fake-pod-44-p5zx6": {}, + "/v1/default/Pod/fake-pod-44-p8zn2": {}, + "/v1/default/Pod/fake-pod-44-pcnlj": {}, + "/v1/default/Pod/fake-pod-44-pgfvs": {}, + "/v1/default/Pod/fake-pod-44-pkwdw": {}, + "/v1/default/Pod/fake-pod-44-pllc9": {}, + "/v1/default/Pod/fake-pod-44-pqpjf": {}, + "/v1/default/Pod/fake-pod-44-pt2mg": {}, + "/v1/default/Pod/fake-pod-44-pvfnd": {}, + "/v1/default/Pod/fake-pod-44-q2tsd": {}, + "/v1/default/Pod/fake-pod-44-q2xzr": {}, + "/v1/default/Pod/fake-pod-44-q92kz": {}, + "/v1/default/Pod/fake-pod-44-qd4kg": {}, + "/v1/default/Pod/fake-pod-44-qfwcw": {}, + "/v1/default/Pod/fake-pod-44-qg6lm": {}, + "/v1/default/Pod/fake-pod-44-qlksd": {}, + "/v1/default/Pod/fake-pod-44-qrh86": {}, + "/v1/default/Pod/fake-pod-44-qrwd8": {}, + "/v1/default/Pod/fake-pod-44-r4tcm": {}, + "/v1/default/Pod/fake-pod-44-r5dr5": {}, + "/v1/default/Pod/fake-pod-44-r5mdr": {}, + "/v1/default/Pod/fake-pod-44-rc94t": {}, + "/v1/default/Pod/fake-pod-44-rqnk9": {}, + "/v1/default/Pod/fake-pod-44-rrpcx": {}, + "/v1/default/Pod/fake-pod-44-rvgrz": {}, + "/v1/default/Pod/fake-pod-44-s5qj2": {}, + "/v1/default/Pod/fake-pod-44-s7sw8": {}, + "/v1/default/Pod/fake-pod-44-s95mg": {}, + "/v1/default/Pod/fake-pod-44-s96dx": {}, + "/v1/default/Pod/fake-pod-44-sf44q": {}, + "/v1/default/Pod/fake-pod-44-sgtsd": {}, + "/v1/default/Pod/fake-pod-44-snmqr": {}, + "/v1/default/Pod/fake-pod-44-sntpl": {}, + "/v1/default/Pod/fake-pod-44-sp9n4": {}, + "/v1/default/Pod/fake-pod-44-spp2s": {}, + "/v1/default/Pod/fake-pod-44-sz6rn": {}, + "/v1/default/Pod/fake-pod-44-t2bkr": {}, + "/v1/default/Pod/fake-pod-44-t972v": {}, + "/v1/default/Pod/fake-pod-44-tbl5c": {}, + "/v1/default/Pod/fake-pod-44-tcqqk": {}, + "/v1/default/Pod/fake-pod-44-tlqrq": {}, + "/v1/default/Pod/fake-pod-44-tmdd7": {}, + "/v1/default/Pod/fake-pod-44-ttfkt": {}, + "/v1/default/Pod/fake-pod-44-ttnqs": {}, + "/v1/default/Pod/fake-pod-44-tv7j4": {}, + "/v1/default/Pod/fake-pod-44-tw899": {}, + "/v1/default/Pod/fake-pod-44-tzf8z": {}, + "/v1/default/Pod/fake-pod-44-v4m8w": {}, + "/v1/default/Pod/fake-pod-44-v7rcc": {}, + "/v1/default/Pod/fake-pod-44-v7t9g": {}, + "/v1/default/Pod/fake-pod-44-v7xb7": {}, + "/v1/default/Pod/fake-pod-44-v9mcf": {}, + "/v1/default/Pod/fake-pod-44-vjpjd": {}, + "/v1/default/Pod/fake-pod-44-vpd4b": {}, + "/v1/default/Pod/fake-pod-44-vpws9": {}, + "/v1/default/Pod/fake-pod-44-vs27w": {}, + "/v1/default/Pod/fake-pod-44-vwqhn": {}, + "/v1/default/Pod/fake-pod-44-vxpvx": {}, + "/v1/default/Pod/fake-pod-44-w27f2": {}, + "/v1/default/Pod/fake-pod-44-w28bx": {}, + "/v1/default/Pod/fake-pod-44-w2qpr": {}, + "/v1/default/Pod/fake-pod-44-w6w75": {}, + "/v1/default/Pod/fake-pod-44-wbxzg": {}, + "/v1/default/Pod/fake-pod-44-wggf6": {}, + "/v1/default/Pod/fake-pod-44-wh2sk": {}, + "/v1/default/Pod/fake-pod-44-wj672": {}, + "/v1/default/Pod/fake-pod-44-wjpsp": {}, + "/v1/default/Pod/fake-pod-44-wl4v4": {}, + "/v1/default/Pod/fake-pod-44-wnd4x": {}, + "/v1/default/Pod/fake-pod-44-wnxpj": {}, + "/v1/default/Pod/fake-pod-44-wq7wq": {}, + "/v1/default/Pod/fake-pod-44-wqfp4": {}, + "/v1/default/Pod/fake-pod-44-wsh7r": {}, + "/v1/default/Pod/fake-pod-44-wslvs": {}, + "/v1/default/Pod/fake-pod-44-x68k2": {}, + "/v1/default/Pod/fake-pod-44-xb692": {}, + "/v1/default/Pod/fake-pod-44-xpb7m": {}, + "/v1/default/Pod/fake-pod-44-xrfrc": {}, + "/v1/default/Pod/fake-pod-44-xwvm9": {}, + "/v1/default/Pod/fake-pod-44-xxrwp": {}, + "/v1/default/Pod/fake-pod-44-z4kg2": {}, + "/v1/default/Pod/fake-pod-44-z5f9z": {}, + "/v1/default/Pod/fake-pod-44-z7knw": {}, + "/v1/default/Pod/fake-pod-44-zclh7": {}, + "/v1/default/Pod/fake-pod-44-zfzks": {}, + "/v1/default/Pod/fake-pod-44-zg4bz": {}, + "/v1/default/Pod/fake-pod-44-zmqwf": {}, + "/v1/default/Pod/fake-pod-44-zs4n5": {}, + "/v1/default/Pod/fake-pod-44-zz52c": {}, + "/v1/default/Pod/fake-pod-45-26wsg": {}, + "/v1/default/Pod/fake-pod-45-29frs": {}, + "/v1/default/Pod/fake-pod-45-2fns4": {}, + "/v1/default/Pod/fake-pod-45-2gnlx": {}, + "/v1/default/Pod/fake-pod-45-2hnm8": {}, + "/v1/default/Pod/fake-pod-45-2jznr": {}, + "/v1/default/Pod/fake-pod-45-2r472": {}, + "/v1/default/Pod/fake-pod-45-2ts2t": {}, + "/v1/default/Pod/fake-pod-45-448kb": {}, + "/v1/default/Pod/fake-pod-45-44dx9": {}, + "/v1/default/Pod/fake-pod-45-49tbt": {}, + "/v1/default/Pod/fake-pod-45-4c948": {}, + "/v1/default/Pod/fake-pod-45-4cdbg": {}, + "/v1/default/Pod/fake-pod-45-4gcdq": {}, + "/v1/default/Pod/fake-pod-45-4h4g9": {}, + "/v1/default/Pod/fake-pod-45-4mpmc": {}, + "/v1/default/Pod/fake-pod-45-4ng4s": {}, + "/v1/default/Pod/fake-pod-45-4qhxf": {}, + "/v1/default/Pod/fake-pod-45-4s9zg": {}, + "/v1/default/Pod/fake-pod-45-4vjr9": {}, + "/v1/default/Pod/fake-pod-45-4w284": {}, + "/v1/default/Pod/fake-pod-45-4x9zp": {}, + "/v1/default/Pod/fake-pod-45-4xfcb": {}, + "/v1/default/Pod/fake-pod-45-4zprn": {}, + "/v1/default/Pod/fake-pod-45-52kq2": {}, + "/v1/default/Pod/fake-pod-45-5586m": {}, + "/v1/default/Pod/fake-pod-45-56mf7": {}, + "/v1/default/Pod/fake-pod-45-5cdwf": {}, + "/v1/default/Pod/fake-pod-45-5gnnr": {}, + "/v1/default/Pod/fake-pod-45-5krnv": {}, + "/v1/default/Pod/fake-pod-45-5nzsp": {}, + "/v1/default/Pod/fake-pod-45-5pznb": {}, + "/v1/default/Pod/fake-pod-45-5sl29": {}, + "/v1/default/Pod/fake-pod-45-5tlwv": {}, + "/v1/default/Pod/fake-pod-45-5trrf": {}, + "/v1/default/Pod/fake-pod-45-5v4tm": {}, + "/v1/default/Pod/fake-pod-45-6922p": {}, + "/v1/default/Pod/fake-pod-45-69ghv": {}, + "/v1/default/Pod/fake-pod-45-6fzs8": {}, + "/v1/default/Pod/fake-pod-45-6kdp2": {}, + "/v1/default/Pod/fake-pod-45-6kwj2": {}, + "/v1/default/Pod/fake-pod-45-6m28t": {}, + "/v1/default/Pod/fake-pod-45-6mwhq": {}, + "/v1/default/Pod/fake-pod-45-6qbhg": {}, + "/v1/default/Pod/fake-pod-45-6tfs2": {}, + "/v1/default/Pod/fake-pod-45-6w8l7": {}, + "/v1/default/Pod/fake-pod-45-6w9cb": {}, + "/v1/default/Pod/fake-pod-45-6zz2b": {}, + "/v1/default/Pod/fake-pod-45-72qcr": {}, + "/v1/default/Pod/fake-pod-45-75dhw": {}, + "/v1/default/Pod/fake-pod-45-78n22": {}, + "/v1/default/Pod/fake-pod-45-79hh7": {}, + "/v1/default/Pod/fake-pod-45-7c48m": {}, + "/v1/default/Pod/fake-pod-45-7gfcg": {}, + "/v1/default/Pod/fake-pod-45-7hxg4": {}, + "/v1/default/Pod/fake-pod-45-7kcdn": {}, + "/v1/default/Pod/fake-pod-45-7s6cf": {}, + "/v1/default/Pod/fake-pod-45-7tdnr": {}, + "/v1/default/Pod/fake-pod-45-7wv69": {}, + "/v1/default/Pod/fake-pod-45-7zknr": {}, + "/v1/default/Pod/fake-pod-45-82ksz": {}, + "/v1/default/Pod/fake-pod-45-85l2w": {}, + "/v1/default/Pod/fake-pod-45-85mcm": {}, + "/v1/default/Pod/fake-pod-45-86shn": {}, + "/v1/default/Pod/fake-pod-45-894w2": {}, + "/v1/default/Pod/fake-pod-45-8cq4d": {}, + "/v1/default/Pod/fake-pod-45-8d5k5": {}, + "/v1/default/Pod/fake-pod-45-8d5tt": {}, + "/v1/default/Pod/fake-pod-45-8dq4l": {}, + "/v1/default/Pod/fake-pod-45-8ggvz": {}, + "/v1/default/Pod/fake-pod-45-8h6m5": {}, + "/v1/default/Pod/fake-pod-45-8k4qv": {}, + "/v1/default/Pod/fake-pod-45-8n9j2": {}, + "/v1/default/Pod/fake-pod-45-8sqjw": {}, + "/v1/default/Pod/fake-pod-45-8wlgb": {}, + "/v1/default/Pod/fake-pod-45-92p8k": {}, + "/v1/default/Pod/fake-pod-45-96pb9": {}, + "/v1/default/Pod/fake-pod-45-97nhx": {}, + "/v1/default/Pod/fake-pod-45-99cqr": {}, + "/v1/default/Pod/fake-pod-45-9k89r": {}, + "/v1/default/Pod/fake-pod-45-9p4pl": {}, + "/v1/default/Pod/fake-pod-45-9wztp": {}, + "/v1/default/Pod/fake-pod-45-9xmfl": {}, + "/v1/default/Pod/fake-pod-45-9xxgr": {}, + "/v1/default/Pod/fake-pod-45-b6ljn": {}, + "/v1/default/Pod/fake-pod-45-b7r5l": {}, + "/v1/default/Pod/fake-pod-45-b8cmf": {}, + "/v1/default/Pod/fake-pod-45-b8d4x": {}, + "/v1/default/Pod/fake-pod-45-bc75l": {}, + "/v1/default/Pod/fake-pod-45-bdbbx": {}, + "/v1/default/Pod/fake-pod-45-bdzl9": {}, + "/v1/default/Pod/fake-pod-45-bhp28": {}, + "/v1/default/Pod/fake-pod-45-bhr5k": {}, + "/v1/default/Pod/fake-pod-45-bk26z": {}, + "/v1/default/Pod/fake-pod-45-bkhlm": {}, + "/v1/default/Pod/fake-pod-45-bp4z6": {}, + "/v1/default/Pod/fake-pod-45-brg6h": {}, + "/v1/default/Pod/fake-pod-45-bzf5w": {}, + "/v1/default/Pod/fake-pod-45-c5m6m": {}, + "/v1/default/Pod/fake-pod-45-c8qr5": {}, + "/v1/default/Pod/fake-pod-45-c9ksp": {}, + "/v1/default/Pod/fake-pod-45-cdbdm": {}, + "/v1/default/Pod/fake-pod-45-clk8h": {}, + "/v1/default/Pod/fake-pod-45-cn76k": {}, + "/v1/default/Pod/fake-pod-45-cqhct": {}, + "/v1/default/Pod/fake-pod-45-crgb6": {}, + "/v1/default/Pod/fake-pod-45-csj98": {}, + "/v1/default/Pod/fake-pod-45-cthdl": {}, + "/v1/default/Pod/fake-pod-45-cv6kx": {}, + "/v1/default/Pod/fake-pod-45-d26nd": {}, + "/v1/default/Pod/fake-pod-45-d4jls": {}, + "/v1/default/Pod/fake-pod-45-d62q4": {}, + "/v1/default/Pod/fake-pod-45-ddksj": {}, + "/v1/default/Pod/fake-pod-45-dh6ww": {}, + "/v1/default/Pod/fake-pod-45-djwrl": {}, + "/v1/default/Pod/fake-pod-45-dl7dj": {}, + "/v1/default/Pod/fake-pod-45-dl8nk": {}, + "/v1/default/Pod/fake-pod-45-dlp5x": {}, + "/v1/default/Pod/fake-pod-45-dmpg8": {}, + "/v1/default/Pod/fake-pod-45-dnc8m": {}, + "/v1/default/Pod/fake-pod-45-dpzdv": {}, + "/v1/default/Pod/fake-pod-45-ds4ld": {}, + "/v1/default/Pod/fake-pod-45-dxz5k": {}, + "/v1/default/Pod/fake-pod-45-f5njc": {}, + "/v1/default/Pod/fake-pod-45-f75db": {}, + "/v1/default/Pod/fake-pod-45-f7d8g": {}, + "/v1/default/Pod/fake-pod-45-f9bd4": {}, + "/v1/default/Pod/fake-pod-45-fmml6": {}, + "/v1/default/Pod/fake-pod-45-fpgk4": {}, + "/v1/default/Pod/fake-pod-45-fpntg": {}, + "/v1/default/Pod/fake-pod-45-fpsdd": {}, + "/v1/default/Pod/fake-pod-45-fspgz": {}, + "/v1/default/Pod/fake-pod-45-ft52n": {}, + "/v1/default/Pod/fake-pod-45-fws2d": {}, + "/v1/default/Pod/fake-pod-45-fxwfl": {}, + "/v1/default/Pod/fake-pod-45-g7vf9": {}, + "/v1/default/Pod/fake-pod-45-g9q9l": {}, + "/v1/default/Pod/fake-pod-45-gbfwm": {}, + "/v1/default/Pod/fake-pod-45-gbp4w": {}, + "/v1/default/Pod/fake-pod-45-gk2pg": {}, + "/v1/default/Pod/fake-pod-45-gljhn": {}, + "/v1/default/Pod/fake-pod-45-grp5d": {}, + "/v1/default/Pod/fake-pod-45-gs9hh": {}, + "/v1/default/Pod/fake-pod-45-gspmr": {}, + "/v1/default/Pod/fake-pod-45-gvkqw": {}, + "/v1/default/Pod/fake-pod-45-gwfl5": {}, + "/v1/default/Pod/fake-pod-45-gxmfk": {}, + "/v1/default/Pod/fake-pod-45-gzdn9": {}, + "/v1/default/Pod/fake-pod-45-gzvh6": {}, + "/v1/default/Pod/fake-pod-45-h7mbq": {}, + "/v1/default/Pod/fake-pod-45-h9gzf": {}, + "/v1/default/Pod/fake-pod-45-hdxmx": {}, + "/v1/default/Pod/fake-pod-45-hgpjv": {}, + "/v1/default/Pod/fake-pod-45-hjcvk": {}, + "/v1/default/Pod/fake-pod-45-hqhjl": {}, + "/v1/default/Pod/fake-pod-45-hsqc8": {}, + "/v1/default/Pod/fake-pod-45-j7vng": {}, + "/v1/default/Pod/fake-pod-45-j8wth": {}, + "/v1/default/Pod/fake-pod-45-j9wpq": {}, + "/v1/default/Pod/fake-pod-45-jcxr8": {}, + "/v1/default/Pod/fake-pod-45-jfr5z": {}, + "/v1/default/Pod/fake-pod-45-jgl67": {}, + "/v1/default/Pod/fake-pod-45-jj5gm": {}, + "/v1/default/Pod/fake-pod-45-jkv6q": {}, + "/v1/default/Pod/fake-pod-45-jql4j": {}, + "/v1/default/Pod/fake-pod-45-jrrtv": {}, + "/v1/default/Pod/fake-pod-45-jtdj6": {}, + "/v1/default/Pod/fake-pod-45-jw2qb": {}, + "/v1/default/Pod/fake-pod-45-k2bk6": {}, + "/v1/default/Pod/fake-pod-45-k2dmn": {}, + "/v1/default/Pod/fake-pod-45-k6dtw": {}, + "/v1/default/Pod/fake-pod-45-k6n2m": {}, + "/v1/default/Pod/fake-pod-45-k7d2x": {}, + "/v1/default/Pod/fake-pod-45-kcpgh": {}, + "/v1/default/Pod/fake-pod-45-kghpj": {}, + "/v1/default/Pod/fake-pod-45-kjx9f": {}, + "/v1/default/Pod/fake-pod-45-klmcj": {}, + "/v1/default/Pod/fake-pod-45-ksj5n": {}, + "/v1/default/Pod/fake-pod-45-kx85c": {}, + "/v1/default/Pod/fake-pod-45-l4hjw": {}, + "/v1/default/Pod/fake-pod-45-l59ps": {}, + "/v1/default/Pod/fake-pod-45-l8mqn": {}, + "/v1/default/Pod/fake-pod-45-l9fhv": {}, + "/v1/default/Pod/fake-pod-45-lc62v": {}, + "/v1/default/Pod/fake-pod-45-ldzkx": {}, + "/v1/default/Pod/fake-pod-45-lgbg2": {}, + "/v1/default/Pod/fake-pod-45-llbs5": {}, + "/v1/default/Pod/fake-pod-45-lpv2j": {}, + "/v1/default/Pod/fake-pod-45-lst95": {}, + "/v1/default/Pod/fake-pod-45-m6mjj": {}, + "/v1/default/Pod/fake-pod-45-mbmbf": {}, + "/v1/default/Pod/fake-pod-45-mbpg8": {}, + "/v1/default/Pod/fake-pod-45-mfz2k": {}, + "/v1/default/Pod/fake-pod-45-mgrq5": {}, + "/v1/default/Pod/fake-pod-45-mhwlp": {}, + "/v1/default/Pod/fake-pod-45-mjb4k": {}, + "/v1/default/Pod/fake-pod-45-mttz4": {}, + "/v1/default/Pod/fake-pod-45-mzcrl": {}, + "/v1/default/Pod/fake-pod-45-n84sq": {}, + "/v1/default/Pod/fake-pod-45-n88hx": {}, + "/v1/default/Pod/fake-pod-45-nbvxj": {}, + "/v1/default/Pod/fake-pod-45-ndfcp": {}, + "/v1/default/Pod/fake-pod-45-nhfgb": {}, + "/v1/default/Pod/fake-pod-45-nhkg6": {}, + "/v1/default/Pod/fake-pod-45-njrzt": {}, + "/v1/default/Pod/fake-pod-45-njwpm": {}, + "/v1/default/Pod/fake-pod-45-nk4x4": {}, + "/v1/default/Pod/fake-pod-45-nkdkw": {}, + "/v1/default/Pod/fake-pod-45-nspzw": {}, + "/v1/default/Pod/fake-pod-45-nssvl": {}, + "/v1/default/Pod/fake-pod-45-nvjw8": {}, + "/v1/default/Pod/fake-pod-45-nwvsm": {}, + "/v1/default/Pod/fake-pod-45-nxkvg": {}, + "/v1/default/Pod/fake-pod-45-nzvfk": {}, + "/v1/default/Pod/fake-pod-45-p45tp": {}, + "/v1/default/Pod/fake-pod-45-p4fvf": {}, + "/v1/default/Pod/fake-pod-45-p5w8b": {}, + "/v1/default/Pod/fake-pod-45-p9frk": {}, + "/v1/default/Pod/fake-pod-45-phzll": {}, + "/v1/default/Pod/fake-pod-45-pkmd2": {}, + "/v1/default/Pod/fake-pod-45-prjf4": {}, + "/v1/default/Pod/fake-pod-45-prwqk": {}, + "/v1/default/Pod/fake-pod-45-pz8d2": {}, + "/v1/default/Pod/fake-pod-45-q4zl4": {}, + "/v1/default/Pod/fake-pod-45-q5dck": {}, + "/v1/default/Pod/fake-pod-45-q5lfj": {}, + "/v1/default/Pod/fake-pod-45-ql784": {}, + "/v1/default/Pod/fake-pod-45-qmz7k": {}, + "/v1/default/Pod/fake-pod-45-qn89l": {}, + "/v1/default/Pod/fake-pod-45-qpbtj": {}, + "/v1/default/Pod/fake-pod-45-qpjq8": {}, + "/v1/default/Pod/fake-pod-45-qz6v9": {}, + "/v1/default/Pod/fake-pod-45-qzb7t": {}, + "/v1/default/Pod/fake-pod-45-r24km": {}, + "/v1/default/Pod/fake-pod-45-r9nt9": {}, + "/v1/default/Pod/fake-pod-45-rb25r": {}, + "/v1/default/Pod/fake-pod-45-rcqlx": {}, + "/v1/default/Pod/fake-pod-45-rdssv": {}, + "/v1/default/Pod/fake-pod-45-rfq5c": {}, + "/v1/default/Pod/fake-pod-45-rgw2d": {}, + "/v1/default/Pod/fake-pod-45-rjw8n": {}, + "/v1/default/Pod/fake-pod-45-rk4zv": {}, + "/v1/default/Pod/fake-pod-45-rqw9n": {}, + "/v1/default/Pod/fake-pod-45-rt5h8": {}, + "/v1/default/Pod/fake-pod-45-rwj5s": {}, + "/v1/default/Pod/fake-pod-45-rxr88": {}, + "/v1/default/Pod/fake-pod-45-s2jcp": {}, + "/v1/default/Pod/fake-pod-45-s4fwg": {}, + "/v1/default/Pod/fake-pod-45-s6v2s": {}, + "/v1/default/Pod/fake-pod-45-slq89": {}, + "/v1/default/Pod/fake-pod-45-stddj": {}, + "/v1/default/Pod/fake-pod-45-svjdx": {}, + "/v1/default/Pod/fake-pod-45-swgx2": {}, + "/v1/default/Pod/fake-pod-45-sxtm4": {}, + "/v1/default/Pod/fake-pod-45-sznjx": {}, + "/v1/default/Pod/fake-pod-45-t87ll": {}, + "/v1/default/Pod/fake-pod-45-t8m47": {}, + "/v1/default/Pod/fake-pod-45-t9gjx": {}, + "/v1/default/Pod/fake-pod-45-t9wf2": {}, + "/v1/default/Pod/fake-pod-45-tbl69": {}, + "/v1/default/Pod/fake-pod-45-thpfj": {}, + "/v1/default/Pod/fake-pod-45-tkgpm": {}, + "/v1/default/Pod/fake-pod-45-twk24": {}, + "/v1/default/Pod/fake-pod-45-tzbq6": {}, + "/v1/default/Pod/fake-pod-45-v79s5": {}, + "/v1/default/Pod/fake-pod-45-vc2qf": {}, + "/v1/default/Pod/fake-pod-45-vclj6": {}, + "/v1/default/Pod/fake-pod-45-vf4ls": {}, + "/v1/default/Pod/fake-pod-45-vgdbr": {}, + "/v1/default/Pod/fake-pod-45-vhkbk": {}, + "/v1/default/Pod/fake-pod-45-vhsnj": {}, + "/v1/default/Pod/fake-pod-45-vrn4s": {}, + "/v1/default/Pod/fake-pod-45-vsb8b": {}, + "/v1/default/Pod/fake-pod-45-vt5bd": {}, + "/v1/default/Pod/fake-pod-45-w6qf2": {}, + "/v1/default/Pod/fake-pod-45-w84jm": {}, + "/v1/default/Pod/fake-pod-45-w9m55": {}, + "/v1/default/Pod/fake-pod-45-wcvjx": {}, + "/v1/default/Pod/fake-pod-45-wcxnj": {}, + "/v1/default/Pod/fake-pod-45-wdhfj": {}, + "/v1/default/Pod/fake-pod-45-wf52c": {}, + "/v1/default/Pod/fake-pod-45-wl7m2": {}, + "/v1/default/Pod/fake-pod-45-wr72w": {}, + "/v1/default/Pod/fake-pod-45-wznbg": {}, + "/v1/default/Pod/fake-pod-45-wzxgm": {}, + "/v1/default/Pod/fake-pod-45-x7dfd": {}, + "/v1/default/Pod/fake-pod-45-xd67t": {}, + "/v1/default/Pod/fake-pod-45-xdwbw": {}, + "/v1/default/Pod/fake-pod-45-xf5mh": {}, + "/v1/default/Pod/fake-pod-45-xn5ft": {}, + "/v1/default/Pod/fake-pod-45-xrlg2": {}, + "/v1/default/Pod/fake-pod-45-xrzbq": {}, + "/v1/default/Pod/fake-pod-45-z8tbf": {}, + "/v1/default/Pod/fake-pod-45-zb55f": {}, + "/v1/default/Pod/fake-pod-45-zgnq7": {}, + "/v1/default/Pod/fake-pod-45-zphvp": {}, + "/v1/default/Pod/fake-pod-45-ztn7h": {}, + "/v1/default/Pod/fake-pod-45-zwb42": {}, + "/v1/default/Pod/fake-pod-45-zwh4h": {}, + "/v1/default/Pod/fake-pod-46-2724b": {}, + "/v1/default/Pod/fake-pod-46-27p2h": {}, + "/v1/default/Pod/fake-pod-46-29hsl": {}, + "/v1/default/Pod/fake-pod-46-29vrw": {}, + "/v1/default/Pod/fake-pod-46-2ljb6": {}, + "/v1/default/Pod/fake-pod-46-2pwk7": {}, + "/v1/default/Pod/fake-pod-46-2q2z2": {}, + "/v1/default/Pod/fake-pod-46-2qmvd": {}, + "/v1/default/Pod/fake-pod-46-2tgrb": {}, + "/v1/default/Pod/fake-pod-46-2v2h6": {}, + "/v1/default/Pod/fake-pod-46-2v92n": {}, + "/v1/default/Pod/fake-pod-46-2zcmn": {}, + "/v1/default/Pod/fake-pod-46-455xc": {}, + "/v1/default/Pod/fake-pod-46-47d7w": {}, + "/v1/default/Pod/fake-pod-46-4bfxt": {}, + "/v1/default/Pod/fake-pod-46-4k6d5": {}, + "/v1/default/Pod/fake-pod-46-4n8j8": {}, + "/v1/default/Pod/fake-pod-46-4nnhh": {}, + "/v1/default/Pod/fake-pod-46-4npc5": {}, + "/v1/default/Pod/fake-pod-46-4p86q": {}, + "/v1/default/Pod/fake-pod-46-4qkzf": {}, + "/v1/default/Pod/fake-pod-46-52f5r": {}, + "/v1/default/Pod/fake-pod-46-55wq7": {}, + "/v1/default/Pod/fake-pod-46-57vq8": {}, + "/v1/default/Pod/fake-pod-46-59mxg": {}, + "/v1/default/Pod/fake-pod-46-5d88d": {}, + "/v1/default/Pod/fake-pod-46-5f5gq": {}, + "/v1/default/Pod/fake-pod-46-5g59p": {}, + "/v1/default/Pod/fake-pod-46-5jssw": {}, + "/v1/default/Pod/fake-pod-46-5mzk7": {}, + "/v1/default/Pod/fake-pod-46-5n4jd": {}, + "/v1/default/Pod/fake-pod-46-5phlt": {}, + "/v1/default/Pod/fake-pod-46-5t94m": {}, + "/v1/default/Pod/fake-pod-46-5tlmf": {}, + "/v1/default/Pod/fake-pod-46-5tpls": {}, + "/v1/default/Pod/fake-pod-46-5xwxv": {}, + "/v1/default/Pod/fake-pod-46-62fhj": {}, + "/v1/default/Pod/fake-pod-46-66k2n": {}, + "/v1/default/Pod/fake-pod-46-66svv": {}, + "/v1/default/Pod/fake-pod-46-6cbkt": {}, + "/v1/default/Pod/fake-pod-46-6cqkh": {}, + "/v1/default/Pod/fake-pod-46-6dtdc": {}, + "/v1/default/Pod/fake-pod-46-6hhqt": {}, + "/v1/default/Pod/fake-pod-46-6l6jc": {}, + "/v1/default/Pod/fake-pod-46-6rrkz": {}, + "/v1/default/Pod/fake-pod-46-6zcxf": {}, + "/v1/default/Pod/fake-pod-46-75vf7": {}, + "/v1/default/Pod/fake-pod-46-76c9v": {}, + "/v1/default/Pod/fake-pod-46-7kp4d": {}, + "/v1/default/Pod/fake-pod-46-7nlsv": {}, + "/v1/default/Pod/fake-pod-46-7v7j6": {}, + "/v1/default/Pod/fake-pod-46-7w49z": {}, + "/v1/default/Pod/fake-pod-46-82576": {}, + "/v1/default/Pod/fake-pod-46-82jtx": {}, + "/v1/default/Pod/fake-pod-46-8867v": {}, + "/v1/default/Pod/fake-pod-46-8kzqs": {}, + "/v1/default/Pod/fake-pod-46-8lcqd": {}, + "/v1/default/Pod/fake-pod-46-8nvcb": {}, + "/v1/default/Pod/fake-pod-46-8pd7l": {}, + "/v1/default/Pod/fake-pod-46-8qv4s": {}, + "/v1/default/Pod/fake-pod-46-8rxgx": {}, + "/v1/default/Pod/fake-pod-46-8trmd": {}, + "/v1/default/Pod/fake-pod-46-8v5dn": {}, + "/v1/default/Pod/fake-pod-46-8v94g": {}, + "/v1/default/Pod/fake-pod-46-95w8l": {}, + "/v1/default/Pod/fake-pod-46-9gl6c": {}, + "/v1/default/Pod/fake-pod-46-9p749": {}, + "/v1/default/Pod/fake-pod-46-9q6hp": {}, + "/v1/default/Pod/fake-pod-46-9sktq": {}, + "/v1/default/Pod/fake-pod-46-9wsgz": {}, + "/v1/default/Pod/fake-pod-46-9x2t4": {}, + "/v1/default/Pod/fake-pod-46-9zlfr": {}, + "/v1/default/Pod/fake-pod-46-b2b6w": {}, + "/v1/default/Pod/fake-pod-46-b2lsw": {}, + "/v1/default/Pod/fake-pod-46-b577d": {}, + "/v1/default/Pod/fake-pod-46-b5sj5": {}, + "/v1/default/Pod/fake-pod-46-b6jxx": {}, + "/v1/default/Pod/fake-pod-46-b7bhn": {}, + "/v1/default/Pod/fake-pod-46-b9m5v": {}, + "/v1/default/Pod/fake-pod-46-b9pzs": {}, + "/v1/default/Pod/fake-pod-46-bd8gj": {}, + "/v1/default/Pod/fake-pod-46-bdlcn": {}, + "/v1/default/Pod/fake-pod-46-bm2zq": {}, + "/v1/default/Pod/fake-pod-46-bnsrx": {}, + "/v1/default/Pod/fake-pod-46-bxm8w": {}, + "/v1/default/Pod/fake-pod-46-c4hdn": {}, + "/v1/default/Pod/fake-pod-46-c5mhf": {}, + "/v1/default/Pod/fake-pod-46-c9zfh": {}, + "/v1/default/Pod/fake-pod-46-cbnww": {}, + "/v1/default/Pod/fake-pod-46-cgn8j": {}, + "/v1/default/Pod/fake-pod-46-cnndk": {}, + "/v1/default/Pod/fake-pod-46-cq55x": {}, + "/v1/default/Pod/fake-pod-46-cr4h8": {}, + "/v1/default/Pod/fake-pod-46-cz58j": {}, + "/v1/default/Pod/fake-pod-46-d2gnz": {}, + "/v1/default/Pod/fake-pod-46-d2s75": {}, + "/v1/default/Pod/fake-pod-46-d82d7": {}, + "/v1/default/Pod/fake-pod-46-d8rs2": {}, + "/v1/default/Pod/fake-pod-46-d9d6c": {}, + "/v1/default/Pod/fake-pod-46-d9gpz": {}, + "/v1/default/Pod/fake-pod-46-dgkml": {}, + "/v1/default/Pod/fake-pod-46-dkctf": {}, + "/v1/default/Pod/fake-pod-46-dq86z": {}, + "/v1/default/Pod/fake-pod-46-dsfsm": {}, + "/v1/default/Pod/fake-pod-46-dzfzk": {}, + "/v1/default/Pod/fake-pod-46-f4kh9": {}, + "/v1/default/Pod/fake-pod-46-f5kvp": {}, + "/v1/default/Pod/fake-pod-46-f98h7": {}, + "/v1/default/Pod/fake-pod-46-fclkw": {}, + "/v1/default/Pod/fake-pod-46-fdgqq": {}, + "/v1/default/Pod/fake-pod-46-fdtqh": {}, + "/v1/default/Pod/fake-pod-46-fjf85": {}, + "/v1/default/Pod/fake-pod-46-flp4l": {}, + "/v1/default/Pod/fake-pod-46-flz6h": {}, + "/v1/default/Pod/fake-pod-46-fmfpx": {}, + "/v1/default/Pod/fake-pod-46-fnp7n": {}, + "/v1/default/Pod/fake-pod-46-fqjbv": {}, + "/v1/default/Pod/fake-pod-46-ft99k": {}, + "/v1/default/Pod/fake-pod-46-ftc8x": {}, + "/v1/default/Pod/fake-pod-46-ftkwl": {}, + "/v1/default/Pod/fake-pod-46-fvbqk": {}, + "/v1/default/Pod/fake-pod-46-fvk2h": {}, + "/v1/default/Pod/fake-pod-46-fzml5": {}, + "/v1/default/Pod/fake-pod-46-g28mx": {}, + "/v1/default/Pod/fake-pod-46-g46gv": {}, + "/v1/default/Pod/fake-pod-46-g8bf2": {}, + "/v1/default/Pod/fake-pod-46-g9ctf": {}, + "/v1/default/Pod/fake-pod-46-gh65r": {}, + "/v1/default/Pod/fake-pod-46-ghmf8": {}, + "/v1/default/Pod/fake-pod-46-gmrmb": {}, + "/v1/default/Pod/fake-pod-46-gqflh": {}, + "/v1/default/Pod/fake-pod-46-gs57s": {}, + "/v1/default/Pod/fake-pod-46-gvgl7": {}, + "/v1/default/Pod/fake-pod-46-gz6z8": {}, + "/v1/default/Pod/fake-pod-46-gzmjt": {}, + "/v1/default/Pod/fake-pod-46-h5h6x": {}, + "/v1/default/Pod/fake-pod-46-h6jfp": {}, + "/v1/default/Pod/fake-pod-46-h7mmq": {}, + "/v1/default/Pod/fake-pod-46-h8rx4": {}, + "/v1/default/Pod/fake-pod-46-hchnl": {}, + "/v1/default/Pod/fake-pod-46-hd96m": {}, + "/v1/default/Pod/fake-pod-46-hgdbr": {}, + "/v1/default/Pod/fake-pod-46-hgq7t": {}, + "/v1/default/Pod/fake-pod-46-hhmkn": {}, + "/v1/default/Pod/fake-pod-46-hmtlk": {}, + "/v1/default/Pod/fake-pod-46-hqslj": {}, + "/v1/default/Pod/fake-pod-46-hr5pf": {}, + "/v1/default/Pod/fake-pod-46-hr6lg": {}, + "/v1/default/Pod/fake-pod-46-hrm82": {}, + "/v1/default/Pod/fake-pod-46-j2thq": {}, + "/v1/default/Pod/fake-pod-46-j5ttc": {}, + "/v1/default/Pod/fake-pod-46-j7k6r": {}, + "/v1/default/Pod/fake-pod-46-j7ph9": {}, + "/v1/default/Pod/fake-pod-46-jbclv": {}, + "/v1/default/Pod/fake-pod-46-jd6r2": {}, + "/v1/default/Pod/fake-pod-46-jfrd6": {}, + "/v1/default/Pod/fake-pod-46-jgfmz": {}, + "/v1/default/Pod/fake-pod-46-jmxq2": {}, + "/v1/default/Pod/fake-pod-46-jnbsf": {}, + "/v1/default/Pod/fake-pod-46-jqs7n": {}, + "/v1/default/Pod/fake-pod-46-jrc5x": {}, + "/v1/default/Pod/fake-pod-46-jzlht": {}, + "/v1/default/Pod/fake-pod-46-k27zd": {}, + "/v1/default/Pod/fake-pod-46-k4wzr": {}, + "/v1/default/Pod/fake-pod-46-k5hmz": {}, + "/v1/default/Pod/fake-pod-46-kcnp8": {}, + "/v1/default/Pod/fake-pod-46-kkcgs": {}, + "/v1/default/Pod/fake-pod-46-kkfjl": {}, + "/v1/default/Pod/fake-pod-46-ks5fd": {}, + "/v1/default/Pod/fake-pod-46-kxwr8": {}, + "/v1/default/Pod/fake-pod-46-kzz5l": {}, + "/v1/default/Pod/fake-pod-46-l2hlx": {}, + "/v1/default/Pod/fake-pod-46-l54nt": {}, + "/v1/default/Pod/fake-pod-46-l7z7d": {}, + "/v1/default/Pod/fake-pod-46-ldb8p": {}, + "/v1/default/Pod/fake-pod-46-lkb8l": {}, + "/v1/default/Pod/fake-pod-46-lm5jr": {}, + "/v1/default/Pod/fake-pod-46-lpc2z": {}, + "/v1/default/Pod/fake-pod-46-lr58n": {}, + "/v1/default/Pod/fake-pod-46-m2bch": {}, + "/v1/default/Pod/fake-pod-46-m5l4b": {}, + "/v1/default/Pod/fake-pod-46-m7v4v": {}, + "/v1/default/Pod/fake-pod-46-m7zg8": {}, + "/v1/default/Pod/fake-pod-46-m8n6h": {}, + "/v1/default/Pod/fake-pod-46-m97df": {}, + "/v1/default/Pod/fake-pod-46-mb4sk": {}, + "/v1/default/Pod/fake-pod-46-mgcsq": {}, + "/v1/default/Pod/fake-pod-46-mk9sn": {}, + "/v1/default/Pod/fake-pod-46-mmqnq": {}, + "/v1/default/Pod/fake-pod-46-mqkvv": {}, + "/v1/default/Pod/fake-pod-46-mvjj9": {}, + "/v1/default/Pod/fake-pod-46-mxqzw": {}, + "/v1/default/Pod/fake-pod-46-n2bns": {}, + "/v1/default/Pod/fake-pod-46-n6fm6": {}, + "/v1/default/Pod/fake-pod-46-n6z95": {}, + "/v1/default/Pod/fake-pod-46-n9ddt": {}, + "/v1/default/Pod/fake-pod-46-n9sr6": {}, + "/v1/default/Pod/fake-pod-46-nbjdb": {}, + "/v1/default/Pod/fake-pod-46-ndlv2": {}, + "/v1/default/Pod/fake-pod-46-ngqj5": {}, + "/v1/default/Pod/fake-pod-46-nh45b": {}, + "/v1/default/Pod/fake-pod-46-ns62f": {}, + "/v1/default/Pod/fake-pod-46-p2nsr": {}, + "/v1/default/Pod/fake-pod-46-p44zc": {}, + "/v1/default/Pod/fake-pod-46-p8k2x": {}, + "/v1/default/Pod/fake-pod-46-pbb8d": {}, + "/v1/default/Pod/fake-pod-46-pbvcb": {}, + "/v1/default/Pod/fake-pod-46-pgkdp": {}, + "/v1/default/Pod/fake-pod-46-pjm7x": {}, + "/v1/default/Pod/fake-pod-46-pp5v7": {}, + "/v1/default/Pod/fake-pod-46-pp9wc": {}, + "/v1/default/Pod/fake-pod-46-pz6wh": {}, + "/v1/default/Pod/fake-pod-46-q42xv": {}, + "/v1/default/Pod/fake-pod-46-q5vll": {}, + "/v1/default/Pod/fake-pod-46-q8gnc": {}, + "/v1/default/Pod/fake-pod-46-q8mk6": {}, + "/v1/default/Pod/fake-pod-46-qkbff": {}, + "/v1/default/Pod/fake-pod-46-qrddw": {}, + "/v1/default/Pod/fake-pod-46-qtqm8": {}, + "/v1/default/Pod/fake-pod-46-qwrxn": {}, + "/v1/default/Pod/fake-pod-46-r4lft": {}, + "/v1/default/Pod/fake-pod-46-r4xgz": {}, + "/v1/default/Pod/fake-pod-46-rckc7": {}, + "/v1/default/Pod/fake-pod-46-rcmk5": {}, + "/v1/default/Pod/fake-pod-46-rdkq6": {}, + "/v1/default/Pod/fake-pod-46-rdprv": {}, + "/v1/default/Pod/fake-pod-46-rg8p5": {}, + "/v1/default/Pod/fake-pod-46-rghd2": {}, + "/v1/default/Pod/fake-pod-46-rmm2r": {}, + "/v1/default/Pod/fake-pod-46-rtjt7": {}, + "/v1/default/Pod/fake-pod-46-rvhtf": {}, + "/v1/default/Pod/fake-pod-46-rvrjr": {}, + "/v1/default/Pod/fake-pod-46-rxq86": {}, + "/v1/default/Pod/fake-pod-46-rzq5x": {}, + "/v1/default/Pod/fake-pod-46-s2k52": {}, + "/v1/default/Pod/fake-pod-46-s2pl2": {}, + "/v1/default/Pod/fake-pod-46-s4nwn": {}, + "/v1/default/Pod/fake-pod-46-shrxp": {}, + "/v1/default/Pod/fake-pod-46-sj7f6": {}, + "/v1/default/Pod/fake-pod-46-sjp6f": {}, + "/v1/default/Pod/fake-pod-46-smvhb": {}, + "/v1/default/Pod/fake-pod-46-snxkn": {}, + "/v1/default/Pod/fake-pod-46-t68sv": {}, + "/v1/default/Pod/fake-pod-46-t6p26": {}, + "/v1/default/Pod/fake-pod-46-t6qg4": {}, + "/v1/default/Pod/fake-pod-46-t7xxn": {}, + "/v1/default/Pod/fake-pod-46-t87wz": {}, + "/v1/default/Pod/fake-pod-46-t8kfz": {}, + "/v1/default/Pod/fake-pod-46-tbbtt": {}, + "/v1/default/Pod/fake-pod-46-td58z": {}, + "/v1/default/Pod/fake-pod-46-thx47": {}, + "/v1/default/Pod/fake-pod-46-tjvxr": {}, + "/v1/default/Pod/fake-pod-46-tnfng": {}, + "/v1/default/Pod/fake-pod-46-tpnsd": {}, + "/v1/default/Pod/fake-pod-46-tz5dz": {}, + "/v1/default/Pod/fake-pod-46-v6pkk": {}, + "/v1/default/Pod/fake-pod-46-v8xhs": {}, + "/v1/default/Pod/fake-pod-46-vcn6j": {}, + "/v1/default/Pod/fake-pod-46-vhflw": {}, + "/v1/default/Pod/fake-pod-46-vrkzn": {}, + "/v1/default/Pod/fake-pod-46-vsgw4": {}, + "/v1/default/Pod/fake-pod-46-vw9wv": {}, + "/v1/default/Pod/fake-pod-46-vwwwv": {}, + "/v1/default/Pod/fake-pod-46-vxjlh": {}, + "/v1/default/Pod/fake-pod-46-w6lc2": {}, + "/v1/default/Pod/fake-pod-46-w72lp": {}, + "/v1/default/Pod/fake-pod-46-wlzt4": {}, + "/v1/default/Pod/fake-pod-46-wnnvj": {}, + "/v1/default/Pod/fake-pod-46-wqgf8": {}, + "/v1/default/Pod/fake-pod-46-wv9h9": {}, + "/v1/default/Pod/fake-pod-46-x492p": {}, + "/v1/default/Pod/fake-pod-46-x4jrg": {}, + "/v1/default/Pod/fake-pod-46-x4szl": {}, + "/v1/default/Pod/fake-pod-46-x8c4q": {}, + "/v1/default/Pod/fake-pod-46-x9fk6": {}, + "/v1/default/Pod/fake-pod-46-xcb8r": {}, + "/v1/default/Pod/fake-pod-46-xf629": {}, + "/v1/default/Pod/fake-pod-46-xh9dk": {}, + "/v1/default/Pod/fake-pod-46-xmctr": {}, + "/v1/default/Pod/fake-pod-46-xnlw5": {}, + "/v1/default/Pod/fake-pod-46-xpld2": {}, + "/v1/default/Pod/fake-pod-46-xsltv": {}, + "/v1/default/Pod/fake-pod-46-xtvzf": {}, + "/v1/default/Pod/fake-pod-46-xwx4x": {}, + "/v1/default/Pod/fake-pod-46-z44hz": {}, + "/v1/default/Pod/fake-pod-46-z54pl": {}, + "/v1/default/Pod/fake-pod-46-z6qf2": {}, + "/v1/default/Pod/fake-pod-46-z9nvv": {}, + "/v1/default/Pod/fake-pod-46-z9sth": {}, + "/v1/default/Pod/fake-pod-46-z9t56": {}, + "/v1/default/Pod/fake-pod-46-zbzbn": {}, + "/v1/default/Pod/fake-pod-46-zf9s2": {}, + "/v1/default/Pod/fake-pod-46-zgsqf": {}, + "/v1/default/Pod/fake-pod-46-zhtb6": {}, + "/v1/default/Pod/fake-pod-46-zjtcv": {}, + "/v1/default/Pod/fake-pod-46-zmpjn": {}, + "/v1/default/Pod/fake-pod-46-znmrg": {}, + "/v1/default/Pod/fake-pod-46-zpkvq": {}, + "/v1/default/Pod/fake-pod-46-zv7ks": {}, + "/v1/default/Pod/fake-pod-47-244fc": {}, + "/v1/default/Pod/fake-pod-47-2chh8": {}, + "/v1/default/Pod/fake-pod-47-2d5lw": {}, + "/v1/default/Pod/fake-pod-47-2grrj": {}, + "/v1/default/Pod/fake-pod-47-2kst8": {}, + "/v1/default/Pod/fake-pod-47-2lmgq": {}, + "/v1/default/Pod/fake-pod-47-2lvtc": {}, + "/v1/default/Pod/fake-pod-47-425j5": {}, + "/v1/default/Pod/fake-pod-47-42tqp": {}, + "/v1/default/Pod/fake-pod-47-45v66": {}, + "/v1/default/Pod/fake-pod-47-4d6vc": {}, + "/v1/default/Pod/fake-pod-47-4dcjf": {}, + "/v1/default/Pod/fake-pod-47-4fbhg": {}, + "/v1/default/Pod/fake-pod-47-4gj85": {}, + "/v1/default/Pod/fake-pod-47-4kfnw": {}, + "/v1/default/Pod/fake-pod-47-4knx5": {}, + "/v1/default/Pod/fake-pod-47-4ktfq": {}, + "/v1/default/Pod/fake-pod-47-4mm8c": {}, + "/v1/default/Pod/fake-pod-47-4wcrt": {}, + "/v1/default/Pod/fake-pod-47-4x7gs": {}, + "/v1/default/Pod/fake-pod-47-4xd5t": {}, + "/v1/default/Pod/fake-pod-47-52hzq": {}, + "/v1/default/Pod/fake-pod-47-5bpzb": {}, + "/v1/default/Pod/fake-pod-47-5f98l": {}, + "/v1/default/Pod/fake-pod-47-5hcgj": {}, + "/v1/default/Pod/fake-pod-47-5rt8t": {}, + "/v1/default/Pod/fake-pod-47-5tjhd": {}, + "/v1/default/Pod/fake-pod-47-5wwtj": {}, + "/v1/default/Pod/fake-pod-47-5zl8b": {}, + "/v1/default/Pod/fake-pod-47-64b7p": {}, + "/v1/default/Pod/fake-pod-47-662km": {}, + "/v1/default/Pod/fake-pod-47-66z58": {}, + "/v1/default/Pod/fake-pod-47-688fn": {}, + "/v1/default/Pod/fake-pod-47-68d6z": {}, + "/v1/default/Pod/fake-pod-47-68wff": {}, + "/v1/default/Pod/fake-pod-47-6hm24": {}, + "/v1/default/Pod/fake-pod-47-6kg24": {}, + "/v1/default/Pod/fake-pod-47-6kp2k": {}, + "/v1/default/Pod/fake-pod-47-6kr66": {}, + "/v1/default/Pod/fake-pod-47-6ncdc": {}, + "/v1/default/Pod/fake-pod-47-6pvmw": {}, + "/v1/default/Pod/fake-pod-47-6qxvm": {}, + "/v1/default/Pod/fake-pod-47-76xxv": {}, + "/v1/default/Pod/fake-pod-47-78nx6": {}, + "/v1/default/Pod/fake-pod-47-7fk6f": {}, + "/v1/default/Pod/fake-pod-47-7jk2s": {}, + "/v1/default/Pod/fake-pod-47-7qkjz": {}, + "/v1/default/Pod/fake-pod-47-7rlx9": {}, + "/v1/default/Pod/fake-pod-47-7sh26": {}, + "/v1/default/Pod/fake-pod-47-7ttq8": {}, + "/v1/default/Pod/fake-pod-47-7wm8c": {}, + "/v1/default/Pod/fake-pod-47-7zmjj": {}, + "/v1/default/Pod/fake-pod-47-84mpz": {}, + "/v1/default/Pod/fake-pod-47-85spq": {}, + "/v1/default/Pod/fake-pod-47-874f4": {}, + "/v1/default/Pod/fake-pod-47-879rr": {}, + "/v1/default/Pod/fake-pod-47-88jjx": {}, + "/v1/default/Pod/fake-pod-47-89cfx": {}, + "/v1/default/Pod/fake-pod-47-89m7r": {}, + "/v1/default/Pod/fake-pod-47-8bq6f": {}, + "/v1/default/Pod/fake-pod-47-8cfcj": {}, + "/v1/default/Pod/fake-pod-47-8ggsh": {}, + "/v1/default/Pod/fake-pod-47-8kqhp": {}, + "/v1/default/Pod/fake-pod-47-8kqj2": {}, + "/v1/default/Pod/fake-pod-47-8rfc5": {}, + "/v1/default/Pod/fake-pod-47-8wxsg": {}, + "/v1/default/Pod/fake-pod-47-99hg7": {}, + "/v1/default/Pod/fake-pod-47-9f228": {}, + "/v1/default/Pod/fake-pod-47-9fhcb": {}, + "/v1/default/Pod/fake-pod-47-9fwx5": {}, + "/v1/default/Pod/fake-pod-47-9grhn": {}, + "/v1/default/Pod/fake-pod-47-9hz7p": {}, + "/v1/default/Pod/fake-pod-47-9ls7x": {}, + "/v1/default/Pod/fake-pod-47-9pnkh": {}, + "/v1/default/Pod/fake-pod-47-9qpw7": {}, + "/v1/default/Pod/fake-pod-47-9rdh8": {}, + "/v1/default/Pod/fake-pod-47-9scpd": {}, + "/v1/default/Pod/fake-pod-47-9tdk5": {}, + "/v1/default/Pod/fake-pod-47-9xw46": {}, + "/v1/default/Pod/fake-pod-47-b564v": {}, + "/v1/default/Pod/fake-pod-47-b5lzk": {}, + "/v1/default/Pod/fake-pod-47-b6s8b": {}, + "/v1/default/Pod/fake-pod-47-bb7vv": {}, + "/v1/default/Pod/fake-pod-47-bc66b": {}, + "/v1/default/Pod/fake-pod-47-bdskz": {}, + "/v1/default/Pod/fake-pod-47-bg826": {}, + "/v1/default/Pod/fake-pod-47-bgpz5": {}, + "/v1/default/Pod/fake-pod-47-bh857": {}, + "/v1/default/Pod/fake-pod-47-bhcxp": {}, + "/v1/default/Pod/fake-pod-47-bl4hs": {}, + "/v1/default/Pod/fake-pod-47-bp95l": {}, + "/v1/default/Pod/fake-pod-47-bpkf8": {}, + "/v1/default/Pod/fake-pod-47-btdgr": {}, + "/v1/default/Pod/fake-pod-47-bw4wp": {}, + "/v1/default/Pod/fake-pod-47-c4crp": {}, + "/v1/default/Pod/fake-pod-47-c4dmk": {}, + "/v1/default/Pod/fake-pod-47-c6t56": {}, + "/v1/default/Pod/fake-pod-47-cfw6k": {}, + "/v1/default/Pod/fake-pod-47-chbvt": {}, + "/v1/default/Pod/fake-pod-47-cmtzk": {}, + "/v1/default/Pod/fake-pod-47-cnqx8": {}, + "/v1/default/Pod/fake-pod-47-cq79d": {}, + "/v1/default/Pod/fake-pod-47-cxjbt": {}, + "/v1/default/Pod/fake-pod-47-d6lcm": {}, + "/v1/default/Pod/fake-pod-47-d84z4": {}, + "/v1/default/Pod/fake-pod-47-d8h24": {}, + "/v1/default/Pod/fake-pod-47-d9jmp": {}, + "/v1/default/Pod/fake-pod-47-ddsxz": {}, + "/v1/default/Pod/fake-pod-47-dgf9z": {}, + "/v1/default/Pod/fake-pod-47-djrjb": {}, + "/v1/default/Pod/fake-pod-47-djw5p": {}, + "/v1/default/Pod/fake-pod-47-dk4th": {}, + "/v1/default/Pod/fake-pod-47-dlwhc": {}, + "/v1/default/Pod/fake-pod-47-dp6nv": {}, + "/v1/default/Pod/fake-pod-47-drbdm": {}, + "/v1/default/Pod/fake-pod-47-dwrdc": {}, + "/v1/default/Pod/fake-pod-47-f2d98": {}, + "/v1/default/Pod/fake-pod-47-f2psm": {}, + "/v1/default/Pod/fake-pod-47-f7jq5": {}, + "/v1/default/Pod/fake-pod-47-f7lb6": {}, + "/v1/default/Pod/fake-pod-47-fh866": {}, + "/v1/default/Pod/fake-pod-47-fhkfv": {}, + "/v1/default/Pod/fake-pod-47-fjtr8": {}, + "/v1/default/Pod/fake-pod-47-fmmwq": {}, + "/v1/default/Pod/fake-pod-47-fpg5f": {}, + "/v1/default/Pod/fake-pod-47-ftm5c": {}, + "/v1/default/Pod/fake-pod-47-fxvfl": {}, + "/v1/default/Pod/fake-pod-47-g5lfw": {}, + "/v1/default/Pod/fake-pod-47-g8hlg": {}, + "/v1/default/Pod/fake-pod-47-gd94v": {}, + "/v1/default/Pod/fake-pod-47-gdvdv": {}, + "/v1/default/Pod/fake-pod-47-gg7sl": {}, + "/v1/default/Pod/fake-pod-47-gjtx6": {}, + "/v1/default/Pod/fake-pod-47-gq6bf": {}, + "/v1/default/Pod/fake-pod-47-gzstr": {}, + "/v1/default/Pod/fake-pod-47-h5jkh": {}, + "/v1/default/Pod/fake-pod-47-h9tv5": {}, + "/v1/default/Pod/fake-pod-47-hbdjv": {}, + "/v1/default/Pod/fake-pod-47-hbf6c": {}, + "/v1/default/Pod/fake-pod-47-hg9dt": {}, + "/v1/default/Pod/fake-pod-47-hjg7x": {}, + "/v1/default/Pod/fake-pod-47-hqnt9": {}, + "/v1/default/Pod/fake-pod-47-hqrxn": {}, + "/v1/default/Pod/fake-pod-47-hrjbh": {}, + "/v1/default/Pod/fake-pod-47-hvdxh": {}, + "/v1/default/Pod/fake-pod-47-hvrkl": {}, + "/v1/default/Pod/fake-pod-47-hzh7m": {}, + "/v1/default/Pod/fake-pod-47-j42p5": {}, + "/v1/default/Pod/fake-pod-47-jf4zj": {}, + "/v1/default/Pod/fake-pod-47-jmf6l": {}, + "/v1/default/Pod/fake-pod-47-jmfrz": {}, + "/v1/default/Pod/fake-pod-47-jtqx6": {}, + "/v1/default/Pod/fake-pod-47-jx8td": {}, + "/v1/default/Pod/fake-pod-47-jxznp": {}, + "/v1/default/Pod/fake-pod-47-jzmgh": {}, + "/v1/default/Pod/fake-pod-47-k2dmj": {}, + "/v1/default/Pod/fake-pod-47-k5ckf": {}, + "/v1/default/Pod/fake-pod-47-k5pmw": {}, + "/v1/default/Pod/fake-pod-47-k7z6r": {}, + "/v1/default/Pod/fake-pod-47-kl682": {}, + "/v1/default/Pod/fake-pod-47-kp8nn": {}, + "/v1/default/Pod/fake-pod-47-kr42x": {}, + "/v1/default/Pod/fake-pod-47-krkdn": {}, + "/v1/default/Pod/fake-pod-47-kxpgm": {}, + "/v1/default/Pod/fake-pod-47-kz7sb": {}, + "/v1/default/Pod/fake-pod-47-kz7sj": {}, + "/v1/default/Pod/fake-pod-47-kztl8": {}, + "/v1/default/Pod/fake-pod-47-l5b7g": {}, + "/v1/default/Pod/fake-pod-47-l5pf2": {}, + "/v1/default/Pod/fake-pod-47-l7h2f": {}, + "/v1/default/Pod/fake-pod-47-l9lvp": {}, + "/v1/default/Pod/fake-pod-47-ll8c2": {}, + "/v1/default/Pod/fake-pod-47-lm2gj": {}, + "/v1/default/Pod/fake-pod-47-lqlpn": {}, + "/v1/default/Pod/fake-pod-47-lqtqj": {}, + "/v1/default/Pod/fake-pod-47-lw28d": {}, + "/v1/default/Pod/fake-pod-47-lxd6m": {}, + "/v1/default/Pod/fake-pod-47-m9dgv": {}, + "/v1/default/Pod/fake-pod-47-mcthh": {}, + "/v1/default/Pod/fake-pod-47-mf9r9": {}, + "/v1/default/Pod/fake-pod-47-mfj8r": {}, + "/v1/default/Pod/fake-pod-47-mfmdr": {}, + "/v1/default/Pod/fake-pod-47-mr8dm": {}, + "/v1/default/Pod/fake-pod-47-msgg8": {}, + "/v1/default/Pod/fake-pod-47-mtnlz": {}, + "/v1/default/Pod/fake-pod-47-mv2j8": {}, + "/v1/default/Pod/fake-pod-47-mz59f": {}, + "/v1/default/Pod/fake-pod-47-n4mr6": {}, + "/v1/default/Pod/fake-pod-47-n5rzd": {}, + "/v1/default/Pod/fake-pod-47-n8vkf": {}, + "/v1/default/Pod/fake-pod-47-n96zc": {}, + "/v1/default/Pod/fake-pod-47-n9sn6": {}, + "/v1/default/Pod/fake-pod-47-nfzln": {}, + "/v1/default/Pod/fake-pod-47-njgmc": {}, + "/v1/default/Pod/fake-pod-47-nkdv5": {}, + "/v1/default/Pod/fake-pod-47-np67j": {}, + "/v1/default/Pod/fake-pod-47-nqjhd": {}, + "/v1/default/Pod/fake-pod-47-nr49l": {}, + "/v1/default/Pod/fake-pod-47-ns5t4": {}, + "/v1/default/Pod/fake-pod-47-nsc44": {}, + "/v1/default/Pod/fake-pod-47-nsjjt": {}, + "/v1/default/Pod/fake-pod-47-p4rbs": {}, + "/v1/default/Pod/fake-pod-47-p4xb6": {}, + "/v1/default/Pod/fake-pod-47-p8s74": {}, + "/v1/default/Pod/fake-pod-47-p98fj": {}, + "/v1/default/Pod/fake-pod-47-pdfpp": {}, + "/v1/default/Pod/fake-pod-47-pdkmz": {}, + "/v1/default/Pod/fake-pod-47-plwqm": {}, + "/v1/default/Pod/fake-pod-47-pmbtc": {}, + "/v1/default/Pod/fake-pod-47-pmrwh": {}, + "/v1/default/Pod/fake-pod-47-pmzkz": {}, + "/v1/default/Pod/fake-pod-47-ppmvd": {}, + "/v1/default/Pod/fake-pod-47-pvftt": {}, + "/v1/default/Pod/fake-pod-47-pxldh": {}, + "/v1/default/Pod/fake-pod-47-q9rmv": {}, + "/v1/default/Pod/fake-pod-47-qcfvk": {}, + "/v1/default/Pod/fake-pod-47-qgkwz": {}, + "/v1/default/Pod/fake-pod-47-qm84h": {}, + "/v1/default/Pod/fake-pod-47-qn7dr": {}, + "/v1/default/Pod/fake-pod-47-qrq68": {}, + "/v1/default/Pod/fake-pod-47-qsdpt": {}, + "/v1/default/Pod/fake-pod-47-qtspl": {}, + "/v1/default/Pod/fake-pod-47-qwng6": {}, + "/v1/default/Pod/fake-pod-47-qz8bf": {}, + "/v1/default/Pod/fake-pod-47-r7kx7": {}, + "/v1/default/Pod/fake-pod-47-r7wfv": {}, + "/v1/default/Pod/fake-pod-47-r8rcp": {}, + "/v1/default/Pod/fake-pod-47-rcmv7": {}, + "/v1/default/Pod/fake-pod-47-rm7sx": {}, + "/v1/default/Pod/fake-pod-47-rpvpm": {}, + "/v1/default/Pod/fake-pod-47-rqf45": {}, + "/v1/default/Pod/fake-pod-47-rvbvz": {}, + "/v1/default/Pod/fake-pod-47-rz2qr": {}, + "/v1/default/Pod/fake-pod-47-rzvzr": {}, + "/v1/default/Pod/fake-pod-47-s26hx": {}, + "/v1/default/Pod/fake-pod-47-s589n": {}, + "/v1/default/Pod/fake-pod-47-s5c5k": {}, + "/v1/default/Pod/fake-pod-47-s6bf6": {}, + "/v1/default/Pod/fake-pod-47-scgpz": {}, + "/v1/default/Pod/fake-pod-47-sgfb4": {}, + "/v1/default/Pod/fake-pod-47-sh6hz": {}, + "/v1/default/Pod/fake-pod-47-sk9vp": {}, + "/v1/default/Pod/fake-pod-47-smdmb": {}, + "/v1/default/Pod/fake-pod-47-snbwm": {}, + "/v1/default/Pod/fake-pod-47-sqhz5": {}, + "/v1/default/Pod/fake-pod-47-swpt6": {}, + "/v1/default/Pod/fake-pod-47-sx4p8": {}, + "/v1/default/Pod/fake-pod-47-t64tl": {}, + "/v1/default/Pod/fake-pod-47-t6vv9": {}, + "/v1/default/Pod/fake-pod-47-t6wvd": {}, + "/v1/default/Pod/fake-pod-47-t75ws": {}, + "/v1/default/Pod/fake-pod-47-t888h": {}, + "/v1/default/Pod/fake-pod-47-td9rt": {}, + "/v1/default/Pod/fake-pod-47-tf57p": {}, + "/v1/default/Pod/fake-pod-47-tktn4": {}, + "/v1/default/Pod/fake-pod-47-tpdql": {}, + "/v1/default/Pod/fake-pod-47-tw4s8": {}, + "/v1/default/Pod/fake-pod-47-v45wd": {}, + "/v1/default/Pod/fake-pod-47-v5d7b": {}, + "/v1/default/Pod/fake-pod-47-v5fqd": {}, + "/v1/default/Pod/fake-pod-47-v9qp6": {}, + "/v1/default/Pod/fake-pod-47-vbqj6": {}, + "/v1/default/Pod/fake-pod-47-vg6fg": {}, + "/v1/default/Pod/fake-pod-47-vjh96": {}, + "/v1/default/Pod/fake-pod-47-vkhdv": {}, + "/v1/default/Pod/fake-pod-47-vp4d6": {}, + "/v1/default/Pod/fake-pod-47-vpftk": {}, + "/v1/default/Pod/fake-pod-47-vs2qb": {}, + "/v1/default/Pod/fake-pod-47-wb5t6": {}, + "/v1/default/Pod/fake-pod-47-wcpr8": {}, + "/v1/default/Pod/fake-pod-47-wgfqb": {}, + "/v1/default/Pod/fake-pod-47-wjmwv": {}, + "/v1/default/Pod/fake-pod-47-wpdds": {}, + "/v1/default/Pod/fake-pod-47-wsj8x": {}, + "/v1/default/Pod/fake-pod-47-wtg9g": {}, + "/v1/default/Pod/fake-pod-47-wzcvg": {}, + "/v1/default/Pod/fake-pod-47-x6l27": {}, + "/v1/default/Pod/fake-pod-47-xcfmj": {}, + "/v1/default/Pod/fake-pod-47-xdljw": {}, + "/v1/default/Pod/fake-pod-47-xn5f4": {}, + "/v1/default/Pod/fake-pod-47-xp9qv": {}, + "/v1/default/Pod/fake-pod-47-xpddk": {}, + "/v1/default/Pod/fake-pod-47-xpsbq": {}, + "/v1/default/Pod/fake-pod-47-xtr7b": {}, + "/v1/default/Pod/fake-pod-47-xvb56": {}, + "/v1/default/Pod/fake-pod-47-xww5n": {}, + "/v1/default/Pod/fake-pod-47-z5nhk": {}, + "/v1/default/Pod/fake-pod-47-z6s7x": {}, + "/v1/default/Pod/fake-pod-47-zfhbq": {}, + "/v1/default/Pod/fake-pod-47-zh4n4": {}, + "/v1/default/Pod/fake-pod-47-zjnb5": {}, + "/v1/default/Pod/fake-pod-47-zk6h6": {}, + "/v1/default/Pod/fake-pod-47-zlb8s": {}, + "/v1/default/Pod/fake-pod-47-znlrf": {}, + "/v1/default/Pod/fake-pod-47-zp6dz": {}, + "/v1/default/Pod/fake-pod-47-zpdmv": {}, + "/v1/default/Pod/fake-pod-47-zsbl2": {}, + "/v1/default/Pod/fake-pod-47-zz2z7": {}, + "/v1/default/Pod/fake-pod-47-zz4cj": {}, + "/v1/default/Pod/fake-pod-48-2b94p": {}, + "/v1/default/Pod/fake-pod-48-2cnv2": {}, + "/v1/default/Pod/fake-pod-48-2dbsm": {}, + "/v1/default/Pod/fake-pod-48-2dch9": {}, + "/v1/default/Pod/fake-pod-48-2dw8c": {}, + "/v1/default/Pod/fake-pod-48-2f9s5": {}, + "/v1/default/Pod/fake-pod-48-2gzw6": {}, + "/v1/default/Pod/fake-pod-48-2kqnr": {}, + "/v1/default/Pod/fake-pod-48-46hv2": {}, + "/v1/default/Pod/fake-pod-48-487fb": {}, + "/v1/default/Pod/fake-pod-48-4b64s": {}, + "/v1/default/Pod/fake-pod-48-4jqqn": {}, + "/v1/default/Pod/fake-pod-48-4ksnf": {}, + "/v1/default/Pod/fake-pod-48-4lnbm": {}, + "/v1/default/Pod/fake-pod-48-4mxvx": {}, + "/v1/default/Pod/fake-pod-48-4np6r": {}, + "/v1/default/Pod/fake-pod-48-4npm2": {}, + "/v1/default/Pod/fake-pod-48-4vgmm": {}, + "/v1/default/Pod/fake-pod-48-4w7wh": {}, + "/v1/default/Pod/fake-pod-48-4x4zg": {}, + "/v1/default/Pod/fake-pod-48-56w9z": {}, + "/v1/default/Pod/fake-pod-48-58cp9": {}, + "/v1/default/Pod/fake-pod-48-59fqq": {}, + "/v1/default/Pod/fake-pod-48-59lv6": {}, + "/v1/default/Pod/fake-pod-48-5f2sm": {}, + "/v1/default/Pod/fake-pod-48-5mxfx": {}, + "/v1/default/Pod/fake-pod-48-5shdx": {}, + "/v1/default/Pod/fake-pod-48-5w4gw": {}, + "/v1/default/Pod/fake-pod-48-658ks": {}, + "/v1/default/Pod/fake-pod-48-6c77x": {}, + "/v1/default/Pod/fake-pod-48-6nmpp": {}, + "/v1/default/Pod/fake-pod-48-6nz7w": {}, + "/v1/default/Pod/fake-pod-48-6psg9": {}, + "/v1/default/Pod/fake-pod-48-6r7p5": {}, + "/v1/default/Pod/fake-pod-48-6xm77": {}, + "/v1/default/Pod/fake-pod-48-76brs": {}, + "/v1/default/Pod/fake-pod-48-7fpd7": {}, + "/v1/default/Pod/fake-pod-48-7hgff": {}, + "/v1/default/Pod/fake-pod-48-7v45r": {}, + "/v1/default/Pod/fake-pod-48-7xhhc": {}, + "/v1/default/Pod/fake-pod-48-7zzpn": {}, + "/v1/default/Pod/fake-pod-48-84b65": {}, + "/v1/default/Pod/fake-pod-48-84krd": {}, + "/v1/default/Pod/fake-pod-48-8c7c6": {}, + "/v1/default/Pod/fake-pod-48-8cssf": {}, + "/v1/default/Pod/fake-pod-48-8d799": {}, + "/v1/default/Pod/fake-pod-48-8dkcc": {}, + "/v1/default/Pod/fake-pod-48-8jv9s": {}, + "/v1/default/Pod/fake-pod-48-8md95": {}, + "/v1/default/Pod/fake-pod-48-8pvtp": {}, + "/v1/default/Pod/fake-pod-48-8q5jz": {}, + "/v1/default/Pod/fake-pod-48-8s9k4": {}, + "/v1/default/Pod/fake-pod-48-8tt9k": {}, + "/v1/default/Pod/fake-pod-48-8w9dk": {}, + "/v1/default/Pod/fake-pod-48-8xmvl": {}, + "/v1/default/Pod/fake-pod-48-96kv7": {}, + "/v1/default/Pod/fake-pod-48-9bnfk": {}, + "/v1/default/Pod/fake-pod-48-9d8tv": {}, + "/v1/default/Pod/fake-pod-48-9fqsl": {}, + "/v1/default/Pod/fake-pod-48-9kvcw": {}, + "/v1/default/Pod/fake-pod-48-9lxfl": {}, + "/v1/default/Pod/fake-pod-48-9mglt": {}, + "/v1/default/Pod/fake-pod-48-9mllj": {}, + "/v1/default/Pod/fake-pod-48-9ng2q": {}, + "/v1/default/Pod/fake-pod-48-9phw5": {}, + "/v1/default/Pod/fake-pod-48-9t7rl": {}, + "/v1/default/Pod/fake-pod-48-9vnz2": {}, + "/v1/default/Pod/fake-pod-48-9vrr9": {}, + "/v1/default/Pod/fake-pod-48-9whtz": {}, + "/v1/default/Pod/fake-pod-48-9xh2s": {}, + "/v1/default/Pod/fake-pod-48-b5l76": {}, + "/v1/default/Pod/fake-pod-48-b6bdw": {}, + "/v1/default/Pod/fake-pod-48-b6gns": {}, + "/v1/default/Pod/fake-pod-48-b8dpv": {}, + "/v1/default/Pod/fake-pod-48-b8lps": {}, + "/v1/default/Pod/fake-pod-48-b8ngb": {}, + "/v1/default/Pod/fake-pod-48-b9md5": {}, + "/v1/default/Pod/fake-pod-48-bbn8x": {}, + "/v1/default/Pod/fake-pod-48-bk85v": {}, + "/v1/default/Pod/fake-pod-48-blz2f": {}, + "/v1/default/Pod/fake-pod-48-bn4cr": {}, + "/v1/default/Pod/fake-pod-48-bn98c": {}, + "/v1/default/Pod/fake-pod-48-bnzd6": {}, + "/v1/default/Pod/fake-pod-48-bpnq4": {}, + "/v1/default/Pod/fake-pod-48-bswb2": {}, + "/v1/default/Pod/fake-pod-48-btmdd": {}, + "/v1/default/Pod/fake-pod-48-bxp4m": {}, + "/v1/default/Pod/fake-pod-48-c4mbx": {}, + "/v1/default/Pod/fake-pod-48-c4qjr": {}, + "/v1/default/Pod/fake-pod-48-c8fb6": {}, + "/v1/default/Pod/fake-pod-48-cjq26": {}, + "/v1/default/Pod/fake-pod-48-cmk7v": {}, + "/v1/default/Pod/fake-pod-48-cmngz": {}, + "/v1/default/Pod/fake-pod-48-cp684": {}, + "/v1/default/Pod/fake-pod-48-crn94": {}, + "/v1/default/Pod/fake-pod-48-czxzp": {}, + "/v1/default/Pod/fake-pod-48-d2g64": {}, + "/v1/default/Pod/fake-pod-48-d2kg6": {}, + "/v1/default/Pod/fake-pod-48-d2mmm": {}, + "/v1/default/Pod/fake-pod-48-d6hh6": {}, + "/v1/default/Pod/fake-pod-48-d75jb": {}, + "/v1/default/Pod/fake-pod-48-dbtpr": {}, + "/v1/default/Pod/fake-pod-48-dfqjd": {}, + "/v1/default/Pod/fake-pod-48-djnt6": {}, + "/v1/default/Pod/fake-pod-48-dlq58": {}, + "/v1/default/Pod/fake-pod-48-dn6gd": {}, + "/v1/default/Pod/fake-pod-48-dtwmv": {}, + "/v1/default/Pod/fake-pod-48-f26zn": {}, + "/v1/default/Pod/fake-pod-48-f5lzz": {}, + "/v1/default/Pod/fake-pod-48-f874w": {}, + "/v1/default/Pod/fake-pod-48-f9qg7": {}, + "/v1/default/Pod/fake-pod-48-fcmmr": {}, + "/v1/default/Pod/fake-pod-48-fnrdd": {}, + "/v1/default/Pod/fake-pod-48-fq9bl": {}, + "/v1/default/Pod/fake-pod-48-fssl2": {}, + "/v1/default/Pod/fake-pod-48-fsvqd": {}, + "/v1/default/Pod/fake-pod-48-fv2wm": {}, + "/v1/default/Pod/fake-pod-48-fvb4b": {}, + "/v1/default/Pod/fake-pod-48-fw8gr": {}, + "/v1/default/Pod/fake-pod-48-g6lg9": {}, + "/v1/default/Pod/fake-pod-48-g744x": {}, + "/v1/default/Pod/fake-pod-48-gb9l2": {}, + "/v1/default/Pod/fake-pod-48-gfpgv": {}, + "/v1/default/Pod/fake-pod-48-ghkrd": {}, + "/v1/default/Pod/fake-pod-48-gqcwd": {}, + "/v1/default/Pod/fake-pod-48-grfjm": {}, + "/v1/default/Pod/fake-pod-48-gv74d": {}, + "/v1/default/Pod/fake-pod-48-gxqvw": {}, + "/v1/default/Pod/fake-pod-48-h7mg4": {}, + "/v1/default/Pod/fake-pod-48-hdqld": {}, + "/v1/default/Pod/fake-pod-48-hjcdw": {}, + "/v1/default/Pod/fake-pod-48-hnrs8": {}, + "/v1/default/Pod/fake-pod-48-hql9d": {}, + "/v1/default/Pod/fake-pod-48-hrzhd": {}, + "/v1/default/Pod/fake-pod-48-hx264": {}, + "/v1/default/Pod/fake-pod-48-j4wcn": {}, + "/v1/default/Pod/fake-pod-48-j9brx": {}, + "/v1/default/Pod/fake-pod-48-jc4xs": {}, + "/v1/default/Pod/fake-pod-48-jc9pq": {}, + "/v1/default/Pod/fake-pod-48-jcx2k": {}, + "/v1/default/Pod/fake-pod-48-jddc6": {}, + "/v1/default/Pod/fake-pod-48-jfvlg": {}, + "/v1/default/Pod/fake-pod-48-jnl8x": {}, + "/v1/default/Pod/fake-pod-48-jscjp": {}, + "/v1/default/Pod/fake-pod-48-jscmz": {}, + "/v1/default/Pod/fake-pod-48-jsl7l": {}, + "/v1/default/Pod/fake-pod-48-jwz2b": {}, + "/v1/default/Pod/fake-pod-48-k2fzk": {}, + "/v1/default/Pod/fake-pod-48-k2mpl": {}, + "/v1/default/Pod/fake-pod-48-kbxjg": {}, + "/v1/default/Pod/fake-pod-48-kfjg9": {}, + "/v1/default/Pod/fake-pod-48-khlmg": {}, + "/v1/default/Pod/fake-pod-48-kjjw2": {}, + "/v1/default/Pod/fake-pod-48-kjlgj": {}, + "/v1/default/Pod/fake-pod-48-kkhb7": {}, + "/v1/default/Pod/fake-pod-48-km6xm": {}, + "/v1/default/Pod/fake-pod-48-kmt56": {}, + "/v1/default/Pod/fake-pod-48-kpn5z": {}, + "/v1/default/Pod/fake-pod-48-kqnrp": {}, + "/v1/default/Pod/fake-pod-48-kvvbm": {}, + "/v1/default/Pod/fake-pod-48-l2rg8": {}, + "/v1/default/Pod/fake-pod-48-ld97j": {}, + "/v1/default/Pod/fake-pod-48-lf75b": {}, + "/v1/default/Pod/fake-pod-48-lfqx6": {}, + "/v1/default/Pod/fake-pod-48-ll77l": {}, + "/v1/default/Pod/fake-pod-48-lljnj": {}, + "/v1/default/Pod/fake-pod-48-lnc2m": {}, + "/v1/default/Pod/fake-pod-48-lqdlg": {}, + "/v1/default/Pod/fake-pod-48-lszsr": {}, + "/v1/default/Pod/fake-pod-48-lxbsw": {}, + "/v1/default/Pod/fake-pod-48-lxwrf": {}, + "/v1/default/Pod/fake-pod-48-lz6qh": {}, + "/v1/default/Pod/fake-pod-48-m4nf8": {}, + "/v1/default/Pod/fake-pod-48-m56lc": {}, + "/v1/default/Pod/fake-pod-48-m7hsw": {}, + "/v1/default/Pod/fake-pod-48-m966j": {}, + "/v1/default/Pod/fake-pod-48-mhbfd": {}, + "/v1/default/Pod/fake-pod-48-mj65t": {}, + "/v1/default/Pod/fake-pod-48-mkprf": {}, + "/v1/default/Pod/fake-pod-48-mnlfq": {}, + "/v1/default/Pod/fake-pod-48-mr7kn": {}, + "/v1/default/Pod/fake-pod-48-mstn5": {}, + "/v1/default/Pod/fake-pod-48-mv6nm": {}, + "/v1/default/Pod/fake-pod-48-mwzfj": {}, + "/v1/default/Pod/fake-pod-48-mzsnw": {}, + "/v1/default/Pod/fake-pod-48-n2g5d": {}, + "/v1/default/Pod/fake-pod-48-n2v6q": {}, + "/v1/default/Pod/fake-pod-48-n9djb": {}, + "/v1/default/Pod/fake-pod-48-ngm64": {}, + "/v1/default/Pod/fake-pod-48-njdgm": {}, + "/v1/default/Pod/fake-pod-48-njvrr": {}, + "/v1/default/Pod/fake-pod-48-nnm4x": {}, + "/v1/default/Pod/fake-pod-48-nps4s": {}, + "/v1/default/Pod/fake-pod-48-nqfcx": {}, + "/v1/default/Pod/fake-pod-48-p2bvn": {}, + "/v1/default/Pod/fake-pod-48-p7kt7": {}, + "/v1/default/Pod/fake-pod-48-p7s7v": {}, + "/v1/default/Pod/fake-pod-48-pccpx": {}, + "/v1/default/Pod/fake-pod-48-pchh4": {}, + "/v1/default/Pod/fake-pod-48-pd42f": {}, + "/v1/default/Pod/fake-pod-48-pf5c4": {}, + "/v1/default/Pod/fake-pod-48-phrrx": {}, + "/v1/default/Pod/fake-pod-48-pkvhn": {}, + "/v1/default/Pod/fake-pod-48-pmmhb": {}, + "/v1/default/Pod/fake-pod-48-pqfd2": {}, + "/v1/default/Pod/fake-pod-48-pqrc8": {}, + "/v1/default/Pod/fake-pod-48-pwftq": {}, + "/v1/default/Pod/fake-pod-48-pznk4": {}, + "/v1/default/Pod/fake-pod-48-q6snh": {}, + "/v1/default/Pod/fake-pod-48-q8xw6": {}, + "/v1/default/Pod/fake-pod-48-qfc9t": {}, + "/v1/default/Pod/fake-pod-48-qh5w9": {}, + "/v1/default/Pod/fake-pod-48-qhrpc": {}, + "/v1/default/Pod/fake-pod-48-qsl4k": {}, + "/v1/default/Pod/fake-pod-48-qvq86": {}, + "/v1/default/Pod/fake-pod-48-qxz6q": {}, + "/v1/default/Pod/fake-pod-48-qxz8v": {}, + "/v1/default/Pod/fake-pod-48-r2kvh": {}, + "/v1/default/Pod/fake-pod-48-r4lzv": {}, + "/v1/default/Pod/fake-pod-48-r6s8d": {}, + "/v1/default/Pod/fake-pod-48-r9xcx": {}, + "/v1/default/Pod/fake-pod-48-rd9gl": {}, + "/v1/default/Pod/fake-pod-48-rjvtm": {}, + "/v1/default/Pod/fake-pod-48-rkgcg": {}, + "/v1/default/Pod/fake-pod-48-rpjw6": {}, + "/v1/default/Pod/fake-pod-48-rs97k": {}, + "/v1/default/Pod/fake-pod-48-rwpqz": {}, + "/v1/default/Pod/fake-pod-48-rzmfs": {}, + "/v1/default/Pod/fake-pod-48-rzntx": {}, + "/v1/default/Pod/fake-pod-48-s2xdz": {}, + "/v1/default/Pod/fake-pod-48-s4jb6": {}, + "/v1/default/Pod/fake-pod-48-sckfk": {}, + "/v1/default/Pod/fake-pod-48-sg8fd": {}, + "/v1/default/Pod/fake-pod-48-sjsmm": {}, + "/v1/default/Pod/fake-pod-48-slgtc": {}, + "/v1/default/Pod/fake-pod-48-sp9z6": {}, + "/v1/default/Pod/fake-pod-48-ssxl9": {}, + "/v1/default/Pod/fake-pod-48-st47k": {}, + "/v1/default/Pod/fake-pod-48-sxk5c": {}, + "/v1/default/Pod/fake-pod-48-t5mvg": {}, + "/v1/default/Pod/fake-pod-48-t6km4": {}, + "/v1/default/Pod/fake-pod-48-t7vfr": {}, + "/v1/default/Pod/fake-pod-48-tfkgg": {}, + "/v1/default/Pod/fake-pod-48-tfkjw": {}, + "/v1/default/Pod/fake-pod-48-tj8c9": {}, + "/v1/default/Pod/fake-pod-48-tmphc": {}, + "/v1/default/Pod/fake-pod-48-tqb8p": {}, + "/v1/default/Pod/fake-pod-48-tswxs": {}, + "/v1/default/Pod/fake-pod-48-tx7b7": {}, + "/v1/default/Pod/fake-pod-48-v26qx": {}, + "/v1/default/Pod/fake-pod-48-v5z2p": {}, + "/v1/default/Pod/fake-pod-48-v9qzs": {}, + "/v1/default/Pod/fake-pod-48-vhw6r": {}, + "/v1/default/Pod/fake-pod-48-vjlwb": {}, + "/v1/default/Pod/fake-pod-48-vkd9c": {}, + "/v1/default/Pod/fake-pod-48-vkr7l": {}, + "/v1/default/Pod/fake-pod-48-vnp6q": {}, + "/v1/default/Pod/fake-pod-48-vnxcp": {}, + "/v1/default/Pod/fake-pod-48-vq4wr": {}, + "/v1/default/Pod/fake-pod-48-vqcnn": {}, + "/v1/default/Pod/fake-pod-48-vrb2m": {}, + "/v1/default/Pod/fake-pod-48-vxwrl": {}, + "/v1/default/Pod/fake-pod-48-vzdjp": {}, + "/v1/default/Pod/fake-pod-48-w2tdv": {}, + "/v1/default/Pod/fake-pod-48-w5k5f": {}, + "/v1/default/Pod/fake-pod-48-w7g77": {}, + "/v1/default/Pod/fake-pod-48-w7v5r": {}, + "/v1/default/Pod/fake-pod-48-w8fvn": {}, + "/v1/default/Pod/fake-pod-48-wc9h8": {}, + "/v1/default/Pod/fake-pod-48-wdgc6": {}, + "/v1/default/Pod/fake-pod-48-wf6tl": {}, + "/v1/default/Pod/fake-pod-48-wg6gc": {}, + "/v1/default/Pod/fake-pod-48-whvzd": {}, + "/v1/default/Pod/fake-pod-48-wqxhm": {}, + "/v1/default/Pod/fake-pod-48-wsrcz": {}, + "/v1/default/Pod/fake-pod-48-wxj2m": {}, + "/v1/default/Pod/fake-pod-48-x6d8s": {}, + "/v1/default/Pod/fake-pod-48-xb6fj": {}, + "/v1/default/Pod/fake-pod-48-xbpql": {}, + "/v1/default/Pod/fake-pod-48-xc2rb": {}, + "/v1/default/Pod/fake-pod-48-xdvzf": {}, + "/v1/default/Pod/fake-pod-48-xkt8w": {}, + "/v1/default/Pod/fake-pod-48-xl98p": {}, + "/v1/default/Pod/fake-pod-48-xlg4v": {}, + "/v1/default/Pod/fake-pod-48-xmxbp": {}, + "/v1/default/Pod/fake-pod-48-xpld9": {}, + "/v1/default/Pod/fake-pod-48-xwj6c": {}, + "/v1/default/Pod/fake-pod-48-xxmxb": {}, + "/v1/default/Pod/fake-pod-48-z2xfd": {}, + "/v1/default/Pod/fake-pod-48-z48tg": {}, + "/v1/default/Pod/fake-pod-48-z4vd9": {}, + "/v1/default/Pod/fake-pod-48-zb4hd": {}, + "/v1/default/Pod/fake-pod-48-zh5pl": {}, + "/v1/default/Pod/fake-pod-48-zj7zk": {}, + "/v1/default/Pod/fake-pod-48-zj87d": {}, + "/v1/default/Pod/fake-pod-48-zlf7d": {}, + "/v1/default/Pod/fake-pod-48-zqhxn": {}, + "/v1/default/Pod/fake-pod-48-zv5lp": {}, + "/v1/default/Pod/fake-pod-48-zvknj": {}, + "/v1/default/Pod/fake-pod-49-24bvz": {}, + "/v1/default/Pod/fake-pod-49-28wch": {}, + "/v1/default/Pod/fake-pod-49-2jnwv": {}, + "/v1/default/Pod/fake-pod-49-2k8s2": {}, + "/v1/default/Pod/fake-pod-49-2pq79": {}, + "/v1/default/Pod/fake-pod-49-2qkhl": {}, + "/v1/default/Pod/fake-pod-49-2wkhn": {}, + "/v1/default/Pod/fake-pod-49-2xm2b": {}, + "/v1/default/Pod/fake-pod-49-4fjjh": {}, + "/v1/default/Pod/fake-pod-49-4jjbw": {}, + "/v1/default/Pod/fake-pod-49-4jkvs": {}, + "/v1/default/Pod/fake-pod-49-4lt72": {}, + "/v1/default/Pod/fake-pod-49-4m2xv": {}, + "/v1/default/Pod/fake-pod-49-4p4vf": {}, + "/v1/default/Pod/fake-pod-49-4pp5w": {}, + "/v1/default/Pod/fake-pod-49-4w7gg": {}, + "/v1/default/Pod/fake-pod-49-52jfw": {}, + "/v1/default/Pod/fake-pod-49-52rpr": {}, + "/v1/default/Pod/fake-pod-49-542np": {}, + "/v1/default/Pod/fake-pod-49-54h97": {}, + "/v1/default/Pod/fake-pod-49-5b9bw": {}, + "/v1/default/Pod/fake-pod-49-5hpqp": {}, + "/v1/default/Pod/fake-pod-49-5lqzx": {}, + "/v1/default/Pod/fake-pod-49-5m4ql": {}, + "/v1/default/Pod/fake-pod-49-5mwhl": {}, + "/v1/default/Pod/fake-pod-49-5p25t": {}, + "/v1/default/Pod/fake-pod-49-5q689": {}, + "/v1/default/Pod/fake-pod-49-5svfb": {}, + "/v1/default/Pod/fake-pod-49-5t2jx": {}, + "/v1/default/Pod/fake-pod-49-5tzqr": {}, + "/v1/default/Pod/fake-pod-49-5wmtn": {}, + "/v1/default/Pod/fake-pod-49-6258k": {}, + "/v1/default/Pod/fake-pod-49-65x7n": {}, + "/v1/default/Pod/fake-pod-49-68bgv": {}, + "/v1/default/Pod/fake-pod-49-69xbs": {}, + "/v1/default/Pod/fake-pod-49-6gb94": {}, + "/v1/default/Pod/fake-pod-49-6hzwn": {}, + "/v1/default/Pod/fake-pod-49-6jpxp": {}, + "/v1/default/Pod/fake-pod-49-6jtvt": {}, + "/v1/default/Pod/fake-pod-49-6k9wz": {}, + "/v1/default/Pod/fake-pod-49-6rrwk": {}, + "/v1/default/Pod/fake-pod-49-6sfgz": {}, + "/v1/default/Pod/fake-pod-49-6ts4c": {}, + "/v1/default/Pod/fake-pod-49-769zq": {}, + "/v1/default/Pod/fake-pod-49-776hc": {}, + "/v1/default/Pod/fake-pod-49-79xt5": {}, + "/v1/default/Pod/fake-pod-49-7dg59": {}, + "/v1/default/Pod/fake-pod-49-7dwws": {}, + "/v1/default/Pod/fake-pod-49-7g888": {}, + "/v1/default/Pod/fake-pod-49-7gjp8": {}, + "/v1/default/Pod/fake-pod-49-7kpcz": {}, + "/v1/default/Pod/fake-pod-49-7mq2v": {}, + "/v1/default/Pod/fake-pod-49-7p94s": {}, + "/v1/default/Pod/fake-pod-49-7pjvh": {}, + "/v1/default/Pod/fake-pod-49-7tdg5": {}, + "/v1/default/Pod/fake-pod-49-7xbft": {}, + "/v1/default/Pod/fake-pod-49-7zf6d": {}, + "/v1/default/Pod/fake-pod-49-82fkv": {}, + "/v1/default/Pod/fake-pod-49-84j5s": {}, + "/v1/default/Pod/fake-pod-49-8979f": {}, + "/v1/default/Pod/fake-pod-49-89lqg": {}, + "/v1/default/Pod/fake-pod-49-8dc7b": {}, + "/v1/default/Pod/fake-pod-49-8gw66": {}, + "/v1/default/Pod/fake-pod-49-8rf6r": {}, + "/v1/default/Pod/fake-pod-49-92qqr": {}, + "/v1/default/Pod/fake-pod-49-96ml4": {}, + "/v1/default/Pod/fake-pod-49-9c25n": {}, + "/v1/default/Pod/fake-pod-49-9klks": {}, + "/v1/default/Pod/fake-pod-49-9mdnr": {}, + "/v1/default/Pod/fake-pod-49-9mq8m": {}, + "/v1/default/Pod/fake-pod-49-9rww7": {}, + "/v1/default/Pod/fake-pod-49-9swsl": {}, + "/v1/default/Pod/fake-pod-49-9tc8s": {}, + "/v1/default/Pod/fake-pod-49-9wz6f": {}, + "/v1/default/Pod/fake-pod-49-b2mlq": {}, + "/v1/default/Pod/fake-pod-49-b79sz": {}, + "/v1/default/Pod/fake-pod-49-b7bq7": {}, + "/v1/default/Pod/fake-pod-49-b7qz5": {}, + "/v1/default/Pod/fake-pod-49-bcvbt": {}, + "/v1/default/Pod/fake-pod-49-bmj52": {}, + "/v1/default/Pod/fake-pod-49-bqvzz": {}, + "/v1/default/Pod/fake-pod-49-bx88v": {}, + "/v1/default/Pod/fake-pod-49-c2fpr": {}, + "/v1/default/Pod/fake-pod-49-c4n85": {}, + "/v1/default/Pod/fake-pod-49-c5wxq": {}, + "/v1/default/Pod/fake-pod-49-c866n": {}, + "/v1/default/Pod/fake-pod-49-cbbb7": {}, + "/v1/default/Pod/fake-pod-49-cbmdc": {}, + "/v1/default/Pod/fake-pod-49-cdpsg": {}, + "/v1/default/Pod/fake-pod-49-cfrtl": {}, + "/v1/default/Pod/fake-pod-49-clt76": {}, + "/v1/default/Pod/fake-pod-49-ctncp": {}, + "/v1/default/Pod/fake-pod-49-ctrr8": {}, + "/v1/default/Pod/fake-pod-49-cvlxq": {}, + "/v1/default/Pod/fake-pod-49-cwgwn": {}, + "/v1/default/Pod/fake-pod-49-cx2q8": {}, + "/v1/default/Pod/fake-pod-49-d642t": {}, + "/v1/default/Pod/fake-pod-49-d85n4": {}, + "/v1/default/Pod/fake-pod-49-d87fj": {}, + "/v1/default/Pod/fake-pod-49-d9s4x": {}, + "/v1/default/Pod/fake-pod-49-ddtq4": {}, + "/v1/default/Pod/fake-pod-49-dftp2": {}, + "/v1/default/Pod/fake-pod-49-djvqn": {}, + "/v1/default/Pod/fake-pod-49-dlq7g": {}, + "/v1/default/Pod/fake-pod-49-dm6cb": {}, + "/v1/default/Pod/fake-pod-49-dmjnh": {}, + "/v1/default/Pod/fake-pod-49-dmpps": {}, + "/v1/default/Pod/fake-pod-49-dtbzc": {}, + "/v1/default/Pod/fake-pod-49-dtkpx": {}, + "/v1/default/Pod/fake-pod-49-dv8q8": {}, + "/v1/default/Pod/fake-pod-49-f4mc6": {}, + "/v1/default/Pod/fake-pod-49-f66k7": {}, + "/v1/default/Pod/fake-pod-49-f8twb": {}, + "/v1/default/Pod/fake-pod-49-ff257": {}, + "/v1/default/Pod/fake-pod-49-fgc6c": {}, + "/v1/default/Pod/fake-pod-49-fjb45": {}, + "/v1/default/Pod/fake-pod-49-fmd6h": {}, + "/v1/default/Pod/fake-pod-49-fmsxt": {}, + "/v1/default/Pod/fake-pod-49-fr95f": {}, + "/v1/default/Pod/fake-pod-49-g5kgr": {}, + "/v1/default/Pod/fake-pod-49-gdtct": {}, + "/v1/default/Pod/fake-pod-49-gkkxd": {}, + "/v1/default/Pod/fake-pod-49-gknt9": {}, + "/v1/default/Pod/fake-pod-49-gmtvt": {}, + "/v1/default/Pod/fake-pod-49-gn8lf": {}, + "/v1/default/Pod/fake-pod-49-gqrsx": {}, + "/v1/default/Pod/fake-pod-49-grcd6": {}, + "/v1/default/Pod/fake-pod-49-gsp7x": {}, + "/v1/default/Pod/fake-pod-49-gt2kz": {}, + "/v1/default/Pod/fake-pod-49-h2nwb": {}, + "/v1/default/Pod/fake-pod-49-h48tj": {}, + "/v1/default/Pod/fake-pod-49-h4b2f": {}, + "/v1/default/Pod/fake-pod-49-h5bnr": {}, + "/v1/default/Pod/fake-pod-49-h7nxf": {}, + "/v1/default/Pod/fake-pod-49-h98b7": {}, + "/v1/default/Pod/fake-pod-49-hcbf7": {}, + "/v1/default/Pod/fake-pod-49-hfgjw": {}, + "/v1/default/Pod/fake-pod-49-hjnx5": {}, + "/v1/default/Pod/fake-pod-49-hlmvp": {}, + "/v1/default/Pod/fake-pod-49-hwxjr": {}, + "/v1/default/Pod/fake-pod-49-hz4fn": {}, + "/v1/default/Pod/fake-pod-49-j9f8d": {}, + "/v1/default/Pod/fake-pod-49-jcmh5": {}, + "/v1/default/Pod/fake-pod-49-jfrpw": {}, + "/v1/default/Pod/fake-pod-49-jjv7q": {}, + "/v1/default/Pod/fake-pod-49-jnflt": {}, + "/v1/default/Pod/fake-pod-49-jr2mv": {}, + "/v1/default/Pod/fake-pod-49-jrczt": {}, + "/v1/default/Pod/fake-pod-49-jrkr8": {}, + "/v1/default/Pod/fake-pod-49-jsnjc": {}, + "/v1/default/Pod/fake-pod-49-jvbtb": {}, + "/v1/default/Pod/fake-pod-49-k4zdz": {}, + "/v1/default/Pod/fake-pod-49-k5rhg": {}, + "/v1/default/Pod/fake-pod-49-k62bq": {}, + "/v1/default/Pod/fake-pod-49-k6n5s": {}, + "/v1/default/Pod/fake-pod-49-kbtxw": {}, + "/v1/default/Pod/fake-pod-49-kdphx": {}, + "/v1/default/Pod/fake-pod-49-kf46n": {}, + "/v1/default/Pod/fake-pod-49-kgjlg": {}, + "/v1/default/Pod/fake-pod-49-kjjpl": {}, + "/v1/default/Pod/fake-pod-49-klzlv": {}, + "/v1/default/Pod/fake-pod-49-kmzhp": {}, + "/v1/default/Pod/fake-pod-49-kqqwq": {}, + "/v1/default/Pod/fake-pod-49-kwd68": {}, + "/v1/default/Pod/fake-pod-49-l2sqf": {}, + "/v1/default/Pod/fake-pod-49-l5m6g": {}, + "/v1/default/Pod/fake-pod-49-l9j7d": {}, + "/v1/default/Pod/fake-pod-49-lb6kq": {}, + "/v1/default/Pod/fake-pod-49-ld7z4": {}, + "/v1/default/Pod/fake-pod-49-ldjd7": {}, + "/v1/default/Pod/fake-pod-49-lg454": {}, + "/v1/default/Pod/fake-pod-49-ljlvq": {}, + "/v1/default/Pod/fake-pod-49-lkj2v": {}, + "/v1/default/Pod/fake-pod-49-llq9d": {}, + "/v1/default/Pod/fake-pod-49-llrgs": {}, + "/v1/default/Pod/fake-pod-49-lqbkx": {}, + "/v1/default/Pod/fake-pod-49-ltt9r": {}, + "/v1/default/Pod/fake-pod-49-lzg8d": {}, + "/v1/default/Pod/fake-pod-49-lzj2x": {}, + "/v1/default/Pod/fake-pod-49-m4msr": {}, + "/v1/default/Pod/fake-pod-49-m4p42": {}, + "/v1/default/Pod/fake-pod-49-m6c2x": {}, + "/v1/default/Pod/fake-pod-49-m8f5p": {}, + "/v1/default/Pod/fake-pod-49-m8mm8": {}, + "/v1/default/Pod/fake-pod-49-m946h": {}, + "/v1/default/Pod/fake-pod-49-mdmxw": {}, + "/v1/default/Pod/fake-pod-49-mf2nq": {}, + "/v1/default/Pod/fake-pod-49-mgwfz": {}, + "/v1/default/Pod/fake-pod-49-mm5sg": {}, + "/v1/default/Pod/fake-pod-49-mnd4d": {}, + "/v1/default/Pod/fake-pod-49-mnths": {}, + "/v1/default/Pod/fake-pod-49-mq5wx": {}, + "/v1/default/Pod/fake-pod-49-mqnd5": {}, + "/v1/default/Pod/fake-pod-49-msvfw": {}, + "/v1/default/Pod/fake-pod-49-mvg6w": {}, + "/v1/default/Pod/fake-pod-49-n67pq": {}, + "/v1/default/Pod/fake-pod-49-n6vbh": {}, + "/v1/default/Pod/fake-pod-49-n8vv7": {}, + "/v1/default/Pod/fake-pod-49-nclvs": {}, + "/v1/default/Pod/fake-pod-49-nmlpt": {}, + "/v1/default/Pod/fake-pod-49-nmtvp": {}, + "/v1/default/Pod/fake-pod-49-npt22": {}, + "/v1/default/Pod/fake-pod-49-nsq6z": {}, + "/v1/default/Pod/fake-pod-49-nwbpf": {}, + "/v1/default/Pod/fake-pod-49-p6tb5": {}, + "/v1/default/Pod/fake-pod-49-pblfm": {}, + "/v1/default/Pod/fake-pod-49-pcn48": {}, + "/v1/default/Pod/fake-pod-49-pct8f": {}, + "/v1/default/Pod/fake-pod-49-pdxnf": {}, + "/v1/default/Pod/fake-pod-49-pkl8l": {}, + "/v1/default/Pod/fake-pod-49-pqb4r": {}, + "/v1/default/Pod/fake-pod-49-pv4kj": {}, + "/v1/default/Pod/fake-pod-49-q2fmz": {}, + "/v1/default/Pod/fake-pod-49-q4zgw": {}, + "/v1/default/Pod/fake-pod-49-q9pvs": {}, + "/v1/default/Pod/fake-pod-49-qdr98": {}, + "/v1/default/Pod/fake-pod-49-qkmb6": {}, + "/v1/default/Pod/fake-pod-49-ql8r6": {}, + "/v1/default/Pod/fake-pod-49-qlfcc": {}, + "/v1/default/Pod/fake-pod-49-qlglf": {}, + "/v1/default/Pod/fake-pod-49-qltj8": {}, + "/v1/default/Pod/fake-pod-49-qptsq": {}, + "/v1/default/Pod/fake-pod-49-qwchf": {}, + "/v1/default/Pod/fake-pod-49-r2l8v": {}, + "/v1/default/Pod/fake-pod-49-r2lkt": {}, + "/v1/default/Pod/fake-pod-49-rbmd5": {}, + "/v1/default/Pod/fake-pod-49-rff2n": {}, + "/v1/default/Pod/fake-pod-49-rfgfw": {}, + "/v1/default/Pod/fake-pod-49-rfrxw": {}, + "/v1/default/Pod/fake-pod-49-rfs2k": {}, + "/v1/default/Pod/fake-pod-49-rh9bz": {}, + "/v1/default/Pod/fake-pod-49-rl92f": {}, + "/v1/default/Pod/fake-pod-49-rlts5": {}, + "/v1/default/Pod/fake-pod-49-rmp75": {}, + "/v1/default/Pod/fake-pod-49-rqchf": {}, + "/v1/default/Pod/fake-pod-49-rx9cx": {}, + "/v1/default/Pod/fake-pod-49-s552b": {}, + "/v1/default/Pod/fake-pod-49-s5dtp": {}, + "/v1/default/Pod/fake-pod-49-s6xbm": {}, + "/v1/default/Pod/fake-pod-49-s7gz2": {}, + "/v1/default/Pod/fake-pod-49-s8jm5": {}, + "/v1/default/Pod/fake-pod-49-slz75": {}, + "/v1/default/Pod/fake-pod-49-smqns": {}, + "/v1/default/Pod/fake-pod-49-sr225": {}, + "/v1/default/Pod/fake-pod-49-szpht": {}, + "/v1/default/Pod/fake-pod-49-t5rn5": {}, + "/v1/default/Pod/fake-pod-49-t5sh5": {}, + "/v1/default/Pod/fake-pod-49-t7n7q": {}, + "/v1/default/Pod/fake-pod-49-t7rzs": {}, + "/v1/default/Pod/fake-pod-49-t82kd": {}, + "/v1/default/Pod/fake-pod-49-tb4lp": {}, + "/v1/default/Pod/fake-pod-49-tcvjc": {}, + "/v1/default/Pod/fake-pod-49-tdvzt": {}, + "/v1/default/Pod/fake-pod-49-tn86t": {}, + "/v1/default/Pod/fake-pod-49-tp6c9": {}, + "/v1/default/Pod/fake-pod-49-tp9pn": {}, + "/v1/default/Pod/fake-pod-49-tqqrc": {}, + "/v1/default/Pod/fake-pod-49-tr26g": {}, + "/v1/default/Pod/fake-pod-49-tvz4b": {}, + "/v1/default/Pod/fake-pod-49-v7lfm": {}, + "/v1/default/Pod/fake-pod-49-v7vjt": {}, + "/v1/default/Pod/fake-pod-49-v9s78": {}, + "/v1/default/Pod/fake-pod-49-vbkt4": {}, + "/v1/default/Pod/fake-pod-49-vdjcf": {}, + "/v1/default/Pod/fake-pod-49-vmzpk": {}, + "/v1/default/Pod/fake-pod-49-vn92z": {}, + "/v1/default/Pod/fake-pod-49-vqvzx": {}, + "/v1/default/Pod/fake-pod-49-vvmlp": {}, + "/v1/default/Pod/fake-pod-49-wbcwc": {}, + "/v1/default/Pod/fake-pod-49-wfxz7": {}, + "/v1/default/Pod/fake-pod-49-wrhpt": {}, + "/v1/default/Pod/fake-pod-49-wszlg": {}, + "/v1/default/Pod/fake-pod-49-wvsv7": {}, + "/v1/default/Pod/fake-pod-49-wxxp8": {}, + "/v1/default/Pod/fake-pod-49-wzr2d": {}, + "/v1/default/Pod/fake-pod-49-x4htg": {}, + "/v1/default/Pod/fake-pod-49-xd2zw": {}, + "/v1/default/Pod/fake-pod-49-xj7bq": {}, + "/v1/default/Pod/fake-pod-49-xkqr8": {}, + "/v1/default/Pod/fake-pod-49-xqk4l": {}, + "/v1/default/Pod/fake-pod-49-xrm42": {}, + "/v1/default/Pod/fake-pod-49-xsd7g": {}, + "/v1/default/Pod/fake-pod-49-xtms6": {}, + "/v1/default/Pod/fake-pod-49-xwzt2": {}, + "/v1/default/Pod/fake-pod-49-xxbht": {}, + "/v1/default/Pod/fake-pod-49-z4fp6": {}, + "/v1/default/Pod/fake-pod-49-z5gt9": {}, + "/v1/default/Pod/fake-pod-49-z64hk": {}, + "/v1/default/Pod/fake-pod-49-z6mng": {}, + "/v1/default/Pod/fake-pod-49-z7mss": {}, + "/v1/default/Pod/fake-pod-49-z9jp5": {}, + "/v1/default/Pod/fake-pod-49-zc5mj": {}, + "/v1/default/Pod/fake-pod-49-zdbfg": {}, + "/v1/default/Pod/fake-pod-49-zdghq": {}, + "/v1/default/Pod/fake-pod-49-zdlrl": {}, + "/v1/default/Pod/fake-pod-49-zkfp4": {}, + "/v1/default/Pod/fake-pod-49-zq89d": {}, + "/v1/default/Pod/fake-pod-49-zsv92": {}, + "/v1/default/Pod/fake-pod-49-zzl45": {}, + "/v1/default/Pod/fake-pod-5-2846z": {}, + "/v1/default/Pod/fake-pod-5-2ckfb": {}, + "/v1/default/Pod/fake-pod-5-2dx8k": {}, + "/v1/default/Pod/fake-pod-5-2fgdj": {}, + "/v1/default/Pod/fake-pod-5-2ftgs": {}, + "/v1/default/Pod/fake-pod-5-2j9f8": {}, + "/v1/default/Pod/fake-pod-5-2jxwq": {}, + "/v1/default/Pod/fake-pod-5-2pqs8": {}, + "/v1/default/Pod/fake-pod-5-2r6r6": {}, + "/v1/default/Pod/fake-pod-5-2rfw7": {}, + "/v1/default/Pod/fake-pod-5-2zh84": {}, + "/v1/default/Pod/fake-pod-5-2zkgt": {}, + "/v1/default/Pod/fake-pod-5-44lhj": {}, + "/v1/default/Pod/fake-pod-5-44r6j": {}, + "/v1/default/Pod/fake-pod-5-485vb": {}, + "/v1/default/Pod/fake-pod-5-48ktn": {}, + "/v1/default/Pod/fake-pod-5-4bwxg": {}, + "/v1/default/Pod/fake-pod-5-4dd4w": {}, + "/v1/default/Pod/fake-pod-5-4ft78": {}, + "/v1/default/Pod/fake-pod-5-4j65f": {}, + "/v1/default/Pod/fake-pod-5-4jzkb": {}, + "/v1/default/Pod/fake-pod-5-4tjr8": {}, + "/v1/default/Pod/fake-pod-5-4xthz": {}, + "/v1/default/Pod/fake-pod-5-4zhnh": {}, + "/v1/default/Pod/fake-pod-5-52cdc": {}, + "/v1/default/Pod/fake-pod-5-54cg8": {}, + "/v1/default/Pod/fake-pod-5-55gsf": {}, + "/v1/default/Pod/fake-pod-5-5lp4b": {}, + "/v1/default/Pod/fake-pod-5-5szx8": {}, + "/v1/default/Pod/fake-pod-5-5v99k": {}, + "/v1/default/Pod/fake-pod-5-5xxrz": {}, + "/v1/default/Pod/fake-pod-5-5zs2q": {}, + "/v1/default/Pod/fake-pod-5-625t9": {}, + "/v1/default/Pod/fake-pod-5-6dkp9": {}, + "/v1/default/Pod/fake-pod-5-6ldbt": {}, + "/v1/default/Pod/fake-pod-5-6mgxx": {}, + "/v1/default/Pod/fake-pod-5-6mpjp": {}, + "/v1/default/Pod/fake-pod-5-6qlbd": {}, + "/v1/default/Pod/fake-pod-5-6tdb7": {}, + "/v1/default/Pod/fake-pod-5-6vsdt": {}, + "/v1/default/Pod/fake-pod-5-6ztp4": {}, + "/v1/default/Pod/fake-pod-5-76j2f": {}, + "/v1/default/Pod/fake-pod-5-77cp8": {}, + "/v1/default/Pod/fake-pod-5-78wq7": {}, + "/v1/default/Pod/fake-pod-5-7cgcl": {}, + "/v1/default/Pod/fake-pod-5-7fjd2": {}, + "/v1/default/Pod/fake-pod-5-7ljjj": {}, + "/v1/default/Pod/fake-pod-5-7p29s": {}, + "/v1/default/Pod/fake-pod-5-7tk5m": {}, + "/v1/default/Pod/fake-pod-5-7zklr": {}, + "/v1/default/Pod/fake-pod-5-8452f": {}, + "/v1/default/Pod/fake-pod-5-85kqw": {}, + "/v1/default/Pod/fake-pod-5-87d6z": {}, + "/v1/default/Pod/fake-pod-5-89hrk": {}, + "/v1/default/Pod/fake-pod-5-8cbpf": {}, + "/v1/default/Pod/fake-pod-5-8clnr": {}, + "/v1/default/Pod/fake-pod-5-8fjwv": {}, + "/v1/default/Pod/fake-pod-5-8gqts": {}, + "/v1/default/Pod/fake-pod-5-8h7zk": {}, + "/v1/default/Pod/fake-pod-5-8hrbk": {}, + "/v1/default/Pod/fake-pod-5-8kdwp": {}, + "/v1/default/Pod/fake-pod-5-8s8r2": {}, + "/v1/default/Pod/fake-pod-5-8w4mh": {}, + "/v1/default/Pod/fake-pod-5-8w97f": {}, + "/v1/default/Pod/fake-pod-5-8wc5v": {}, + "/v1/default/Pod/fake-pod-5-8wm87": {}, + "/v1/default/Pod/fake-pod-5-8wq6j": {}, + "/v1/default/Pod/fake-pod-5-969fw": {}, + "/v1/default/Pod/fake-pod-5-97knw": {}, + "/v1/default/Pod/fake-pod-5-98bbj": {}, + "/v1/default/Pod/fake-pod-5-98gcj": {}, + "/v1/default/Pod/fake-pod-5-996w7": {}, + "/v1/default/Pod/fake-pod-5-9d2wj": {}, + "/v1/default/Pod/fake-pod-5-9fgfc": {}, + "/v1/default/Pod/fake-pod-5-9jc4p": {}, + "/v1/default/Pod/fake-pod-5-9klst": {}, + "/v1/default/Pod/fake-pod-5-9m4m2": {}, + "/v1/default/Pod/fake-pod-5-9mrxk": {}, + "/v1/default/Pod/fake-pod-5-9q5p9": {}, + "/v1/default/Pod/fake-pod-5-9rxxl": {}, + "/v1/default/Pod/fake-pod-5-9ww5d": {}, + "/v1/default/Pod/fake-pod-5-b4sjh": {}, + "/v1/default/Pod/fake-pod-5-b88fp": {}, + "/v1/default/Pod/fake-pod-5-b8cz9": {}, + "/v1/default/Pod/fake-pod-5-b8xxw": {}, + "/v1/default/Pod/fake-pod-5-bgqmj": {}, + "/v1/default/Pod/fake-pod-5-bjr6q": {}, + "/v1/default/Pod/fake-pod-5-bmmrt": {}, + "/v1/default/Pod/fake-pod-5-bnsz9": {}, + "/v1/default/Pod/fake-pod-5-bt7gq": {}, + "/v1/default/Pod/fake-pod-5-bvxxl": {}, + "/v1/default/Pod/fake-pod-5-bxcwq": {}, + "/v1/default/Pod/fake-pod-5-c4xbw": {}, + "/v1/default/Pod/fake-pod-5-c559b": {}, + "/v1/default/Pod/fake-pod-5-clgkh": {}, + "/v1/default/Pod/fake-pod-5-cmntd": {}, + "/v1/default/Pod/fake-pod-5-cq8wh": {}, + "/v1/default/Pod/fake-pod-5-cvxbn": {}, + "/v1/default/Pod/fake-pod-5-cvz5d": {}, + "/v1/default/Pod/fake-pod-5-czx5w": {}, + "/v1/default/Pod/fake-pod-5-d4d5g": {}, + "/v1/default/Pod/fake-pod-5-d527s": {}, + "/v1/default/Pod/fake-pod-5-d9ckt": {}, + "/v1/default/Pod/fake-pod-5-d9ffx": {}, + "/v1/default/Pod/fake-pod-5-dq6gh": {}, + "/v1/default/Pod/fake-pod-5-f5qzv": {}, + "/v1/default/Pod/fake-pod-5-f9gsc": {}, + "/v1/default/Pod/fake-pod-5-f9hjk": {}, + "/v1/default/Pod/fake-pod-5-fcs5x": {}, + "/v1/default/Pod/fake-pod-5-fgw4s": {}, + "/v1/default/Pod/fake-pod-5-fhfv7": {}, + "/v1/default/Pod/fake-pod-5-fkc2x": {}, + "/v1/default/Pod/fake-pod-5-flt2z": {}, + "/v1/default/Pod/fake-pod-5-fqr7k": {}, + "/v1/default/Pod/fake-pod-5-fscw8": {}, + "/v1/default/Pod/fake-pod-5-fvf2n": {}, + "/v1/default/Pod/fake-pod-5-fzwj5": {}, + "/v1/default/Pod/fake-pod-5-g68tn": {}, + "/v1/default/Pod/fake-pod-5-g8qbm": {}, + "/v1/default/Pod/fake-pod-5-g8r22": {}, + "/v1/default/Pod/fake-pod-5-gcslq": {}, + "/v1/default/Pod/fake-pod-5-gh9sq": {}, + "/v1/default/Pod/fake-pod-5-gmnql": {}, + "/v1/default/Pod/fake-pod-5-gnb25": {}, + "/v1/default/Pod/fake-pod-5-gnk96": {}, + "/v1/default/Pod/fake-pod-5-gq6n4": {}, + "/v1/default/Pod/fake-pod-5-gtcd2": {}, + "/v1/default/Pod/fake-pod-5-gvwl8": {}, + "/v1/default/Pod/fake-pod-5-gwch7": {}, + "/v1/default/Pod/fake-pod-5-gxw8w": {}, + "/v1/default/Pod/fake-pod-5-gztqb": {}, + "/v1/default/Pod/fake-pod-5-hdzh7": {}, + "/v1/default/Pod/fake-pod-5-hgrtg": {}, + "/v1/default/Pod/fake-pod-5-hjjkm": {}, + "/v1/default/Pod/fake-pod-5-hjkbr": {}, + "/v1/default/Pod/fake-pod-5-hjm9z": {}, + "/v1/default/Pod/fake-pod-5-hkplv": {}, + "/v1/default/Pod/fake-pod-5-hnww7": {}, + "/v1/default/Pod/fake-pod-5-hpsmq": {}, + "/v1/default/Pod/fake-pod-5-hs2sq": {}, + "/v1/default/Pod/fake-pod-5-hsktd": {}, + "/v1/default/Pod/fake-pod-5-j447v": {}, + "/v1/default/Pod/fake-pod-5-jbgdt": {}, + "/v1/default/Pod/fake-pod-5-jc99f": {}, + "/v1/default/Pod/fake-pod-5-jh25x": {}, + "/v1/default/Pod/fake-pod-5-jjbhb": {}, + "/v1/default/Pod/fake-pod-5-jmk7b": {}, + "/v1/default/Pod/fake-pod-5-jrksl": {}, + "/v1/default/Pod/fake-pod-5-jtjsj": {}, + "/v1/default/Pod/fake-pod-5-jvww9": {}, + "/v1/default/Pod/fake-pod-5-jw7qg": {}, + "/v1/default/Pod/fake-pod-5-k4lbk": {}, + "/v1/default/Pod/fake-pod-5-k5wd7": {}, + "/v1/default/Pod/fake-pod-5-kfqqn": {}, + "/v1/default/Pod/fake-pod-5-kgrt8": {}, + "/v1/default/Pod/fake-pod-5-kh8bj": {}, + "/v1/default/Pod/fake-pod-5-kl8qr": {}, + "/v1/default/Pod/fake-pod-5-km5rn": {}, + "/v1/default/Pod/fake-pod-5-knm79": {}, + "/v1/default/Pod/fake-pod-5-kp2x2": {}, + "/v1/default/Pod/fake-pod-5-kpv8h": {}, + "/v1/default/Pod/fake-pod-5-kr8wb": {}, + "/v1/default/Pod/fake-pod-5-kt7wq": {}, + "/v1/default/Pod/fake-pod-5-kth9q": {}, + "/v1/default/Pod/fake-pod-5-kxbn8": {}, + "/v1/default/Pod/fake-pod-5-kxcfx": {}, + "/v1/default/Pod/fake-pod-5-l4sqr": {}, + "/v1/default/Pod/fake-pod-5-l54r7": {}, + "/v1/default/Pod/fake-pod-5-l5j78": {}, + "/v1/default/Pod/fake-pod-5-l5vfp": {}, + "/v1/default/Pod/fake-pod-5-l89vw": {}, + "/v1/default/Pod/fake-pod-5-lbjzb": {}, + "/v1/default/Pod/fake-pod-5-lbsnv": {}, + "/v1/default/Pod/fake-pod-5-lgk9p": {}, + "/v1/default/Pod/fake-pod-5-llkbs": {}, + "/v1/default/Pod/fake-pod-5-lrl9x": {}, + "/v1/default/Pod/fake-pod-5-lw4jx": {}, + "/v1/default/Pod/fake-pod-5-lzgkt": {}, + "/v1/default/Pod/fake-pod-5-m2ntj": {}, + "/v1/default/Pod/fake-pod-5-m8bvd": {}, + "/v1/default/Pod/fake-pod-5-m9llt": {}, + "/v1/default/Pod/fake-pod-5-m9pkg": {}, + "/v1/default/Pod/fake-pod-5-m9scs": {}, + "/v1/default/Pod/fake-pod-5-mc5k5": {}, + "/v1/default/Pod/fake-pod-5-mdnks": {}, + "/v1/default/Pod/fake-pod-5-mkgjn": {}, + "/v1/default/Pod/fake-pod-5-mmr5z": {}, + "/v1/default/Pod/fake-pod-5-mpkl7": {}, + "/v1/default/Pod/fake-pod-5-mqhtn": {}, + "/v1/default/Pod/fake-pod-5-mqzjs": {}, + "/v1/default/Pod/fake-pod-5-mrnzt": {}, + "/v1/default/Pod/fake-pod-5-msgks": {}, + "/v1/default/Pod/fake-pod-5-mv9b7": {}, + "/v1/default/Pod/fake-pod-5-mz2qt": {}, + "/v1/default/Pod/fake-pod-5-n7884": {}, + "/v1/default/Pod/fake-pod-5-n8v6x": {}, + "/v1/default/Pod/fake-pod-5-n92f2": {}, + "/v1/default/Pod/fake-pod-5-ncnrb": {}, + "/v1/default/Pod/fake-pod-5-ngzwg": {}, + "/v1/default/Pod/fake-pod-5-nk9dl": {}, + "/v1/default/Pod/fake-pod-5-nl6p2": {}, + "/v1/default/Pod/fake-pod-5-nmvzz": {}, + "/v1/default/Pod/fake-pod-5-npbff": {}, + "/v1/default/Pod/fake-pod-5-nq4qk": {}, + "/v1/default/Pod/fake-pod-5-nx4zm": {}, + "/v1/default/Pod/fake-pod-5-p8zr5": {}, + "/v1/default/Pod/fake-pod-5-p92fb": {}, + "/v1/default/Pod/fake-pod-5-pcs4l": {}, + "/v1/default/Pod/fake-pod-5-pfxh9": {}, + "/v1/default/Pod/fake-pod-5-ph9jg": {}, + "/v1/default/Pod/fake-pod-5-pknt7": {}, + "/v1/default/Pod/fake-pod-5-pntkx": {}, + "/v1/default/Pod/fake-pod-5-ppbpg": {}, + "/v1/default/Pod/fake-pod-5-prwcp": {}, + "/v1/default/Pod/fake-pod-5-ps9c2": {}, + "/v1/default/Pod/fake-pod-5-pttmc": {}, + "/v1/default/Pod/fake-pod-5-pv8bb": {}, + "/v1/default/Pod/fake-pod-5-pvd2h": {}, + "/v1/default/Pod/fake-pod-5-pwvhg": {}, + "/v1/default/Pod/fake-pod-5-pxbmj": {}, + "/v1/default/Pod/fake-pod-5-qcbrv": {}, + "/v1/default/Pod/fake-pod-5-qcfmj": {}, + "/v1/default/Pod/fake-pod-5-qdq5r": {}, + "/v1/default/Pod/fake-pod-5-qldtc": {}, + "/v1/default/Pod/fake-pod-5-qpms2": {}, + "/v1/default/Pod/fake-pod-5-qqjhl": {}, + "/v1/default/Pod/fake-pod-5-qvvdq": {}, + "/v1/default/Pod/fake-pod-5-qxbzm": {}, + "/v1/default/Pod/fake-pod-5-qztwt": {}, + "/v1/default/Pod/fake-pod-5-r2k9m": {}, + "/v1/default/Pod/fake-pod-5-r5ctd": {}, + "/v1/default/Pod/fake-pod-5-r97m8": {}, + "/v1/default/Pod/fake-pod-5-rbd4b": {}, + "/v1/default/Pod/fake-pod-5-rhgvw": {}, + "/v1/default/Pod/fake-pod-5-rnfhn": {}, + "/v1/default/Pod/fake-pod-5-rp6gz": {}, + "/v1/default/Pod/fake-pod-5-rq848": {}, + "/v1/default/Pod/fake-pod-5-s62c9": {}, + "/v1/default/Pod/fake-pod-5-s9n89": {}, + "/v1/default/Pod/fake-pod-5-sdkd4": {}, + "/v1/default/Pod/fake-pod-5-sgwvj": {}, + "/v1/default/Pod/fake-pod-5-sjtwv": {}, + "/v1/default/Pod/fake-pod-5-sksjd": {}, + "/v1/default/Pod/fake-pod-5-sl6rz": {}, + "/v1/default/Pod/fake-pod-5-smwcn": {}, + "/v1/default/Pod/fake-pod-5-spkht": {}, + "/v1/default/Pod/fake-pod-5-st76m": {}, + "/v1/default/Pod/fake-pod-5-swsnh": {}, + "/v1/default/Pod/fake-pod-5-t65m2": {}, + "/v1/default/Pod/fake-pod-5-t6nfw": {}, + "/v1/default/Pod/fake-pod-5-t9rgc": {}, + "/v1/default/Pod/fake-pod-5-tlgkw": {}, + "/v1/default/Pod/fake-pod-5-tn527": {}, + "/v1/default/Pod/fake-pod-5-tpk5p": {}, + "/v1/default/Pod/fake-pod-5-v2rpr": {}, + "/v1/default/Pod/fake-pod-5-v2zbc": {}, + "/v1/default/Pod/fake-pod-5-v5fmh": {}, + "/v1/default/Pod/fake-pod-5-v5rjr": {}, + "/v1/default/Pod/fake-pod-5-v5xjs": {}, + "/v1/default/Pod/fake-pod-5-v774l": {}, + "/v1/default/Pod/fake-pod-5-vk6qn": {}, + "/v1/default/Pod/fake-pod-5-vkj5h": {}, + "/v1/default/Pod/fake-pod-5-vqqpg": {}, + "/v1/default/Pod/fake-pod-5-vs8zf": {}, + "/v1/default/Pod/fake-pod-5-vshz7": {}, + "/v1/default/Pod/fake-pod-5-vwzkq": {}, + "/v1/default/Pod/fake-pod-5-vxkbc": {}, + "/v1/default/Pod/fake-pod-5-vxpb4": {}, + "/v1/default/Pod/fake-pod-5-w6mkn": {}, + "/v1/default/Pod/fake-pod-5-w7l5n": {}, + "/v1/default/Pod/fake-pod-5-wht7r": {}, + "/v1/default/Pod/fake-pod-5-wng9z": {}, + "/v1/default/Pod/fake-pod-5-wnvhv": {}, + "/v1/default/Pod/fake-pod-5-wtx9h": {}, + "/v1/default/Pod/fake-pod-5-x5pqk": {}, + "/v1/default/Pod/fake-pod-5-x6lzb": {}, + "/v1/default/Pod/fake-pod-5-x796x": {}, + "/v1/default/Pod/fake-pod-5-xbss4": {}, + "/v1/default/Pod/fake-pod-5-xgxzd": {}, + "/v1/default/Pod/fake-pod-5-xt99c": {}, + "/v1/default/Pod/fake-pod-5-xz87d": {}, + "/v1/default/Pod/fake-pod-5-xzkjh": {}, + "/v1/default/Pod/fake-pod-5-z6sdk": {}, + "/v1/default/Pod/fake-pod-5-z89z7": {}, + "/v1/default/Pod/fake-pod-5-z8pqb": {}, + "/v1/default/Pod/fake-pod-5-zcn6q": {}, + "/v1/default/Pod/fake-pod-5-zd772": {}, + "/v1/default/Pod/fake-pod-5-zjkxf": {}, + "/v1/default/Pod/fake-pod-5-zkgd4": {}, + "/v1/default/Pod/fake-pod-5-zpbqf": {}, + "/v1/default/Pod/fake-pod-5-zr6dl": {}, + "/v1/default/Pod/fake-pod-5-zrfp7": {}, + "/v1/default/Pod/fake-pod-5-zrp26": {}, + "/v1/default/Pod/fake-pod-5-zsckd": {}, + "/v1/default/Pod/fake-pod-5-zsr6h": {}, + "/v1/default/Pod/fake-pod-5-ztqfl": {}, + "/v1/default/Pod/fake-pod-5-zx288": {}, + "/v1/default/Pod/fake-pod-5-zxbkp": {}, + "/v1/default/Pod/fake-pod-5-zzml5": {}, + "/v1/default/Pod/fake-pod-6-24t52": {}, + "/v1/default/Pod/fake-pod-6-2bc2r": {}, + "/v1/default/Pod/fake-pod-6-2dzcr": {}, + "/v1/default/Pod/fake-pod-6-2g9kw": {}, + "/v1/default/Pod/fake-pod-6-2gb9p": {}, + "/v1/default/Pod/fake-pod-6-2hcp4": {}, + "/v1/default/Pod/fake-pod-6-2hps4": {}, + "/v1/default/Pod/fake-pod-6-2p8cc": {}, + "/v1/default/Pod/fake-pod-6-2qjzl": {}, + "/v1/default/Pod/fake-pod-6-2rqsn": {}, + "/v1/default/Pod/fake-pod-6-2tvf4": {}, + "/v1/default/Pod/fake-pod-6-2tvm5": {}, + "/v1/default/Pod/fake-pod-6-2xl5c": {}, + "/v1/default/Pod/fake-pod-6-45bzp": {}, + "/v1/default/Pod/fake-pod-6-4bh59": {}, + "/v1/default/Pod/fake-pod-6-4cbjn": {}, + "/v1/default/Pod/fake-pod-6-4gvmm": {}, + "/v1/default/Pod/fake-pod-6-4hzcg": {}, + "/v1/default/Pod/fake-pod-6-4jfkd": {}, + "/v1/default/Pod/fake-pod-6-4jr9b": {}, + "/v1/default/Pod/fake-pod-6-4lhgt": {}, + "/v1/default/Pod/fake-pod-6-4lz7w": {}, + "/v1/default/Pod/fake-pod-6-4m9kx": {}, + "/v1/default/Pod/fake-pod-6-4p98d": {}, + "/v1/default/Pod/fake-pod-6-4xkg6": {}, + "/v1/default/Pod/fake-pod-6-4zv6h": {}, + "/v1/default/Pod/fake-pod-6-524lm": {}, + "/v1/default/Pod/fake-pod-6-55c4b": {}, + "/v1/default/Pod/fake-pod-6-57tqm": {}, + "/v1/default/Pod/fake-pod-6-5bcr5": {}, + "/v1/default/Pod/fake-pod-6-5lv7d": {}, + "/v1/default/Pod/fake-pod-6-5mqnt": {}, + "/v1/default/Pod/fake-pod-6-5p2mk": {}, + "/v1/default/Pod/fake-pod-6-5xvw5": {}, + "/v1/default/Pod/fake-pod-6-5z5c7": {}, + "/v1/default/Pod/fake-pod-6-64p9m": {}, + "/v1/default/Pod/fake-pod-6-64pvg": {}, + "/v1/default/Pod/fake-pod-6-66x27": {}, + "/v1/default/Pod/fake-pod-6-68frd": {}, + "/v1/default/Pod/fake-pod-6-68lss": {}, + "/v1/default/Pod/fake-pod-6-6h8tw": {}, + "/v1/default/Pod/fake-pod-6-6hxzz": {}, + "/v1/default/Pod/fake-pod-6-6qts6": {}, + "/v1/default/Pod/fake-pod-6-6qwvc": {}, + "/v1/default/Pod/fake-pod-6-6t674": {}, + "/v1/default/Pod/fake-pod-6-6x2hh": {}, + "/v1/default/Pod/fake-pod-6-6x8k7": {}, + "/v1/default/Pod/fake-pod-6-757kg": {}, + "/v1/default/Pod/fake-pod-6-76dhf": {}, + "/v1/default/Pod/fake-pod-6-7khv2": {}, + "/v1/default/Pod/fake-pod-6-7l8s6": {}, + "/v1/default/Pod/fake-pod-6-7nqjv": {}, + "/v1/default/Pod/fake-pod-6-7zc7c": {}, + "/v1/default/Pod/fake-pod-6-7zp9x": {}, + "/v1/default/Pod/fake-pod-6-87njh": {}, + "/v1/default/Pod/fake-pod-6-8j885": {}, + "/v1/default/Pod/fake-pod-6-8krrv": {}, + "/v1/default/Pod/fake-pod-6-8nsxh": {}, + "/v1/default/Pod/fake-pod-6-8pvsz": {}, + "/v1/default/Pod/fake-pod-6-8r6sf": {}, + "/v1/default/Pod/fake-pod-6-8slph": {}, + "/v1/default/Pod/fake-pod-6-8snb8": {}, + "/v1/default/Pod/fake-pod-6-8ssc6": {}, + "/v1/default/Pod/fake-pod-6-8svq8": {}, + "/v1/default/Pod/fake-pod-6-957vc": {}, + "/v1/default/Pod/fake-pod-6-95s8l": {}, + "/v1/default/Pod/fake-pod-6-97zvl": {}, + "/v1/default/Pod/fake-pod-6-9f7dg": {}, + "/v1/default/Pod/fake-pod-6-9gxwz": {}, + "/v1/default/Pod/fake-pod-6-9j64m": {}, + "/v1/default/Pod/fake-pod-6-9kzsk": {}, + "/v1/default/Pod/fake-pod-6-9m5wq": {}, + "/v1/default/Pod/fake-pod-6-9wjqw": {}, + "/v1/default/Pod/fake-pod-6-b4897": {}, + "/v1/default/Pod/fake-pod-6-b6bvx": {}, + "/v1/default/Pod/fake-pod-6-bg6pv": {}, + "/v1/default/Pod/fake-pod-6-bm7w5": {}, + "/v1/default/Pod/fake-pod-6-bv4zd": {}, + "/v1/default/Pod/fake-pod-6-c4fg7": {}, + "/v1/default/Pod/fake-pod-6-c7hlt": {}, + "/v1/default/Pod/fake-pod-6-c7mdw": {}, + "/v1/default/Pod/fake-pod-6-c7x7d": {}, + "/v1/default/Pod/fake-pod-6-cb5zt": {}, + "/v1/default/Pod/fake-pod-6-cbnb5": {}, + "/v1/default/Pod/fake-pod-6-cdbrp": {}, + "/v1/default/Pod/fake-pod-6-ck5bx": {}, + "/v1/default/Pod/fake-pod-6-clzcv": {}, + "/v1/default/Pod/fake-pod-6-cpbvn": {}, + "/v1/default/Pod/fake-pod-6-cpnhq": {}, + "/v1/default/Pod/fake-pod-6-cs72j": {}, + "/v1/default/Pod/fake-pod-6-ctph9": {}, + "/v1/default/Pod/fake-pod-6-cx94v": {}, + "/v1/default/Pod/fake-pod-6-d5xgr": {}, + "/v1/default/Pod/fake-pod-6-ddq2j": {}, + "/v1/default/Pod/fake-pod-6-df5qw": {}, + "/v1/default/Pod/fake-pod-6-dfx9d": {}, + "/v1/default/Pod/fake-pod-6-dghzt": {}, + "/v1/default/Pod/fake-pod-6-dgrp4": {}, + "/v1/default/Pod/fake-pod-6-dh95c": {}, + "/v1/default/Pod/fake-pod-6-dkq6m": {}, + "/v1/default/Pod/fake-pod-6-dnrsn": {}, + "/v1/default/Pod/fake-pod-6-dqnvl": {}, + "/v1/default/Pod/fake-pod-6-dwxwm": {}, + "/v1/default/Pod/fake-pod-6-dx55j": {}, + "/v1/default/Pod/fake-pod-6-dxlcq": {}, + "/v1/default/Pod/fake-pod-6-dxnr2": {}, + "/v1/default/Pod/fake-pod-6-f2777": {}, + "/v1/default/Pod/fake-pod-6-f49px": {}, + "/v1/default/Pod/fake-pod-6-f4s9c": {}, + "/v1/default/Pod/fake-pod-6-fd6r5": {}, + "/v1/default/Pod/fake-pod-6-ffmmk": {}, + "/v1/default/Pod/fake-pod-6-fggg8": {}, + "/v1/default/Pod/fake-pod-6-fht9t": {}, + "/v1/default/Pod/fake-pod-6-fj5bk": {}, + "/v1/default/Pod/fake-pod-6-fkb79": {}, + "/v1/default/Pod/fake-pod-6-fmz56": {}, + "/v1/default/Pod/fake-pod-6-fpt9t": {}, + "/v1/default/Pod/fake-pod-6-frmrd": {}, + "/v1/default/Pod/fake-pod-6-fwtgc": {}, + "/v1/default/Pod/fake-pod-6-fz29w": {}, + "/v1/default/Pod/fake-pod-6-g84d5": {}, + "/v1/default/Pod/fake-pod-6-gdjpl": {}, + "/v1/default/Pod/fake-pod-6-gf22m": {}, + "/v1/default/Pod/fake-pod-6-gjwwh": {}, + "/v1/default/Pod/fake-pod-6-gr6zw": {}, + "/v1/default/Pod/fake-pod-6-gv6dg": {}, + "/v1/default/Pod/fake-pod-6-gvkwj": {}, + "/v1/default/Pod/fake-pod-6-gwrzs": {}, + "/v1/default/Pod/fake-pod-6-gzd94": {}, + "/v1/default/Pod/fake-pod-6-h4r2p": {}, + "/v1/default/Pod/fake-pod-6-h65tx": {}, + "/v1/default/Pod/fake-pod-6-h67vz": {}, + "/v1/default/Pod/fake-pod-6-hfs9p": {}, + "/v1/default/Pod/fake-pod-6-hhfgm": {}, + "/v1/default/Pod/fake-pod-6-hmvcn": {}, + "/v1/default/Pod/fake-pod-6-hpjr9": {}, + "/v1/default/Pod/fake-pod-6-hpqc6": {}, + "/v1/default/Pod/fake-pod-6-hqxfg": {}, + "/v1/default/Pod/fake-pod-6-hxmrt": {}, + "/v1/default/Pod/fake-pod-6-hz4t8": {}, + "/v1/default/Pod/fake-pod-6-j2k96": {}, + "/v1/default/Pod/fake-pod-6-j9frd": {}, + "/v1/default/Pod/fake-pod-6-j9kzc": {}, + "/v1/default/Pod/fake-pod-6-jbcsz": {}, + "/v1/default/Pod/fake-pod-6-jj87n": {}, + "/v1/default/Pod/fake-pod-6-jjjts": {}, + "/v1/default/Pod/fake-pod-6-jqgn9": {}, + "/v1/default/Pod/fake-pod-6-jrjgd": {}, + "/v1/default/Pod/fake-pod-6-jwj86": {}, + "/v1/default/Pod/fake-pod-6-jwvmk": {}, + "/v1/default/Pod/fake-pod-6-jxzkb": {}, + "/v1/default/Pod/fake-pod-6-jzngk": {}, + "/v1/default/Pod/fake-pod-6-k48f5": {}, + "/v1/default/Pod/fake-pod-6-k6vdj": {}, + "/v1/default/Pod/fake-pod-6-khjk5": {}, + "/v1/default/Pod/fake-pod-6-kks5r": {}, + "/v1/default/Pod/fake-pod-6-kl778": {}, + "/v1/default/Pod/fake-pod-6-kmvzb": {}, + "/v1/default/Pod/fake-pod-6-kp7q7": {}, + "/v1/default/Pod/fake-pod-6-kqsr7": {}, + "/v1/default/Pod/fake-pod-6-ks4fj": {}, + "/v1/default/Pod/fake-pod-6-kslbs": {}, + "/v1/default/Pod/fake-pod-6-kvt5x": {}, + "/v1/default/Pod/fake-pod-6-kx2r4": {}, + "/v1/default/Pod/fake-pod-6-l94hv": {}, + "/v1/default/Pod/fake-pod-6-lbzpp": {}, + "/v1/default/Pod/fake-pod-6-lc7cr": {}, + "/v1/default/Pod/fake-pod-6-lcdbq": {}, + "/v1/default/Pod/fake-pod-6-ld44c": {}, + "/v1/default/Pod/fake-pod-6-lhrt2": {}, + "/v1/default/Pod/fake-pod-6-lk428": {}, + "/v1/default/Pod/fake-pod-6-lkl8f": {}, + "/v1/default/Pod/fake-pod-6-llk6s": {}, + "/v1/default/Pod/fake-pod-6-llk84": {}, + "/v1/default/Pod/fake-pod-6-lm5cm": {}, + "/v1/default/Pod/fake-pod-6-lnxl9": {}, + "/v1/default/Pod/fake-pod-6-lvf7f": {}, + "/v1/default/Pod/fake-pod-6-lxgcm": {}, + "/v1/default/Pod/fake-pod-6-lz55c": {}, + "/v1/default/Pod/fake-pod-6-lznlt": {}, + "/v1/default/Pod/fake-pod-6-m4tx9": {}, + "/v1/default/Pod/fake-pod-6-mg5cz": {}, + "/v1/default/Pod/fake-pod-6-mkhp5": {}, + "/v1/default/Pod/fake-pod-6-mlgwd": {}, + "/v1/default/Pod/fake-pod-6-mrj9h": {}, + "/v1/default/Pod/fake-pod-6-mttlw": {}, + "/v1/default/Pod/fake-pod-6-mw9fc": {}, + "/v1/default/Pod/fake-pod-6-n4fj4": {}, + "/v1/default/Pod/fake-pod-6-nbtvr": {}, + "/v1/default/Pod/fake-pod-6-ngw7x": {}, + "/v1/default/Pod/fake-pod-6-njv7f": {}, + "/v1/default/Pod/fake-pod-6-nkjr5": {}, + "/v1/default/Pod/fake-pod-6-nkvbw": {}, + "/v1/default/Pod/fake-pod-6-nlfsq": {}, + "/v1/default/Pod/fake-pod-6-nsjvg": {}, + "/v1/default/Pod/fake-pod-6-nslt7": {}, + "/v1/default/Pod/fake-pod-6-nsrvx": {}, + "/v1/default/Pod/fake-pod-6-nt7ww": {}, + "/v1/default/Pod/fake-pod-6-ntngx": {}, + "/v1/default/Pod/fake-pod-6-nwfh4": {}, + "/v1/default/Pod/fake-pod-6-nxpb2": {}, + "/v1/default/Pod/fake-pod-6-p6n2f": {}, + "/v1/default/Pod/fake-pod-6-pb762": {}, + "/v1/default/Pod/fake-pod-6-plz7t": {}, + "/v1/default/Pod/fake-pod-6-pmz8v": {}, + "/v1/default/Pod/fake-pod-6-ppv9h": {}, + "/v1/default/Pod/fake-pod-6-psmsf": {}, + "/v1/default/Pod/fake-pod-6-pt6vs": {}, + "/v1/default/Pod/fake-pod-6-q2nc8": {}, + "/v1/default/Pod/fake-pod-6-q6lw8": {}, + "/v1/default/Pod/fake-pod-6-qcjcl": {}, + "/v1/default/Pod/fake-pod-6-qg9rg": {}, + "/v1/default/Pod/fake-pod-6-qglsn": {}, + "/v1/default/Pod/fake-pod-6-qhdqh": {}, + "/v1/default/Pod/fake-pod-6-qplhr": {}, + "/v1/default/Pod/fake-pod-6-qpm2h": {}, + "/v1/default/Pod/fake-pod-6-qqdfj": {}, + "/v1/default/Pod/fake-pod-6-qr5tb": {}, + "/v1/default/Pod/fake-pod-6-qs5zw": {}, + "/v1/default/Pod/fake-pod-6-qzmsp": {}, + "/v1/default/Pod/fake-pod-6-r5cft": {}, + "/v1/default/Pod/fake-pod-6-r5g7b": {}, + "/v1/default/Pod/fake-pod-6-r9cbf": {}, + "/v1/default/Pod/fake-pod-6-rd8cb": {}, + "/v1/default/Pod/fake-pod-6-rh8ln": {}, + "/v1/default/Pod/fake-pod-6-rnhjq": {}, + "/v1/default/Pod/fake-pod-6-rpm5h": {}, + "/v1/default/Pod/fake-pod-6-rrwdb": {}, + "/v1/default/Pod/fake-pod-6-rtrb6": {}, + "/v1/default/Pod/fake-pod-6-rvcwb": {}, + "/v1/default/Pod/fake-pod-6-s6h2f": {}, + "/v1/default/Pod/fake-pod-6-s7gc5": {}, + "/v1/default/Pod/fake-pod-6-s8vm9": {}, + "/v1/default/Pod/fake-pod-6-sb7zg": {}, + "/v1/default/Pod/fake-pod-6-sbbsg": {}, + "/v1/default/Pod/fake-pod-6-scqgf": {}, + "/v1/default/Pod/fake-pod-6-sfbch": {}, + "/v1/default/Pod/fake-pod-6-sgnl5": {}, + "/v1/default/Pod/fake-pod-6-shgmh": {}, + "/v1/default/Pod/fake-pod-6-sl7x7": {}, + "/v1/default/Pod/fake-pod-6-snspp": {}, + "/v1/default/Pod/fake-pod-6-sqvxw": {}, + "/v1/default/Pod/fake-pod-6-sqz2j": {}, + "/v1/default/Pod/fake-pod-6-ssxmv": {}, + "/v1/default/Pod/fake-pod-6-sz696": {}, + "/v1/default/Pod/fake-pod-6-szp5w": {}, + "/v1/default/Pod/fake-pod-6-t28tk": {}, + "/v1/default/Pod/fake-pod-6-t2fvz": {}, + "/v1/default/Pod/fake-pod-6-t84cn": {}, + "/v1/default/Pod/fake-pod-6-tbh8v": {}, + "/v1/default/Pod/fake-pod-6-tc4nv": {}, + "/v1/default/Pod/fake-pod-6-tfpzn": {}, + "/v1/default/Pod/fake-pod-6-tgwnm": {}, + "/v1/default/Pod/fake-pod-6-th6np": {}, + "/v1/default/Pod/fake-pod-6-th8ct": {}, + "/v1/default/Pod/fake-pod-6-thzbf": {}, + "/v1/default/Pod/fake-pod-6-tk5pm": {}, + "/v1/default/Pod/fake-pod-6-tm28h": {}, + "/v1/default/Pod/fake-pod-6-trsc4": {}, + "/v1/default/Pod/fake-pod-6-v2zvx": {}, + "/v1/default/Pod/fake-pod-6-v8p9r": {}, + "/v1/default/Pod/fake-pod-6-vb424": {}, + "/v1/default/Pod/fake-pod-6-vfdls": {}, + "/v1/default/Pod/fake-pod-6-vhz4d": {}, + "/v1/default/Pod/fake-pod-6-vk76g": {}, + "/v1/default/Pod/fake-pod-6-vt4vv": {}, + "/v1/default/Pod/fake-pod-6-vtc7p": {}, + "/v1/default/Pod/fake-pod-6-vwktg": {}, + "/v1/default/Pod/fake-pod-6-vwvqn": {}, + "/v1/default/Pod/fake-pod-6-w2js5": {}, + "/v1/default/Pod/fake-pod-6-w4mth": {}, + "/v1/default/Pod/fake-pod-6-w74gq": {}, + "/v1/default/Pod/fake-pod-6-wb7dn": {}, + "/v1/default/Pod/fake-pod-6-wdxxr": {}, + "/v1/default/Pod/fake-pod-6-wf8hk": {}, + "/v1/default/Pod/fake-pod-6-whcll": {}, + "/v1/default/Pod/fake-pod-6-wjjqc": {}, + "/v1/default/Pod/fake-pod-6-wms7l": {}, + "/v1/default/Pod/fake-pod-6-wpg6q": {}, + "/v1/default/Pod/fake-pod-6-wpjh7": {}, + "/v1/default/Pod/fake-pod-6-wzpw5": {}, + "/v1/default/Pod/fake-pod-6-x4hb4": {}, + "/v1/default/Pod/fake-pod-6-xc4pt": {}, + "/v1/default/Pod/fake-pod-6-xc7tn": {}, + "/v1/default/Pod/fake-pod-6-xgdpj": {}, + "/v1/default/Pod/fake-pod-6-xk59d": {}, + "/v1/default/Pod/fake-pod-6-xr7x6": {}, + "/v1/default/Pod/fake-pod-6-xrn44": {}, + "/v1/default/Pod/fake-pod-6-xtcwx": {}, + "/v1/default/Pod/fake-pod-6-z49hk": {}, + "/v1/default/Pod/fake-pod-6-z7m8c": {}, + "/v1/default/Pod/fake-pod-6-zgbnz": {}, + "/v1/default/Pod/fake-pod-6-zh2gx": {}, + "/v1/default/Pod/fake-pod-6-zhbql": {}, + "/v1/default/Pod/fake-pod-6-zhkgt": {}, + "/v1/default/Pod/fake-pod-6-zhqcx": {}, + "/v1/default/Pod/fake-pod-6-zj84x": {}, + "/v1/default/Pod/fake-pod-6-zsst8": {}, + "/v1/default/Pod/fake-pod-6-zw49l": {}, + "/v1/default/Pod/fake-pod-7-22brk": {}, + "/v1/default/Pod/fake-pod-7-24h6n": {}, + "/v1/default/Pod/fake-pod-7-2b8xv": {}, + "/v1/default/Pod/fake-pod-7-2bcnj": {}, + "/v1/default/Pod/fake-pod-7-2d4fg": {}, + "/v1/default/Pod/fake-pod-7-2gd45": {}, + "/v1/default/Pod/fake-pod-7-2k922": {}, + "/v1/default/Pod/fake-pod-7-2nv6f": {}, + "/v1/default/Pod/fake-pod-7-2nvzh": {}, + "/v1/default/Pod/fake-pod-7-2sgqr": {}, + "/v1/default/Pod/fake-pod-7-2zqr6": {}, + "/v1/default/Pod/fake-pod-7-42xpp": {}, + "/v1/default/Pod/fake-pod-7-4527r": {}, + "/v1/default/Pod/fake-pod-7-48msp": {}, + "/v1/default/Pod/fake-pod-7-4bl9x": {}, + "/v1/default/Pod/fake-pod-7-4d6n2": {}, + "/v1/default/Pod/fake-pod-7-4knlf": {}, + "/v1/default/Pod/fake-pod-7-4nm74": {}, + "/v1/default/Pod/fake-pod-7-4qvl2": {}, + "/v1/default/Pod/fake-pod-7-4s5km": {}, + "/v1/default/Pod/fake-pod-7-4zf8b": {}, + "/v1/default/Pod/fake-pod-7-556s4": {}, + "/v1/default/Pod/fake-pod-7-56hdp": {}, + "/v1/default/Pod/fake-pod-7-56k4n": {}, + "/v1/default/Pod/fake-pod-7-576cp": {}, + "/v1/default/Pod/fake-pod-7-59rm9": {}, + "/v1/default/Pod/fake-pod-7-5bq27": {}, + "/v1/default/Pod/fake-pod-7-5cx88": {}, + "/v1/default/Pod/fake-pod-7-5lqvr": {}, + "/v1/default/Pod/fake-pod-7-5nfpk": {}, + "/v1/default/Pod/fake-pod-7-5pnnk": {}, + "/v1/default/Pod/fake-pod-7-5qdh6": {}, + "/v1/default/Pod/fake-pod-7-5r9wz": {}, + "/v1/default/Pod/fake-pod-7-5v8jb": {}, + "/v1/default/Pod/fake-pod-7-5xkvm": {}, + "/v1/default/Pod/fake-pod-7-62wfp": {}, + "/v1/default/Pod/fake-pod-7-654ls": {}, + "/v1/default/Pod/fake-pod-7-66997": {}, + "/v1/default/Pod/fake-pod-7-68v6w": {}, + "/v1/default/Pod/fake-pod-7-697tp": {}, + "/v1/default/Pod/fake-pod-7-69m6f": {}, + "/v1/default/Pod/fake-pod-7-6bzbk": {}, + "/v1/default/Pod/fake-pod-7-6gzvl": {}, + "/v1/default/Pod/fake-pod-7-6h29r": {}, + "/v1/default/Pod/fake-pod-7-6h84q": {}, + "/v1/default/Pod/fake-pod-7-6lg25": {}, + "/v1/default/Pod/fake-pod-7-6lwln": {}, + "/v1/default/Pod/fake-pod-7-6pl6n": {}, + "/v1/default/Pod/fake-pod-7-6z88c": {}, + "/v1/default/Pod/fake-pod-7-77mnx": {}, + "/v1/default/Pod/fake-pod-7-77tcq": {}, + "/v1/default/Pod/fake-pod-7-798fg": {}, + "/v1/default/Pod/fake-pod-7-7g7tn": {}, + "/v1/default/Pod/fake-pod-7-7gcr4": {}, + "/v1/default/Pod/fake-pod-7-7lfwm": {}, + "/v1/default/Pod/fake-pod-7-7ndwj": {}, + "/v1/default/Pod/fake-pod-7-7pckc": {}, + "/v1/default/Pod/fake-pod-7-7qlgg": {}, + "/v1/default/Pod/fake-pod-7-7tkzc": {}, + "/v1/default/Pod/fake-pod-7-7ttkb": {}, + "/v1/default/Pod/fake-pod-7-7wb4z": {}, + "/v1/default/Pod/fake-pod-7-826fh": {}, + "/v1/default/Pod/fake-pod-7-84j2w": {}, + "/v1/default/Pod/fake-pod-7-85w9b": {}, + "/v1/default/Pod/fake-pod-7-862nh": {}, + "/v1/default/Pod/fake-pod-7-87p6b": {}, + "/v1/default/Pod/fake-pod-7-89lsg": {}, + "/v1/default/Pod/fake-pod-7-8jpvb": {}, + "/v1/default/Pod/fake-pod-7-8jx27": {}, + "/v1/default/Pod/fake-pod-7-8jzd5": {}, + "/v1/default/Pod/fake-pod-7-8krbc": {}, + "/v1/default/Pod/fake-pod-7-8md4f": {}, + "/v1/default/Pod/fake-pod-7-8n2zl": {}, + "/v1/default/Pod/fake-pod-7-8psph": {}, + "/v1/default/Pod/fake-pod-7-8qbfp": {}, + "/v1/default/Pod/fake-pod-7-8rgx7": {}, + "/v1/default/Pod/fake-pod-7-8xdfc": {}, + "/v1/default/Pod/fake-pod-7-954rk": {}, + "/v1/default/Pod/fake-pod-7-98t7r": {}, + "/v1/default/Pod/fake-pod-7-98zsx": {}, + "/v1/default/Pod/fake-pod-7-9dbbh": {}, + "/v1/default/Pod/fake-pod-7-9f8cc": {}, + "/v1/default/Pod/fake-pod-7-9h6wg": {}, + "/v1/default/Pod/fake-pod-7-9s4w6": {}, + "/v1/default/Pod/fake-pod-7-9sqwt": {}, + "/v1/default/Pod/fake-pod-7-9v2xn": {}, + "/v1/default/Pod/fake-pod-7-9wggz": {}, + "/v1/default/Pod/fake-pod-7-9x6f2": {}, + "/v1/default/Pod/fake-pod-7-9zc22": {}, + "/v1/default/Pod/fake-pod-7-9zl9t": {}, + "/v1/default/Pod/fake-pod-7-b5lvj": {}, + "/v1/default/Pod/fake-pod-7-b9rg8": {}, + "/v1/default/Pod/fake-pod-7-bdzmd": {}, + "/v1/default/Pod/fake-pod-7-bjqqb": {}, + "/v1/default/Pod/fake-pod-7-btkvj": {}, + "/v1/default/Pod/fake-pod-7-bvlb9": {}, + "/v1/default/Pod/fake-pod-7-bw8bj": {}, + "/v1/default/Pod/fake-pod-7-c6rfq": {}, + "/v1/default/Pod/fake-pod-7-c769x": {}, + "/v1/default/Pod/fake-pod-7-c7754": {}, + "/v1/default/Pod/fake-pod-7-c8sq5": {}, + "/v1/default/Pod/fake-pod-7-cc4zr": {}, + "/v1/default/Pod/fake-pod-7-cfjkm": {}, + "/v1/default/Pod/fake-pod-7-cfzkq": {}, + "/v1/default/Pod/fake-pod-7-cg5jt": {}, + "/v1/default/Pod/fake-pod-7-cgqc4": {}, + "/v1/default/Pod/fake-pod-7-cmdwk": {}, + "/v1/default/Pod/fake-pod-7-czxrz": {}, + "/v1/default/Pod/fake-pod-7-d2m5d": {}, + "/v1/default/Pod/fake-pod-7-d5fws": {}, + "/v1/default/Pod/fake-pod-7-d5r7t": {}, + "/v1/default/Pod/fake-pod-7-d8st7": {}, + "/v1/default/Pod/fake-pod-7-dchck": {}, + "/v1/default/Pod/fake-pod-7-df6xs": {}, + "/v1/default/Pod/fake-pod-7-dhksd": {}, + "/v1/default/Pod/fake-pod-7-djjb7": {}, + "/v1/default/Pod/fake-pod-7-dlm6r": {}, + "/v1/default/Pod/fake-pod-7-dmm5k": {}, + "/v1/default/Pod/fake-pod-7-dvc45": {}, + "/v1/default/Pod/fake-pod-7-dzgnc": {}, + "/v1/default/Pod/fake-pod-7-f2bsx": {}, + "/v1/default/Pod/fake-pod-7-f4ljt": {}, + "/v1/default/Pod/fake-pod-7-f4qcr": {}, + "/v1/default/Pod/fake-pod-7-f6pjq": {}, + "/v1/default/Pod/fake-pod-7-fcrg2": {}, + "/v1/default/Pod/fake-pod-7-fq2sb": {}, + "/v1/default/Pod/fake-pod-7-fq4fd": {}, + "/v1/default/Pod/fake-pod-7-g2wcv": {}, + "/v1/default/Pod/fake-pod-7-g5fvb": {}, + "/v1/default/Pod/fake-pod-7-g5zpq": {}, + "/v1/default/Pod/fake-pod-7-g79kl": {}, + "/v1/default/Pod/fake-pod-7-g8rpd": {}, + "/v1/default/Pod/fake-pod-7-gbtvg": {}, + "/v1/default/Pod/fake-pod-7-ggdgx": {}, + "/v1/default/Pod/fake-pod-7-gk4mw": {}, + "/v1/default/Pod/fake-pod-7-gkd8v": {}, + "/v1/default/Pod/fake-pod-7-gmq25": {}, + "/v1/default/Pod/fake-pod-7-gq6pp": {}, + "/v1/default/Pod/fake-pod-7-gsx7j": {}, + "/v1/default/Pod/fake-pod-7-h4c89": {}, + "/v1/default/Pod/fake-pod-7-h9x52": {}, + "/v1/default/Pod/fake-pod-7-hb8v2": {}, + "/v1/default/Pod/fake-pod-7-hclgm": {}, + "/v1/default/Pod/fake-pod-7-hfqfz": {}, + "/v1/default/Pod/fake-pod-7-hj9zq": {}, + "/v1/default/Pod/fake-pod-7-hmpcl": {}, + "/v1/default/Pod/fake-pod-7-hpf8r": {}, + "/v1/default/Pod/fake-pod-7-hsjtr": {}, + "/v1/default/Pod/fake-pod-7-hsszk": {}, + "/v1/default/Pod/fake-pod-7-hvzmc": {}, + "/v1/default/Pod/fake-pod-7-hwh5r": {}, + "/v1/default/Pod/fake-pod-7-j2w44": {}, + "/v1/default/Pod/fake-pod-7-j4jxl": {}, + "/v1/default/Pod/fake-pod-7-jd7nn": {}, + "/v1/default/Pod/fake-pod-7-jgxbn": {}, + "/v1/default/Pod/fake-pod-7-jms9f": {}, + "/v1/default/Pod/fake-pod-7-jqxrb": {}, + "/v1/default/Pod/fake-pod-7-jtvdj": {}, + "/v1/default/Pod/fake-pod-7-jv2f2": {}, + "/v1/default/Pod/fake-pod-7-jzjwj": {}, + "/v1/default/Pod/fake-pod-7-k2xp7": {}, + "/v1/default/Pod/fake-pod-7-k4226": {}, + "/v1/default/Pod/fake-pod-7-kbq8j": {}, + "/v1/default/Pod/fake-pod-7-kc2qh": {}, + "/v1/default/Pod/fake-pod-7-kfgtm": {}, + "/v1/default/Pod/fake-pod-7-kjzjn": {}, + "/v1/default/Pod/fake-pod-7-kq9kz": {}, + "/v1/default/Pod/fake-pod-7-kwzzr": {}, + "/v1/default/Pod/fake-pod-7-l9b7b": {}, + "/v1/default/Pod/fake-pod-7-lfzwm": {}, + "/v1/default/Pod/fake-pod-7-lgz72": {}, + "/v1/default/Pod/fake-pod-7-lstj6": {}, + "/v1/default/Pod/fake-pod-7-lxbtx": {}, + "/v1/default/Pod/fake-pod-7-m2rsj": {}, + "/v1/default/Pod/fake-pod-7-m7gb7": {}, + "/v1/default/Pod/fake-pod-7-mdhvs": {}, + "/v1/default/Pod/fake-pod-7-mfctr": {}, + "/v1/default/Pod/fake-pod-7-mkqml": {}, + "/v1/default/Pod/fake-pod-7-mldx5": {}, + "/v1/default/Pod/fake-pod-7-mwjjw": {}, + "/v1/default/Pod/fake-pod-7-n55rd": {}, + "/v1/default/Pod/fake-pod-7-n5xld": {}, + "/v1/default/Pod/fake-pod-7-n9sx6": {}, + "/v1/default/Pod/fake-pod-7-ndnwn": {}, + "/v1/default/Pod/fake-pod-7-njcbj": {}, + "/v1/default/Pod/fake-pod-7-nmnk5": {}, + "/v1/default/Pod/fake-pod-7-np6j6": {}, + "/v1/default/Pod/fake-pod-7-nqxxw": {}, + "/v1/default/Pod/fake-pod-7-nsx4t": {}, + "/v1/default/Pod/fake-pod-7-nwpz6": {}, + "/v1/default/Pod/fake-pod-7-nzhrq": {}, + "/v1/default/Pod/fake-pod-7-p556l": {}, + "/v1/default/Pod/fake-pod-7-pc8mq": {}, + "/v1/default/Pod/fake-pod-7-pg6bd": {}, + "/v1/default/Pod/fake-pod-7-phx59": {}, + "/v1/default/Pod/fake-pod-7-pj4dl": {}, + "/v1/default/Pod/fake-pod-7-pjc4s": {}, + "/v1/default/Pod/fake-pod-7-pjgjh": {}, + "/v1/default/Pod/fake-pod-7-pnxkc": {}, + "/v1/default/Pod/fake-pod-7-pxqcn": {}, + "/v1/default/Pod/fake-pod-7-q5x6s": {}, + "/v1/default/Pod/fake-pod-7-q6mzp": {}, + "/v1/default/Pod/fake-pod-7-q7q4s": {}, + "/v1/default/Pod/fake-pod-7-q7r7m": {}, + "/v1/default/Pod/fake-pod-7-q8486": {}, + "/v1/default/Pod/fake-pod-7-q8dl9": {}, + "/v1/default/Pod/fake-pod-7-q9wf7": {}, + "/v1/default/Pod/fake-pod-7-q9zzp": {}, + "/v1/default/Pod/fake-pod-7-qcn9q": {}, + "/v1/default/Pod/fake-pod-7-ql2fx": {}, + "/v1/default/Pod/fake-pod-7-qsg5z": {}, + "/v1/default/Pod/fake-pod-7-qtj8t": {}, + "/v1/default/Pod/fake-pod-7-qtz8h": {}, + "/v1/default/Pod/fake-pod-7-qwth6": {}, + "/v1/default/Pod/fake-pod-7-r2nkp": {}, + "/v1/default/Pod/fake-pod-7-r4pvp": {}, + "/v1/default/Pod/fake-pod-7-r86mc": {}, + "/v1/default/Pod/fake-pod-7-r9vq6": {}, + "/v1/default/Pod/fake-pod-7-rmk8j": {}, + "/v1/default/Pod/fake-pod-7-rngw7": {}, + "/v1/default/Pod/fake-pod-7-rpgqc": {}, + "/v1/default/Pod/fake-pod-7-rqtms": {}, + "/v1/default/Pod/fake-pod-7-rrd8r": {}, + "/v1/default/Pod/fake-pod-7-rvzbp": {}, + "/v1/default/Pod/fake-pod-7-s2l9r": {}, + "/v1/default/Pod/fake-pod-7-s5rxs": {}, + "/v1/default/Pod/fake-pod-7-sbwtz": {}, + "/v1/default/Pod/fake-pod-7-sghdp": {}, + "/v1/default/Pod/fake-pod-7-slk4c": {}, + "/v1/default/Pod/fake-pod-7-ss7zq": {}, + "/v1/default/Pod/fake-pod-7-sssnw": {}, + "/v1/default/Pod/fake-pod-7-st9dp": {}, + "/v1/default/Pod/fake-pod-7-t58qx": {}, + "/v1/default/Pod/fake-pod-7-t59zt": {}, + "/v1/default/Pod/fake-pod-7-t5bfs": {}, + "/v1/default/Pod/fake-pod-7-t8kv2": {}, + "/v1/default/Pod/fake-pod-7-tbbzq": {}, + "/v1/default/Pod/fake-pod-7-tcjrc": {}, + "/v1/default/Pod/fake-pod-7-tdmq8": {}, + "/v1/default/Pod/fake-pod-7-thdpz": {}, + "/v1/default/Pod/fake-pod-7-tj4sx": {}, + "/v1/default/Pod/fake-pod-7-tj5xc": {}, + "/v1/default/Pod/fake-pod-7-tlxcg": {}, + "/v1/default/Pod/fake-pod-7-tnbhh": {}, + "/v1/default/Pod/fake-pod-7-tqfpn": {}, + "/v1/default/Pod/fake-pod-7-tqsm8": {}, + "/v1/default/Pod/fake-pod-7-tqtt2": {}, + "/v1/default/Pod/fake-pod-7-tt4k9": {}, + "/v1/default/Pod/fake-pod-7-tt5nq": {}, + "/v1/default/Pod/fake-pod-7-twmjv": {}, + "/v1/default/Pod/fake-pod-7-tzck8": {}, + "/v1/default/Pod/fake-pod-7-tzjzr": {}, + "/v1/default/Pod/fake-pod-7-v8tdr": {}, + "/v1/default/Pod/fake-pod-7-vf4k5": {}, + "/v1/default/Pod/fake-pod-7-vhrr7": {}, + "/v1/default/Pod/fake-pod-7-vnjkc": {}, + "/v1/default/Pod/fake-pod-7-vsbdw": {}, + "/v1/default/Pod/fake-pod-7-vsshp": {}, + "/v1/default/Pod/fake-pod-7-vtkkr": {}, + "/v1/default/Pod/fake-pod-7-w2kzp": {}, + "/v1/default/Pod/fake-pod-7-w474d": {}, + "/v1/default/Pod/fake-pod-7-wbwks": {}, + "/v1/default/Pod/fake-pod-7-wcgll": {}, + "/v1/default/Pod/fake-pod-7-wgtbv": {}, + "/v1/default/Pod/fake-pod-7-whlvk": {}, + "/v1/default/Pod/fake-pod-7-wjn8l": {}, + "/v1/default/Pod/fake-pod-7-wjwsj": {}, + "/v1/default/Pod/fake-pod-7-wljs8": {}, + "/v1/default/Pod/fake-pod-7-wvbt4": {}, + "/v1/default/Pod/fake-pod-7-ww6w5": {}, + "/v1/default/Pod/fake-pod-7-wxl58": {}, + "/v1/default/Pod/fake-pod-7-wxm7f": {}, + "/v1/default/Pod/fake-pod-7-x4ssb": {}, + "/v1/default/Pod/fake-pod-7-x59fd": {}, + "/v1/default/Pod/fake-pod-7-x5xhp": {}, + "/v1/default/Pod/fake-pod-7-xc77h": {}, + "/v1/default/Pod/fake-pod-7-xfz5m": {}, + "/v1/default/Pod/fake-pod-7-xjm2b": {}, + "/v1/default/Pod/fake-pod-7-xk5n4": {}, + "/v1/default/Pod/fake-pod-7-xn9mh": {}, + "/v1/default/Pod/fake-pod-7-xntmn": {}, + "/v1/default/Pod/fake-pod-7-xtsj4": {}, + "/v1/default/Pod/fake-pod-7-xvqsg": {}, + "/v1/default/Pod/fake-pod-7-xwf6r": {}, + "/v1/default/Pod/fake-pod-7-xxtq2": {}, + "/v1/default/Pod/fake-pod-7-z4s6w": {}, + "/v1/default/Pod/fake-pod-7-zdg8h": {}, + "/v1/default/Pod/fake-pod-7-zggwm": {}, + "/v1/default/Pod/fake-pod-7-zk7sc": {}, + "/v1/default/Pod/fake-pod-7-zn4l2": {}, + "/v1/default/Pod/fake-pod-7-znpxd": {}, + "/v1/default/Pod/fake-pod-7-zpkhw": {}, + "/v1/default/Pod/fake-pod-7-zpvsd": {}, + "/v1/default/Pod/fake-pod-7-zqdhq": {}, + "/v1/default/Pod/fake-pod-7-zqqmd": {}, + "/v1/default/Pod/fake-pod-7-zr9s2": {}, + "/v1/default/Pod/fake-pod-7-zw5j4": {}, + "/v1/default/Pod/fake-pod-7-zw8sq": {}, + "/v1/default/Pod/fake-pod-7-zxs6t": {}, + "/v1/default/Pod/fake-pod-8-25wgj": {}, + "/v1/default/Pod/fake-pod-8-29vzh": {}, + "/v1/default/Pod/fake-pod-8-2ckwp": {}, + "/v1/default/Pod/fake-pod-8-2f69r": {}, + "/v1/default/Pod/fake-pod-8-2hhkm": {}, + "/v1/default/Pod/fake-pod-8-2jfn5": {}, + "/v1/default/Pod/fake-pod-8-2kn66": {}, + "/v1/default/Pod/fake-pod-8-2ppkc": {}, + "/v1/default/Pod/fake-pod-8-2q6pz": {}, + "/v1/default/Pod/fake-pod-8-2qvhv": {}, + "/v1/default/Pod/fake-pod-8-2sml2": {}, + "/v1/default/Pod/fake-pod-8-2txm7": {}, + "/v1/default/Pod/fake-pod-8-2txzz": {}, + "/v1/default/Pod/fake-pod-8-2zbp8": {}, + "/v1/default/Pod/fake-pod-8-2zrgg": {}, + "/v1/default/Pod/fake-pod-8-42fkg": {}, + "/v1/default/Pod/fake-pod-8-45gnm": {}, + "/v1/default/Pod/fake-pod-8-495g8": {}, + "/v1/default/Pod/fake-pod-8-4ddl5": {}, + "/v1/default/Pod/fake-pod-8-4f2wt": {}, + "/v1/default/Pod/fake-pod-8-4l58b": {}, + "/v1/default/Pod/fake-pod-8-4z9jq": {}, + "/v1/default/Pod/fake-pod-8-4z9kx": {}, + "/v1/default/Pod/fake-pod-8-4zgnv": {}, + "/v1/default/Pod/fake-pod-8-55rx6": {}, + "/v1/default/Pod/fake-pod-8-58cwx": {}, + "/v1/default/Pod/fake-pod-8-5bk5w": {}, + "/v1/default/Pod/fake-pod-8-5d27n": {}, + "/v1/default/Pod/fake-pod-8-5dfw5": {}, + "/v1/default/Pod/fake-pod-8-5hjbl": {}, + "/v1/default/Pod/fake-pod-8-5mm8r": {}, + "/v1/default/Pod/fake-pod-8-5ncfs": {}, + "/v1/default/Pod/fake-pod-8-5nmxp": {}, + "/v1/default/Pod/fake-pod-8-5nwtv": {}, + "/v1/default/Pod/fake-pod-8-5s9dw": {}, + "/v1/default/Pod/fake-pod-8-66xzf": {}, + "/v1/default/Pod/fake-pod-8-6j72f": {}, + "/v1/default/Pod/fake-pod-8-6mrqw": {}, + "/v1/default/Pod/fake-pod-8-6pvpv": {}, + "/v1/default/Pod/fake-pod-8-6xfdb": {}, + "/v1/default/Pod/fake-pod-8-74sb8": {}, + "/v1/default/Pod/fake-pod-8-75f4f": {}, + "/v1/default/Pod/fake-pod-8-7blf4": {}, + "/v1/default/Pod/fake-pod-8-7cwcn": {}, + "/v1/default/Pod/fake-pod-8-7d88w": {}, + "/v1/default/Pod/fake-pod-8-7ffgs": {}, + "/v1/default/Pod/fake-pod-8-7hkqt": {}, + "/v1/default/Pod/fake-pod-8-7lmrp": {}, + "/v1/default/Pod/fake-pod-8-7lrk6": {}, + "/v1/default/Pod/fake-pod-8-7mxgf": {}, + "/v1/default/Pod/fake-pod-8-7nsr6": {}, + "/v1/default/Pod/fake-pod-8-7wvpb": {}, + "/v1/default/Pod/fake-pod-8-8kqdx": {}, + "/v1/default/Pod/fake-pod-8-8kzrg": {}, + "/v1/default/Pod/fake-pod-8-8nslb": {}, + "/v1/default/Pod/fake-pod-8-8pcfx": {}, + "/v1/default/Pod/fake-pod-8-8rm2n": {}, + "/v1/default/Pod/fake-pod-8-8t67d": {}, + "/v1/default/Pod/fake-pod-8-8x4x5": {}, + "/v1/default/Pod/fake-pod-8-8x79v": {}, + "/v1/default/Pod/fake-pod-8-94ksx": {}, + "/v1/default/Pod/fake-pod-8-98m77": {}, + "/v1/default/Pod/fake-pod-8-98rj8": {}, + "/v1/default/Pod/fake-pod-8-9cz78": {}, + "/v1/default/Pod/fake-pod-8-9d9dr": {}, + "/v1/default/Pod/fake-pod-8-9h8wx": {}, + "/v1/default/Pod/fake-pod-8-9jz82": {}, + "/v1/default/Pod/fake-pod-8-9lpdd": {}, + "/v1/default/Pod/fake-pod-8-9m668": {}, + "/v1/default/Pod/fake-pod-8-9nm2d": {}, + "/v1/default/Pod/fake-pod-8-9pnlt": {}, + "/v1/default/Pod/fake-pod-8-b5bfx": {}, + "/v1/default/Pod/fake-pod-8-b5sts": {}, + "/v1/default/Pod/fake-pod-8-b69rx": {}, + "/v1/default/Pod/fake-pod-8-bb4hw": {}, + "/v1/default/Pod/fake-pod-8-bkdpc": {}, + "/v1/default/Pod/fake-pod-8-bl9bj": {}, + "/v1/default/Pod/fake-pod-8-blwz9": {}, + "/v1/default/Pod/fake-pod-8-bn4gd": {}, + "/v1/default/Pod/fake-pod-8-bq2gh": {}, + "/v1/default/Pod/fake-pod-8-brmj5": {}, + "/v1/default/Pod/fake-pod-8-bxhcl": {}, + "/v1/default/Pod/fake-pod-8-c22vf": {}, + "/v1/default/Pod/fake-pod-8-c6s26": {}, + "/v1/default/Pod/fake-pod-8-cbqw2": {}, + "/v1/default/Pod/fake-pod-8-cc8vn": {}, + "/v1/default/Pod/fake-pod-8-cd6zv": {}, + "/v1/default/Pod/fake-pod-8-chlpw": {}, + "/v1/default/Pod/fake-pod-8-chx7f": {}, + "/v1/default/Pod/fake-pod-8-cpq5p": {}, + "/v1/default/Pod/fake-pod-8-cqqpm": {}, + "/v1/default/Pod/fake-pod-8-cxlxl": {}, + "/v1/default/Pod/fake-pod-8-d5bbq": {}, + "/v1/default/Pod/fake-pod-8-d8zmf": {}, + "/v1/default/Pod/fake-pod-8-dfpg9": {}, + "/v1/default/Pod/fake-pod-8-dg49q": {}, + "/v1/default/Pod/fake-pod-8-dhp8g": {}, + "/v1/default/Pod/fake-pod-8-djplh": {}, + "/v1/default/Pod/fake-pod-8-dlcbf": {}, + "/v1/default/Pod/fake-pod-8-dn87k": {}, + "/v1/default/Pod/fake-pod-8-dqpsp": {}, + "/v1/default/Pod/fake-pod-8-dxsqf": {}, + "/v1/default/Pod/fake-pod-8-f548n": {}, + "/v1/default/Pod/fake-pod-8-f6tvj": {}, + "/v1/default/Pod/fake-pod-8-f826w": {}, + "/v1/default/Pod/fake-pod-8-fb6lw": {}, + "/v1/default/Pod/fake-pod-8-fdg5m": {}, + "/v1/default/Pod/fake-pod-8-ffdz6": {}, + "/v1/default/Pod/fake-pod-8-fgv5x": {}, + "/v1/default/Pod/fake-pod-8-fjtq6": {}, + "/v1/default/Pod/fake-pod-8-fk9d2": {}, + "/v1/default/Pod/fake-pod-8-fl6v5": {}, + "/v1/default/Pod/fake-pod-8-fqj7t": {}, + "/v1/default/Pod/fake-pod-8-fsbpd": {}, + "/v1/default/Pod/fake-pod-8-ft4xv": {}, + "/v1/default/Pod/fake-pod-8-ftbh6": {}, + "/v1/default/Pod/fake-pod-8-ftxp5": {}, + "/v1/default/Pod/fake-pod-8-fz7jg": {}, + "/v1/default/Pod/fake-pod-8-fzc8h": {}, + "/v1/default/Pod/fake-pod-8-g55m7": {}, + "/v1/default/Pod/fake-pod-8-g5gmk": {}, + "/v1/default/Pod/fake-pod-8-gbn9w": {}, + "/v1/default/Pod/fake-pod-8-ggg4l": {}, + "/v1/default/Pod/fake-pod-8-glvtd": {}, + "/v1/default/Pod/fake-pod-8-gpkpk": {}, + "/v1/default/Pod/fake-pod-8-grdbm": {}, + "/v1/default/Pod/fake-pod-8-gsbm5": {}, + "/v1/default/Pod/fake-pod-8-gsqcg": {}, + "/v1/default/Pod/fake-pod-8-gvzdj": {}, + "/v1/default/Pod/fake-pod-8-h8557": {}, + "/v1/default/Pod/fake-pod-8-hbd7g": {}, + "/v1/default/Pod/fake-pod-8-hbwlr": {}, + "/v1/default/Pod/fake-pod-8-hhnvk": {}, + "/v1/default/Pod/fake-pod-8-hjjb6": {}, + "/v1/default/Pod/fake-pod-8-hjlmd": {}, + "/v1/default/Pod/fake-pod-8-hmzlb": {}, + "/v1/default/Pod/fake-pod-8-hpn5z": {}, + "/v1/default/Pod/fake-pod-8-hrp99": {}, + "/v1/default/Pod/fake-pod-8-j2kn5": {}, + "/v1/default/Pod/fake-pod-8-j7f27": {}, + "/v1/default/Pod/fake-pod-8-j7gkf": {}, + "/v1/default/Pod/fake-pod-8-jbbbz": {}, + "/v1/default/Pod/fake-pod-8-jf6dv": {}, + "/v1/default/Pod/fake-pod-8-jfxzf": {}, + "/v1/default/Pod/fake-pod-8-jh5nk": {}, + "/v1/default/Pod/fake-pod-8-jklxn": {}, + "/v1/default/Pod/fake-pod-8-jkxbz": {}, + "/v1/default/Pod/fake-pod-8-jp88p": {}, + "/v1/default/Pod/fake-pod-8-jq9pc": {}, + "/v1/default/Pod/fake-pod-8-k8h5p": {}, + "/v1/default/Pod/fake-pod-8-kbmzx": {}, + "/v1/default/Pod/fake-pod-8-kbrvl": {}, + "/v1/default/Pod/fake-pod-8-kdntk": {}, + "/v1/default/Pod/fake-pod-8-kg5qv": {}, + "/v1/default/Pod/fake-pod-8-kh4xw": {}, + "/v1/default/Pod/fake-pod-8-kwvw7": {}, + "/v1/default/Pod/fake-pod-8-kxv9j": {}, + "/v1/default/Pod/fake-pod-8-l4r24": {}, + "/v1/default/Pod/fake-pod-8-l8s89": {}, + "/v1/default/Pod/fake-pod-8-l9qmd": {}, + "/v1/default/Pod/fake-pod-8-lcjp8": {}, + "/v1/default/Pod/fake-pod-8-lcqkw": {}, + "/v1/default/Pod/fake-pod-8-lcwl2": {}, + "/v1/default/Pod/fake-pod-8-lddzf": {}, + "/v1/default/Pod/fake-pod-8-ldsmh": {}, + "/v1/default/Pod/fake-pod-8-lhjx2": {}, + "/v1/default/Pod/fake-pod-8-ll2q4": {}, + "/v1/default/Pod/fake-pod-8-llnbw": {}, + "/v1/default/Pod/fake-pod-8-llpfv": {}, + "/v1/default/Pod/fake-pod-8-lm77m": {}, + "/v1/default/Pod/fake-pod-8-lpt4s": {}, + "/v1/default/Pod/fake-pod-8-ltg5b": {}, + "/v1/default/Pod/fake-pod-8-lwvk7": {}, + "/v1/default/Pod/fake-pod-8-m5z77": {}, + "/v1/default/Pod/fake-pod-8-m92sc": {}, + "/v1/default/Pod/fake-pod-8-mdhsx": {}, + "/v1/default/Pod/fake-pod-8-mdztc": {}, + "/v1/default/Pod/fake-pod-8-mjt25": {}, + "/v1/default/Pod/fake-pod-8-mk674": {}, + "/v1/default/Pod/fake-pod-8-mm75b": {}, + "/v1/default/Pod/fake-pod-8-mnqkz": {}, + "/v1/default/Pod/fake-pod-8-mq5ft": {}, + "/v1/default/Pod/fake-pod-8-mqbpq": {}, + "/v1/default/Pod/fake-pod-8-mqgll": {}, + "/v1/default/Pod/fake-pod-8-ms9tb": {}, + "/v1/default/Pod/fake-pod-8-mw9nl": {}, + "/v1/default/Pod/fake-pod-8-mxtvx": {}, + "/v1/default/Pod/fake-pod-8-n5h5g": {}, + "/v1/default/Pod/fake-pod-8-n8sgx": {}, + "/v1/default/Pod/fake-pod-8-n9q27": {}, + "/v1/default/Pod/fake-pod-8-nhlfs": {}, + "/v1/default/Pod/fake-pod-8-nk6hk": {}, + "/v1/default/Pod/fake-pod-8-nkxdz": {}, + "/v1/default/Pod/fake-pod-8-nrnm9": {}, + "/v1/default/Pod/fake-pod-8-ntkjj": {}, + "/v1/default/Pod/fake-pod-8-nw28l": {}, + "/v1/default/Pod/fake-pod-8-nz45m": {}, + "/v1/default/Pod/fake-pod-8-p4rbc": {}, + "/v1/default/Pod/fake-pod-8-p7244": {}, + "/v1/default/Pod/fake-pod-8-pllkd": {}, + "/v1/default/Pod/fake-pod-8-psnrr": {}, + "/v1/default/Pod/fake-pod-8-pwb6j": {}, + "/v1/default/Pod/fake-pod-8-pzr4b": {}, + "/v1/default/Pod/fake-pod-8-qc9g4": {}, + "/v1/default/Pod/fake-pod-8-qcsgx": {}, + "/v1/default/Pod/fake-pod-8-qgl4d": {}, + "/v1/default/Pod/fake-pod-8-qgxlg": {}, + "/v1/default/Pod/fake-pod-8-qhgvk": {}, + "/v1/default/Pod/fake-pod-8-qhmbn": {}, + "/v1/default/Pod/fake-pod-8-qj4fp": {}, + "/v1/default/Pod/fake-pod-8-qkbbz": {}, + "/v1/default/Pod/fake-pod-8-qn89x": {}, + "/v1/default/Pod/fake-pod-8-qql6p": {}, + "/v1/default/Pod/fake-pod-8-qwvhz": {}, + "/v1/default/Pod/fake-pod-8-r2kf9": {}, + "/v1/default/Pod/fake-pod-8-r2m52": {}, + "/v1/default/Pod/fake-pod-8-rdzgj": {}, + "/v1/default/Pod/fake-pod-8-rfh7c": {}, + "/v1/default/Pod/fake-pod-8-rk5lw": {}, + "/v1/default/Pod/fake-pod-8-rmchx": {}, + "/v1/default/Pod/fake-pod-8-rptmr": {}, + "/v1/default/Pod/fake-pod-8-rqnj9": {}, + "/v1/default/Pod/fake-pod-8-rqvqw": {}, + "/v1/default/Pod/fake-pod-8-rsp6k": {}, + "/v1/default/Pod/fake-pod-8-s8bfn": {}, + "/v1/default/Pod/fake-pod-8-sb5cr": {}, + "/v1/default/Pod/fake-pod-8-sb97d": {}, + "/v1/default/Pod/fake-pod-8-scqf8": {}, + "/v1/default/Pod/fake-pod-8-sj7cd": {}, + "/v1/default/Pod/fake-pod-8-sjsmr": {}, + "/v1/default/Pod/fake-pod-8-sl8wf": {}, + "/v1/default/Pod/fake-pod-8-sm4kz": {}, + "/v1/default/Pod/fake-pod-8-sncvn": {}, + "/v1/default/Pod/fake-pod-8-sqr46": {}, + "/v1/default/Pod/fake-pod-8-srj76": {}, + "/v1/default/Pod/fake-pod-8-ssr5k": {}, + "/v1/default/Pod/fake-pod-8-st2ct": {}, + "/v1/default/Pod/fake-pod-8-svs4l": {}, + "/v1/default/Pod/fake-pod-8-t7fmg": {}, + "/v1/default/Pod/fake-pod-8-tbf77": {}, + "/v1/default/Pod/fake-pod-8-tgpml": {}, + "/v1/default/Pod/fake-pod-8-tlphx": {}, + "/v1/default/Pod/fake-pod-8-tndrm": {}, + "/v1/default/Pod/fake-pod-8-tpp6j": {}, + "/v1/default/Pod/fake-pod-8-tqq6p": {}, + "/v1/default/Pod/fake-pod-8-ts4zc": {}, + "/v1/default/Pod/fake-pod-8-ttwc7": {}, + "/v1/default/Pod/fake-pod-8-tzmnr": {}, + "/v1/default/Pod/fake-pod-8-tzzqg": {}, + "/v1/default/Pod/fake-pod-8-v582n": {}, + "/v1/default/Pod/fake-pod-8-v7ckj": {}, + "/v1/default/Pod/fake-pod-8-v8khn": {}, + "/v1/default/Pod/fake-pod-8-vd7vd": {}, + "/v1/default/Pod/fake-pod-8-vkcnn": {}, + "/v1/default/Pod/fake-pod-8-vltkx": {}, + "/v1/default/Pod/fake-pod-8-vpthj": {}, + "/v1/default/Pod/fake-pod-8-w5p7s": {}, + "/v1/default/Pod/fake-pod-8-w6bkb": {}, + "/v1/default/Pod/fake-pod-8-w6vz9": {}, + "/v1/default/Pod/fake-pod-8-wc2mh": {}, + "/v1/default/Pod/fake-pod-8-wf5vf": {}, + "/v1/default/Pod/fake-pod-8-wfrn5": {}, + "/v1/default/Pod/fake-pod-8-wfw5g": {}, + "/v1/default/Pod/fake-pod-8-wgnlg": {}, + "/v1/default/Pod/fake-pod-8-whrzh": {}, + "/v1/default/Pod/fake-pod-8-wkt2v": {}, + "/v1/default/Pod/fake-pod-8-wnd7h": {}, + "/v1/default/Pod/fake-pod-8-wsn5r": {}, + "/v1/default/Pod/fake-pod-8-x5vdf": {}, + "/v1/default/Pod/fake-pod-8-x89cj": {}, + "/v1/default/Pod/fake-pod-8-x8n5x": {}, + "/v1/default/Pod/fake-pod-8-xdbjj": {}, + "/v1/default/Pod/fake-pod-8-xh5ql": {}, + "/v1/default/Pod/fake-pod-8-xkk4m": {}, + "/v1/default/Pod/fake-pod-8-xlh4n": {}, + "/v1/default/Pod/fake-pod-8-xq2r9": {}, + "/v1/default/Pod/fake-pod-8-xsg6n": {}, + "/v1/default/Pod/fake-pod-8-xts49": {}, + "/v1/default/Pod/fake-pod-8-xv282": {}, + "/v1/default/Pod/fake-pod-8-xvjkg": {}, + "/v1/default/Pod/fake-pod-8-xvxfx": {}, + "/v1/default/Pod/fake-pod-8-xxtgm": {}, + "/v1/default/Pod/fake-pod-8-z2r6f": {}, + "/v1/default/Pod/fake-pod-8-z4h9h": {}, + "/v1/default/Pod/fake-pod-8-z85ck": {}, + "/v1/default/Pod/fake-pod-8-z875w": {}, + "/v1/default/Pod/fake-pod-8-zcstt": {}, + "/v1/default/Pod/fake-pod-8-zcx96": {}, + "/v1/default/Pod/fake-pod-8-zgv89": {}, + "/v1/default/Pod/fake-pod-8-zh9xc": {}, + "/v1/default/Pod/fake-pod-8-zjth5": {}, + "/v1/default/Pod/fake-pod-8-zlmnh": {}, + "/v1/default/Pod/fake-pod-8-zm6bx": {}, + "/v1/default/Pod/fake-pod-8-znqbp": {}, + "/v1/default/Pod/fake-pod-8-zr5xv": {}, + "/v1/default/Pod/fake-pod-8-zrq6w": {}, + "/v1/default/Pod/fake-pod-8-zs8p5": {}, + "/v1/default/Pod/fake-pod-8-ztjcg": {}, + "/v1/default/Pod/fake-pod-8-zvmxs": {}, + "/v1/default/Pod/fake-pod-9-242wh": {}, + "/v1/default/Pod/fake-pod-9-28lp5": {}, + "/v1/default/Pod/fake-pod-9-28xmm": {}, + "/v1/default/Pod/fake-pod-9-2d9jx": {}, + "/v1/default/Pod/fake-pod-9-2nxtn": {}, + "/v1/default/Pod/fake-pod-9-2rdvr": {}, + "/v1/default/Pod/fake-pod-9-2rsq7": {}, + "/v1/default/Pod/fake-pod-9-4288w": {}, + "/v1/default/Pod/fake-pod-9-444f5": {}, + "/v1/default/Pod/fake-pod-9-44ncw": {}, + "/v1/default/Pod/fake-pod-9-4c2bg": {}, + "/v1/default/Pod/fake-pod-9-4ds8t": {}, + "/v1/default/Pod/fake-pod-9-4fmrf": {}, + "/v1/default/Pod/fake-pod-9-4gtvh": {}, + "/v1/default/Pod/fake-pod-9-4jk98": {}, + "/v1/default/Pod/fake-pod-9-4l66t": {}, + "/v1/default/Pod/fake-pod-9-4pnxf": {}, + "/v1/default/Pod/fake-pod-9-4s7l4": {}, + "/v1/default/Pod/fake-pod-9-4t8xw": {}, + "/v1/default/Pod/fake-pod-9-4xggk": {}, + "/v1/default/Pod/fake-pod-9-522qv": {}, + "/v1/default/Pod/fake-pod-9-5546z": {}, + "/v1/default/Pod/fake-pod-9-56x9j": {}, + "/v1/default/Pod/fake-pod-9-58tgv": {}, + "/v1/default/Pod/fake-pod-9-5d48m": {}, + "/v1/default/Pod/fake-pod-9-5dml6": {}, + "/v1/default/Pod/fake-pod-9-5lczc": {}, + "/v1/default/Pod/fake-pod-9-5lzf6": {}, + "/v1/default/Pod/fake-pod-9-5vljh": {}, + "/v1/default/Pod/fake-pod-9-5vx54": {}, + "/v1/default/Pod/fake-pod-9-5w8kt": {}, + "/v1/default/Pod/fake-pod-9-5wc9v": {}, + "/v1/default/Pod/fake-pod-9-5x76z": {}, + "/v1/default/Pod/fake-pod-9-5zj5w": {}, + "/v1/default/Pod/fake-pod-9-65fdl": {}, + "/v1/default/Pod/fake-pod-9-68dxd": {}, + "/v1/default/Pod/fake-pod-9-6b25p": {}, + "/v1/default/Pod/fake-pod-9-6b69k": {}, + "/v1/default/Pod/fake-pod-9-6cc8k": {}, + "/v1/default/Pod/fake-pod-9-6cgqv": {}, + "/v1/default/Pod/fake-pod-9-6dqzn": {}, + "/v1/default/Pod/fake-pod-9-6gktd": {}, + "/v1/default/Pod/fake-pod-9-6h8r4": {}, + "/v1/default/Pod/fake-pod-9-6hg4s": {}, + "/v1/default/Pod/fake-pod-9-6mgwr": {}, + "/v1/default/Pod/fake-pod-9-6r4gh": {}, + "/v1/default/Pod/fake-pod-9-6rthx": {}, + "/v1/default/Pod/fake-pod-9-6v4xw": {}, + "/v1/default/Pod/fake-pod-9-6xcbw": {}, + "/v1/default/Pod/fake-pod-9-6zmg4": {}, + "/v1/default/Pod/fake-pod-9-72xvs": {}, + "/v1/default/Pod/fake-pod-9-74j7r": {}, + "/v1/default/Pod/fake-pod-9-7dfq9": {}, + "/v1/default/Pod/fake-pod-9-7dlq9": {}, + "/v1/default/Pod/fake-pod-9-7f5hn": {}, + "/v1/default/Pod/fake-pod-9-7gwmx": {}, + "/v1/default/Pod/fake-pod-9-7jdtz": {}, + "/v1/default/Pod/fake-pod-9-7m47f": {}, + "/v1/default/Pod/fake-pod-9-7q5m6": {}, + "/v1/default/Pod/fake-pod-9-82l6h": {}, + "/v1/default/Pod/fake-pod-9-82tk7": {}, + "/v1/default/Pod/fake-pod-9-87bmb": {}, + "/v1/default/Pod/fake-pod-9-89cqq": {}, + "/v1/default/Pod/fake-pod-9-8cr7r": {}, + "/v1/default/Pod/fake-pod-9-8ctbt": {}, + "/v1/default/Pod/fake-pod-9-8cvgh": {}, + "/v1/default/Pod/fake-pod-9-8dw8h": {}, + "/v1/default/Pod/fake-pod-9-8h6t5": {}, + "/v1/default/Pod/fake-pod-9-8p5zs": {}, + "/v1/default/Pod/fake-pod-9-8tnhd": {}, + "/v1/default/Pod/fake-pod-9-8wcrk": {}, + "/v1/default/Pod/fake-pod-9-96hqk": {}, + "/v1/default/Pod/fake-pod-9-96qnq": {}, + "/v1/default/Pod/fake-pod-9-97c4r": {}, + "/v1/default/Pod/fake-pod-9-99h6k": {}, + "/v1/default/Pod/fake-pod-9-9h5c5": {}, + "/v1/default/Pod/fake-pod-9-9jzt6": {}, + "/v1/default/Pod/fake-pod-9-9kkl9": {}, + "/v1/default/Pod/fake-pod-9-9kqnr": {}, + "/v1/default/Pod/fake-pod-9-9qdlq": {}, + "/v1/default/Pod/fake-pod-9-9r86s": {}, + "/v1/default/Pod/fake-pod-9-9sxwg": {}, + "/v1/default/Pod/fake-pod-9-9v8nd": {}, + "/v1/default/Pod/fake-pod-9-9vfp4": {}, + "/v1/default/Pod/fake-pod-9-b2w28": {}, + "/v1/default/Pod/fake-pod-9-b5mfm": {}, + "/v1/default/Pod/fake-pod-9-b5ml9": {}, + "/v1/default/Pod/fake-pod-9-b74z6": {}, + "/v1/default/Pod/fake-pod-9-bbh7s": {}, + "/v1/default/Pod/fake-pod-9-bfknh": {}, + "/v1/default/Pod/fake-pod-9-bjnjs": {}, + "/v1/default/Pod/fake-pod-9-bkdhm": {}, + "/v1/default/Pod/fake-pod-9-bp5kq": {}, + "/v1/default/Pod/fake-pod-9-brsdg": {}, + "/v1/default/Pod/fake-pod-9-bxrvt": {}, + "/v1/default/Pod/fake-pod-9-c2njk": {}, + "/v1/default/Pod/fake-pod-9-c4vjl": {}, + "/v1/default/Pod/fake-pod-9-c99xk": {}, + "/v1/default/Pod/fake-pod-9-c9cqt": {}, + "/v1/default/Pod/fake-pod-9-cf4nb": {}, + "/v1/default/Pod/fake-pod-9-cpxm9": {}, + "/v1/default/Pod/fake-pod-9-cvsx9": {}, + "/v1/default/Pod/fake-pod-9-cz8cl": {}, + "/v1/default/Pod/fake-pod-9-d7fh2": {}, + "/v1/default/Pod/fake-pod-9-db9lv": {}, + "/v1/default/Pod/fake-pod-9-dg7rd": {}, + "/v1/default/Pod/fake-pod-9-djkrd": {}, + "/v1/default/Pod/fake-pod-9-dkxqb": {}, + "/v1/default/Pod/fake-pod-9-dpmtl": {}, + "/v1/default/Pod/fake-pod-9-drjfz": {}, + "/v1/default/Pod/fake-pod-9-dsv2m": {}, + "/v1/default/Pod/fake-pod-9-dtw6c": {}, + "/v1/default/Pod/fake-pod-9-dwbc7": {}, + "/v1/default/Pod/fake-pod-9-dx7zs": {}, + "/v1/default/Pod/fake-pod-9-f7jq7": {}, + "/v1/default/Pod/fake-pod-9-f979d": {}, + "/v1/default/Pod/fake-pod-9-fcv9f": {}, + "/v1/default/Pod/fake-pod-9-fhktm": {}, + "/v1/default/Pod/fake-pod-9-fkpgt": {}, + "/v1/default/Pod/fake-pod-9-fkqt6": {}, + "/v1/default/Pod/fake-pod-9-fmpws": {}, + "/v1/default/Pod/fake-pod-9-fqpd2": {}, + "/v1/default/Pod/fake-pod-9-fv95g": {}, + "/v1/default/Pod/fake-pod-9-fw858": {}, + "/v1/default/Pod/fake-pod-9-fwq4p": {}, + "/v1/default/Pod/fake-pod-9-fz6vs": {}, + "/v1/default/Pod/fake-pod-9-fz8sj": {}, + "/v1/default/Pod/fake-pod-9-g26r8": {}, + "/v1/default/Pod/fake-pod-9-g5rx5": {}, + "/v1/default/Pod/fake-pod-9-g6t4p": {}, + "/v1/default/Pod/fake-pod-9-g82vr": {}, + "/v1/default/Pod/fake-pod-9-gdh7n": {}, + "/v1/default/Pod/fake-pod-9-gg5xb": {}, + "/v1/default/Pod/fake-pod-9-gjqd5": {}, + "/v1/default/Pod/fake-pod-9-gk6zn": {}, + "/v1/default/Pod/fake-pod-9-glwdn": {}, + "/v1/default/Pod/fake-pod-9-gqbpn": {}, + "/v1/default/Pod/fake-pod-9-gqg67": {}, + "/v1/default/Pod/fake-pod-9-gqnbk": {}, + "/v1/default/Pod/fake-pod-9-gr64p": {}, + "/v1/default/Pod/fake-pod-9-gw4v9": {}, + "/v1/default/Pod/fake-pod-9-gz4fm": {}, + "/v1/default/Pod/fake-pod-9-h6qft": {}, + "/v1/default/Pod/fake-pod-9-h8jm7": {}, + "/v1/default/Pod/fake-pod-9-h966l": {}, + "/v1/default/Pod/fake-pod-9-hd6fp": {}, + "/v1/default/Pod/fake-pod-9-hff29": {}, + "/v1/default/Pod/fake-pod-9-hfjn5": {}, + "/v1/default/Pod/fake-pod-9-hkf9v": {}, + "/v1/default/Pod/fake-pod-9-hpk79": {}, + "/v1/default/Pod/fake-pod-9-hr292": {}, + "/v1/default/Pod/fake-pod-9-hsgzx": {}, + "/v1/default/Pod/fake-pod-9-hwntn": {}, + "/v1/default/Pod/fake-pod-9-hzz6q": {}, + "/v1/default/Pod/fake-pod-9-j4qr4": {}, + "/v1/default/Pod/fake-pod-9-j6f6x": {}, + "/v1/default/Pod/fake-pod-9-jcfbb": {}, + "/v1/default/Pod/fake-pod-9-jdkl9": {}, + "/v1/default/Pod/fake-pod-9-jfq9m": {}, + "/v1/default/Pod/fake-pod-9-jqxm5": {}, + "/v1/default/Pod/fake-pod-9-jr56c": {}, + "/v1/default/Pod/fake-pod-9-jrwbf": {}, + "/v1/default/Pod/fake-pod-9-jxh8t": {}, + "/v1/default/Pod/fake-pod-9-jxxkm": {}, + "/v1/default/Pod/fake-pod-9-k4nvj": {}, + "/v1/default/Pod/fake-pod-9-k5hfp": {}, + "/v1/default/Pod/fake-pod-9-k5jbn": {}, + "/v1/default/Pod/fake-pod-9-k7425": {}, + "/v1/default/Pod/fake-pod-9-k7bp9": {}, + "/v1/default/Pod/fake-pod-9-k8gxs": {}, + "/v1/default/Pod/fake-pod-9-k9gxm": {}, + "/v1/default/Pod/fake-pod-9-kb8vc": {}, + "/v1/default/Pod/fake-pod-9-kcmfq": {}, + "/v1/default/Pod/fake-pod-9-kfkgb": {}, + "/v1/default/Pod/fake-pod-9-khbdz": {}, + "/v1/default/Pod/fake-pod-9-kqsv5": {}, + "/v1/default/Pod/fake-pod-9-kttps": {}, + "/v1/default/Pod/fake-pod-9-kvmfq": {}, + "/v1/default/Pod/fake-pod-9-kw7r2": {}, + "/v1/default/Pod/fake-pod-9-kwlj2": {}, + "/v1/default/Pod/fake-pod-9-kx285": {}, + "/v1/default/Pod/fake-pod-9-kzttl": {}, + "/v1/default/Pod/fake-pod-9-l5rxs": {}, + "/v1/default/Pod/fake-pod-9-lbnln": {}, + "/v1/default/Pod/fake-pod-9-lchml": {}, + "/v1/default/Pod/fake-pod-9-lgp2q": {}, + "/v1/default/Pod/fake-pod-9-lgrfq": {}, + "/v1/default/Pod/fake-pod-9-ljjxg": {}, + "/v1/default/Pod/fake-pod-9-lrzkx": {}, + "/v1/default/Pod/fake-pod-9-lxrvd": {}, + "/v1/default/Pod/fake-pod-9-m2ssj": {}, + "/v1/default/Pod/fake-pod-9-m7b6c": {}, + "/v1/default/Pod/fake-pod-9-m8xb2": {}, + "/v1/default/Pod/fake-pod-9-m9649": {}, + "/v1/default/Pod/fake-pod-9-mcxwf": {}, + "/v1/default/Pod/fake-pod-9-mthwx": {}, + "/v1/default/Pod/fake-pod-9-mwwt4": {}, + "/v1/default/Pod/fake-pod-9-n46rx": {}, + "/v1/default/Pod/fake-pod-9-n8pxd": {}, + "/v1/default/Pod/fake-pod-9-nbd4n": {}, + "/v1/default/Pod/fake-pod-9-ndnt9": {}, + "/v1/default/Pod/fake-pod-9-nfpgz": {}, + "/v1/default/Pod/fake-pod-9-ng94v": {}, + "/v1/default/Pod/fake-pod-9-ngjrm": {}, + "/v1/default/Pod/fake-pod-9-nh2pz": {}, + "/v1/default/Pod/fake-pod-9-nh8zf": {}, + "/v1/default/Pod/fake-pod-9-nqnpt": {}, + "/v1/default/Pod/fake-pod-9-ntmxd": {}, + "/v1/default/Pod/fake-pod-9-ntrsz": {}, + "/v1/default/Pod/fake-pod-9-nvdvd": {}, + "/v1/default/Pod/fake-pod-9-p2fw8": {}, + "/v1/default/Pod/fake-pod-9-p5mmn": {}, + "/v1/default/Pod/fake-pod-9-p6ppq": {}, + "/v1/default/Pod/fake-pod-9-p7knw": {}, + "/v1/default/Pod/fake-pod-9-p7s97": {}, + "/v1/default/Pod/fake-pod-9-p8skm": {}, + "/v1/default/Pod/fake-pod-9-p9bhb": {}, + "/v1/default/Pod/fake-pod-9-phjd7": {}, + "/v1/default/Pod/fake-pod-9-phppn": {}, + "/v1/default/Pod/fake-pod-9-pmc28": {}, + "/v1/default/Pod/fake-pod-9-pmsmf": {}, + "/v1/default/Pod/fake-pod-9-pprtg": {}, + "/v1/default/Pod/fake-pod-9-pt9tc": {}, + "/v1/default/Pod/fake-pod-9-ptxrp": {}, + "/v1/default/Pod/fake-pod-9-q2xb9": {}, + "/v1/default/Pod/fake-pod-9-q4rsp": {}, + "/v1/default/Pod/fake-pod-9-q55vg": {}, + "/v1/default/Pod/fake-pod-9-q5p9k": {}, + "/v1/default/Pod/fake-pod-9-q5t7h": {}, + "/v1/default/Pod/fake-pod-9-qcwkt": {}, + "/v1/default/Pod/fake-pod-9-qg7wf": {}, + "/v1/default/Pod/fake-pod-9-qw8tb": {}, + "/v1/default/Pod/fake-pod-9-qwwlc": {}, + "/v1/default/Pod/fake-pod-9-r99w5": {}, + "/v1/default/Pod/fake-pod-9-rh4nb": {}, + "/v1/default/Pod/fake-pod-9-rllvn": {}, + "/v1/default/Pod/fake-pod-9-rr2c6": {}, + "/v1/default/Pod/fake-pod-9-rwncx": {}, + "/v1/default/Pod/fake-pod-9-rz2f6": {}, + "/v1/default/Pod/fake-pod-9-s6rjj": {}, + "/v1/default/Pod/fake-pod-9-s9fvs": {}, + "/v1/default/Pod/fake-pod-9-sdpkn": {}, + "/v1/default/Pod/fake-pod-9-sf2bz": {}, + "/v1/default/Pod/fake-pod-9-sf5lj": {}, + "/v1/default/Pod/fake-pod-9-shrxl": {}, + "/v1/default/Pod/fake-pod-9-sjw84": {}, + "/v1/default/Pod/fake-pod-9-sk22d": {}, + "/v1/default/Pod/fake-pod-9-sllbb": {}, + "/v1/default/Pod/fake-pod-9-sm8cj": {}, + "/v1/default/Pod/fake-pod-9-sn9kt": {}, + "/v1/default/Pod/fake-pod-9-ssvbz": {}, + "/v1/default/Pod/fake-pod-9-svzwf": {}, + "/v1/default/Pod/fake-pod-9-sz4wb": {}, + "/v1/default/Pod/fake-pod-9-t6jfw": {}, + "/v1/default/Pod/fake-pod-9-t7qvz": {}, + "/v1/default/Pod/fake-pod-9-t8pmm": {}, + "/v1/default/Pod/fake-pod-9-tfslx": {}, + "/v1/default/Pod/fake-pod-9-tgknv": {}, + "/v1/default/Pod/fake-pod-9-tjtvr": {}, + "/v1/default/Pod/fake-pod-9-tknkq": {}, + "/v1/default/Pod/fake-pod-9-tt4zg": {}, + "/v1/default/Pod/fake-pod-9-tw7v9": {}, + "/v1/default/Pod/fake-pod-9-v27bx": {}, + "/v1/default/Pod/fake-pod-9-v2l9r": {}, + "/v1/default/Pod/fake-pod-9-v4jm7": {}, + "/v1/default/Pod/fake-pod-9-v89hv": {}, + "/v1/default/Pod/fake-pod-9-vbmcn": {}, + "/v1/default/Pod/fake-pod-9-vh8pp": {}, + "/v1/default/Pod/fake-pod-9-vkkdv": {}, + "/v1/default/Pod/fake-pod-9-vnk4b": {}, + "/v1/default/Pod/fake-pod-9-vplfk": {}, + "/v1/default/Pod/fake-pod-9-vxnv9": {}, + "/v1/default/Pod/fake-pod-9-vzld6": {}, + "/v1/default/Pod/fake-pod-9-w5bxp": {}, + "/v1/default/Pod/fake-pod-9-wbf88": {}, + "/v1/default/Pod/fake-pod-9-wnxvn": {}, + "/v1/default/Pod/fake-pod-9-ws6z2": {}, + "/v1/default/Pod/fake-pod-9-wvfpc": {}, + "/v1/default/Pod/fake-pod-9-x2v2g": {}, + "/v1/default/Pod/fake-pod-9-x45bd": {}, + "/v1/default/Pod/fake-pod-9-x7dcb": {}, + "/v1/default/Pod/fake-pod-9-x7vfz": {}, + "/v1/default/Pod/fake-pod-9-x8pzp": {}, + "/v1/default/Pod/fake-pod-9-xqqh9": {}, + "/v1/default/Pod/fake-pod-9-xrj7j": {}, + "/v1/default/Pod/fake-pod-9-xs49r": {}, + "/v1/default/Pod/fake-pod-9-xs4d2": {}, + "/v1/default/Pod/fake-pod-9-xscvz": {}, + "/v1/default/Pod/fake-pod-9-xtlvb": {}, + "/v1/default/Pod/fake-pod-9-z44mb": {}, + "/v1/default/Pod/fake-pod-9-zbh85": {}, + "/v1/default/Pod/fake-pod-9-zl48g": {}, + "/v1/default/Pod/fake-pod-9-zmvcj": {}, + "/v1/default/Pod/fake-pod-9-zqjn2": {}, + "/v1/default/Pod/fake-pod-9-zqsp5": {}, + "/v1/default/Pod/fake-pod-9-zsgjn": {}, + "/v1/default/Pod/fake-pod-9-zv9v9": {}, + "/v1/default/Pod/fake-pod-9-zxf9z": {}, + "/v1/default/Pod/fake-pod-9-zxfsq": {}, + "/v1/default/Service/fake-service-1": {}, + "/v1/default/Service/fake-service-10": {}, + "/v1/default/Service/fake-service-100": {}, + "/v1/default/Service/fake-service-101": {}, + "/v1/default/Service/fake-service-102": {}, + "/v1/default/Service/fake-service-103": {}, + "/v1/default/Service/fake-service-104": {}, + "/v1/default/Service/fake-service-105": {}, + "/v1/default/Service/fake-service-106": {}, + "/v1/default/Service/fake-service-107": {}, + "/v1/default/Service/fake-service-108": {}, + "/v1/default/Service/fake-service-109": {}, + "/v1/default/Service/fake-service-11": {}, + "/v1/default/Service/fake-service-110": {}, + "/v1/default/Service/fake-service-111": {}, + "/v1/default/Service/fake-service-112": {}, + "/v1/default/Service/fake-service-113": {}, + "/v1/default/Service/fake-service-114": {}, + "/v1/default/Service/fake-service-115": {}, + "/v1/default/Service/fake-service-116": {}, + "/v1/default/Service/fake-service-117": {}, + "/v1/default/Service/fake-service-118": {}, + "/v1/default/Service/fake-service-119": {}, + "/v1/default/Service/fake-service-12": {}, + "/v1/default/Service/fake-service-120": {}, + "/v1/default/Service/fake-service-121": {}, + "/v1/default/Service/fake-service-122": {}, + "/v1/default/Service/fake-service-123": {}, + "/v1/default/Service/fake-service-124": {}, + "/v1/default/Service/fake-service-125": {}, + "/v1/default/Service/fake-service-126": {}, + "/v1/default/Service/fake-service-127": {}, + "/v1/default/Service/fake-service-128": {}, + "/v1/default/Service/fake-service-129": {}, + "/v1/default/Service/fake-service-13": {}, + "/v1/default/Service/fake-service-130": {}, + "/v1/default/Service/fake-service-131": {}, + "/v1/default/Service/fake-service-132": {}, + "/v1/default/Service/fake-service-133": {}, + "/v1/default/Service/fake-service-134": {}, + "/v1/default/Service/fake-service-135": {}, + "/v1/default/Service/fake-service-136": {}, + "/v1/default/Service/fake-service-137": {}, + "/v1/default/Service/fake-service-138": {}, + "/v1/default/Service/fake-service-139": {}, + "/v1/default/Service/fake-service-14": {}, + "/v1/default/Service/fake-service-140": {}, + "/v1/default/Service/fake-service-141": {}, + "/v1/default/Service/fake-service-142": {}, + "/v1/default/Service/fake-service-143": {}, + "/v1/default/Service/fake-service-144": {}, + "/v1/default/Service/fake-service-145": {}, + "/v1/default/Service/fake-service-146": {}, + "/v1/default/Service/fake-service-147": {}, + "/v1/default/Service/fake-service-148": {}, + "/v1/default/Service/fake-service-149": {}, + "/v1/default/Service/fake-service-15": {}, + "/v1/default/Service/fake-service-150": {}, + "/v1/default/Service/fake-service-151": {}, + "/v1/default/Service/fake-service-152": {}, + "/v1/default/Service/fake-service-153": {}, + "/v1/default/Service/fake-service-154": {}, + "/v1/default/Service/fake-service-155": {}, + "/v1/default/Service/fake-service-156": {}, + "/v1/default/Service/fake-service-157": {}, + "/v1/default/Service/fake-service-158": {}, + "/v1/default/Service/fake-service-159": {}, + "/v1/default/Service/fake-service-16": {}, + "/v1/default/Service/fake-service-160": {}, + "/v1/default/Service/fake-service-161": {}, + "/v1/default/Service/fake-service-162": {}, + "/v1/default/Service/fake-service-163": {}, + "/v1/default/Service/fake-service-164": {}, + "/v1/default/Service/fake-service-165": {}, + "/v1/default/Service/fake-service-166": {}, + "/v1/default/Service/fake-service-167": {}, + "/v1/default/Service/fake-service-168": {}, + "/v1/default/Service/fake-service-169": {}, + "/v1/default/Service/fake-service-17": {}, + "/v1/default/Service/fake-service-170": {}, + "/v1/default/Service/fake-service-171": {}, + "/v1/default/Service/fake-service-172": {}, + "/v1/default/Service/fake-service-173": {}, + "/v1/default/Service/fake-service-174": {}, + "/v1/default/Service/fake-service-175": {}, + "/v1/default/Service/fake-service-176": {}, + "/v1/default/Service/fake-service-177": {}, + "/v1/default/Service/fake-service-178": {}, + "/v1/default/Service/fake-service-179": {}, + "/v1/default/Service/fake-service-18": {}, + "/v1/default/Service/fake-service-180": {}, + "/v1/default/Service/fake-service-181": {}, + "/v1/default/Service/fake-service-182": {}, + "/v1/default/Service/fake-service-183": {}, + "/v1/default/Service/fake-service-184": {}, + "/v1/default/Service/fake-service-185": {}, + "/v1/default/Service/fake-service-186": {}, + "/v1/default/Service/fake-service-187": {}, + "/v1/default/Service/fake-service-188": {}, + "/v1/default/Service/fake-service-189": {}, + "/v1/default/Service/fake-service-19": {}, + "/v1/default/Service/fake-service-190": {}, + "/v1/default/Service/fake-service-191": {}, + "/v1/default/Service/fake-service-192": {}, + "/v1/default/Service/fake-service-193": {}, + "/v1/default/Service/fake-service-194": {}, + "/v1/default/Service/fake-service-195": {}, + "/v1/default/Service/fake-service-196": {}, + "/v1/default/Service/fake-service-197": {}, + "/v1/default/Service/fake-service-198": {}, + "/v1/default/Service/fake-service-199": {}, + "/v1/default/Service/fake-service-2": {}, + "/v1/default/Service/fake-service-20": {}, + "/v1/default/Service/fake-service-200": {}, + "/v1/default/Service/fake-service-201": {}, + "/v1/default/Service/fake-service-202": {}, + "/v1/default/Service/fake-service-203": {}, + "/v1/default/Service/fake-service-204": {}, + "/v1/default/Service/fake-service-205": {}, + "/v1/default/Service/fake-service-206": {}, + "/v1/default/Service/fake-service-207": {}, + "/v1/default/Service/fake-service-208": {}, + "/v1/default/Service/fake-service-209": {}, + "/v1/default/Service/fake-service-21": {}, + "/v1/default/Service/fake-service-210": {}, + "/v1/default/Service/fake-service-211": {}, + "/v1/default/Service/fake-service-212": {}, + "/v1/default/Service/fake-service-213": {}, + "/v1/default/Service/fake-service-214": {}, + "/v1/default/Service/fake-service-215": {}, + "/v1/default/Service/fake-service-216": {}, + "/v1/default/Service/fake-service-217": {}, + "/v1/default/Service/fake-service-218": {}, + "/v1/default/Service/fake-service-219": {}, + "/v1/default/Service/fake-service-22": {}, + "/v1/default/Service/fake-service-220": {}, + "/v1/default/Service/fake-service-221": {}, + "/v1/default/Service/fake-service-222": {}, + "/v1/default/Service/fake-service-223": {}, + "/v1/default/Service/fake-service-224": {}, + "/v1/default/Service/fake-service-225": {}, + "/v1/default/Service/fake-service-226": {}, + "/v1/default/Service/fake-service-227": {}, + "/v1/default/Service/fake-service-228": {}, + "/v1/default/Service/fake-service-229": {}, + "/v1/default/Service/fake-service-23": {}, + "/v1/default/Service/fake-service-230": {}, + "/v1/default/Service/fake-service-231": {}, + "/v1/default/Service/fake-service-232": {}, + "/v1/default/Service/fake-service-233": {}, + "/v1/default/Service/fake-service-234": {}, + "/v1/default/Service/fake-service-235": {}, + "/v1/default/Service/fake-service-236": {}, + "/v1/default/Service/fake-service-237": {}, + "/v1/default/Service/fake-service-238": {}, + "/v1/default/Service/fake-service-239": {}, + "/v1/default/Service/fake-service-24": {}, + "/v1/default/Service/fake-service-240": {}, + "/v1/default/Service/fake-service-241": {}, + "/v1/default/Service/fake-service-242": {}, + "/v1/default/Service/fake-service-243": {}, + "/v1/default/Service/fake-service-244": {}, + "/v1/default/Service/fake-service-245": {}, + "/v1/default/Service/fake-service-246": {}, + "/v1/default/Service/fake-service-247": {}, + "/v1/default/Service/fake-service-248": {}, + "/v1/default/Service/fake-service-249": {}, + "/v1/default/Service/fake-service-25": {}, + "/v1/default/Service/fake-service-250": {}, + "/v1/default/Service/fake-service-251": {}, + "/v1/default/Service/fake-service-252": {}, + "/v1/default/Service/fake-service-253": {}, + "/v1/default/Service/fake-service-26": {}, + "/v1/default/Service/fake-service-27": {}, + "/v1/default/Service/fake-service-28": {}, + "/v1/default/Service/fake-service-29": {}, + "/v1/default/Service/fake-service-3": {}, + "/v1/default/Service/fake-service-30": {}, + "/v1/default/Service/fake-service-31": {}, + "/v1/default/Service/fake-service-32": {}, + "/v1/default/Service/fake-service-33": {}, + "/v1/default/Service/fake-service-34": {}, + "/v1/default/Service/fake-service-35": {}, + "/v1/default/Service/fake-service-36": {}, + "/v1/default/Service/fake-service-37": {}, + "/v1/default/Service/fake-service-38": {}, + "/v1/default/Service/fake-service-39": {}, + "/v1/default/Service/fake-service-4": {}, + "/v1/default/Service/fake-service-40": {}, + "/v1/default/Service/fake-service-41": {}, + "/v1/default/Service/fake-service-42": {}, + "/v1/default/Service/fake-service-43": {}, + "/v1/default/Service/fake-service-44": {}, + "/v1/default/Service/fake-service-45": {}, + "/v1/default/Service/fake-service-46": {}, + "/v1/default/Service/fake-service-47": {}, + "/v1/default/Service/fake-service-48": {}, + "/v1/default/Service/fake-service-49": {}, + "/v1/default/Service/fake-service-5": {}, + "/v1/default/Service/fake-service-50": {}, + "/v1/default/Service/fake-service-51": {}, + "/v1/default/Service/fake-service-52": {}, + "/v1/default/Service/fake-service-53": {}, + "/v1/default/Service/fake-service-54": {}, + "/v1/default/Service/fake-service-55": {}, + "/v1/default/Service/fake-service-56": {}, + "/v1/default/Service/fake-service-57": {}, + "/v1/default/Service/fake-service-58": {}, + "/v1/default/Service/fake-service-59": {}, + "/v1/default/Service/fake-service-6": {}, + "/v1/default/Service/fake-service-60": {}, + "/v1/default/Service/fake-service-61": {}, + "/v1/default/Service/fake-service-62": {}, + "/v1/default/Service/fake-service-63": {}, + "/v1/default/Service/fake-service-64": {}, + "/v1/default/Service/fake-service-65": {}, + "/v1/default/Service/fake-service-66": {}, + "/v1/default/Service/fake-service-67": {}, + "/v1/default/Service/fake-service-68": {}, + "/v1/default/Service/fake-service-69": {}, + "/v1/default/Service/fake-service-7": {}, + "/v1/default/Service/fake-service-70": {}, + "/v1/default/Service/fake-service-71": {}, + "/v1/default/Service/fake-service-72": {}, + "/v1/default/Service/fake-service-73": {}, + "/v1/default/Service/fake-service-74": {}, + "/v1/default/Service/fake-service-75": {}, + "/v1/default/Service/fake-service-76": {}, + "/v1/default/Service/fake-service-77": {}, + "/v1/default/Service/fake-service-78": {}, + "/v1/default/Service/fake-service-79": {}, + "/v1/default/Service/fake-service-8": {}, + "/v1/default/Service/fake-service-80": {}, + "/v1/default/Service/fake-service-81": {}, + "/v1/default/Service/fake-service-82": {}, + "/v1/default/Service/fake-service-83": {}, + "/v1/default/Service/fake-service-84": {}, + "/v1/default/Service/fake-service-85": {}, + "/v1/default/Service/fake-service-86": {}, + "/v1/default/Service/fake-service-87": {}, + "/v1/default/Service/fake-service-88": {}, + "/v1/default/Service/fake-service-89": {}, + "/v1/default/Service/fake-service-9": {}, + "/v1/default/Service/fake-service-90": {}, + "/v1/default/Service/fake-service-91": {}, + "/v1/default/Service/fake-service-92": {}, + "/v1/default/Service/fake-service-93": {}, + "/v1/default/Service/fake-service-94": {}, + "/v1/default/Service/fake-service-95": {}, + "/v1/default/Service/fake-service-96": {}, + "/v1/default/Service/fake-service-97": {}, + "/v1/default/Service/fake-service-98": {}, + "/v1/default/Service/fake-service-99": {}, + "/v1/default/Service/kubernetes": {}, + "/v1/default/ServiceAccount/default": {}, + "/v1/kube-node-lease/ConfigMap/kube-root-ca.crt": {}, + "/v1/kube-node-lease/ServiceAccount/default": {}, + "/v1/kube-public/ConfigMap/kube-root-ca.crt": {}, + "/v1/kube-public/ServiceAccount/default": {}, + "/v1/kube-system/ConfigMap/extension-apiserver-authentication": {}, + "/v1/kube-system/ConfigMap/kube-apiserver-legacy-service-account-token-tracking": {}, + "/v1/kube-system/ConfigMap/kube-root-ca.crt": {}, + "/v1/kube-system/ServiceAccount/default": {}, + "apps/v1/default/DaemonSet/fake-pod-1": {}, + "apps/v1/default/DaemonSet/fake-pod-10": {}, + "apps/v1/default/DaemonSet/fake-pod-11": {}, + "apps/v1/default/DaemonSet/fake-pod-12": {}, + "apps/v1/default/DaemonSet/fake-pod-13": {}, + "apps/v1/default/DaemonSet/fake-pod-14": {}, + "apps/v1/default/DaemonSet/fake-pod-15": {}, + "apps/v1/default/DaemonSet/fake-pod-16": {}, + "apps/v1/default/DaemonSet/fake-pod-17": {}, + "apps/v1/default/DaemonSet/fake-pod-18": {}, + "apps/v1/default/DaemonSet/fake-pod-19": {}, + "apps/v1/default/DaemonSet/fake-pod-2": {}, + "apps/v1/default/DaemonSet/fake-pod-20": {}, + "apps/v1/default/DaemonSet/fake-pod-21": {}, + "apps/v1/default/DaemonSet/fake-pod-22": {}, + "apps/v1/default/DaemonSet/fake-pod-23": {}, + "apps/v1/default/DaemonSet/fake-pod-24": {}, + "apps/v1/default/DaemonSet/fake-pod-25": {}, + "apps/v1/default/DaemonSet/fake-pod-26": {}, + "apps/v1/default/DaemonSet/fake-pod-27": {}, + "apps/v1/default/DaemonSet/fake-pod-28": {}, + "apps/v1/default/DaemonSet/fake-pod-29": {}, + "apps/v1/default/DaemonSet/fake-pod-3": {}, + "apps/v1/default/DaemonSet/fake-pod-30": {}, + "apps/v1/default/DaemonSet/fake-pod-31": {}, + "apps/v1/default/DaemonSet/fake-pod-32": {}, + "apps/v1/default/DaemonSet/fake-pod-33": {}, + "apps/v1/default/DaemonSet/fake-pod-34": {}, + "apps/v1/default/DaemonSet/fake-pod-35": {}, + "apps/v1/default/DaemonSet/fake-pod-36": {}, + "apps/v1/default/DaemonSet/fake-pod-37": {}, + "apps/v1/default/DaemonSet/fake-pod-38": {}, + "apps/v1/default/DaemonSet/fake-pod-39": {}, + "apps/v1/default/DaemonSet/fake-pod-4": {}, + "apps/v1/default/DaemonSet/fake-pod-40": {}, + "apps/v1/default/DaemonSet/fake-pod-41": {}, + "apps/v1/default/DaemonSet/fake-pod-42": {}, + "apps/v1/default/DaemonSet/fake-pod-43": {}, + "apps/v1/default/DaemonSet/fake-pod-44": {}, + "apps/v1/default/DaemonSet/fake-pod-45": {}, + "apps/v1/default/DaemonSet/fake-pod-46": {}, + "apps/v1/default/DaemonSet/fake-pod-47": {}, + "apps/v1/default/DaemonSet/fake-pod-48": {}, + "apps/v1/default/DaemonSet/fake-pod-49": {}, + "apps/v1/default/DaemonSet/fake-pod-5": {}, + "apps/v1/default/DaemonSet/fake-pod-6": {}, + "apps/v1/default/DaemonSet/fake-pod-7": {}, + "apps/v1/default/DaemonSet/fake-pod-8": {}, + "apps/v1/default/DaemonSet/fake-pod-9": {} + }, + "ResourcesResult": {}, + "ResourceSource": {}, + "ResourcesPrioritized": {}, + "ResourceAttackTracks": null, + "AttackTracks": null, + "Report": { + "generationTime": "0001-01-01T00:00:00Z", + "metadata": { + "targetMetadata": {}, + "clusterMetadata": {}, + "scanMetadata": {} + }, + "clusterAPIServerInfo": { + "major": "1", + "minor": "27", + "gitVersion": "v1.27.1", + "gitCommit": "4c9411232e10168d7b050c49a1b59f6df9d7ea4b", + "gitTreeState": "clean", + "buildDate": "2023-04-14T13:14:42Z", + "goVersion": "go1.20.3", + "compiler": "gc", + "platform": "linux/arm64" + }, + "customerGUID": "", + "clusterName": "", + "clusterCloudProvider": "", + "reportGUID": "", + "jobID": "", + "attributes": null, + "summaryDetails": { + "controls": { + "C-0001": { + "statusInfo": {}, + "controlID": "C-0001", + "name": "Forbidden Container Registries", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0002": { + "statusInfo": {}, + "controlID": "C-0002", + "name": "Exec into container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0004": { + "statusInfo": {}, + "controlID": "C-0004", + "name": "Resources memory limit and request", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0005": { + "statusInfo": {}, + "controlID": "C-0005", + "name": "API server insecure port is enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + }, + "C-0007": { + "statusInfo": {}, + "controlID": "C-0007", + "name": "Data Destruction", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0009": { + "statusInfo": {}, + "controlID": "C-0009", + "name": "Resource limits", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0012": { + "statusInfo": {}, + "controlID": "C-0012", + "name": "Applications credentials in configuration files", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0013": { + "statusInfo": {}, + "controlID": "C-0013", + "name": "Non-root containers", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0014": { + "statusInfo": {}, + "controlID": "C-0014", + "name": "Access Kubernetes dashboard", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0015": { + "statusInfo": {}, + "controlID": "C-0015", + "name": "List Kubernetes secrets", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0016": { + "statusInfo": {}, + "controlID": "C-0016", + "name": "Allow privilege escalation", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0017": { + "statusInfo": {}, + "controlID": "C-0017", + "name": "Immutable container filesystem", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0018": { + "statusInfo": {}, + "controlID": "C-0018", + "name": "Configured readiness probe", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0020": { + "statusInfo": {}, + "controlID": "C-0020", + "name": "Mount service principal", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0021": { + "statusInfo": {}, + "controlID": "C-0021", + "name": "Exposed sensitive interfaces", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0026": { + "statusInfo": {}, + "controlID": "C-0026", + "name": "Kubernetes CronJob", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 1 + }, + "C-0030": { + "statusInfo": {}, + "controlID": "C-0030", + "name": "Ingress and Egress blocked", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0031": { + "statusInfo": {}, + "controlID": "C-0031", + "name": "Delete Kubernetes events", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0034": { + "statusInfo": {}, + "controlID": "C-0034", + "name": "Automatic mapping of service account", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0035": { + "statusInfo": {}, + "controlID": "C-0035", + "name": "Cluster-admin binding", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0036": { + "statusInfo": {}, + "controlID": "C-0036", + "name": "Malicious admission controller (validating)", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0037": { + "statusInfo": {}, + "controlID": "C-0037", + "name": "CoreDNS poisoning", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0038": { + "statusInfo": {}, + "controlID": "C-0038", + "name": "Host PID/IPC privileges", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0039": { + "statusInfo": {}, + "controlID": "C-0039", + "name": "Malicious admission controller (mutating)", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0041": { + "statusInfo": {}, + "controlID": "C-0041", + "name": "HostNetwork access", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0042": { + "statusInfo": {}, + "controlID": "C-0042", + "name": "SSH server running inside container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0044": { + "statusInfo": {}, + "controlID": "C-0044", + "name": "Container hostPort", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0045": { + "statusInfo": {}, + "controlID": "C-0045", + "name": "Writable hostPath mount", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0046": { + "statusInfo": {}, + "controlID": "C-0046", + "name": "Insecure capabilities", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0048": { + "statusInfo": {}, + "controlID": "C-0048", + "name": "HostPath mount", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0049": { + "statusInfo": {}, + "controlID": "C-0049", + "name": "Network mapping", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0050": { + "statusInfo": {}, + "controlID": "C-0050", + "name": "Resources CPU limit and request", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0052": { + "statusInfo": {}, + "controlID": "C-0052", + "name": "Instance Metadata API", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0053": { + "statusInfo": {}, + "controlID": "C-0053", + "name": "Access container service account", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0054": { + "statusInfo": {}, + "controlID": "C-0054", + "name": "Cluster internal networking", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0055": { + "statusInfo": {}, + "controlID": "C-0055", + "name": "Linux hardening", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0056": { + "statusInfo": {}, + "controlID": "C-0056", + "name": "Configured liveness probe", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0057": { + "statusInfo": {}, + "controlID": "C-0057", + "name": "Privileged container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0058": { + "statusInfo": {}, + "controlID": "C-0058", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0059": { + "statusInfo": {}, + "controlID": "C-0059", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0061": { + "statusInfo": {}, + "controlID": "C-0061", + "name": "Pods in default namespace", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0062": { + "statusInfo": {}, + "controlID": "C-0062", + "name": "Sudo in container entrypoint", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0063": { + "statusInfo": {}, + "controlID": "C-0063", + "name": "Portforwarding privileges", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0065": { + "statusInfo": {}, + "controlID": "C-0065", + "name": "No impersonation", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0066": { + "statusInfo": {}, + "controlID": "C-0066", + "name": "Secret/ETCD encryption enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0067": { + "statusInfo": {}, + "controlID": "C-0067", + "name": "Audit logs enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0068": { + "statusInfo": {}, + "controlID": "C-0068", + "name": "PSP enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 1 + }, + "C-0069": { + "statusInfo": {}, + "controlID": "C-0069", + "name": "Disable anonymous access to Kubelet service", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 10 + }, + "C-0070": { + "statusInfo": {}, + "controlID": "C-0070", + "name": "Enforce Kubelet client TLS authentication", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + }, + "C-0073": { + "statusInfo": {}, + "controlID": "C-0073", + "name": "Naked PODs", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0074": { + "statusInfo": {}, + "controlID": "C-0074", + "name": "Containers mounting Docker socket", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0075": { + "statusInfo": {}, + "controlID": "C-0075", + "name": "Image pull policy on latest tag", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0076": { + "statusInfo": {}, + "controlID": "C-0076", + "name": "Label usage for resources", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0077": { + "statusInfo": {}, + "controlID": "C-0077", + "name": "K8s common labels usage", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0078": { + "statusInfo": {}, + "controlID": "C-0078", + "name": "Images from allowed registry", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0079": { + "statusInfo": {}, + "controlID": "C-0079", + "name": "CVE-2022-0185-linux-kernel-container-escape", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0081": { + "statusInfo": {}, + "controlID": "C-0081", + "name": "CVE-2022-24348-argocddirtraversal", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0083": { + "statusInfo": {}, + "controlID": "C-0083", + "name": "Workloads with Critical vulnerabilities exposed to external traffic", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0084": { + "statusInfo": {}, + "controlID": "C-0084", + "name": "Workloads with RCE vulnerabilities exposed to external traffic", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0085": { + "statusInfo": {}, + "controlID": "C-0085", + "name": "Workloads with excessive amount of vulnerabilities", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0086": { + "statusInfo": {}, + "controlID": "C-0086", + "name": "CVE-2022-0492-cgroups-container-escape", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0087": { + "statusInfo": {}, + "controlID": "C-0087", + "name": "CVE-2022-23648-containerd-fs-escape", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0088": { + "statusInfo": {}, + "controlID": "C-0088", + "name": "RBAC enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0090": { + "statusInfo": {}, + "controlID": "C-0090", + "name": "CVE-2022-39328-grafana-auth-bypass", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + }, + "C-0091": { + "statusInfo": {}, + "controlID": "C-0091", + "name": "CVE-2022-47633-kyverno-signature-bypass", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + } + }, + "status": "", + "frameworks": [ + { + "controls": { + "C-0001": { + "statusInfo": {}, + "controlID": "C-0001", + "name": "Forbidden Container Registries", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0002": { + "statusInfo": {}, + "controlID": "C-0002", + "name": "Exec into container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0004": { + "statusInfo": {}, + "controlID": "C-0004", + "name": "Resources memory limit and request", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0005": { + "statusInfo": {}, + "controlID": "C-0005", + "name": "API server insecure port is enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + }, + "C-0007": { + "statusInfo": {}, + "controlID": "C-0007", + "name": "Data Destruction", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0009": { + "statusInfo": {}, + "controlID": "C-0009", + "name": "Resource limits", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0012": { + "statusInfo": {}, + "controlID": "C-0012", + "name": "Applications credentials in configuration files", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0013": { + "statusInfo": {}, + "controlID": "C-0013", + "name": "Non-root containers", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0014": { + "statusInfo": {}, + "controlID": "C-0014", + "name": "Access Kubernetes dashboard", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0015": { + "statusInfo": {}, + "controlID": "C-0015", + "name": "List Kubernetes secrets", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0016": { + "statusInfo": {}, + "controlID": "C-0016", + "name": "Allow privilege escalation", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0017": { + "statusInfo": {}, + "controlID": "C-0017", + "name": "Immutable container filesystem", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0018": { + "statusInfo": {}, + "controlID": "C-0018", + "name": "Configured readiness probe", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0020": { + "statusInfo": {}, + "controlID": "C-0020", + "name": "Mount service principal", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0021": { + "statusInfo": {}, + "controlID": "C-0021", + "name": "Exposed sensitive interfaces", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0026": { + "statusInfo": {}, + "controlID": "C-0026", + "name": "Kubernetes CronJob", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 1 + }, + "C-0030": { + "statusInfo": {}, + "controlID": "C-0030", + "name": "Ingress and Egress blocked", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0031": { + "statusInfo": {}, + "controlID": "C-0031", + "name": "Delete Kubernetes events", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0034": { + "statusInfo": {}, + "controlID": "C-0034", + "name": "Automatic mapping of service account", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0035": { + "statusInfo": {}, + "controlID": "C-0035", + "name": "Cluster-admin binding", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0036": { + "statusInfo": {}, + "controlID": "C-0036", + "name": "Malicious admission controller (validating)", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0038": { + "statusInfo": {}, + "controlID": "C-0038", + "name": "Host PID/IPC privileges", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0039": { + "statusInfo": {}, + "controlID": "C-0039", + "name": "Malicious admission controller (mutating)", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0041": { + "statusInfo": {}, + "controlID": "C-0041", + "name": "HostNetwork access", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0042": { + "statusInfo": {}, + "controlID": "C-0042", + "name": "SSH server running inside container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0044": { + "statusInfo": {}, + "controlID": "C-0044", + "name": "Container hostPort", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0045": { + "statusInfo": {}, + "controlID": "C-0045", + "name": "Writable hostPath mount", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0046": { + "statusInfo": {}, + "controlID": "C-0046", + "name": "Insecure capabilities", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0048": { + "statusInfo": {}, + "controlID": "C-0048", + "name": "HostPath mount", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0049": { + "statusInfo": {}, + "controlID": "C-0049", + "name": "Network mapping", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0050": { + "statusInfo": {}, + "controlID": "C-0050", + "name": "Resources CPU limit and request", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0052": { + "statusInfo": {}, + "controlID": "C-0052", + "name": "Instance Metadata API", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0053": { + "statusInfo": {}, + "controlID": "C-0053", + "name": "Access container service account", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0054": { + "statusInfo": {}, + "controlID": "C-0054", + "name": "Cluster internal networking", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0055": { + "statusInfo": {}, + "controlID": "C-0055", + "name": "Linux hardening", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0056": { + "statusInfo": {}, + "controlID": "C-0056", + "name": "Configured liveness probe", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0057": { + "statusInfo": {}, + "controlID": "C-0057", + "name": "Privileged container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0058": { + "statusInfo": {}, + "controlID": "C-0058", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0059": { + "statusInfo": {}, + "controlID": "C-0059", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0061": { + "statusInfo": {}, + "controlID": "C-0061", + "name": "Pods in default namespace", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0062": { + "statusInfo": {}, + "controlID": "C-0062", + "name": "Sudo in container entrypoint", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0063": { + "statusInfo": {}, + "controlID": "C-0063", + "name": "Portforwarding privileges", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0065": { + "statusInfo": {}, + "controlID": "C-0065", + "name": "No impersonation", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0066": { + "statusInfo": {}, + "controlID": "C-0066", + "name": "Secret/ETCD encryption enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0067": { + "statusInfo": {}, + "controlID": "C-0067", + "name": "Audit logs enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0068": { + "statusInfo": {}, + "controlID": "C-0068", + "name": "PSP enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 1 + }, + "C-0069": { + "statusInfo": {}, + "controlID": "C-0069", + "name": "Disable anonymous access to Kubelet service", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 10 + }, + "C-0070": { + "statusInfo": {}, + "controlID": "C-0070", + "name": "Enforce Kubelet client TLS authentication", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + }, + "C-0073": { + "statusInfo": {}, + "controlID": "C-0073", + "name": "Naked PODs", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0074": { + "statusInfo": {}, + "controlID": "C-0074", + "name": "Containers mounting Docker socket", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0075": { + "statusInfo": {}, + "controlID": "C-0075", + "name": "Image pull policy on latest tag", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0076": { + "statusInfo": {}, + "controlID": "C-0076", + "name": "Label usage for resources", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0077": { + "statusInfo": {}, + "controlID": "C-0077", + "name": "K8s common labels usage", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0078": { + "statusInfo": {}, + "controlID": "C-0078", + "name": "Images from allowed registry", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0079": { + "statusInfo": {}, + "controlID": "C-0079", + "name": "CVE-2022-0185-linux-kernel-container-escape", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0081": { + "statusInfo": {}, + "controlID": "C-0081", + "name": "CVE-2022-24348-argocddirtraversal", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0083": { + "statusInfo": {}, + "controlID": "C-0083", + "name": "Workloads with Critical vulnerabilities exposed to external traffic", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0084": { + "statusInfo": {}, + "controlID": "C-0084", + "name": "Workloads with RCE vulnerabilities exposed to external traffic", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0085": { + "statusInfo": {}, + "controlID": "C-0085", + "name": "Workloads with excessive amount of vulnerabilities", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0086": { + "statusInfo": {}, + "controlID": "C-0086", + "name": "CVE-2022-0492-cgroups-container-escape", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0087": { + "statusInfo": {}, + "controlID": "C-0087", + "name": "CVE-2022-23648-containerd-fs-escape", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0088": { + "statusInfo": {}, + "controlID": "C-0088", + "name": "RBAC enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0090": { + "statusInfo": {}, + "controlID": "C-0090", + "name": "CVE-2022-39328-grafana-auth-bypass", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + }, + "C-0091": { + "statusInfo": {}, + "controlID": "C-0091", + "name": "CVE-2022-47633-kyverno-signature-bypass", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + } + }, + "name": "AllControls", + "status": "", + "version": "", + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "score": 0, + "complianceScore": 0 + }, + { + "controls": { + "C-0002": { + "statusInfo": {}, + "controlID": "C-0002", + "name": "Exec into container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0005": { + "statusInfo": {}, + "controlID": "C-0005", + "name": "API server insecure port is enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + }, + "C-0009": { + "statusInfo": {}, + "controlID": "C-0009", + "name": "Resource limits", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0012": { + "statusInfo": {}, + "controlID": "C-0012", + "name": "Applications credentials in configuration files", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0013": { + "statusInfo": {}, + "controlID": "C-0013", + "name": "Non-root containers", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0016": { + "statusInfo": {}, + "controlID": "C-0016", + "name": "Allow privilege escalation", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0017": { + "statusInfo": {}, + "controlID": "C-0017", + "name": "Immutable container filesystem", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0030": { + "statusInfo": {}, + "controlID": "C-0030", + "name": "Ingress and Egress blocked", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0034": { + "statusInfo": {}, + "controlID": "C-0034", + "name": "Automatic mapping of service account", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0035": { + "statusInfo": {}, + "controlID": "C-0035", + "name": "Cluster-admin binding", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0038": { + "statusInfo": {}, + "controlID": "C-0038", + "name": "Host PID/IPC privileges", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0041": { + "statusInfo": {}, + "controlID": "C-0041", + "name": "HostNetwork access", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0044": { + "statusInfo": {}, + "controlID": "C-0044", + "name": "Container hostPort", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0046": { + "statusInfo": {}, + "controlID": "C-0046", + "name": "Insecure capabilities", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0054": { + "statusInfo": {}, + "controlID": "C-0054", + "name": "Cluster internal networking", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0055": { + "statusInfo": {}, + "controlID": "C-0055", + "name": "Linux hardening", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0057": { + "statusInfo": {}, + "controlID": "C-0057", + "name": "Privileged container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0058": { + "statusInfo": {}, + "controlID": "C-0058", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0059": { + "statusInfo": {}, + "controlID": "C-0059", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0066": { + "statusInfo": {}, + "controlID": "C-0066", + "name": "Secret/ETCD encryption enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0067": { + "statusInfo": {}, + "controlID": "C-0067", + "name": "Audit logs enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0068": { + "statusInfo": {}, + "controlID": "C-0068", + "name": "PSP enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 1 + }, + "C-0069": { + "statusInfo": {}, + "controlID": "C-0069", + "name": "Disable anonymous access to Kubelet service", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 10 + }, + "C-0070": { + "statusInfo": {}, + "controlID": "C-0070", + "name": "Enforce Kubelet client TLS authentication", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + } + }, + "name": "NSA", + "status": "", + "version": "", + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "score": 0, + "complianceScore": 0 + }, + { + "controls": { + "C-0002": { + "statusInfo": {}, + "controlID": "C-0002", + "name": "Exec into container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0007": { + "statusInfo": {}, + "controlID": "C-0007", + "name": "Data Destruction", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0012": { + "statusInfo": {}, + "controlID": "C-0012", + "name": "Applications credentials in configuration files", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0014": { + "statusInfo": {}, + "controlID": "C-0014", + "name": "Access Kubernetes dashboard", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 2 + }, + "C-0015": { + "statusInfo": {}, + "controlID": "C-0015", + "name": "List Kubernetes secrets", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0020": { + "statusInfo": {}, + "controlID": "C-0020", + "name": "Mount service principal", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0021": { + "statusInfo": {}, + "controlID": "C-0021", + "name": "Exposed sensitive interfaces", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0026": { + "statusInfo": {}, + "controlID": "C-0026", + "name": "Kubernetes CronJob", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 1 + }, + "C-0031": { + "statusInfo": {}, + "controlID": "C-0031", + "name": "Delete Kubernetes events", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0035": { + "statusInfo": {}, + "controlID": "C-0035", + "name": "Cluster-admin binding", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0036": { + "statusInfo": {}, + "controlID": "C-0036", + "name": "Malicious admission controller (validating)", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0037": { + "statusInfo": {}, + "controlID": "C-0037", + "name": "CoreDNS poisoning", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0039": { + "statusInfo": {}, + "controlID": "C-0039", + "name": "Malicious admission controller (mutating)", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0042": { + "statusInfo": {}, + "controlID": "C-0042", + "name": "SSH server running inside container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 3 + }, + "C-0045": { + "statusInfo": {}, + "controlID": "C-0045", + "name": "Writable hostPath mount", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0048": { + "statusInfo": {}, + "controlID": "C-0048", + "name": "HostPath mount", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0052": { + "statusInfo": {}, + "controlID": "C-0052", + "name": "Instance Metadata API", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 7 + }, + "C-0053": { + "statusInfo": {}, + "controlID": "C-0053", + "name": "Access container service account", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0054": { + "statusInfo": {}, + "controlID": "C-0054", + "name": "Cluster internal networking", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 4 + }, + "C-0057": { + "statusInfo": {}, + "controlID": "C-0057", + "name": "Privileged container", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0058": { + "statusInfo": {}, + "controlID": "C-0058", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0059": { + "statusInfo": {}, + "controlID": "C-0059", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 8 + }, + "C-0066": { + "statusInfo": {}, + "controlID": "C-0066", + "name": "Secret/ETCD encryption enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 6 + }, + "C-0067": { + "statusInfo": {}, + "controlID": "C-0067", + "name": "Audit logs enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 5 + }, + "C-0068": { + "statusInfo": {}, + "controlID": "C-0068", + "name": "PSP enabled", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 1 + }, + "C-0069": { + "statusInfo": {}, + "controlID": "C-0069", + "name": "Disable anonymous access to Kubelet service", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 10 + }, + "C-0070": { + "statusInfo": {}, + "controlID": "C-0070", + "name": "Enforce Kubelet client TLS authentication", + "status": "", + "resourceIDs": {}, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "subStatusCounters": { + "ignoredResources": 0 + }, + "score": 0, + "scoreFactor": 9 + } + }, + "name": "MITRE", + "status": "", + "version": "", + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "score": 0, + "complianceScore": 0 + } + ], + "resourcesSeverityCounters": { + "criticalSeverity": 0, + "highSeverity": 0, + "mediumSeverity": 0, + "lowSeverity": 0 + }, + "controlsSeverityCounters": { + "criticalSeverity": 0, + "highSeverity": 0, + "mediumSeverity": 0, + "lowSeverity": 0 + }, + "ResourceCounters": { + "passedResources": 0, + "failedResources": 0, + "skippedResources": 0, + "excludedResources": 0 + }, + "score": 0, + "complianceScore": 0 + }, + "paginationInfo": { + "chunkNumber": 0, + "isLastChunk": false + } + }, + "RegoInputData": { + "postureControlInputs": { + "cpu_limit_max": [], + "cpu_limit_min": [], + "cpu_request_max": [], + "cpu_request_min": [], + "imageRepositoryAllowList": [], + "insecureCapabilities": [ + "SETPCAP", + "NET_ADMIN", + "NET_RAW", + "SYS_MODULE", + "SYS_RAWIO", + "SYS_PTRACE", + "SYS_ADMIN", + "SYS_BOOT", + "MAC_OVERRIDE", + "MAC_ADMIN", + "PERFMON", + "ALL", + "BPF" + ], + "k8sRecommendedLabels": [ + "app.kubernetes.io/name", + "app.kubernetes.io/instance", + "app.kubernetes.io/version", + "app.kubernetes.io/component", + "app.kubernetes.io/part-of", + "app.kubernetes.io/managed-by", + "app.kubernetes.io/created-by" + ], + "listOfDangerousArtifacts": [ + "bin/bash", + "sbin/sh", + "bin/ksh", + "bin/tcsh", + "bin/zsh", + "usr/bin/scsh", + "bin/csh", + "bin/busybox", + "usr/bin/busybox" + ], + "max_critical_vulnerabilities": [ + "5" + ], + "max_high_vulnerabilities": [ + "10" + ], + "memory_limit_max": [], + "memory_limit_min": [], + "memory_request_max": [], + "memory_request_min": [], + "publicRegistries": [], + "recommendedLabels": [ + "app", + "tier", + "phase", + "version", + "owner", + "env" + ], + "sensitiveInterfaces": [ + "nifi", + "argo-server", + "weave-scope-app", + "kubeflow", + "kubernetes-dashboard", + "jenkins", + "prometheus-deployment" + ], + "sensitiveKeyNames": [ + "aws_access_key_id", + "aws_secret_access_key", + "azure_batchai_storage_account", + "azure_batchai_storage_key", + "azure_batch_account", + "azure_batch_key", + "secret", + "key", + "password", + "pwd", + "token", + "jwt", + "bearer", + "credential" + ], + "sensitiveValues": [ + "BEGIN \\w+ PRIVATE KEY", + "PRIVATE KEY", + "eyJhbGciO", + "JWT", + "Bearer", + "_key_", + "_secret_" + ], + "sensitiveValuesAllowed": [], + "servicesNames": [ + "nifi-service", + "argo-server", + "minio", + "postgres", + "workflow-controller-metrics", + "weave-scope-app", + "kubernetes-dashboard" + ], + "trustedCosignPublicKeys": [], + "untrustedRegistries": [], + "wlKnownNames": [ + "coredns", + "kube-proxy", + "event-exporter-gke", + "kube-dns", + "17-default-backend", + "metrics-server", + "ca-audit", + "ca-dashboard-aggregator", + "ca-notification-server", + "ca-ocimage", + "ca-oracle", + "ca-posture", + "ca-rbac", + "ca-vuln-scan", + "ca-webhook", + "ca-websocket", + "clair-clair" + ] + }, + "dataControlInputs": null + }, + "Metadata": { + "targetMetadata": { + "clusterContextMetadata": { + "namespaceToNumberOfResources": { + "default": 305, + "kube-node-lease": 2, + "kube-public": 2, + "kube-system": 4 + }, + "contextName": "kwok-kwok-cluster", + "numberOfWorkerNodes": 299 + } + }, + "clusterMetadata": {}, + "scanMetadata": { + "targetType": "Framework", + "formatVersion": "v2", + "formats": [ + "" + ], + "targetNames": [ + "allcontrols", + "nsa", + "mitre" + ], + "failThreshold": 100 + } + }, + "InfoMap": { + "armo.vuln.images/v1/ImageVulnerabilities": { + "status": "skipped", + "info": "failed to pull image scanning data: credentials are not configured for any registry adaptor. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities" + }, + "container.googleapis.com/v1/ClusterDescribe": { + "status": "skipped", + "info": "failed to get cloud provider, cluster: kwok-kwok-cluster" + }, + "eks.amazonaws.com/v1/ClusterDescribe": { + "status": "skipped", + "info": "failed to get cloud provider, cluster: kwok-kwok-cluster" + }, + "hostdata.kubescape.cloud/v1beta0/KubeletCommandLine": { + "status": "skipped", + "info": "This control requires the host-scanner capability. To activate the host scanner capability, proceed with the installation of the kubescape operator chart found here: https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-cloud-operator" + }, + "hostdata.kubescape.cloud/v1beta0/KubeletConfiguration": { + "status": "skipped", + "info": "This control requires the host-scanner capability. To activate the host scanner capability, proceed with the installation of the kubescape operator chart found here: https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-cloud-operator" + }, + "hostdata.kubescape.cloud/v1beta0/KubeletInfo": { + "status": "skipped", + "info": "This control requires the host-scanner capability. To activate the host scanner capability, proceed with the installation of the kubescape operator chart found here: https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-cloud-operator" + }, + "hostdata.kubescape.cloud/v1beta0/LinuxKernelVariables": { + "status": "skipped", + "info": "This control requires the host-scanner capability. To activate the host scanner capability, proceed with the installation of the kubescape operator chart found here: https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-cloud-operator" + }, + "image.vulnscan.com/v1/ImageVulnerabilities": { + "status": "skipped", + "info": "failed to pull image scanning data: credentials are not configured for any registry adaptor. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities" + }, + "management.azure.com/v1/ClusterDescribe": { + "status": "skipped", + "info": "failed to get cloud provider, cluster: kwok-kwok-cluster" + } + }, + "ResourceToControlsMap": { + "armo.vuln.images/v1/ImageVulnerabilities": [ + "C-0083", + "C-0084", + "C-0085" + ], + "container.googleapis.com/v1/ClusterDescribe": [ + "C-0066", + "C-0067", + "C-0068", + "C-0088" + ], + "eks.amazonaws.com/v1/ClusterDescribe": [ + "C-0066", + "C-0067", + "C-0068", + "C-0088" + ], + "hostdata.kubescape.cloud/v1beta0/KubeletCommandLine": [ + "C-0070" + ], + "hostdata.kubescape.cloud/v1beta0/KubeletConfiguration": [ + "C-0070" + ], + "hostdata.kubescape.cloud/v1beta0/KubeletInfo": [ + "C-0069" + ], + "hostdata.kubescape.cloud/v1beta0/LinuxKernelVariables": [ + "C-0079" + ], + "image.vulnscan.com/v1/ImageVulnerabilities": [ + "C-0083", + "C-0084", + "C-0085" + ], + "management.azure.com/v1/ClusterDescribe": [ + "C-0066", + "C-0067", + "C-0068", + "C-0088" + ] + }, + "SessionID": "61788b19-5c9a-4b4b-b223-67e95bd2d372", + "Policies": [ + { + "guid": "", + "name": "AllControls", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "description": "Contains all the controls from all the frameworks", + "controls": [ + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Forbidden Container Registries", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Initial Access" + ] + }, + "controlID": "C-0001", + "creationTime": "", + "description": "In cases where the Kubernetes cluster is provided by a CSP (e.g., AKS in Azure, GKE in GCP, or EKS in AWS), compromised cloud credential can lead to the cluster takeover. Attackers may abuse cloud account credentials or IAM mechanism to the cluster’s management layer.", + "remediation": "Limit the registries from which you pull container images from", + "rules": [ + { + "guid": "", + "name": "rule-identify-blocklisted-image-registries", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Initial Access::Compromised images in registry" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\n# Check for images from blocklisted repos\n\nuntrustedImageRepo[msga] {\n\tpod := input[_]\n\tk := pod.kind\n\tk == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tpath := sprintf(\"spec.containers[%v].image\", [format_int(i, 10)])\n\timage := container.image\n untrusted_or_public_registries(image)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\nuntrustedImageRepo[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\timage := container.image\n untrusted_or_public_registries(image)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\nuntrustedImageRepo[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\timage := container.image\n untrusted_or_public_registries(image)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\nuntrusted_or_public_registries(image){\n\t# see default-config-inputs.json for list values\n\tuntrusted_registries := data.postureControlInputs.untrustedRegistries\n\trepo_prefix := untrusted_registries[_]\n\tstartswith(image, repo_prefix)\n}\n\nuntrusted_or_public_registries(image){\n\t# see default-config-inputs.json for list values\n\tpublic_registries := data.postureControlInputs.publicRegistries\n\trepo_prefix := public_registries[_]\n\tstartswith(image, repo_prefix)\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Pod", + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet", + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.publicRegistries", + "settings.postureControlInputs.untrustedRegistries" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.publicRegistries", + "name": "Public registries", + "description": "Kubescape checks none of these public registries are in use." + }, + { + "path": "settings.postureControlInputs.untrustedRegistries", + "name": "Registries block list", + "description": "Kubescape checks none of the following registries are in use." + } + ], + "description": "Identifying if pod container images are from unallowed registries", + "remediation": "Use images from safe registry", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Exec into container", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Execution" + ], + "rbacQuery": "Show who can access into pods" + }, + "controlID": "C-0002", + "creationTime": "", + "description": "Attackers with relevant permissions can run malicious commands in the context of legitimate containers in the cluster using “kubectl exec” command. This control determines which subjects have permissions to use this command.", + "remediation": "It is recommended to prohibit “kubectl exec” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.", + "rules": [ + { + "guid": "", + "name": "exec-into-container-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Exec into container", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# input: regoResponseVectorObject\n# returns subjects that can exec into container\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"create\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"pods/exec\", \"pods/*\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can exec into containers\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "rbac.authorization.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "RoleBinding", + "ClusterRoleBinding", + "Role", + "ClusterRole" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have permissions to exec into pods", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Resources memory limit and request", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - service destruction" + ] + } + ], + "controlTypeTags": [ + "compliance", + "devops" + ] + }, + "controlID": "C-0004", + "creationTime": "", + "description": "This control identifies all Pods for which the memory limit is not set.", + "remediation": "Set the memory limit or use exception mechanism to avoid unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "resources-memory-limit-and-request", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if pod does not have container with memory-limit or request\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tnot request_or_limit_memory(container)\n\tfixPaths := [\n\t\t{\"path\": sprintf(\"spec.containers[%v].resources.limits.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t\t{\"path\": sprintf(\"spec.containers[%v].resources.requests.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have memory-limit or request\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPaths,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [pod]},\n\t}\n}\n\n# Fails if workload does not have container with memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tnot request_or_limit_memory(container)\n\tfixPaths := [\n\t\t{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.limits.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t\t{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.requests.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPaths,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\n# Fails if cronjob does not have container with memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tnot request_or_limit_memory(container)\n\tfixPaths := [\n\t\t{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.limits.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t\t{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.requests.memory\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"},\n\t]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPaths,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\nrequest_or_limit_memory(container) {\n\tcontainer.resources.limits.memory\n\tcontainer.resources.requests.memory\n}\n\n######################################################################################################\n\n# Fails if pod exceeds memory-limit or request\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\trequest_or_limit_memory(container)\n\tresource := is_min_max_exceeded_memory(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v exceeds memory-limit or request\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [pod]},\n\t}\n}\n\n# Fails if workload exceeds memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\n\trequest_or_limit_memory(container)\n\tresource := is_min_max_exceeded_memory(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\n# Fails if cronjob exceeds memory-limit or request\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\n\trequest_or_limit_memory(container)\n\tresource := is_min_max_exceeded_memory(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds memory-limit or request\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\"k8sApiObjects\": [wl]},\n\t}\n}\n\n######################################################################################################\n\nis_min_max_exceeded_memory(container) = \"resources.limits.memory\" {\n\tmemory_limit := container.resources.limits.memory\n\tis_limit_exceeded_memory(memory_limit)\n} else = \"resouces.requests.memory\" {\n\tmemory_req := container.resources.requests.memory\n\tis_req_exceeded_memory(memory_req)\n} else = \"\" {\n\ttrue\n}\n\nis_limit_exceeded_memory(memory_limit) {\n\tis_min_limit_exceeded_memory(memory_limit)\n}\n\nis_limit_exceeded_memory(memory_limit) {\n\tis_max_limit_exceeded_memory(memory_limit)\n}\n\nis_req_exceeded_memory(memory_req) {\n\tis_max_request_exceeded_memory(memory_req)\n}\n\nis_req_exceeded_memory(memory_req) {\n\tis_min_request_exceeded_memory(memory_req)\n}\n\n# helpers\n\nis_max_limit_exceeded_memory(memory_limit) {\n\tmemory_limit_max :=data.postureControlInputs.memory_limit_max[_]\n\tcompare_max(memory_limit_max, memory_limit)\n}\n\nis_min_limit_exceeded_memory(memory_limit) {\n\tmemory_limit_min := data.postureControlInputs.memory_limit_min[_]\n\tcompare_min(memory_limit_min, memory_limit)\n}\n\nis_max_request_exceeded_memory(memory_req) {\n\tmemory_req_max := data.postureControlInputs.memory_request_max[_]\n\tcompare_max(memory_req_max, memory_req)\n}\n\nis_min_request_exceeded_memory(memory_req) {\n\tmemory_req_min := data.postureControlInputs.memory_request_min[_]\n\tcompare_min(memory_req_min, memory_req)\n}\n\n##############\n# helpers\n\n# Compare according to unit - max\ncompare_max(max, given) {\n\tendswith(max, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_max := split(max, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"M\")\n\tendswith(given, \"M\")\n\tsplit_max := split(max, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"m\")\n\tendswith(given, \"m\")\n\tsplit_max := split(max, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tnot is_special_measure(max)\n\tnot is_special_measure(given)\n\tgiven \u003e max\n}\n\n\n\n################\n# Compare according to unit - min\ncompare_min(min, given) {\n\tendswith(min, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_min := split(min, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"M\")\n\tendswith(given, \"M\")\n\tsplit_min := split(min, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"m\")\n\tendswith(given, \"m\")\n\tsplit_min := split(min, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tnot is_special_measure(min)\n\tnot is_special_measure(given)\n\tgiven \u003c min\n}\n\n\n# Check that is same unit\nis_special_measure(unit) {\n\tendswith(unit, \"m\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"M\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"Mi\")\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet", + "Job", + "Pod", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.memory_request_max", + "settings.postureControlInputs.memory_request_min", + "settings.postureControlInputs.memory_limit_max", + "settings.postureControlInputs.memory_limit_min" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.memory_request_max", + "name": "memory_request_max", + "description": "Ensure memory max requests are set" + }, + { + "path": "settings.postureControlInputs.memory_request_min", + "name": "memory_request_min", + "description": "Ensure memory min requests are set" + }, + { + "path": "settings.postureControlInputs.memory_limit_max", + "name": "memory_limit_max", + "description": "Ensure memory max limits are set" + }, + { + "path": "settings.postureControlInputs.memory_limit_min", + "name": "memory_limit_min", + "description": "Ensure memory min limits are set" + } + ], + "description": "memory limits and requests are not set.", + "remediation": "Ensure memory limits and requests are set.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "API server insecure port is enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0005", + "creationTime": "", + "description": "Kubernetes control plane API is running with non-secure port enabled which allows attackers to gain unprotected access to the cluster.", + "remediation": "Set the insecure-port flag of the API server to zero.", + "rules": [ + { + "guid": "", + "name": "insecure-port-flag", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Fails if pod has insecure-port flag enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontains(pod.metadata.name, \"kube-apiserver\")\n container := pod.spec.containers[i]\n\tpath = is_insecure_port_flag(container, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"The API server container: %v has insecure-port flag enabled\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\t\nis_insecure_port_flag(container, i) = path {\n\tcommand := container.command[j]\n\tcontains(command, \"--insecure-port=1\")\n\tpath := sprintf(\"spec.containers[%v].command[%v]\", [format_int(i, 10), format_int(j, 10)])\n}", + "resourceEnumerator": "package armo_builtins\nimport data.cautils as cautils\n\n# Fails if pod has insecure-port flag enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontains(pod.metadata.name, \"kube-apiserver\")\n container := pod.spec.containers[_]\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"The API server container: %v has insecure-port flag enabled\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if the api server has insecure-port enabled", + "remediation": "Make sure that the insecure-port flag of the api server is set to 0", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Data Destruction", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Impact" + ], + "rbacQuery": "Data destruction" + }, + "controlID": "C-0007", + "creationTime": "", + "description": "Attackers may attempt to destroy data and resources in the cluster. This includes deleting deployments, configurations, storage, and compute resources. This control identifies all subjects that can delete resources.", + "remediation": "You should follow the least privilege principle and minimize the number of subjects that can delete resources.", + "rules": [ + { + "guid": "", + "name": "rule-excessive-delete-rights-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Impact::Data Destruction", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can can delete important resources\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"delete\", \"deletecollection\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\", \"apps\", \"batch\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"secrets\", \"pods\", \"services\", \"deployments\", \"replicasets\", \"daemonsets\", \"statefulsets\", \"jobs\", \"cronjobs\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can delete important resources\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if user can delete important resources", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Resource limits", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - service destruction" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0009", + "creationTime": "", + "description": "CPU and memory resources should have a limit set for every container or a namespace to prevent resource exhaustion. This control identifies all the Pods without resource limit definitions by checking their yaml definition file as well as their namespace LimitRange objects. It is also recommended to use ResourceQuota object to restrict overall namespace resources, but this is not verified by this control.", + "remediation": "Define LimitRange and Resource Limits in the namespace or in the deployment/POD yamls.", + "rules": [ + { + "guid": "", + "name": "resource-policies", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if container has limits\ndeny[msga] {\n \tpods := [pod | pod = input[_]; pod.kind == \"Pod\"]\n pod := pods[_]\n\tcontainer := pod.spec.containers[i]\n\t\n\t\n\tbeggining_of_path := \"spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Check if container has limits - for workloads\n# If there is no limits specified in the workload, we check the namespace, since if limits are only specified for namespace\n# and not in workload, it won't be on the yaml\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\t\n\tbeggining_of_path\t:= \"spec.template.spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\t\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n\t\n}\n\n# Check if container has limits - for cronjobs\n# If there is no limits specified in the cronjob, we check the namespace, since if limits are only specified for namespace\n# and not in cronjob, it won't be on the yaml\ndeny [msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\t\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# no limits at all\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tnot container.resources.limits\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}, {\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}\n\n# only memory limit\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.cpu\n\tcontainer.resources.limits.memory\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}\n\n# only cpu limit\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) =fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.memory\n\tcontainer.resources.limits.cpu\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n\tfailed_path = \"\"\n}\n# limits but without capu and memory \nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.memory\n\tnot container.resources.limits.cpu\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}, {\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if namespace has no resource policies defined", + "remediation": "Make sure that you definy resource policies (LimitRange or ResourceQuota) which limit the usage of resources for all the namespaces", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Applications credentials in configuration files", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Credential access" + ] + }, + { + "attackTrack": "container", + "categories": [ + "Credential access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Credential access", + "Lateral Movement" + ] + }, + "controlID": "C-0012", + "creationTime": "", + "description": "Attackers who have access to configuration files can steal the stored secrets and use them. This control checks if ConfigMaps or pod specifications have sensitive information in their configuration.", + "remediation": "Use Kubernetes secrets or Key Management Systems to store credentials.", + "rules": [ + { + "guid": "", + "name": "rule-credentials-in-env-var", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "\tpackage armo_builtins\n\t# import data.cautils as cautils\n\t# import data.kubernetes.api.client as client\n\timport data\n\n\tdeny[msga] {\n\t\tpod := input[_]\n\t\tpod.kind == \"Pod\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := pod.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Pod: %v has sensitive information in environment variables\", [pod.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [pod]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\t\tspec_template_spec_patterns[wl.kind]\n\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\t\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"%v: %v has sensitive information in environment variables\", [wl.kind, wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\twl.kind == \"CronJob\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\t\t\n\t\tis_not_reference(env)\n\t\t\n\t\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Cronjob: %v has sensitive information in environment variables\", [wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\n\nis_not_reference(env)\n{\n\tnot env.valueFrom.secretKeyRef\n\tnot env.valueFrom.configMapKeyRef\n}\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if Pods have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + }, + { + "guid": "", + "name": "rule-credentials-configmap", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "package armo_builtins\n# import data.cautils as cautils\n# import data.kubernetes.api.client as client\nimport data\n\n# fails if config map has keys with suspicious name\ndeny[msga] {\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n # see default-config-inputs.json for list values\n sensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n key_name := sensitive_key_names[_]\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n \n contains(lower(map_key), lower(key_name))\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n \n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - not base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n regex.match(value , map_secret)\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n decoded_secret := base64.decode(map_secret)\n \n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n regex.match(value , decoded_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveValues", + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveValues", + "name": "Values", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Below you can find some examples of popular value phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if ConfigMaps have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Non-root containers", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0013", + "creationTime": "", + "description": "Potential attackers may gain access to a container and leverage its existing privileges to conduct an attack. Therefore, it is not recommended to deploy containers with root privileges unless it is absolutely necessary. This control identifies all the Pods running as root or can escalate to root.", + "remediation": "If your application does not need root privileges, make sure to define the runAsUser or runAsGroup under the PodSecurityContext and use user ID 1000 or higher. Do not turn on allowPrivlegeEscalation bit and make sure runAsNonRoot is true.", + "rules": [ + { + "guid": "", + "name": "non-root-containers", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n################################################################################\n# Rules\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\n\tbeggining_of_path := \"spec\"\n\talertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v may run as root\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\n\tbeggining_of_path := \"spec.template.spec\"\n\talertInfo := evaluate_workload_non_root_container(container, wl.spec.template, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v may run as root\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has a container configured to run as root\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec\"\n\talertInfo := evaluate_workload_non_root_container(container, wl.spec.jobTemplate.spec.template, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\t\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v may run as root\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nget_failed_path(alertInfo, i) = [replace(alertInfo.failed_path,\"container_ndx\",format_int(i,10))] {\n\talertInfo.failed_path != \"\"\n} else = []\n\n\nget_fixed_path(alertInfo, i) = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}, {\"path\":replace(alertInfo.fixPath[1].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[1].value}]{\n\tcount(alertInfo.fixPath) == 2\n} else = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}] {\n\tcount(alertInfo.fixPath) == 1\n} else = []\n\n#################################################################################\n# Workload evaluation \n\nevaluate_workload_non_root_container(container, pod, beggining_of_path) = alertInfo {\n\trunAsNonRootValue := get_run_as_non_root_value(container, pod, beggining_of_path)\n\trunAsNonRootValue.value == false\n\t\n\trunAsUserValue := get_run_as_user_value(container, pod, beggining_of_path)\n\trunAsUserValue.value == 0\n\n\talertInfo := choose_first_if_defined(runAsUserValue, runAsNonRootValue)\n} else = alertInfo {\n allowPrivilegeEscalationValue := get_allow_privilege_escalation(container, pod, beggining_of_path)\n allowPrivilegeEscalationValue.value == true\n\n alertInfo := allowPrivilegeEscalationValue\n}\n\n\n#################################################################################\n# Value resolution functions\n\n\nget_run_as_non_root_value(container, pod, beggining_of_path) = runAsNonRoot {\n failed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : container.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [] ,\"defined\" : true}\n} else = runAsNonRoot {\n\tfailed_path := sprintf(\"%v.securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : pod.spec.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}], \"defined\" : false} {\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) , \"value\":\"true\"}, {\"path\":sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nget_run_as_user_value(container, pod, beggining_of_path) = runAsUser {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : container.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = runAsUser {\n\tfailed_path := sprintf(\"%v.securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : pod.spec.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}],\"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n\t\"defined\" : false}\n\nget_run_as_group_value(container, pod, beggining_of_path) = runAsGroup {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : container.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = runAsGroup {\n\tfailed_path := sprintf(\"%v.securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : pod.spec.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\":[], \"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}], \"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n \t\"defined\" : false\n}\n\nget_allow_privilege_escalation(container, pod, beggining_of_path) = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : container.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : pod.spec.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : true, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nchoose_first_if_defined(l1, l2) = c {\n l1.defined\n c := l1\n} else = l2\n\n\nis_allow_privilege_escalation_field(container, pod) {\n\tcontainer.securityContext.allowPrivilegeEscalation == false\n}\n\nis_allow_privilege_escalation_field(container, pod) {\n\tpod.spec.securityContext.allowPrivilegeEscalation == false\n}\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container can run as root", + "remediation": "Make sure that the user/group in the securityContext of pod/container is set to an id less than 1000, or the runAsNonRoot flag is set to true. Also make sure that the allowPrivilegeEscalation field is set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "", + "" + ], + "guid": "", + "name": "Access Kubernetes dashboard", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery", + "Lateral Movement" + ], + "rbacQuery": "Access k8s Dashboard" + }, + "controlID": "C-0014", + "creationTime": "", + "description": "Attackers who gain access to the dashboard service account or have its RBAC permissions can use its network access to retrieve information about resources in the cluster or change them. This control checks if a subject that is not dashboard service account is bound to dashboard role/clusterrole, or - if anyone that is not the dashboard pod is associated with dashboard service account.", + "remediation": "Make sure that the “Kubernetes Dashboard” service account is only bound to the Kubernetes dashboard following the least privilege principle.", + "rules": [ + { + "guid": "", + "name": "rule-access-dashboard-subject-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Access Kubernetes dashboard, Discovery::Access Kubernetes dashboard", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: regoResponseVectorObject\n# fails if a subject that is not dashboard service account is bound to dashboard role\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(subjectVector.relatedObjects[i].kind, \"Role\")\n\tendswith(subjectVector.relatedObjects[j].kind, \"Binding\")\n\n\trole.metadata.name == \"kubernetes-dashboard\"\n\tsubjectVector.name != \"kubernetes-dashboard\"\n\n\tsubject := rolebinding.subjects[k]\n path := [sprintf(\"relatedObjects[%v].subjects[%v]\", [format_int(j, 10), format_int(k, 10)])]\n\tfinalpath := array.concat(path, [sprintf(\"relatedObjects[%v].roleRef.name\", [format_int(j, 10)])])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %v-%v is bound to dashboard role/clusterrole\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if subject that is not dashboard service account is bound to dashboard role/clusterrole, or- if anyone that is not dashboard pod is associated with its service account.", + "remediation": "", + "ruleQuery": "", + "relevantCloudProviders": null + }, + { + "guid": "", + "name": "rule-access-dashboard-wl-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Access Kubernetes dashboard, Discovery::Access Kubernetes dashboard", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: \n# apiversion: \n# fails if pod that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n pod := input[_]\n pod.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(pod.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following pods: %s are associated with dashboard service account\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [\"spec.serviceaccountname\"],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# input: \n# apiversion: \n# fails if workload that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n wl.spec.template.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(wl.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is associated with dashboard service account\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"spec.template.spec.serviceaccountname\"],\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# input: \n# apiversion: \n# fails if CronJob that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n wl.spec.jobTemplate.spec.template.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(wl.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjob: %s is associated with dashboard service account\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [\"spec.jobTemplate.spec.template.spec.serviceaccountname\"],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if subject that is not dashboard service account is bound to dashboard role/clusterrole, or- if anyone that is not dashboard pod is associated with its service account.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "List Kubernetes secrets", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Credential access" + ] + } + ], + "controlTypeTags": [ + "security-impact", + "compliance" + ], + "microsoftMitreColumns": [ + "Credential access" + ], + "rbacQuery": "Show who can access secrets" + }, + "controlID": "C-0015", + "creationTime": "", + "description": "Attackers who have permissions to access secrets can access sensitive information that might include credentials to various services. This control determines which user, group or service account can list/get secrets.", + "remediation": "Monitor and approve list of users, groups and service accounts that can access secrets. Use exception mechanism to prevent repetitive the notifications.", + "rules": [ + { + "guid": "", + "name": "rule-can-list-get-secrets-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Discovery::Access the K8s API server", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can list/get secrets \ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"get\", \"list\", \"watch\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"secrets\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can read secrets\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can list/get secrets", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Allow privilege escalation", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0016", + "creationTime": "", + "description": "Attackers may gain access to a container and uplift its privilege to enable excessive capabilities.", + "remediation": "If your application does not need it, make sure the allowPrivilegeEscalation field of the securityContext is set to false.", + "rules": [ + { + "guid": "", + "name": "rule-allow-privilege-escalation", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has container that allow privilege escalation\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v allow privilege escalation\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has a container that allow privilege escalation\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v allow privilege escalation\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has a container that allow privilege escalation\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v allow privilege escalation\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n not container.securityContext.allowPrivilegeEscalation == false\n\tnot container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) == 0\n\tfailed_path = \"\"\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)]), \"value\":\"false\"} \n}\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n not container.securityContext.allowPrivilegeEscalation == false\n\tnot container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) \u003e 0\n\tpsp := psps[_]\n\tnot psp.spec.allowPrivilegeEscalation == false\n\tfailed_path = \"\"\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)]), \"value\":\"false\"} \n}\n\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) == 0\n\tfixPath = \"\"\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)])\n}\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path)= [failed_path, fixPath] {\n container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) \u003e 0\n\tpsp := psps[_]\n\tnot psp.spec.allowPrivilegeEscalation == false\n\tfixPath = \"\"\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)])\n}\n\n get_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + }, + { + "apiGroups": [ + "policy" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "PodSecurityPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container allows privilege escalation", + "remediation": "Make sure that the allowPrivilegeEscalation field in the securityContext of pod/container is set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Immutable container filesystem", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Execution", + "Persistence" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0017", + "creationTime": "", + "description": "Mutable container filesystem can be abused to inject malicious code or data into containers. Use immutable (read-only) filesystem to limit potential attacks.", + "remediation": "Set the filesystem of the container to read-only when possible (POD securityContext, readOnlyRootFilesystem: true). If containers application needs to write into the filesystem, it is recommended to mount secondary filesystems for specific directories where application require write access.", + "rules": [ + { + "guid": "", + "name": "immutable-container-filesystem", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pods has container with mutable filesystem\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v has mutable filesystem\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has container with mutable filesystem \ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v has mutable filesystem\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has container with mutable filesystem \ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v has mutable filesystem\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Default of readOnlyRootFilesystem is false. This field is only in container spec and not pod spec\nis_mutable_filesystem(container, beggining_of_path, i) = [failed_path, fixPath] {\n\tcontainer.securityContext.readOnlyRootFilesystem == false\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.readOnlyRootFilesystem\", [beggining_of_path, format_int(i, 10)])\n\tfixPath = \"\"\n }\n\n is_mutable_filesystem(container, beggining_of_path, i) = [failed_path, fixPath] {\n\tnot container.securityContext.readOnlyRootFilesystem == false\n not container.securityContext.readOnlyRootFilesystem == true\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.readOnlyRootFilesystem\", [beggining_of_path, format_int(i, 10)]), \"value\": \"true\"}\n\tfailed_path = \"\"\n }\n\n\n get_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container has mutable filesystem", + "remediation": "Make sure that the securityContext.readOnlyRootFilesystem field in the container/pod spec is set to true", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Configured readiness probe", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0018", + "creationTime": "", + "description": "Readiness probe is intended to ensure that workload is ready to process network traffic. It is highly recommended to define readiness probe for every worker container. This control finds all the PODs where the readiness probe is not configured.", + "remediation": "Ensure Readiness probes are configured wherever possible.", + "rules": [ + { + "guid": "", + "name": "configured-readiness-probe", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod does not have container with readinessProbe\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tnot container.readinessProbe\n\tfix_path := {\"path\": sprintf(\"spec.containers[%v].readinessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have readinessProbe\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload does not have container with readinessProbe\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n not container.readinessProbe\n\tfix_path := {\"path\": sprintf(\"spec.template.spec.containers[%v].readinessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have readinessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob does not have container with readinessProbe\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n not container.readinessProbe\n\tfix_path := {\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].readinessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have readinessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Readiness probe is not configured", + "remediation": "Ensure Readiness probe is configured", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Mount service principal", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Credential Access" + ] + }, + "controlID": "C-0020", + "creationTime": "", + "description": "When a cluster is deployed in the cloud, in some cases attackers can leverage their access to a container in the cluster to gain cloud credentials. This control determines if any workload contains a volume with potential access to cloud credential.", + "remediation": "Refrain from using path mount to known cloud credentials folders or files .", + "rules": [ + { + "guid": "", + "name": "alert-mount-potential-credentials-paths", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport future.keywords.if\n\n\ndeny[msga] {\n\tprovider := data.dataControlInputs.cloudProvider\n\tprovider != \"\"\n\tresources := input[_]\n\tvolumes_data := get_volumes(resources)\n volumes := volumes_data[\"volumes\"]\n volume := volumes[i]\n\tbeggining_of_path := volumes_data[\"beggining_of_path\"]\n result := is_unsafe_paths(volume, beggining_of_path, provider,i)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as volume with potential credentials access.\", [resources.kind, resources.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [resources]\n\t\t}\n\t}\t\n}\n\n\t\n# get_volume - get resource volumes paths for {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\nget_volumes(resources) := result {\n\tresources_kinds := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tresources_kinds[resources.kind]\n\tresult = {\"volumes\": resources.spec.template.spec.volumes, \"beggining_of_path\": \"spec.template.spec.\"}\n}\n\n# get_volume - get resource volumes paths for \"Pod\"\nget_volumes(resources) := result {\n\tresources.kind == \"Pod\"\n\tresult = {\"volumes\": resources.spec.volumes, \"beggining_of_path\": \"spec.\"}\n}\n\n# get_volume - get resource volumes paths for \"CronJob\"\nget_volumes(resources) := result {\n\tresources.kind == \"CronJob\"\n\tresult = {\"volumes\": resources.spec.jobTemplate.spec.template.spec.volumes, \"beggining_of_path\": \"spec.jobTemplate.spec.template.spec.\"}\n}\n\n\n# is_unsafe_paths - looking for cloud provider (eks/gke/aks) paths that have the potential of accessing credentials\nis_unsafe_paths(volume, beggining_of_path, provider, i) = result {\n\tunsafe := unsafe_paths(provider)\n\tunsafe[_] == fix_path(volume.hostPath.path)\n\tresult= sprintf(\"%vvolumes[%d].hostPath.path\", [beggining_of_path, i])\n}\n\n\n# fix_path - adding \"/\" at the end of the path if doesn't exist and if not a file path.\nfix_path(path) := result if {\n\n\t# filter file path\n not regex.match(`[\\\\w-]+\\\\.`, path)\n\n\t# filter path that doesn't end with \"/\"\n not endswith(path, \"/\")\n\n\t# adding \"/\" to the end of the path\n result = sprintf(\"%v/\", [path])\n} else := path\n\n\n\n# eks unsafe paths\nunsafe_paths(x) := [\"/.aws/\", \n\t\t\t\t\t\"/.aws/config/\", \n\t\t\t\t\t\"/.aws/credentials/\"] if {x==\"eks\"}\n\n# aks unsafe paths\nunsafe_paths(x) := [\"/etc/\",\n\t\t\t\t\t\"/etc/kubernetes/\",\n\t\t\t\t\t\"/etc/kubernetes/azure.json\", \n\t\t\t\t\t\"/.azure/\",\n\t\t\t\t\t\"/.azure/credentials/\", \n\t\t\t\t\t\"/etc/kubernetes/azure.json\"] if {x==\"aks\"}\n\n# gke unsafe paths\nunsafe_paths(x) := [\"/.config/gcloud/\", \n\t\t\t\t\t\"/.config/\", \n\t\t\t\t\t\"/gcloud/\", \n\t\t\t\t\t\"/.config/gcloud/application_default_credentials.json\",\n\t\t\t\t\t\"/gcloud/application_default_credentials.json\"] if {x==\"gke\"}\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume", + "remediation": "Try to refrain from using hostPath mounts", + "ruleQuery": "", + "relevantCloudProviders": [ + "EKS", + "GKE", + "AKS" + ] + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Exposed sensitive interfaces", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Initial access" + ] + }, + "controlID": "C-0021", + "creationTime": "", + "description": "Exposing a sensitive interface to the internet poses a security risk. It might enable attackers to run malicious code or deploy containers in the cluster. This control checks if known components (e.g. Kubeflow, Argo Workflows, etc.) are deployed and exposed services externally.", + "remediation": "Consider blocking external interfaces or protect them with appropriate security tools.", + "rules": [ + { + "guid": "", + "name": "exposed-sensitive-interfaces-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Initial access::Exposed sensitive interfaces", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.kubernetes.api.client as client\nimport data\n\n# loadbalancer\ndeny[msga] {\n\twl := input[_]\n\tworkload_types = {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"Pod\", \"CronJob\"}\n\tworkload_types[wl.kind]\n\n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"LoadBalancer\"\n\n\tresult := wl_connectedto_service(wl, service)\n \n # externalIP := service.spec.externalIPs[_]\n\texternalIP := service.status.loadBalancer.ingress[0].ip\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\n\n# nodePort\n# get a pod connected to that service, get nodeIP (hostIP?)\n# use ip + nodeport\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"Pod\"\n \n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n \n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"NodePort\"\n\n\tresult := wl_connectedto_service(wl, service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n} \n\n# nodePort\n# get a workload connected to that service, get nodeIP (hostIP?)\n# use ip + nodeport\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"CronJob\"}\n\tspec_template_spec_patterns[wl.kind]\n \n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n \n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"NodePort\"\n\n\tresult := wl_connectedto_service(wl, service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\n# ====================================================================================\n\nwl_connectedto_service(wl, service) = paths{\n\tcount({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)\n\tpaths = [\"spec.selector.matchLabels\", \"service.spec.selector\"]\n}\n\nwl_connectedto_service(wl, service) = paths {\n\twl.spec.selector.matchLabels == service.spec.selector\n\tpaths = [\"spec.selector.matchLabels\", \"service.spec.selector\"]\n}", + "resourceEnumerator": "package armo_builtins\nimport data.kubernetes.api.client as client\nimport data\n\ndeny[msga] {\n\twl := input[_]\n\tworkload_types = {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"Pod\", \"CronJob\"}\n\tworkload_types[wl.kind]\n\n\t# see default-config-inputs.json for list values\n\twl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n\n\tsrvc := get_wl_connectedto_service(wl)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": srvc}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"wl: %v is in the cluster\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\nget_wl_connectedto_service(wl) = s {\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\twl_connectedto_service(wl, service)\n\ts = [service]\n}\n\nget_wl_connectedto_service(wl) = s {\n\tservices := [service | service = input[_]; service.kind == \"Service\"]\n\tcount({i | services[i]; wl_connectedto_service(wl, services[i])}) == 0\n\ts = []\n}\n\nwl_connectedto_service(wl, service){\n\tcount({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Service" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": [ + "settings.postureControlInputs.sensitiveInterfaces" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveInterfaces", + "name": "Sensitive interfaces", + "description": "The following interfaces were seen exploited. Kubescape checks it they are externally exposed." + } + ], + "description": "fails if known interfaces have exposed services", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Kubernetes CronJob", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Persistence" + ] + }, + "controlID": "C-0026", + "creationTime": "", + "description": "Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a POD in the cluster. This control lists all the CronJobs that exist in the cluster for the user to approve.", + "remediation": "Watch Kubernetes CronJobs and make sure they are legitimate.", + "rules": [ + { + "guid": "", + "name": "rule-deny-cronjobs", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Kubernetes Cronjob" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# alert cronjobs\n\n#handles cronjob\ndeny[msga] {\n\n\twl := input[_]\n\twl.kind == \"CronJob\"\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined: %v\", [wl.metadata.name]),\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if it's cronjob", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 1 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Ingress and Egress blocked", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ] + }, + "controlID": "C-0030", + "creationTime": "", + "description": "Disable Ingress and Egress traffic on all pods wherever possible. It is recommended to define restrictive network policy on all new PODs, and then enable sources/destinations that this POD must communicate with.", + "remediation": "Define a network policy that restricts ingress and egress connections.", + "rules": [ + { + "guid": "", + "name": "ingress-and-egress-blocked", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# For pods\ndeny[msga] {\n \t\tpods := [pod | pod= input[_]; pod.kind == \"Pod\"]\n\t\tnetworkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\t\tpod := pods[_]\n\t\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; pod_connected_to_network_policy(pod, networkpolicie)]\n\t\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\t\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v does not have ingress/egress defined\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n\n}\n\n# For pods\ndeny[msga] {\n \t\tpods := [pod | pod= input[_]; pod.kind == \"Pod\"]\n\t\tnetworkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\t\tpod := pods[_]\n\t\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; pod_connected_to_network_policy(pod, networkpolicie)]\n\t\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v does not have ingress/egress defined\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n\n}\n\n# For workloads\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; wlConnectedToNetworkPolicy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# For workloads\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; wlConnectedToNetworkPolicy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# For Cronjobs\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; cronjob_connected_to_network_policy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# For Cronjobs\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; cronjob_connected_to_network_policy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tmetadata1.namespace == metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tnot metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata2.namespace\n\tmetadata1.namespace == \"default\"\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tmetadata2.namespace == \"default\"\n}\n\npod_connected_to_network_policy(pod, networkpolicie){\n\tis_same_namespace(networkpolicie.metadata, pod.metadata)\n count(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == pod.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\npod_connected_to_network_policy(pod, networkpolicie){\n\tis_same_namespace(networkpolicie.metadata ,pod.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\nwlConnectedToNetworkPolicy(wl, networkpolicie){\n\tis_same_namespace(wl.metadata , networkpolicie.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\n\nwlConnectedToNetworkPolicy(wl, networkpolicie){\n\tis_same_namespace(wl.metadata, networkpolicie.metadata)\n\tcount(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == wl.spec.template.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\n\ncronjob_connected_to_network_policy(cj, networkpolicie){\n\tis_same_namespace(cj.metadata , networkpolicie.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\ncronjob_connected_to_network_policy(cj, networkpolicie){\n\tis_same_namespace(cj.metadata , networkpolicie.metadata)\n\tcount(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == cj.spec.jobTemplate.spec.template.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\nis_ingerss_egress_policy(networkpolicie) {\n list_contains(networkpolicie.spec.policyTypes, \"Ingress\")\n list_contains(networkpolicie.spec.policyTypes, \"Egress\")\n }\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if there are no ingress and egress defined for pod", + "remediation": "Make sure you define ingress and egress policies for all your Pods", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Delete Kubernetes events", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Defense evasion" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Defense evasion" + ], + "rbacQuery": "Show who can delete k8s events" + }, + "controlID": "C-0031", + "creationTime": "", + "description": "Attackers may delete Kubernetes events to avoid detection of their activity in the cluster. This control identifies all the subjects that can delete Kubernetes events.", + "remediation": "You should follow the least privilege principle. Minimize the number of subjects who can delete Kubernetes events. Avoid using these subjects in the daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-can-delete-k8s-events-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Defense Evasion::Delete K8S events", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can delete events\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"delete\", \"deletecollection\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"events\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can delete events\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can delete events", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Automatic mapping of service account", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Impact - K8s API access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0034", + "creationTime": "", + "description": "Potential attacker may gain access to a POD and steal its service account token. Therefore, it is recommended to disable automatic mapping of the service account tokens in service account configuration and enable it only for PODs that need to use them.", + "remediation": "Disable automatic mounting of service account tokens to PODs either at the service account level or at the individual POD level, by specifying the automountServiceAccountToken: false. Note that POD level takes precedence.", + "rules": [ + { + "guid": "", + "name": "automount-service-account", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if user account mount tokens in pod by default\ndeny [msga]{\n service_accounts := [service_account | service_account= input[_]; service_account.kind == \"ServiceAccount\"]\n service_account := service_accounts[_]\n result := is_auto_mount(service_account)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t \"alertMessage\": sprintf(\"the following service account: %v in the following namespace: %v mounts service account tokens in pods by default\", [service_account.metadata.name, service_account.metadata.namespace]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [service_account]\n\t\t}\n\t}\n} \n\n\n # -- ---- For workloads -- ---- \n# Fails if pod mount tokens by default (either by its config or by its SA config)\n\n # POD \ndeny [msga]{\n pod := input[_]\n\tpod.kind == \"Pod\"\n\n\tbeggining_of_path := \"spec.\"\n\twl_namespace := pod.metadata.namespace\n\tresult := is_sa_auto_mounted(pod.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t \"alertMessage\": sprintf(\"Pod: %v in the following namespace: %v mounts service account tokens by default\", [pod.metadata.name, pod.metadata.namespace]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n} \n\n# WORKLOADS\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tbeggining_of_path := \"spec.template.spec.\"\n\n\twl_namespace := wl.metadata.namespace\n\tresult := is_sa_auto_mounted(wl.spec.template.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v in the following namespace: %v mounts service account tokens by default\", [wl.kind, wl.metadata.name, wl.metadata.namespace]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# CRONJOB\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n \n\twl_namespace := wl.metadata.namespace\n\tresult := is_sa_auto_mounted(wl.spec.jobTemplate.spec.template.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v in the following namespace: %v mounts service account tokens by default\", [wl.kind, wl.metadata.name, wl.metadata.namespace]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n # -- ---- For workloads -- ---- \nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken not in pod spec\n\tnot spec.automountServiceAccountToken == false\n\tnot spec.automountServiceAccountToken == true\n\n\t# check if SA automount by default\n\tsa := input[_]\n\tis_same_sa(spec, sa.metadata.name)\n\tis_same_namespace(sa.metadata.namespace , wl_namespace)\n\tnot sa.automountServiceAccountToken == false\n\n\t# path is pod spec\n\tfix_path = { \"path\": sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path]), \"value\": \"false\"}\n\tfailed_path = \"\"\n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken set to true in pod spec\n\tspec.automountServiceAccountToken == true\n\t\n\t# SA automount by default\n\tservice_accounts := [service_account | service_account = input[_]; service_account.kind == \"ServiceAccount\"]\n\tcount(service_accounts) \u003e 0\n\tsa := service_accounts[_]\n\tis_same_sa(spec, sa.metadata.name)\n\tis_same_namespace(sa.metadata.namespace , wl_namespace)\n\tnot sa.automountServiceAccountToken == false\n\n\tfailed_path = sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path])\n\tfix_path = \"\"\n}\n\nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken set to true in pod spec\n\tspec.automountServiceAccountToken == true\n\t\n\t# No SA (yaml scan)\n\tservice_accounts := [service_account | service_account = input[_]; service_account.kind == \"ServiceAccount\"]\n\tcount(service_accounts) == 0\n\tfailed_path = sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path])\n\tfix_path = \"\"\n}\n\n\n\n # -- ---- For SAs -- ---- \nis_auto_mount(service_account) = [failed_path, fix_path] {\n\tservice_account.automountServiceAccountToken == true\n\tfailed_path = \"automountServiceAccountToken\"\n\tfix_path = \"\"\n}\n\nis_auto_mount(service_account)= [failed_path, fix_path] {\n\tnot service_account.automountServiceAccountToken == false\n\tnot service_account.automountServiceAccountToken == true\n\tfix_path = {\"path\": \"automountServiceAccountToken\", \"value\": \"false\"}\n\tfailed_path = \"\"\n}\n\nis_same_sa(spec, serviceAccountName) {\n\tspec.serviceAccountName == serviceAccountName\n}\n\nis_same_sa(spec, serviceAccountName) {\n\tnot spec.serviceAccountName \n\tserviceAccountName == \"default\"\n}\n\n\nis_same_namespace(metadata1, metadata2) {\n\tmetadata1.namespace == metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tnot metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata2.namespace\n\tmetadata1.namespace == \"default\"\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tmetadata2.namespace == \"default\"\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "ServiceAccount" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if service account and workloads mount service account token by default", + "remediation": "Make sure that the automountServiceAccountToken field on the service account spec if set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Cluster-admin binding", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ], + "rbacQuery": "Show cluster_admin" + }, + "controlID": "C-0035", + "creationTime": "", + "description": "Attackers who have cluster admin permissions (can perform any action on any resource), can take advantage of their privileges for malicious activities. This control determines which subjects have cluster admin permissions.", + "remediation": "You should apply least privilege principle. Make sure cluster admin permissions are granted only when it is absolutely necessary. Don't use subjects with such high permissions for daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-list-all-cluster-admins-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Cluster-admin binding", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# returns subjects with cluster admin permissions\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"*\", \"\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s have high privileges, such as cluster-admin\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have cluster admin permissions", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Malicious admission controller (validating)", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Credential access" + ] + }, + "controlID": "C-0036", + "creationTime": "", + "description": "Attackers can use validating webhooks to intercept and discover all the resources in the cluster. This control lists all the validating webhook configurations that must be verified.", + "remediation": "Ensure all the webhooks are necessary. Use exception mechanism to prevent repititive notifications.", + "rules": [ + { + "guid": "", + "name": "list-all-validating-webhooks", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential Access::Malicious admission controller" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny [msga] {\n admissionwebhooks := [admissionwebhook | admissionwebhook = input[_]; admissionwebhook.kind == \"ValidatingWebhookConfiguration\"]\n admissionwebhook := admissionwebhooks[_]\n\n \tmsga := {\n\t\t\"alertMessage\": sprintf(\"The following validating webhook configuration should be checked %v.\", [admissionwebhook.metadata.name]),\n\t\t\"alertScore\": 6,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [admissionwebhook]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "admissionregistration.k8s.io" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "ValidatingWebhookConfiguration" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Returns validating webhook configurations to be verified", + "remediation": "Analyze webhook for malicious behavior", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Host PID/IPC privileges", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0038", + "creationTime": "", + "description": "Containers should be isolated from the host machine as much as possible. The hostPID and hostIPC fields in deployment yaml may allow cross-container influence and may expose the host itself to potentially malicious or destructive actions. This control identifies all PODs using hostPID or hostIPC privileges.", + "remediation": "Remove hostPID and hostIPC from the yaml file(s) privileges unless they are absolutely necessary.", + "rules": [ + { + "guid": "", + "name": "host-pid-ipc-privileges", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has hostPID enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tis_host_pid(pod.spec)\n\tpath := \"spec.hostPID\"\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v has hostPID enabled\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if pod has hostIPC enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tis_host_ipc(pod.spec)\n\tpath := \"spec.hostIPC\"\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v has hostIPC enabled\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has hostPID enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_pid(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostPID\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod with hostPID enabled\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has hostIPC enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_ipc(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostIPC\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod with hostIPC enabled\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has hostPID enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_pid(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostPID\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod with hostPID enabled\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has hostIPC enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_ipc(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostIPC\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod with hostIPC enabled\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Check that hostPID and hostIPC are set to false. Default is false. Only in pod spec\n\n\nis_host_pid(podspec){\n podspec.hostPID == true\n}\n\nis_host_ipc(podspec){\n podspec.hostIPC == true\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Containers should be as isolated as possible from the host machine. The hostPID and hostIPC fields in Kubernetes may excessively expose the host to potentially malicious actions.", + "remediation": "Make sure that the fields hostIPC and hostPID in the pod spec are not set to true (set to false or not present)", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Malicious admission controller (mutating)", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Persistence" + ] + }, + "controlID": "C-0039", + "creationTime": "", + "description": "Attackers may use mutating webhooks to intercept and modify all the resources in the cluster. This control lists all mutating webhook configurations that must be verified.", + "remediation": "Ensure all the webhooks are necessary. Use exception mechanism to prevent repititive notifications.", + "rules": [ + { + "guid": "", + "name": "list-all-mutating-webhooks", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Malicious admission controller" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny [msga] {\n mutatingwebhooks := [mutatingwebhook | mutatingwebhook = input[_]; mutatingwebhook.kind == \"MutatingWebhookConfiguration\"]\n mutatingwebhook := mutatingwebhooks[_]\n\n \tmsga := {\n\t\t\"alertMessage\": sprintf(\"The following mutating webhook configuration should be checked %v.\", [mutatingwebhook.metadata.name]),\n\t\t\"alertScore\": 6,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [mutatingwebhook]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "admissionregistration.k8s.io" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "MutatingWebhookConfiguration" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Returns mutating webhook configurations to be verified", + "remediation": "Analyze webhook for malicious behavior", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "HostNetwork access", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery", + "Lateral movement", + "Impact - service access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0041", + "creationTime": "", + "description": "Potential attackers may gain access to a POD and inherit access to the entire host network. For example, in AWS case, they will have access to the entire VPC. This control identifies all the PODs with host network access enabled.", + "remediation": "Only connect PODs to host network when it is necessary. If not, set the hostNetwork field of the pod spec to false, or completely remove it (false is the default). Whitelist only those PODs that must have access to host network by design.", + "rules": [ + { + "guid": "", + "name": "host-network-access", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if pod has hostNetwork enabled\ndeny[msga] {\n pods := [ pod | pod = input[_] ; pod.kind == \"Pod\"]\n pod := pods[_]\n\n\tis_host_network(pod.spec)\n\tpath := \"spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"Pod: %v is connected to the host network\", [pod.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has hostNetwork enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_network(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod connected to the host network\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has hostNetwork enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_network(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod connected to the host network\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_host_network(podspec) {\n podspec.hostNetwork == true\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if pod has hostNetwork enabled", + "remediation": "Make sure that the hostNetwork field of the pod spec is not set to true (set to false or not present)", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "SSH server running inside container", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Execution" + ] + }, + "controlID": "C-0042", + "creationTime": "", + "description": "An SSH server that is running inside a container may be used by attackers to get remote access to the container. This control checks if pods have an open SSH port (22/2222).", + "remediation": "Remove SSH from the container image or limit the access to the SSH server using network policies.", + "rules": [ + { + "guid": "", + "name": "rule-can-ssh-to-pod-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Execution::SSH server running inside container", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: pod\n# apiversion: v1\n# does:\treturns the external facing services of that pod\n\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tpodns := pod.metadata.namespace\n\tpodname := pod.metadata.name\n\tlabels := pod.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n path := \"metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == podns\n\tservice.spec.selector == filtered_labels\n \n\thasSSHPorts(service)\n\n\twlvector = {\"name\": pod.metadata.name,\n\t\t\t\t\"namespace\": pod.metadata.namespace,\n\t\t\t\t\"kind\": pod.kind,\n\t\t\t\t\"relatedObjects\": service}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed by SSH services: %v\", [podns, podname, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tlabels := wl.spec.template.metadata.labels\n path := \"spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\thasSSHPorts(service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tlabels := wl.spec.jobTemplate.spec.template.metadata.labels\n path := \"spec.jobTemplate.spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\thasSSHPorts(service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 2222\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 2222\n}\n", + "resourceEnumerator": "package armo_builtins\n\n# input: pod\n# apiversion: v1\n# does:\treturns the external facing services of that pod\n\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tpodns := pod.metadata.namespace\n\tpodname := pod.metadata.name\n\tlabels := pod.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n path := \"metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == podns\n\tservice.spec.selector == filtered_labels\n\n\n\twlvector = {\"name\": pod.metadata.name,\n\t\t\t\t\"namespace\": pod.metadata.namespace,\n\t\t\t\t\"kind\": pod.kind,\n\t\t\t\t\"relatedObjects\": service}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed by SSH services: %v\", [podns, podname, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tlabels := wl.spec.template.metadata.labels\n path := \"spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tlabels := wl.spec.jobTemplate.spec.template.metadata.labels\n path := \"spec.jobTemplate.spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Service" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "denies pods with SSH ports opened(22/222)", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Container hostPort", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "devops" + ] + }, + "controlID": "C-0044", + "creationTime": "", + "description": "Configuring hostPort requires a particular port number. If two objects specify the same HostPort, they could not be deployed to the same node. It may prevent the second object from starting, even if Kubernetes will try reschedule it on another node, provided there are available nodes with sufficient amount of resources. Also, if the number of replicas of such workload is higher than the number of nodes, the deployment will consistently fail.", + "remediation": "Avoid usage of hostPort unless it is absolutely necessary, in which case define appropriate exception. Use NodePort / ClusterIP instead.", + "rules": [ + { + "guid": "", + "name": "container-hostPort", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has container with hostPort\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n\tpath := is_host_port(container, i, beggining_of_path)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v has Host-port\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has container with hostPort\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n path := is_host_port(container, i, beggining_of_path)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v has Host-port\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has container with hostPort\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n path := is_host_port(container, i, beggining_of_path)\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v has Host-port\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_host_port(container, i, beggining_of_path) = path {\n\tpath = [sprintf(\"%vcontainers[%v].ports[%v].hostPort\", [beggining_of_path, format_int(i, 10), format_int(j, 10)]) | port = container.ports[j]; port.hostPort]\n\tcount(path) \u003e 0\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container has hostPort", + "remediation": "Make sure you do not configure hostPort for the container, if necessary use NodePort / ClusterIP", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Writable hostPath mount", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Persistence", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "devops", + "security-impact" + ], + "microsoftMitreColumns": [ + "Persistence", + "Lateral Movement" + ] + }, + "controlID": "C-0045", + "creationTime": "", + "description": "Mounting host directory to the container can be used by attackers to get access to the underlying host and gain persistence.", + "remediation": "Refrain from using the hostPath mount or use the exception mechanism to remove unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "alert-rw-hostpath", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Writable hostPath mount, Lateral Movement::Writable volume mounts on the host" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if container has a hostPath volume which is not readOnly\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := pod.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n podname := pod.metadata.name\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has: %v as hostPath volume\", [podname, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := wl.spec.template.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.template.spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t\n\t}\n}\n\n#handles CronJobs\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n volumes := wl.spec.jobTemplate.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k) \n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\n\tmsga := {\n\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\"packagename\": \"armo_builtins\",\n\t\"alertScore\": 7,\n\t\"fixPaths\": fixed_path,\n\t\"failedPaths\": failed_path,\n\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n\nis_rw_mount(mount, beggining_of_path, i, k) = [failed_path, fix_path] {\n\tnot mount.readOnly == true\n \tnot mount.readOnly == false\n\tfailed_path = \"\"\n fix_path = {\"path\": sprintf(\"%vcontainers[%v].volumeMounts[%v].readOnly\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]), \"value\":\"true\"}\n}\n\nis_rw_mount(mount, beggining_of_path, i, k) = [failed_path, fix_path] {\n \tmount.readOnly == false\n \tfailed_path = sprintf(\"%vcontainers[%v].volumeMounts[%v].readOnly\", [beggining_of_path, format_int(i, 10), format_int(k, 10)])\n fix_path = \"\"\n} ", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "cautils" + }, + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume with rw permissions", + "remediation": "Set the readOnly field of the mount to true", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Insecure capabilities", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0046", + "creationTime": "", + "description": "Giving insecure or excessive capabilities to a container can increase the impact of the container compromise. This control identifies all the PODs with dangerous capabilities (see documentation pages for details).", + "remediation": "Remove all insecure capabilities which are not necessary for the container.", + "rules": [ + { + "guid": "", + "name": "insecure-capabilities", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\nimport data.cautils as cautils\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v have dangerous capabilities\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in workload: %v have dangerous capabilities\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in cronjob: %v have dangerous capabilities\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_dangerous_capabilities(container, beggining_of_path, i) = path {\n\t# see default-config-inputs.json for list values\n insecureCapabilities := data.postureControlInputs.insecureCapabilities\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capability = container.securityContext.capabilities.add[k]; cautils.list_contains(insecureCapabilities, capability)]\n\tcount(path) \u003e 0\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.insecureCapabilities" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.insecureCapabilities", + "name": "Insecure capabilities", + "description": "You can see the list of capabilities in https://man7.org/linux/man-pages/man7/capabilities.7.html. Kubescape looks for the following capabilities in containers which might lead to attackers getting high privileges in your system." + } + ], + "description": "fails if container has insecure capabilities", + "remediation": "Remove all insecure capabilities which aren’t necessary for the container.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "HostPath mount", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ] + }, + "controlID": "C-0048", + "creationTime": "", + "description": "Mounting host directory to the container can be used by attackers to get access to the underlying host. This control identifies all the PODs using hostPath mount.", + "remediation": "Remove hostPath mounts unless they are absolutely necessary and use exception mechanism to remove notifications.", + "rules": [ + { + "guid": "", + "name": "alert-any-hostpath", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::hostPath mount" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.\"\n\tresult := is_dangerous_host_path(volume, beggining_of_path, i)\n podname := pod.metadata.name\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has: %v as hostPath volume\", [podname, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_dangerous_host_path(volume, beggining_of_path, i)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n#handles CronJobs\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n volumes := wl.spec.jobTemplate.spec.template.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n result := is_dangerous_host_path(volume, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_dangerous_host_path(volume, beggining_of_path, i) = path {\n startswith(volume.hostPath.path, \"/etc\")\n\tpath = sprintf(\"%vvolumes[%v].hostPath.path\", [beggining_of_path, format_int(i, 10)])\n}\n\nis_dangerous_host_path(volume, beggining_of_path, i) = path {\n startswith(volume.hostPath.path, \"/var\")\n\tpath = sprintf(\"%vvolumes[%v].hostPath.path\", [beggining_of_path, format_int(i, 10)])\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume", + "remediation": "Try to refrain from using hostPath mounts", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Network mapping", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery" + ] + }, + "controlID": "C-0049", + "creationTime": "", + "description": "If no network policy is defined, attackers who gain access to a single container may use it to probe the network. This control lists all namespaces in which no network policies are defined.", + "remediation": "Define network policies or use similar network protection mechanisms.", + "rules": [ + { + "guid": "", + "name": "internal-networking", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Container internal networking, Discovery::Network mapping" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: network policies\n# apiversion: networking.k8s.io/v1\n# fails if no network policies are defined in a certain namespace\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\tpolicy_names := [policy.metadata.namespace | policy = input[_]; policy.kind == \"NetworkPolicy\"]\n\tnot list_contains(policy_names, namespace.metadata.name)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "package armo_builtins\n\n# input: network policies + namespaces\n# apiversion: networking.k8s.io/v1\n# returns all namespaces\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Namespace" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "lists namespaces in which no network policies are defined", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Resources CPU limit and request", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "devops" + ] + }, + "controlID": "C-0050", + "creationTime": "", + "description": "This control identifies all Pods for which the CPU limit is not set.", + "remediation": "Set the CPU limit or use exception mechanism to avoid unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "resources-cpu-limit-and-request", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\n\n# Fails if pod does not have container with CPU-limit or request\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tnot request_or_limit_cpu(container)\n\n\tfixPaths := [{\"path\": sprintf(\"spec.containers[%v].resources.limits.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}, \n\t\t\t\t{\"path\": sprintf(\"spec.containers[%v].resources.requests.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have CPU-limit or request\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPaths,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload does not have container with CPU-limit or request\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n not request_or_limit_cpu(container)\n\n\tfixPaths := [{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.limits.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}, \n\t\t\t\t{\"path\": sprintf(\"spec.template.spec.containers[%v].resources.requests.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPaths,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob does not have container with CPU-limit or request\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n not request_or_limit_cpu(container)\n\n\tfixPaths := [{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.limits.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}, \n\t\t\t\t{\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].resources.requests.cpu\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}]\n\t\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPaths,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n\n###################################################################################################################\n\n# Fails if pod exceeds CPU-limit or request\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\trequest_or_limit_cpu(container)\n\tresource := is_min_max_exceeded_cpu(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v exceeds CPU-limit or request\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload exceeds CPU-limit or request\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\n\trequest_or_limit_cpu(container)\n\tresource := is_min_max_exceeded_cpu(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob doas exceeds CPU-limit or request\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\n\trequest_or_limit_cpu(container)\n \tresource := is_min_max_exceeded_cpu(container)\n\tresource != \"\"\n\n\tfailed_paths := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].%v\", [format_int(i, 10), resource])\n\t\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v exceeds CPU-limit or request\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [failed_paths],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n\n#################################################################################################################3\n\nrequest_or_limit_cpu(container) {\n\tcontainer.resources.limits.cpu\n\tcontainer.resources.requests.cpu\n}\n\n\nis_min_max_exceeded_cpu(container) = \"resources.limits.cpu\" {\n\tcpu_limit := container.resources.limits.cpu\n\tis_limit_exceeded_cpu(cpu_limit)\n} else = \"resouces.requests.cpu\" {\n\tcpu_req := container.resources.requests.cpu\n\tis_req_exceeded_cpu(cpu_req)\n} else = \"\"\n\n\nis_limit_exceeded_cpu(cpu_limit) {\n\tis_min_limit_exceeded_cpu(cpu_limit)\n}\n\nis_limit_exceeded_cpu(cpu_limit) {\n\tis_max_limit_exceeded_cpu(cpu_limit)\n}\n\nis_req_exceeded_cpu(cpu_req) {\n\tis_max_request_exceeded_cpu(cpu_req)\n}\n\nis_req_exceeded_cpu(cpu_req) {\n\tis_min_request_exceeded_cpu(cpu_req)\n}\n\nis_max_limit_exceeded_cpu(cpu_limit) {\n\tcpu_limit_max := data.postureControlInputs.cpu_limit_max[_]\n\tcompare_max(cpu_limit_max, cpu_limit)\n}\n\nis_min_limit_exceeded_cpu(cpu_limit) {\n\tcpu_limit_min := data.postureControlInputs.cpu_limit_min[_]\n\tcompare_min(cpu_limit_min, cpu_limit) \n}\n\nis_max_request_exceeded_cpu(cpu_req) {\n\tcpu_req_max := data.postureControlInputs.cpu_request_max[_]\n\tcompare_max(cpu_req_max, cpu_req)\n}\n\nis_min_request_exceeded_cpu(cpu_req) {\n\tcpu_req_min := data.postureControlInputs.cpu_request_min[_]\n\tcompare_min(cpu_req_min, cpu_req) \n}\n\n##############\n# helpers\n\n# Compare according to unit - max\ncompare_max(max, given) {\n\tendswith(max, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_max := split(max, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"M\")\n\tendswith(given, \"M\")\n\tsplit_max := split(max, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tendswith(max, \"m\")\n\tendswith(given, \"m\")\n\tsplit_max := split(max, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003e split_max\n}\n\ncompare_max(max, given) {\n\tnot is_special_measure(max)\n\tnot is_special_measure(given)\n\tgiven \u003e max\n}\n\n\n\n################\n# Compare according to unit - min\ncompare_min(min, given) {\n\tendswith(min, \"Mi\")\n\tendswith(given, \"Mi\")\n\tsplit_min := split(min, \"Mi\")[0]\n\tsplit_given := split(given, \"Mi\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"M\")\n\tendswith(given, \"M\")\n\tsplit_min := split(min, \"M\")[0]\n\tsplit_given := split(given, \"M\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tendswith(min, \"m\")\n\tendswith(given, \"m\")\n\tsplit_min := split(min, \"m\")[0]\n\tsplit_given := split(given, \"m\")[0]\n\tsplit_given \u003c split_min\n}\n\ncompare_min(min, given) {\n\tnot is_special_measure(min)\n\tnot is_special_measure(given)\n\tgiven \u003c min\n}\n\n\n# Check that is same unit\nis_special_measure(unit) {\n\tendswith(unit, \"m\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"M\")\n}\n\nis_special_measure(unit) {\n\tendswith(unit, \"Mi\")\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.cpu_request_max", + "settings.postureControlInputs.cpu_request_min", + "settings.postureControlInputs.cpu_limit_min", + "settings.postureControlInputs.cpu_limit_max" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.cpu_request_max", + "name": "cpu_request_max", + "description": "Ensure CPU max requests are set" + }, + { + "path": "settings.postureControlInputs.cpu_request_min", + "name": "cpu_request_min", + "description": "Ensure CPU min requests are set" + }, + { + "path": "settings.postureControlInputs.cpu_limit_max", + "name": "cpu_limit_max", + "description": "Ensure CPU max limits are set" + }, + { + "path": "settings.postureControlInputs.cpu_limit_min", + "name": "cpu_limit_min", + "description": "Ensure CPU min limits are set" + } + ], + "description": "CPU limits and requests are not set.", + "remediation": "Ensure CPU limits and requests are set.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Instance Metadata API", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Discovery", + "Impact - service access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery" + ] + }, + "controlID": "C-0052", + "creationTime": "", + "description": "Attackers who gain access to a container, may query the metadata API service for getting information about the underlying node. This control checks if there is access from the nodes to cloud providers instance metadata services.", + "remediation": "Disable metadata services for pods in cloud provider settings.", + "rules": [ + { + "guid": "", + "name": "instance-metadata-api-access", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true", + "m$K8sThreatMatrix": "Credential Access::Instance Metadata API" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msg] {\n\tobj = input[_]\n\tis_cloud_provider_info(obj)\n\n\tobj.data.providerMetaDataAPIAccess == true\n\n\n\tmsg := {\n\t\t\"alertMessage\": sprintf(\"Node '%s' has access to Instance Metadata Services of cloud provider.\", [obj.metadata.name]),\n\t\t\"alert\": true,\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"externalObjects\": obj\n\t\t},\n\t\t\"packagename\": \"armo_builtins\"\n\t}\n\n}\n\n\n\nis_cloud_provider_info(obj) {\n\tobj.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\tobj.kind == \"cloudProviderInfo\"\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "cloudProviderInfo" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Checks if there is access from the nodes to cloud prividers instance metadata services", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Access container service account", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Impact - K8s API access" + ] + } + ], + "controlTypeTags": [ + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Credential access" + ], + "rbacQuery": "Container service account mapping" + }, + "controlID": "C-0053", + "creationTime": "", + "description": "Attackers who obtain access to a pod can use its SA token to communicate with KubeAPI server. All PODs with SA token mounted (if such token has a Role or a ClusterRole binding) are considerred potentially dangerous.", + "remediation": "Verify that RBAC is enabled. Follow the least privilege principle and ensure that only necessary PODs have SA token mounted into them.", + "rules": [ + { + "guid": "", + "name": "access-container-service-account-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential Access::Access container service account, Lateral Movement::Container service account", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Returns the rbac permission of each service account\ndeny[msga] {\n subjectVector := input[_]\n subjectVector.kind == \"ServiceAccount\"\n \n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n subject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service account: %v has the following permissions in the cluster\", [subjectVector.name]),\n\t\t\"packagename\": \"armo_builtins\",\n \"failedPaths\": [],\n \"fixPaths\":[],\n\t\t\"alertScore\": 7,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": subjectVector\n\t\t}\n\t}\n}\n\n# ===============================================================\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}", + "resourceEnumerator": "package armo_builtins\n\n\n# Returns the rbac permission of each service account\ndeny[msga] {\n subjectVector := input[_]\n subjectVector.kind == \"ServiceAccount\"\n \n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n subject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service account: %v has the following permissions in the cluster\", [subjectVector.name]),\n\t\t\"packagename\": \"armo_builtins\",\n \"failedPaths\": [],\n \"fixPaths\":[],\n\t\t\"alertScore\": 7,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": subjectVector\n\t\t}\n\t}\n}\n\n# ===============================================================\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "rbac.authorization.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "RoleBinding", + "ClusterRoleBinding", + "Role", + "ClusterRole" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which service accounts can be used to access other resources in the cluster", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Cluster internal networking", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery", + "Lateral movement" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Lateral movement" + ] + }, + "controlID": "C-0054", + "creationTime": "", + "description": "If no network policy is defined, attackers who gain access to a container may use it to move laterally in the cluster. This control lists namespaces in which no network policy is defined.", + "remediation": "Define Kubernetes network policies or use alternative products to protect cluster network.", + "rules": [ + { + "guid": "", + "name": "internal-networking", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Container internal networking, Discovery::Network mapping" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: network policies\n# apiversion: networking.k8s.io/v1\n# fails if no network policies are defined in a certain namespace\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\tpolicy_names := [policy.metadata.namespace | policy = input[_]; policy.kind == \"NetworkPolicy\"]\n\tnot list_contains(policy_names, namespace.metadata.name)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "package armo_builtins\n\n# input: network policies + namespaces\n# apiversion: networking.k8s.io/v1\n# returns all namespaces\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Namespace" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "lists namespaces in which no network policies are defined", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Linux hardening", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0055", + "creationTime": "", + "description": "Containers may be given more privileges than they actually need. This can increase the potential impact of a container compromise.", + "remediation": "You can use AppArmor, Seccomp, SELinux and Linux Capabilities mechanisms to restrict containers abilities to utilize unwanted privileges.", + "rules": [ + { + "guid": "", + "name": "linux-hardening", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# Fails if pod does not define linux security hardening \ndeny[msga] {\n\tobj := input[_]\n\tfix_paths := is_unsafe_obj(obj)\n\tcount(fix_paths) \u003e 0\n\n\t# final_fix_pathes := array.concat(fix_paths) # -\u003e produce only one failed result\n\tfinal_fix_pathes := fix_paths[_] # -\u003e produce failed result for each container\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%s: %s does not define any linux security hardening\", [obj.kind, obj.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": final_fix_pathes,\n\t\t\"alertObject\": {\"k8sApiObjects\": [obj]},\n\t}\n}\n\nis_unsafe_obj(obj) := fix_paths {\n\tobj.kind == \"Pod\"\n\tfix_paths := are_unsafe_specs(obj, [\"spec\"], [\"metadata\", \"annotations\"])\n} else := fix_paths {\n\tobj.kind == \"CronJob\"\n\tfix_paths := are_unsafe_specs(obj, [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"spec\"], [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"metadata\", \"annotations\"])\n} else := fix_paths {\n\tobj.kind in [\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\"]\n\tfix_paths := are_unsafe_specs(obj, [\"spec\", \"template\", \"spec\"], [\"spec\", \"template\", \"metadata\", \"annotations\"])\n}\n\nare_unsafe_specs(obj, specs_path, anotation_path) := paths {\n\t# spec\n\tspecs := object.get(obj, specs_path, null)\n\tspecs != null\n\tare_seccomp_and_selinux_disabled(specs)\n\n\t# annotation\n\tannotations := object.get(obj, anotation_path, [])\n\tapp_armor_annotations := [annotations[i] | annotation = i; startswith(i, \"container.apparmor.security.beta.kubernetes.io\")]\n\tcount(app_armor_annotations) == 0\n\n\t# container\n\tcontainers_path := array.concat(specs_path, [\"containers\"])\n\tcontainers := object.get(obj, containers_path, [])\n\n\t# Psuedo code explanation:\n\t# for i, container in containers\n\t# \t\tif is_unsafe_container:\n\t# \t\t\tfix_paths += [(containers_path[i] + field) for j, field in fix_fields]\n\t# \n\t# At the end we get [[\u003ccontainer1_path1\u003e, \u003ccontainer1_path2\u003e, ...], ...]\n\tcontainers_fix_path := concat(\".\", containers_path)\n\tfix_fields := [\"seccompProfile\", \"seLinuxOptions\", \"capabilities.drop[0]\"]\n\tpaths := [[{\n\t\t\"path\": sprintf(\"%s[%d].securityContext.%s\", [containers_fix_path, i, field]),\n\t\t\"value\": \"YOUR_VALUE\",\n\t} |\n\t\tfield := fix_fields[j]\n\t] |\n\t\tcontainer = containers[i]\n\t\tis_unsafe_container(container)\n\t]\n\n\tcount(paths) \u003e 0\n}\n\nare_seccomp_and_selinux_disabled(obj) {\n\tnot obj.securityContext.seccompProfile\n\tnot obj.securityContext.seLinuxOptions\n}\n\nis_unsafe_container(container) {\n\tare_seccomp_and_selinux_disabled(container)\n\tnot container.securityContext.capabilities.drop\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container does not define any linux security hardening", + "remediation": "Make sure you define at least one linux security hardening property out of Seccomp, SELinux or Capabilities.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Configured liveness probe", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0056", + "creationTime": "", + "description": "Liveness probe is intended to ensure that workload remains healthy during its entire execution lifecycle, or otherwise restrat the container. It is highly recommended to define liveness probe for every worker container. This control finds all the PODs where the Liveness probe is not configured.", + "remediation": "Ensure Liveness probes are configured wherever possible.", + "rules": [ + { + "guid": "", + "name": "configured-liveness-probe", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if container does not have livenessProbe - for pod\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tnot container.livenessProbe\n\tfix_path := {\"path\": sprintf(\"spec.containers[%v].livenessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v does not have livenessProbe\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if container does not have livenessProbe - for wl\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n not container.livenessProbe\n\tfix_path := {\"path\": sprintf(\"spec.template.spec.containers[%v].livenessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have livenessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if container does not have livenessProbe - for cronjob\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n not container.livenessProbe\n\tfix_path := {\"path\": sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].livenessProbe\", [format_int(i, 10)]), \"value\": \"YOUR_VALUE\"}\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v does not have livenessProbe\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"fixPaths\": [fix_path],\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Liveness probe is not configured", + "remediation": "Ensure Liveness probe is configured", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Privileged container", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ] + }, + "controlID": "C-0057", + "creationTime": "", + "description": "Potential attackers may gain access to privileged containers and inherit access to the host resources. Therefore, it is not recommended to deploy privileged containers unless it is absolutely necessary. This control identifies all the privileged Pods.", + "remediation": "Remove privileged capabilities by setting the securityContext.privileged to false. If you must deploy a Pod as privileged, add other restriction to it, such as network policy, Seccomp etc and still remove all unnecessary capabilities. Use the exception mechanism to remove unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "rule-privilege-escalation", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::privileged container", + "mitre": "Privilege Escalation", + "mitreCode": "TA0004" + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n#privileged pods\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following pods are defined as privileged: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is defined as privileged:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined as privileged: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n\n# Only SYS_ADMIN capabilite\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tnot container.securityContext.privileged == true\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path) \u003e 0\n}\n\n# Only securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tcontainer.securityContext.privileged == true\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003c 1\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])]\n}\n\n# SYS_ADMIN capabilite \u0026\u0026 securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003e 0\n\tcontainer.securityContext.privileged == true\n\tpath = array.concat(path1, [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])])\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if pods/deployments defined as privileged true", + "remediation": "avoid defining pods as privilleged", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Persistence", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0058", + "creationTime": "", + "description": "A user may be able to create a container with subPath or subPathExpr volume mounts to access files \u0026 directories anywhere on the host filesystem. Following Kubernetes versions are affected: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. This control checks the vulnerable versions and the actual usage of the subPath feature in all Pods in the cluster. If you want to learn more about the CVE, please refer to the CVE link: https://nvd.nist.gov/vuln/detail/CVE-2021-25741", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, or remove any existing Pods using subPath or subPathExpr feature.", + "rules": [ + { + "guid": "", + "name": "Symlink-Exchange-Can-Allow-Host-Filesystem-Access", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in pod : %v with subPath/subPathExpr\", [container.name, pod.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\nis_sub_path_container(container, i, beggining_of_path) = path {\n\tpath = [sprintf(\"%vcontainers[%v].volumeMounts[%v].subPath\" ,[beggining_of_path, format_int(i, 10), format_int(j, 10)]) | volume_mount = container.volumeMounts[j]; volume_mount.subPath]\n\tcount(path) \u003e 0\n}\n\nis_vulnerable_version(version) {\n version \u003c= \"v1.19.14\"\n}\n\nis_vulnerable_version(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nis_vulnerable_version(version){\n\tversion == \"v1.20.10\"\n}\n\n\n", + "resourceEnumerator": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n pod := input[_]\n pod.kind == \"Pod\"\n\n\tmsga := {\n\t\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n \n\tmsga := {\n\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\twl.kind == \"CronJob\"\n \n\tmsga := {\n\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\nisVulnerableVersion(version) {\n version \u003c= \"v1.19.14\"\n}\n\nisVulnerableVersion(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nisVulnerableVersion(version){\n\tversion == \"v1.20.10\"\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Node" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "A user may be able to create a container with subPath volume mounts to access files \u0026 directories outside of the volume, including on the host filesystem. This was affected at the following versions: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. ", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, and remove any existing Pods making use of the feature.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0059", + "creationTime": "", + "description": "Security issue in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster (see more at https://github.com/kubernetes/ingress-nginx/issues/7837)", + "remediation": "To mitigate this vulnerability: 1. Upgrade to a version that allows mitigation (\u003e= v0.49.1 or \u003e= v1.0.1), 2. Set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx", + "rules": [ + { + "guid": "", + "name": "nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tis_nginx_image(image)\n\tis_tag_image(image)\n\n\t# Extracting version from image tag\n\ttag_version_match := regex.find_all_string_submatch_n(\"[0-9]+\\\\.[0-9]+\\\\.[0-9]+\", image, -1)[0][0]\n image_version_str_arr := split(tag_version_match,\".\")\n\timage_version_arr := [to_number(image_version_str_arr[0]),to_number(image_version_str_arr[1]),to_number(image_version_str_arr[2])]\n\n\t# Check if vulnerable \n\tis_vulnerable(image_version_arr, deployment.metadata.namespace)\n\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. Deployment %v\", [deployment.metadata.name]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nis_nginx_image(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nis_allow_snippet_annotation_on(namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmap_on_ingress_namespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfig_maps_with_snippet := [configmap | configmap= configmap_on_ingress_namespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(config_maps_with_snippet) \u003c 1\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] \u003c 49\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] == 49\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\t\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 1\n\timage_version[1] == 0\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tisNginxImage(image)\n\tis_tag_image(image)\n\tisVulnerable(image, deployment.metadata.namespace)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. %v\", [deployment]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nisNginxImage(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag \u003c= \"v0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag == \"v1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag \u003c= \"v0.49\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag == \"v1.0.0\"\n}\n\n###### without 'v'\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag \u003c= \"0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag \u003c= \"0.49\"\n}\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmapOnIngressNamespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfigMapsWithSnippet := [configmap | configmap= configmapOnIngressNamespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(configMapsWithSnippet) \u003c 1\n}\n\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Deployment", + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Pods in default namespace", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "devops" + ] + }, + "controlID": "C-0061", + "creationTime": "", + "description": "It is recommended to avoid running PODs in cluster without explicit namespace assignment. This control identifies all the PODs running in the default namespace.", + "remediation": "Create necessary namespaces and move all the PODs from default namespace there.", + "rules": [ + { + "guid": "", + "name": "pods-in-default-namespace", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\", \"Job\", \"CronJob\", \"Pod\"}\n\tspec_template_spec_patterns[wl.kind]\n\tresult := is_default_namespace(wl.metadata)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has pods running in the 'default' namespace\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_default_namespace(metadata) = [failed_path, fixPath] {\n\tmetadata.namespace == \"default\"\n\tfailed_path = \"metadata.namespace\"\n\tfixPath = \"\" \n}\n\nis_default_namespace(metadata) = [failed_path, fixPath] {\n\tnot metadata.namespace\n\tfailed_path = \"\"\n\tfixPath = {\"path\": \"metadata.namespace\", \"value\": \"YOUR_NAMESPACE\"} \n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Sudo in container entrypoint", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0062", + "creationTime": "", + "description": "Adding sudo to a container entry point command may escalate process privileges and allow access to forbidden resources. This control checks all the entry point commands in all containers in the POD to find those that have sudo command.", + "remediation": "Remove sudo from the command line and use Kubernetes native root and capabilities controls to provide necessary privileges where they are required.", + "rules": [ + { + "guid": "", + "name": "sudo-in-container-entrypoint", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_sudo_entrypoint(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v have sudo in entrypoint\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": result,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_sudo_entrypoint(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in %v: %v have sudo in entrypoint\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": result,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_sudo_entrypoint(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in cronjob: %v have sudo in entrypoint\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": result,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_sudo_entrypoint(container, beggining_of_path, i) = path {\n\tpath = [sprintf(\"%vcontainers[%v].command[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | command = container.command[k]; contains(command, \"sudo\")]\n\tcount(path) \u003e 0\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Portforwarding privileges", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Discovery", + "Lateral movement" + ] + } + ], + "controlTypeTags": [ + "security-impact", + "compliance" + ], + "rbacQuery": "Port Forwarding" + }, + "controlID": "C-0063", + "creationTime": "", + "description": "Attackers with relevant RBAC permission can use “kubectl portforward” command to establish direct communication with PODs from within the cluster or even remotely. Such communication will most likely bypass existing security measures in the cluster. This control determines which subjects have permissions to use this command.", + "remediation": "It is recommended to prohibit “kubectl portforward” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.", + "rules": [ + { + "guid": "", + "name": "rule-can-portforward-v1", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"create\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"pods/portforward\", \"pods/*\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can do port forwarding\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "No impersonation", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "rbacQuery": "Impersonation" + }, + "controlID": "C-0065", + "creationTime": "", + "description": "Impersonation is an explicit RBAC permission to use other roles rather than the one assigned to a user, group or service account. This is sometimes needed for testing purposes. However, it is highly recommended not to use this capability in the production environments for daily operations. This control identifies all subjects whose roles include impersonate verb.", + "remediation": "Either remove the impersonate verb from the role where it was found or make sure that this role is not bound to users, groups or service accounts used for ongoing cluster operations. If necessary, bind this role to a subject only for specific needs for limited time period.", + "rules": [ + { + "guid": "", + "name": "rule-can-impersonate-users-groups-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Discovery::Access the K8s API server", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"impersonate\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"users\", \"serviceaccounts\", \"groups\", \"uids\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can impersonate users\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can impersonate users/groups", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Secret/ETCD encryption enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Impact" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0066", + "creationTime": "", + "description": "All Kubernetes Secrets are stored primarily in etcd therefore it is important to encrypt it.", + "remediation": "Turn on the etcd encryption in your cluster, for more see the vendor documentation.", + "rules": [ + { + "guid": "", + "name": "secret-etcd-encryption-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Check if encryption in etcd in enabled for AKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"management.azure.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"aks\"\t\n\tconfig = cluster_config.data\n\n\tnot isEncryptedAKS(config)\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"az aks nodepool add --name hostencrypt --cluster-name \u003cmyAKSCluster\u003e --resource-group \u003cmyResourceGroup\u003e -s Standard_DS2_v2 -l \u003cmyRegion\u003e --enable-encryption-at-host\",\n\t\t\"alertObject\": {\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n# Check if encryption in etcd in enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"eks\"\t\n\tconfig = cluster_config.data\n\n\tis_not_encrypted_EKS(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"eksctl utils enable-secrets-encryption --cluster=\u003ccluster\u003e --key-arn=arn:aws:kms:\u003ccluster_region\u003e:\u003caccount\u003e:key/\u003ckey\u003e --region=\u003cregion\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n\n# Check if encryption in etcd in enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n\n\tnot is_encrypted_GKE(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"data.database_encryption.state\"],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud container clusters update \u003ccluster_name\u003e --region=\u003ccompute_region\u003e --database-encryption-key=\u003ckey_project_id\u003e/locations/\u003clocation\u003e/keyRings/\u003cring_name\u003e/cryptoKeys/\u003ckey_name\u003e --project=\u003ccluster_project_id\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"1\"\n}\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"ENCRYPTED\"\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n goodResources := [resource | resource = cluster_config.Cluster.EncryptionConfig.Resources[_]; resource == \"secrets\"]\n\tcount(goodResources) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcluster_config.Cluster.EncryptionConfig == null\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcount(cluster_config.Cluster.EncryptionConfig) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n count(encryptionConfig.Resources) == 0\n}\n\nisEncryptedAKS(cluster_config) {\n\tcluster_config.properties.agentPoolProfiles.enableEncryptionAtHost == true\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "management.azure.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "container.googleapis.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "AKS", + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "etcd-encryption-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport data.cautils as cautils\n\n# Check if encryption in etcd is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n\tcmd := apiserverpod.spec.containers[0].command\n\tenc_command := [command | command := cmd[_]; contains(command, \"--encryption-provider-config=\")]\n\tcount(enc_command) \u003c 1\n\tfixpath := {\"path\":sprintf(\"spec.containers[0].command[%d]\", [count(cmd)]), \"value\": \"--encryption-provider-config=YOUR_VALUE\"}\n\n\tmsga := {\n\t\t\"alertMessage\": \"etcd encryption is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [fixpath],\n\t\t\"alertObject\": {\"k8sApiObjects\": [apiserverpod]},\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Audit logs enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Defense evasion - KubeAPI" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0067", + "creationTime": "", + "description": "Audit logging is an important security feature in Kubernetes, it enables the operator to track requests to the cluster. It is important to use it so the operator has a record of events happened in Kubernetes", + "remediation": "Turn on audit logging for your cluster. Look at the vendor guidelines for more details", + "rules": [ + { + "guid": "", + "name": "k8s-audit-logs-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.every\n\n# =============================== GKE ===============================\n# Check if audit logs is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"gke\"\n\tconfig := cluster_config.data\n\n\t# If enableComponents is empty, it will disable logging\n\t# https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#loggingcomponentconfig\n\tis_logging_disabled(config)\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nis_logging_disabled(cluster_config) {\n\tnot cluster_config.logging_config.component_config.enable_components\n}\n\nis_logging_disabled(cluster_config) {\n\tcluster_config.logging_config.component_config.enable_components\n\tcount(cluster_config.logging_config.component_config.enable_components) == 0\n}\n\n# =============================== EKS ===============================\n# Check if audit logs is enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"eks\"\n\tconfig := cluster_config.data\n\n\t# logSetup is an object representing the enabled or disabled Kubernetes control plane logs for your cluster.\n\t# types - available cluster control plane log types\n\t# https://docs.aws.amazon.com/eks/latest/APIReference/API_LogSetup.html\n\tlogging_types := {\"api\", \"audit\", \"authenticator\", \"controllerManager\", \"scheduler\"}\n\tlogSetups = config.Cluster.Logging.ClusterLogging\n\tnot all_auditlogs_enabled(logSetups, logging_types)\n\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixCommand\": \"aws eks update-cluster-config --region '${REGION_CODE}' --name '${CLUSTER_NAME}' --logging '{'clusterLogging':[{'types':['api','audit','authenticator','controllerManager','scheduler'],'enabled':true}]}'\",\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nall_auditlogs_enabled(logSetups, types) {\n\tevery type in types {\n\t\tauditlogs_enabled(logSetups, type)\n\t}\n}\n\nauditlogs_enabled(logSetups, type) {\n\tlogSetup := logSetups[_]\n\tlogSetup.Enabled == true\n\tlogSetup.Types[_] == type\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "k8s-audit-logs-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command\n\taudit_policy := [ command |command := cmd[_] ; contains(command, \"--audit-policy-file=\")]\n count(audit_policy) \u003c 1\n\tpath := \"spec.containers[0].command\"\t\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "PSP enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0068", + "creationTime": "", + "description": "PSP enable fine-grained authorization of pod creation and it is important to enable it", + "remediation": "Turn Pod Security Policies on in your cluster, if you use other admission controllers to control the behavior that PSP controls, exclude this control from your scans", + "rules": [ + { + "guid": "", + "name": "psp-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if PSP is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n not config.pod_security_policy_config.enabled == true\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"pod security policy configuration is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud beta container clusters update \u003ccluster_name\u003e --enable-pod-security-policy\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "psp-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command[j]\n contains(cmd, \"--enable-admission-plugins=\")\n output := split(cmd, \"=\")\n not contains(output[1], \"PodSecurityPolicy\")\n\tpath := sprintf(\"spec.containers[0].command[%v]\", [format_int(j, 10)])\t\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"PodSecurityPolicy is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 1 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Disable anonymous access to Kubelet service", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0069", + "creationTime": "", + "description": "By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.", + "remediation": "Start the kubelet with the --anonymous-auth=false flag.", + "rules": [ + { + "guid": "", + "name": "anonymous-requests-to-kubelet-service-updated", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n#CIS 4.2.1 https://workbench.cisecurity.org/sections/1126668/recommendations/1838638\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tcontains(command, \"--anonymous-auth\")\n\tcontains(command, \"--anonymous-auth=true\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tnot contains(command, \"--config\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tdecodedConfigContent := base64.decode(obj.data.configFile.content)\n\tyamlConfig := yaml.unmarshal(decodedConfigContent)\n\tnot yamlConfig.authentication.anonymous.enabled == false\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [\"authentication.anonymous.enabled\"],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"metadata\": obj.metadata,\n\t\t\t\"data\": {\"configFile\": {\"content\": decodedConfigContent}},\n\t\t}},\n\t}\n}\n\n## Host sensor failed to get config file content\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tnot obj.data.configFile.content\n\n\tmsga := {\n\t\t\"alertMessage\": \"Failed to analyze config file\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"data\": obj.data,\n\t\t}},\n\t}\n}\n\nis_kubelet_info(obj) {\n\tobj.kind == \"KubeletInfo\"\n\tobj.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletInfo" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if anonymous requests to the kubelet service are allowed.", + "remediation": "Disable anonymous requests by setting the anonymous-auth flag to false, or using the kubelet configuration file.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 10 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Enforce Kubelet client TLS authentication", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0070", + "creationTime": "", + "description": "Kubelets are the node level orchestrator in Kubernetes control plane. They are publishing service port 10250 where they accept commands from API server. Operator must make sure that only API server is allowed to submit commands to Kubelet. This is done through client certificate verification, must configure Kubelet with client CA file to use for this purpose.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "rules": [ + { + "guid": "", + "name": "enforce-kubelet-client-tls-authentication", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.kubernetes.api.client as client\n\n# Both config and cli present\ndeny[msga] {\n\t\tkubelet_config := input[_]\n\t\tkubelet_config.kind == \"KubeletConfiguration\"\n\t\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\t\tkubelet_cli := input[_] \n\t\tkubelet_cli.kind == \"KubeletCommandLine\"\n\t\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\t\tkubelet_cli_data := kubelet_cli.data\n\n\t\tresult := is_client_tls_disabled_both(kubelet_config, kubelet_cli_data)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [kubelet_config, kubelet_cli]\n\t\t\t},\n\t\t}\n\t}\n\n\n# Only of them present\ndeny[msga] {\n\t\tresult := is_client_tls_disabled_single(input)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [external_obj]\n\t\t\t},\n\t\t}\n\t}\n\n# CLI overrides config\nis_client_tls_disabled_both(kubelet_config, kubelet_cli_data) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n not kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\n# Only cli\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": []} {\n\tkubelet_cli := resources[_] \n\tkubelet_cli.kind == \"KubeletCommandLine\"\n\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_config := [config | config = resources[_]; config.kind == \"KubeletConfiguration\"]\n\tcount(kubelet_config) == 0\n\n\tobj = isClientTlsDisabledCli(kubelet_cli)\n\t\n}\n\n# Only config\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tkubelet_config := resources[_] \n\tkubelet_config.kind == \"KubeletConfiguration\"\n\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_cmd := [cmd | cmd = resources[_]; cmd.kind == \"KubeletCommandLine\"]\n\tcount(kubelet_cmd) == 0\n\n\tobj = is_Client_tls_disabled_config(kubelet_config)\n}\n\n\nis_Client_tls_disabled_config(kubelet_config) = obj {\n\tnot kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\nisClientTlsDisabledCli(kubelet_cli) = obj {\n\tkubelet_cli_data = kubelet_cli.data\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n\tobj = kubelet_cli\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletConfiguration", + "KubeletCommandLine" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "cautils" + }, + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if kubelet client tls authentication is enabled.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Naked PODs", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0073", + "creationTime": "", + "description": "It is not recommended to create PODs without parental Deployment, ReplicaSet, StatefulSet etc.Manual creation if PODs may lead to a configuration drifts and other untracked changes in the system. Such PODs won't be automatically rescheduled by Kubernetes in case of a crash or infrastructure failure. This control identifies every POD that does not have corresponding parental object.", + "remediation": "Create necessary Deployment object for every POD making any POD a first class citizen in your IaC architecture.", + "rules": [ + { + "guid": "", + "name": "naked-pods", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if workload is Pod\ndeny[msga] {\n pod := input[_]\n\tpod.kind == \"Pod\"\n\tnot pod.metadata.ownerReferences\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v not associated with ReplicaSet or Deployment\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [{\"path\": \"metadata.ownerReferences\", \"value\": \"YOUR_VALUE\"}],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Don't use naked Pods (that is, Pods not bound to a ReplicaSet or Deployment) if you can avoid it. Naked Pods will not be rescheduled in the event of a node failure.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Containers mounting Docker socket", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0074", + "creationTime": "", + "description": "Mounting Docker socket (Unix socket) enables container to access Docker internals, retrieve sensitive information and execute Docker commands, if Docker runtime is available. This control identifies PODs that attempt to mount Docker socket for accessing Docker runtime.", + "remediation": "Remove docker socket mount request or define an exception.", + "rules": [ + { + "guid": "", + "name": "containers-mounting-docker-socket", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volume := pod.spec.volumes[i]\n\thost_path := volume.hostPath\n is_docker_mounting(host_path)\n\tpath := sprintf(\"spec.volumes[%v].hostPath.path\", [format_int(i, 10)])\n msga := {\n\t\t\"alertMessage\": sprintf(\"volume: %v in pod: %v has mounting to Docker internals.\", [volume.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertScore\": 5,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\t\n}\n\n\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volume := wl.spec.template.spec.volumes[i]\n\thost_path := volume.hostPath\n is_docker_mounting(host_path)\n\tpath := sprintf(\"spec.template.spec.volumes[%v].hostPath.path\", [format_int(i, 10)])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"volume: %v in %v: %v has mounting to Docker internals.\", [ volume.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertScore\": 5,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tvolume = wl.spec.jobTemplate.spec.template.spec.volumes[i]\n host_path := volume.hostPath\n is_docker_mounting(host_path)\n\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.volumes[%v].hostPath.path\", [format_int(i, 10)])\n msga := {\n\t\t\"alertMessage\": sprintf(\"volume: %v in %v: %v has mounting to Docker internals.\", [ volume.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertScore\": 5,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\nis_docker_mounting(host_path) {\n\thost_path.path == \"/var/run/docker.sock\"\n}\n\nis_docker_mounting(host_path) {\n\thost_path.path == \"/var/run/docker\"\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Check hostpath. If the path is set to /var/run/docker.sock or /var/lib/docker , the container has access to Docker internals - fail.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Image pull policy on latest tag", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0075", + "creationTime": "", + "description": "While usage of the latest tag is not generally recommended, in some cases this is necessary. If it is, the ImagePullPolicy must be set to Always, otherwise Kubernetes may run an older image with the same name that happens to be present in the node cache. Note that using Always will not cause additional image downloads because Kubernetes will check the image hash of the local local against the registry and only pull the image if this hash has changed, which is exactly what users want when use the latest tag. This control will identify all PODs with latest tag that have ImagePullSecret not set to Always.", + "remediation": "Set ImagePullPolicy to Always in all PODs found by this control.", + "rules": [ + { + "guid": "", + "name": "image-pull-policy-is-not-set-to-always", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n is_bad_container(container)\n\tpaths = [sprintf(\"spec.containers[%v].image\", [format_int(i, 10)]), sprintf(\"spec.containers[%v].imagePullPolicy\", [format_int(i, 10)])]\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v has 'latest' tag on image but imagePullPolicy is not set to 'Always'\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": paths,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tpaths = [sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)]), sprintf(\"spec.template.spec.containers[%v].imagePullPolicy\", [format_int(i, 10)])]\n is_bad_container(container)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in %v: %v has 'latest' tag on image but imagePullPolicy is not set to 'Always'\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": paths,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tpaths = [sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].image\", [format_int(i, 10)]), sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].imagePullPolicy\", [format_int(i, 10)])]\n is_bad_container(container)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in cronjob: %v has 'latest' tag on image but imagePullPolicy is not set to 'Always'\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": paths,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# image tag is latest\nis_bad_container(container){\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, container.image, -1)\n v := version[_]\n img := v[_]\n img == \":latest\"\n not_image_pull_policy(container)\n}\n\n# No image tag or digest (== latest)\nis_bad_container(container){\n not is_tag_image(container.image)\n not_image_pull_policy(container)\n}\n\n# image tag is only letters (== latest)\nis_bad_container(container){\n is_tag_image_only_letters(container.image)\n not_image_pull_policy(container)\n}\n\nnot_image_pull_policy(container) {\n container.imagePullPolicy == \"Never\"\n}\n\n\nnot_image_pull_policy(container) {\n container.imagePullPolicy == \"IfNotPresent\"\n}\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}\n\n# The image has a tag, and contains only letters\nis_tag_image_only_letters(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n\treg1 := \"^:[a-zA-Z]{1,127}$\"\n\tre_match(reg1, img)\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "check imagePullPolicy filed, if imagePullPolicy = always pass, else fail.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Label usage for resources", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0076", + "creationTime": "", + "description": "It is recommended to set labels that identify semantic attributes of your application or deployment. For example, { app: myapp, tier: frontend, phase: test, deployment: v3 }. These labels can used to assign policies to logical groups of the deployments as well as for presentation and tracking purposes. This control helps you find deployments without any of the expected labels.", + "remediation": "Define labels that are most suitable to your needs of use the exceptions to prevent further notifications.", + "rules": [ + { + "guid": "", + "name": "label-usage-for-resources", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tfixPath := no_label_or_no_label_usage(pod, \"\")\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"in the following pods a certain set of labels is not defined: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tpodSpec := wl.spec.template\n\tbeggining_of_pod_path := \"spec.template.\"\n\tfixPath := no_label_usage(wl, podSpec, beggining_of_pod_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v a certain set of labels is not defined:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tpodSpec := wl.spec.jobTemplate.spec.template\n\tbeggining_of_pod_path := \"spec.jobTemplate.spec.template.\"\n\tfixPath := no_label_usage(wl, podSpec, beggining_of_pod_path)\n\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs a certain set of labels is not defined: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n# There is no label-usage in WL and also for his Pod\nno_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tpath1 := no_label_or_no_label_usage(wl, \"\")\n\tpath2 := no_label_or_no_label_usage(podSpec, beggining_of_pod_path)\n\tpath = array.concat(path1, path2)\n}\n \n# There is label-usage for WL but not for his Pod\nno_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_label_or_no_label_usage(wl, \"\")\n\tpath := no_label_or_no_label_usage(podSpec, beggining_of_pod_path)\n}\n\n# There is no label-usage for WL but there is for his Pod\nno_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_label_or_no_label_usage(podSpec, beggining_of_pod_path)\n\tpath := no_label_or_no_label_usage(wl, \"\")\n}\n\nno_label_or_no_label_usage(wl, beggining_of_path) = path{\n\tnot wl.metadata\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_label_or_no_label_usage(wl, beggining_of_path) = path{\n\tmetadata := wl.metadata\n\tnot metadata.labels\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_label_or_no_label_usage(wl, beggining_of_path) = path{\n\tlabels := wl.metadata.labels\n\tnot is_desired_label(labels)\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nis_desired_label(labels) {\n\trecommended_labels := data.postureControlInputs.recommendedLabels\n\trecommended_label := recommended_labels[_]\n\tlabels[recommended_label]\n}\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Pod", + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet", + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.recommendedLabels" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.recommendedLabels", + "name": "Recommended Labels", + "description": "Kubescape checks that workloads have at least one of the following labels." + } + ], + "description": "check if a certain set of labels is defined, this is a configurable control. Initial list: app, tier, phase, version, owner, env.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "K8s common labels usage", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "devops" + ] + }, + "controlID": "C-0077", + "creationTime": "", + "description": "Kubernetes common labels help manage and monitor Kubernetes cluster using different tools such as kubectl, dashboard and others in an interoperable way. Refer to https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ for more information. This control helps you find objects that don't have any of these labels defined.", + "remediation": "Define applicable labels or use the exception mechanism to prevent further notifications.", + "rules": [ + { + "guid": "", + "name": "K8s common labels usage", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tfixPath := no_K8s_label_or_no_K8s_label_usage(pod, \"\")\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"in the following pod the kubernetes common labels are not defined: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tpodSpec := wl.spec.template\n\tbeggining_of_pod_path := \"spec.template.\"\n\tfixPath := no_K8s_label_usage(wl, podSpec, beggining_of_pod_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v the kubernetes common labels are is not defined:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tpodSpec := wl.spec.jobTemplate.spec.template\n\tbeggining_of_pod_path := \"spec.jobTemplate.spec.template.\"\n\tfixPath := no_K8s_label_usage(wl, podSpec, beggining_of_pod_path)\n\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs the kubernetes common labels are not defined: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": fixPath,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n\n\n# There is no label-usage in WL and also for his Pod\nno_K8s_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tpath1 := no_K8s_label_or_no_K8s_label_usage(wl, \"\")\n\tpath2 := no_K8s_label_or_no_K8s_label_usage(podSpec, beggining_of_pod_path)\n\tpath = array.concat(path1, path2)\n}\n\n# There is label-usage for WL but not for his Pod\nno_K8s_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_K8s_label_or_no_K8s_label_usage(wl, \"\")\n\tpath := no_K8s_label_or_no_K8s_label_usage(podSpec, beggining_of_pod_path)\n}\n\n# There is no label-usage for WL but there is for his Pod\nno_K8s_label_usage(wl, podSpec, beggining_of_pod_path) = path{\n\tnot no_K8s_label_or_no_K8s_label_usage(podSpec, beggining_of_pod_path)\n\tpath := no_K8s_label_or_no_K8s_label_usage(wl, \"\")\n}\n\nno_K8s_label_or_no_K8s_label_usage(wl, beggining_of_path) = path{\n\tnot wl.metadata.labels\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_K8s_label_or_no_K8s_label_usage(wl, beggining_of_path) = path{\n\tmetadata := wl.metadata\n\tnot metadata.labels\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nno_K8s_label_or_no_K8s_label_usage(wl, beggining_of_path) = path{\n\tlabels := wl.metadata.labels\n\tnot all_kubernetes_labels(labels)\n\tpath = [{\"path\": sprintf(\"%vmetadata.labels\", [beggining_of_path]), \"value\": \"YOUR_VALUE\"}]\n}\n\nall_kubernetes_labels(labels){\n\trecommended_labels := data.postureControlInputs.k8sRecommendedLabels\n\trecommended_label := recommended_labels[_]\n\tlabels[recommended_label]\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.k8sRecommendedLabels" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.k8sRecommendedLabels", + "name": "Kubernetes Recommended Labels", + "description": "Kubescape checks that workloads have at least one of the following kubernetes recommended labels." + } + ], + "description": "Check if the list of label that start with app.kubernetes.io/ are defined.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Images from allowed registry", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Collection" + ] + }, + "controlID": "C-0078", + "creationTime": "", + "description": "This control is intended to ensure that all the used container images are taken from the authorized repositories. It allows user to list all the approved repositories and will fail all the images taken from any repository outside of this list.", + "remediation": "You should enable all trusted repositories in the parameters of this control.", + "rules": [ + { + "guid": "", + "name": "container-image-repository", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Collection::Images from private registry" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\nimport future.keywords.if\n# import data.kubernetes.api.client as client\n\nuntrusted_image_repo[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\timage := container.image\n\tnot image_in_allowed_list(image)\n\tpath := sprintf(\"spec.containers[%v].image\", [format_int(i, 10)])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"alertScore\": 2,\n \"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\nuntrusted_image_repo[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\timage := container.image\n not image_in_allowed_list(image)\n\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"alertScore\": 2,\n \"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nuntrusted_image_repo[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\timage := container.image\n not image_in_allowed_list(image)\n\n\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' comes from untrusted registry\", [image, container.name]),\n\t\t\"alertScore\": 2,\n \"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# image_in_allowed_list - rule to check if an image complies with imageRepositoryAllowList.\nimage_in_allowed_list(image){\n\n\t# see default-config-inputs.json for list values\n\tallowedlist := data.postureControlInputs.imageRepositoryAllowList\n\tregistry := allowedlist[_]\n\n\tregex.match(regexify(registry), docker_host_wrapper(image))\n}\n\n\n# docker_host_wrapper - wrap an image without a host with a docker hub host 'docker.io'. \n# An image that doesn't contain '/' is assumed to not having a host and therefore associated with docker hub.\ndocker_host_wrapper(image) := result if {\n\tnot contains(image, \"/\")\n\tresult := sprintf(\"docker.io/%s\", [image])\n} else := image\n\n\n# regexify - returns a registry regex to be searched only for the image host.\nregexify(registry) := result {\n\tendswith(registry, \"/\")\n\tresult = sprintf(\"^%s.*$\", [registry])\n} else := sprintf(\"^%s\\/.*$\", [registry])\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.imageRepositoryAllowList" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.imageRepositoryAllowList", + "name": "Allowed image repositories", + "description": "Kubescape checks that all the containers are using images from the allowed repositories provided in the following list." + } + ], + "description": "Fails if image is not from allowed repository", + "remediation": "", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-0185-linux-kernel-container-escape", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0079", + "creationTime": "", + "description": "CVE-2022-0185 is a kernel vulnerability enabling privilege escalation and it can lead attackers to escape containers and take control over nodes. This control alerts on vulnerable kernel versions of Kubernetes nodes", + "remediation": "Patch Linux kernel version to 5.16.2 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-0185", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tnode := input[_]\n node.kind == \"Node\"\n kernel_version_match := regex.find_all_string_submatch_n(\"[0-9]+\\\\.[0-9]+\\\\.[0-9]+\", node.status.nodeInfo.kernelVersion, -1)\n kernelVersion := kernel_version_match[0][0]\n \n kernel_version_arr := split(kernelVersion, \".\")\n to_number(kernel_version_arr[0]) == 5\n to_number(kernel_version_arr[1]) \u003e= 1\n to_number(kernel_version_arr[1]) \u003c= 16\n to_number(kernel_version_arr[2]) \u003c 2 \n \n node.status.nodeInfo.operatingSystem == \"linux\"\n path := \"status.nodeInfo.kernelVersion\"\n\n linux_kernel_vars := [linux_kernel_var | linux_kernel_var = input[_]; linux_kernel_var.kind == \"LinuxKernelVariables\"]\n linux_kernel_vars_for_node := [linux_kernel_var | linux_kernel_var = linux_kernel_vars[_]; linux_kernel_var.metadata.name == node.metadata.name]\n data_userns_clones := [linux_kernel_var | linux_kernel_var = linux_kernel_vars_for_node[_].data[_]; is_unprivileged_userns_clone_enabled(linux_kernel_var)]\n count(data_userns_clones) \u003e 0\n\n external_vector := {\n \"name\": node.metadata.name,\n\t\t\"namespace\": \"\",\n\t\t\"kind\": node.kind,\n\t\t\"relatedObjects\": linux_kernel_vars_for_node,\n \"kernelVersion\": node.status.nodeInfo.kernelVersion\n }\n\n\n \tmsga := {\n\t\t\t\"alertMessage\": \"You are vulnerable to CVE-2022-0185\",\n \t\t\"alertObject\": {\n \"externalObjects\": external_vector\n },\n\t\t\t\"failedPaths\": [\"kernelVersion\"],\n \"fixPaths\":[],\n\t}\n}\n\nis_unprivileged_userns_clone_enabled(linux_kernel_var) {\n\tlinux_kernel_var.key == \"unprivileged_userns_clone\"\n linux_kernel_var.value == \"1\\n\"\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tnode := input[_]\n node.kind == \"Node\"\n \n node.status.nodeInfo.operatingSystem == \"linux\"\n\n linux_kernel_vars := [linux_kernel_var | linux_kernel_var = input[_]; linux_kernel_var.kind == \"LinuxKernelVariables\"]\n linux_kernel_vars_for_node := [linux_kernel_var | linux_kernel_var = linux_kernel_vars[_]; linux_kernel_var.metadata.name == node.metadata.name]\n\n external_vector := {\n \"name\": node.metadata.name,\n\t\t\"namespace\": \"\",\n\t\t\"kind\": node.kind,\n\t\t\"relatedObjects\": linux_kernel_vars_for_node,\n \"kernelVersion\": node.status.nodeInfo.kernelVersion\n }\n\n \tmsga := {\n\t\t\t\"alertMessage\": \"You are vulnerable to CVE-2022-0185\",\n \t\t\"alertObject\": {\n \"externalObjects\": external_vector\n },\n\t\t\t\"failedPaths\": [],\n \"fixPaths\":[],\n\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Node" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "LinuxKernelVariables" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-24348-argocddirtraversal", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0081", + "creationTime": "", + "description": "CVE-2022-24348 is a major software supply chain 0-day vulnerability in the popular open source CD platform Argo CD which can lead to privilege escalation and information disclosure.", + "remediation": "Update your ArgoCD deployment to fixed versions (v2.1.9,v2.2.4 or v2.3.0)", + "rules": [ + { + "guid": "", + "name": "CVE-2022-24348", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"argocd:v\")\n\tis_vulnerable_image(image)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-24348\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n\nis_vulnerable_image(image) {\n\tversion := split(image, \":v\")[1]\n\tversionTriplet := split(version, \".\")\n\tcount(versionTriplet) == 3\n\tmajor_version := to_number(versionTriplet[0])\n\tminorVersion := to_number(versionTriplet[1])\n\tsubVersion := to_number(versionTriplet[2]) \n\tisVulnerableVersion(major_version,minorVersion,subVersion)\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 1\n} \n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 2\n\tminorVersion == 0\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 2\n\tminorVersion == 1\n\tsubVersion \u003c 9\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 2\n\tminorVersion == 2\n\tsubVersion \u003c 4\n}\t\n\n", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"argocd:v\")\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-24348\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "a", + "remediation": "a", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Workloads with Critical vulnerabilities exposed to external traffic", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0083", + "creationTime": "", + "description": "Container images with known critical vulnerabilities pose elevated risk if they are exposed to the external traffic. This control lists all images with such vulnerabilities if either LoadBalancer or NodePort service is assigned to them.", + "remediation": "Either update the container image to fix the vulnerabilities (if such fix is available) or reassess if this workload must be exposed to the outseide traffic. If no fix is available, consider periodic restart of the POD to minimize the risk of persistant intrusion. Use exception mechanism if you don't want to see this report again.", + "rules": [ + { + "guid": "", + "name": "exposed-critical-pods", + "attributes": { + "armoBuiltin": true, + "imageScanRelated": true, + "m$K8sThreatMatrix": "exposed-critical-pods" + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n \n container.image == vuln.metadata.name\n\n # At least one critical vulnerabilities\n filter_critical_vulnerabilities(vuln)\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 7,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_critical_vulnerabilities(vuln) {\n data := vuln.data[_]\n data.severity == \"Critical\"\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 7,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Service", + "Pod" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "armo.vuln.images", + "image.vulnscan.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ImageVulnerabilities" + ] + } + ], + "ruleDependencies": null, + "configInputs": null, + "controlConfigInputs": null, + "description": "Fails if pods have exposed services as well as critical vulnerabilities", + "remediation": "The image of the listed pods might have a fix in a newer version. Alternatively, the pod service might not need to be external facing", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Workloads with RCE vulnerabilities exposed to external traffic", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0084", + "creationTime": "", + "description": "Container images with known Remote Code Execution (RCE) vulnerabilities pose significantly higher risk if they are exposed to the external traffic. This control lists all images with such vulnerabilities if their POD has either LoadBalancer or NodePort service.", + "remediation": "Either update the container image to fix the vulnerabilities (if such fix is available) or reassess if this workload must be exposed to the outseide traffic. If no fix is available, consider periodic restart of the POD to minimize the risk of persistant intrusion. Use exception mechanism if you don't want to see this report again.", + "rules": [ + { + "guid": "", + "name": "exposed-rce-pods", + "attributes": { + "armoBuiltin": true, + "imageScanRelated": true, + "m$K8sThreatMatrix": "exposed-rce-pods", + "useFromKubescapeVersion": "v2.0.150" + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\" ]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n # At least one rce vulnerability\n filter_rce_vulnerabilities(vuln)\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with rce vulnerability\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 8,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_rce_vulnerabilities(vuln) {\n data := vuln.data[_]\n data.categories.isRce == true\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "resourceEnumerator": "package armo_builtins\n \ndeny[msga] {\n services := [ x | x = input[_]; x.kind == \"Service\" ; x.apiVersion == \"v1\"]\n pods := [ x | x = input[_]; x.kind == \"Pod\" ; x.apiVersion == \"v1\"]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"] # TODO: x.apiVersion == \"--input--\" || x.apiVersion == \"--input--\" ]\n\n pod := pods[_]\n service := services[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n\n # service is external-facing\n filter_external_access(service)\n\n # pod has the current service\n service_to_pod(service, pod) \u003e 0\n\n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \"name\": pod.metadata.name,\n \"namespace\": pod.metadata.namespace\n }\n\n external_objects = { \n \"apiVersion\": \"result.vulnscan.com/v1\",\n \"kind\": pod.kind,\n \"metadata\": metadata,\n \"relatedObjects\": related_objects\n }\n\n msga := {\n \"alertMessage\": sprintf(\"pod '%v' exposed with rce vulnerability\", [pod.metadata.name]),\n \"packagename\": \"armo_builtins\",\n \"alertScore\": 8,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n \"alertObject\": {\n \"externalObjects\": external_objects\n }\n }\n}\n\nfilter_external_access(service) {\n service.spec.type != \"ClusterIP\"\n}\n\nservice_to_pod(service, pod) = res {\n # Make sure we're looking on the same namespace\n service.metadata.namespace == pod.metadata.namespace\n\n service_selectors := [ x | x = service.spec.selector[_] ]\n\n res := count([ x | x = pod.metadata.labels[_]; x == service_selectors[_] ])\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Service", + "Pod" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "armo.vuln.images", + "image.vulnscan.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ImageVulnerabilities" + ] + } + ], + "ruleDependencies": null, + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if known pods have exposed services and known vulnerabilities with remote code execution", + "remediation": "The image of the listed pods might have a fix in a newer version. Alternatively, the pod service might not need to be external facing", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Workloads with excessive amount of vulnerabilities", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0085", + "creationTime": "", + "description": "Container images with multiple Critical and High sevirity vulnerabilities increase the risk of potential exploit. This control lists all such images according to the threashold provided by the customer.", + "remediation": "Update your workload images as soon as possible when fixes become available.", + "rules": [ + { + "guid": "", + "name": "excessive_amount_of_vulnerabilities_pods", + "attributes": { + "armoBuiltin": true, + "imageScanRelated": true, + "microsoftK8sThreatMatrix": "Initial access::Exposed critical vulnerable pods", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\n\ndeny[msga] {\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n \n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n # Has ^ amount of vulnerabilities\n check_num_vulnerabilities(vuln)\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \t\"name\": pod.metadata.name,\n \t\"namespace\": pod.metadata.namespace\n }\n\n external_objects = {\n \t\"apiVersion\": \"result.vulnscan.com/v1\",\n \t\"kind\": pod.kind,\n \t\"metadata\": metadata,\n \t\"relatedObjects\": related_objects\n }\n\n msga := {\n \t\"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \t\"packagename\": \"armo_builtins\",\n \t\"alertScore\": 7,\n \t\"failedPaths\": [path],\n \t\"fixPaths\": [],\n \t\"alertObject\": {\n \"externalObjects\": external_objects\n \t}\n }\n}\n\ncheck_num_vulnerabilities(vuln) {\n exists := count([ x | x = vuln.data[_]; x.severity == \"Critical\" ])\n\n str_max := data.postureControlInputs.max_critical_vulnerabilities[_]\n exists \u003e to_number(str_max)\n}\n\ncheck_num_vulnerabilities(vuln) {\n exists := count([ x | x = vuln.data[_]; x.severity == \"High\" ])\n \n str_max := data.postureControlInputs.max_high_vulnerabilities[_]\n exists \u003e to_number(str_max)\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n pods := [ x | x = input[_]; x.kind == \"Pod\" ]\n vulns := [ x | x = input[_]; x.kind == \"ImageVulnerabilities\"]\n\n pod := pods[_]\n vuln := vulns[_]\n\n # vuln data is relevant \n count(vuln.data) \u003e 0 \n \n # get container image name\n container := pod.spec.containers[i]\n\n # image has vulnerabilities\n container.image == vuln.metadata.name\n\n related_objects := [pod, vuln]\n\n path := sprintf(\"status.containerStatuses[%v].imageID\", [format_int(i, 10)])\n\n metadata = {\n \t\"name\": pod.metadata.name,\n \t\"namespace\": pod.metadata.namespace\n }\n\n external_objects = {\n \t\"apiVersion\": \"result.vulnscan.com/v1\",\n \t\"kind\": pod.kind,\n \t\"metadata\": metadata,\n \t\"relatedObjects\": related_objects\n }\n\n msga := {\n \t\"alertMessage\": sprintf(\"pod '%v' exposed with critical vulnerabilities\", [pod.metadata.name]),\n \t\"packagename\": \"armo_builtins\",\n \t\"alertScore\": 7,\n \t\"failedPaths\": [path],\n \t\"fixPaths\": [],\n \t\"alertObject\": {\n \"externalObjects\": external_objects\n \t}\n }\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "armo.vuln.images", + "image.vulnscan.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ImageVulnerabilities" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": [ + "settings.postureControlInputs.max_critical_vulnerabilities", + "settings.postureControlInputs.max_high_vulnerabilities" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.max_critical_vulnerabilities", + "name": "Max critical vulnerabilities", + "description": "Maximum amount of allowed critical risk vulnerabilities" + }, + { + "path": "settings.postureControlInputs.max_high_vulnerabilities", + "name": "Max high vulnerabilities", + "description": "Maximum amount of allowed high risk vulnerabilities" + } + ], + "description": "determines which users have permissions to exec into pods", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-0492-cgroups-container-escape", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0086", + "creationTime": "", + "description": "Linux Kernel vulnerability CVE-2022-0492 may allow malicious code running inside container to escape container isolation and gain root privileges on the entire node. When fixed Kernel version numbers will become available, this control will be modified to verify them and avoid false positive detections. This control identifies all the resources that don't deploy neither AppArmor nor SELinux, run as root or allow privileged escalation or have corresponding dangerous capabilities.", + "remediation": "Activate AppArmor or SELinux. Follow the least privilege principle and remove root privileges or privilege escalation option and CAP_DAC_OVERRIDE capability. Make sure you don't allow container images from potentially dangerous sources and that containers that must have high privileges are taken from protected repositories.", + "rules": [ + { + "guid": "", + "name": "CVE-2022-0492", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Case 1: \n# -\tContainer runs as root OR allows privilege escalation (allowPrivilegeEscalation = true or not present), AND\n# -\tNo AppArmor , AND\n# -\tNo SELinux, AND\n# -\tNo Seccomp\n# If container is privileged or has CAP_SYS_ADMIN, don't fail\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\t\n\t# Path to send\n\tbeggining_of_path := \"spec\"\n\t\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\t\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_seccomp_pod(pod)\n\n is_no_SELinux_container(container)\n is_no_Seccomp_Container(container)\n\n\t# Check if is running as root\n alertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\n\t# CAP_DAC_OVERRIDE will fail on second check\n\tnot isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n # Get paths\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tbeggining_of_path := \"spec.template.spec\"\n\n pod := wl.spec.template\n container := pod.spec.containers[i]\n\n # If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\t\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_seccomp_pod(pod)\n\n is_no_SELinux_container(container)\n is_no_Seccomp_Container(container)\n\n\t# Check if is running as root\n alertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\n\t# CAP_DAC_OVERRIDE will fail on second check\n\tnot isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n # Get paths\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i)\n\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec\"\n\n\tpod := wl.spec.jobTemplate.spec.template\n container = pod.spec.containers[i]\n \n \t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\t\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_seccomp_pod(pod)\n\n is_no_SELinux_container(container)\n is_no_Seccomp_Container(container)\n\n\t# Check if is running as root\n alertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\n\t# CAP_DAC_OVERRIDE will fail on second check\n\tnot isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n # Get paths\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i)\n\n msga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n#################################################################################\n# Case 2: \n# - Container has CAP_DAC_OVERRIDE capability, AND\n# - No AppArmor, AND\n# - No SELinux\n# If container is privileged or has CAP_SYS_ADMIN, don't fail\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\n\tbeggining_of_path := \"spec.\"\n\t\n result := isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_SELinux_container(container)\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": [result],\n \"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\n pod := wl.spec.template\n container := pod.spec.containers[i]\n\n\tbeggining_of_path := \"spec.template.spec.\"\n\n result := isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_SELinux_container(container)\n\n\tmsga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": [result],\n \"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n \n pod := wl.spec.jobTemplate.spec.template\n container = pod.spec.containers[i]\n\t\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\n \tresult := isCAP_DAC_OVERRIDE(container, beggining_of_path, i)\n\n\t# If container is privileged or has CAP_SYS_ADMIN, pass\n not container.securityContext.privileged == true\n\tnot is_cap_sys_admin(container, beggining_of_path)\n\n\tis_no_SELinux_No_AppArmor_Pod(pod)\n is_no_SELinux_container(container)\n\n msga := {\n\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-0492\",\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": [result],\n \"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n\nis_cap_sys_admin(container, beggining_of_path) {\n\tcapability = container.securityContext.capabilities.add[k]\n capability == \"SYS_ADMIN\"\n}\n\nisCAP_DAC_OVERRIDE(container, beggining_of_path, i) = path {\n\tcapability = container.securityContext.capabilities.add[k]\n capability == \"DAC_OVERRIDE\"\n path = sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) \n}\n\n\n\n#################################################################################\n\nget_failed_path(alertInfo, i) = [replace(alertInfo.failed_path,\"container_ndx\",format_int(i,10))] {\n\talertInfo.failed_path != \"\"\n} else = []\n\n\nget_fixed_path(alertInfo, i) = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}, {\"path\":replace(alertInfo.fixPath[1].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[1].value}]{\n\tcount(alertInfo.fixPath) == 2\n} else = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}] {\n\tcount(alertInfo.fixPath) == 1\n} else = []\n\n\n\n\n\n#################################################################################\n\n# Check if appArmor or SELinux or seccompProfile is used\n# Fails if none of them is used\nis_no_SELinux_No_AppArmor_Pod(pod){\n not pod.spec.securityContext.seLinuxOptions\n\tannotations := [pod.metadata.annotations[i] | annotaion = i; startswith(i, \"container.apparmor.security.beta.kubernetes.io\")]\n\tnot count(annotations) \u003e 0\n}\n\nis_no_SELinux_container(container){\n not container.securityContext.seLinuxOptions\n}\n\nis_no_seccomp_pod(pod) {\n not pod.spec.securityContext.seccompProfile\n}\n\nis_no_Seccomp_Container(container) {\n not container.securityContext.seccompProfile\n}\n\n\n\n\n\n\n#################################################################################\n# Workload evaluation \n\nevaluate_workload_non_root_container(container, pod, beggining_of_path) = alertInfo {\n\trunAsNonRootValue := get_run_as_non_root_value(container, pod, beggining_of_path)\n\trunAsNonRootValue.value == false\n\t\n\trunAsUserValue := get_run_as_user_value(container, pod, beggining_of_path)\n\trunAsUserValue.value == 0\n\n\talertInfo := choose_first_if_defined(runAsUserValue, runAsNonRootValue)\n} else = alertInfo {\n allowPrivilegeEscalationValue := get_allow_privilege_escalation(container, pod, beggining_of_path)\n allowPrivilegeEscalationValue.value == true\n\n alertInfo := allowPrivilegeEscalationValue\n}\n\n\n#################################################################################\n\n# Checking for non-root and allowPrivilegeEscalation enabled\nget_run_as_non_root_value(container, pod, beggining_of_path) = runAsNonRoot {\n failed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : container.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [] ,\"defined\" : true}\n} else = runAsNonRoot {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : pod.spec.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": \"spec.securityContext.runAsNonRoot\", \"value\":\"true\"}], \"defined\" : false} {\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) , \"value\":\"true\"}, {\"path\":sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nget_run_as_user_value(container, pod, beggining_of_path) = runAsUser {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : container.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = runAsUser {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : pod.spec.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}],\"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.securityContext.containers[container_ndx].runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n\t\"defined\" : false}\n\nget_run_as_group_value(container, pod, beggining_of_path) = runAsGroup {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : container.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = runAsGroup {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : pod.spec.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\":[], \"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": \"spec.securityContext.runAsNonRoot\", \"value\":\"true\"}], \"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n \t\"defined\" : false\n}\n\nget_allow_privilege_escalation(container, pod, beggining_of_path) = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : container.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : pod.spec.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : true, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nchoose_first_if_defined(l1, l2) = c {\n l1.defined\n c := l1\n} else = l2\n\n\nis_allow_privilege_escalation_field(container, pod) {\n\tcontainer.securityContext.allowPrivilegeEscalation == false\n}\n\nis_allow_privilege_escalation_field(container, pod) {\n\tpod.spec.securityContext.allowPrivilegeEscalation == false\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-23648-containerd-fs-escape", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0087", + "creationTime": "", + "description": "CVE-2022-23648 is a vulnerability of containerd enabling attacker to gain access to read-only copies of arbitrary files from the host using aspecially-crafted POD configuration yamls", + "remediation": "Patch containerd to 1.6.1, 1.5.10, 1.4.12 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-23648", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tnode := input[_]\n node.kind == \"Node\"\n \n startswith(node.status.nodeInfo.containerRuntimeVersion,\"containerd://\")\n containerd_version := substring(node.status.nodeInfo.containerRuntimeVersion,13,-1)\n containerd_version_arr := split(containerd_version, \".\")\n major_version := to_number(containerd_version_arr[0]) \n minor_version := to_number(containerd_version_arr[1]) \n subVersion := to_number(containerd_version_arr[2]) \n \n is_vulnerable_version(major_version,minor_version,subVersion)\n\n path := \"status.nodeInfo.containerRuntimeVersion\"\n\n \tmsga := {\n\t\t\t\"alertMessage\": \"You are vulnerable to CVE-2022-23648\",\n \t\t\"alertObject\": {\n \"k8SApiObjects\": [node]\n },\n\t\t\t\"failedPaths\": [path],\n \"fixPaths\":[],\n\t}\n}\n\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 0\n} \n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version \u003c 4\n}\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version == 4\n\tsubVersion \u003c 12\n}\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version == 5\n\tsubVersion \u003c 10\n}\t\n\nis_vulnerable_version(major_version, minor_version, subVersion) {\n\tmajor_version == 1\n\tminor_version == 6\n\tsubVersion \u003c 1\n}\t\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Node" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "RBAC enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access", + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0088", + "creationTime": "", + "description": "RBAC is the most advanced and well accepted mode of authorizing users of the Kubernetes API", + "remediation": "Enable RBAC either in the API server configuration or with the Kubernetes provider API", + "rules": [ + { + "guid": "", + "name": "rbac-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"management.azure.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"aks\"\n\tconfig := cluster_config.data\n\tnot config.properties.enableRBAC == true\n\n\tmsga := {\n\t\t\"alertMessage\": \"rbac is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"data.properties.enableRBAC\"],\n\t\t\"fixCommand\": \"\",\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n \t\t\"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "management.azure.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "container.googleapis.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "AKS", + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "rbac-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command[j]\n contains(cmd, \"--authorization-mode=\")\n output := split(cmd, \"=\")\n not contains(output[1], \"RBAC\")\n\tpath := sprintf(\"spec.containers[0].command[%v]\", [format_int(j, 10)])\t\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"RBAC is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-39328-grafana-auth-bypass", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0090", + "creationTime": "", + "description": "CVE-2022-39328 is a critical vulnerability in Grafana, it might enable attacker to access unauthorized endpoints under heavy load.", + "remediation": "Update your Grafana to 9.2.4 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-39328", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"grafana:\")\n\tis_vulnerable_image(image)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-39328\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n\nis_vulnerable_image(image) {\n\tclean_image := replace(image,\"-ubuntu\",\"\")\n\tversion := split(clean_image, \":\")[1]\n\tversionTriplet := split(version, \".\")\n\tcount(versionTriplet) == 3\n\tmajor_version := to_number(versionTriplet[0])\n\tminorVersion := to_number(versionTriplet[1])\n\tsubVersion := to_number(versionTriplet[2]) \n\tisVulnerableVersion(major_version,minorVersion,subVersion)\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 9\n\tminorVersion == 2\n\tsubVersion \u003c 4\n}\n", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"grafana:\")\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-39328\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "a", + "remediation": "a", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2022-47633-kyverno-signature-bypass", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0091", + "creationTime": "", + "description": "CVE-2022-47633 is a high severity vulnerability in Kyverno, it enables attackers to bypass the image signature validation of policies using a malicious image repository or MITM proxy", + "remediation": "Update your Grafana to 9.2.4 or above", + "rules": [ + { + "guid": "", + "name": "CVE-2022-47633", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"kyverno:\")\n\tis_vulnerable_image(image)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-47633\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n\nis_vulnerable_image(image) {\n\tversion := split(image, \":v\")[1]\n\tversionTriplet := split(version, \".\")\n\tcount(versionTriplet) == 3\n\tmajor_version := to_number(versionTriplet[0])\n\tminorVersion := to_number(versionTriplet[1])\n\tsubVersion := to_number(versionTriplet[2]) \n\tisVulnerableVersion(major_version,minorVersion,subVersion)\n}\n\nisVulnerableVersion(major_version, minorVersion, subVersion) {\n\tmajor_version == 1\n\tminorVersion == 8\n\t3 \u003c= subVersion\n\tsubVersion \u003c 5\n}\n", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tcontains(image, \"kyverno:\")\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n msga := {\n\t\t\t\"alertMessage\": \"You may be vulnerable to CVE-2022-47633\",\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": { \n \"k8SApiObjects\": [deployment]\n },\n\t\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "a", + "remediation": "a", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + } + ], + "controlsIDs": [ + "C-0001", + "C-0002", + "C-0004", + "C-0005", + "C-0007", + "C-0009", + "C-0012", + "C-0013", + "C-0014", + "C-0015", + "C-0016", + "C-0017", + "C-0018", + "C-0020", + "C-0021", + "C-0026", + "C-0030", + "C-0031", + "C-0034", + "C-0035", + "C-0036", + "C-0038", + "C-0039", + "C-0041", + "C-0042", + "C-0044", + "C-0045", + "C-0046", + "C-0048", + "C-0049", + "C-0050", + "C-0052", + "C-0053", + "C-0054", + "C-0055", + "C-0056", + "C-0057", + "C-0058", + "C-0059", + "C-0061", + "C-0062", + "C-0063", + "C-0065", + "C-0066", + "C-0067", + "C-0068", + "C-0069", + "C-0070", + "C-0073", + "C-0074", + "C-0075", + "C-0076", + "C-0077", + "C-0078", + "C-0079", + "C-0081", + "C-0083", + "C-0084", + "C-0085", + "C-0086", + "C-0087", + "C-0088", + "C-0090", + "C-0091" + ] + }, + { + "guid": "", + "name": "NSA", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "description": "Implement NSA security advices for K8s ", + "controls": [ + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Exec into container", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Execution" + ], + "rbacQuery": "Show who can access into pods" + }, + "controlID": "C-0002", + "creationTime": "", + "description": "Attackers with relevant permissions can run malicious commands in the context of legitimate containers in the cluster using “kubectl exec” command. This control determines which subjects have permissions to use this command.", + "remediation": "It is recommended to prohibit “kubectl exec” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.", + "rules": [ + { + "guid": "", + "name": "exec-into-container-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Exec into container", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# input: regoResponseVectorObject\n# returns subjects that can exec into container\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"create\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"pods/exec\", \"pods/*\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can exec into containers\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "rbac.authorization.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "RoleBinding", + "ClusterRoleBinding", + "Role", + "ClusterRole" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have permissions to exec into pods", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "API server insecure port is enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0005", + "creationTime": "", + "description": "Kubernetes control plane API is running with non-secure port enabled which allows attackers to gain unprotected access to the cluster.", + "remediation": "Set the insecure-port flag of the API server to zero.", + "rules": [ + { + "guid": "", + "name": "insecure-port-flag", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Fails if pod has insecure-port flag enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontains(pod.metadata.name, \"kube-apiserver\")\n container := pod.spec.containers[i]\n\tpath = is_insecure_port_flag(container, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"The API server container: %v has insecure-port flag enabled\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\t\nis_insecure_port_flag(container, i) = path {\n\tcommand := container.command[j]\n\tcontains(command, \"--insecure-port=1\")\n\tpath := sprintf(\"spec.containers[%v].command[%v]\", [format_int(i, 10), format_int(j, 10)])\n}", + "resourceEnumerator": "package armo_builtins\nimport data.cautils as cautils\n\n# Fails if pod has insecure-port flag enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontains(pod.metadata.name, \"kube-apiserver\")\n container := pod.spec.containers[_]\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"The API server container: %v has insecure-port flag enabled\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if the api server has insecure-port enabled", + "remediation": "Make sure that the insecure-port flag of the api server is set to 0", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Resource limits", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - service destruction" + ] + } + ], + "controlTypeTags": [ + "security" + ] + }, + "controlID": "C-0009", + "creationTime": "", + "description": "CPU and memory resources should have a limit set for every container or a namespace to prevent resource exhaustion. This control identifies all the Pods without resource limit definitions by checking their yaml definition file as well as their namespace LimitRange objects. It is also recommended to use ResourceQuota object to restrict overall namespace resources, but this is not verified by this control.", + "remediation": "Define LimitRange and Resource Limits in the namespace or in the deployment/POD yamls.", + "rules": [ + { + "guid": "", + "name": "resource-policies", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if container has limits\ndeny[msga] {\n \tpods := [pod | pod = input[_]; pod.kind == \"Pod\"]\n pod := pods[_]\n\tcontainer := pod.spec.containers[i]\n\t\n\t\n\tbeggining_of_path := \"spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Check if container has limits - for workloads\n# If there is no limits specified in the workload, we check the namespace, since if limits are only specified for namespace\n# and not in workload, it won't be on the yaml\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\t\n\tbeggining_of_path\t:= \"spec.template.spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\t\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n\t\n}\n\n# Check if container has limits - for cronjobs\n# If there is no limits specified in the cronjob, we check the namespace, since if limits are only specified for namespace\n# and not in cronjob, it won't be on the yaml\ndeny [msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\t\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tfixPath := is_no_cpu_and_memory_limits_defined(container, beggining_of_path, i)\n\t\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"there are no cpu and memory limits defined for container : %v\", [container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixPath,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# no limits at all\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tnot container.resources.limits\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}, {\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}\n\n# only memory limit\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.cpu\n\tcontainer.resources.limits.memory\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}\n\n# only cpu limit\nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) =fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.memory\n\tcontainer.resources.limits.cpu\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n\tfailed_path = \"\"\n}\n# limits but without capu and memory \nis_no_cpu_and_memory_limits_defined(container, beggining_of_path, i) = fixPath {\n\tcontainer.resources.limits\n\tnot container.resources.limits.memory\n\tnot container.resources.limits.cpu\n\tfixPath = [{\"path\": sprintf(\"%vcontainers[%v].resources.limits.cpu\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}, {\"path\": sprintf(\"%vcontainers[%v].resources.limits.memory\", [beggining_of_path, format_int(i, 10)]), \"value\":\"YOUR_VALUE\"}]\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if namespace has no resource policies defined", + "remediation": "Make sure that you definy resource policies (LimitRange or ResourceQuota) which limit the usage of resources for all the namespaces", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Applications credentials in configuration files", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Credential access" + ] + }, + { + "attackTrack": "container", + "categories": [ + "Credential access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Credential access", + "Lateral Movement" + ] + }, + "controlID": "C-0012", + "creationTime": "", + "description": "Attackers who have access to configuration files can steal the stored secrets and use them. This control checks if ConfigMaps or pod specifications have sensitive information in their configuration.", + "remediation": "Use Kubernetes secrets or Key Management Systems to store credentials.", + "rules": [ + { + "guid": "", + "name": "rule-credentials-in-env-var", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "\tpackage armo_builtins\n\t# import data.cautils as cautils\n\t# import data.kubernetes.api.client as client\n\timport data\n\n\tdeny[msga] {\n\t\tpod := input[_]\n\t\tpod.kind == \"Pod\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := pod.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Pod: %v has sensitive information in environment variables\", [pod.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [pod]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\t\tspec_template_spec_patterns[wl.kind]\n\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\t\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"%v: %v has sensitive information in environment variables\", [wl.kind, wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\twl.kind == \"CronJob\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\t\t\n\t\tis_not_reference(env)\n\t\t\n\t\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Cronjob: %v has sensitive information in environment variables\", [wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\n\nis_not_reference(env)\n{\n\tnot env.valueFrom.secretKeyRef\n\tnot env.valueFrom.configMapKeyRef\n}\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if Pods have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + }, + { + "guid": "", + "name": "rule-credentials-configmap", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "package armo_builtins\n# import data.cautils as cautils\n# import data.kubernetes.api.client as client\nimport data\n\n# fails if config map has keys with suspicious name\ndeny[msga] {\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n # see default-config-inputs.json for list values\n sensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n key_name := sensitive_key_names[_]\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n \n contains(lower(map_key), lower(key_name))\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n \n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - not base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n regex.match(value , map_secret)\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n decoded_secret := base64.decode(map_secret)\n \n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n regex.match(value , decoded_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveValues", + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveValues", + "name": "Values", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Below you can find some examples of popular value phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if ConfigMaps have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Non-root containers", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0013", + "creationTime": "", + "description": "Potential attackers may gain access to a container and leverage its existing privileges to conduct an attack. Therefore, it is not recommended to deploy containers with root privileges unless it is absolutely necessary. This control identifies all the Pods running as root or can escalate to root.", + "remediation": "If your application does not need root privileges, make sure to define the runAsUser or runAsGroup under the PodSecurityContext and use user ID 1000 or higher. Do not turn on allowPrivlegeEscalation bit and make sure runAsNonRoot is true.", + "rules": [ + { + "guid": "", + "name": "non-root-containers", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n################################################################################\n# Rules\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\n\tbeggining_of_path := \"spec\"\n\talertInfo := evaluate_workload_non_root_container(container, pod, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v may run as root\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\n\tbeggining_of_path := \"spec.template.spec\"\n\talertInfo := evaluate_workload_non_root_container(container, wl.spec.template, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v may run as root\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has a container configured to run as root\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec\"\n\talertInfo := evaluate_workload_non_root_container(container, wl.spec.jobTemplate.spec.template, beggining_of_path)\n\tfixPath := get_fixed_path(alertInfo, i)\n failed_path := get_failed_path(alertInfo, i) \n\t\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v may run as root\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n \"fixPaths\": fixPath,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nget_failed_path(alertInfo, i) = [replace(alertInfo.failed_path,\"container_ndx\",format_int(i,10))] {\n\talertInfo.failed_path != \"\"\n} else = []\n\n\nget_fixed_path(alertInfo, i) = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}, {\"path\":replace(alertInfo.fixPath[1].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[1].value}]{\n\tcount(alertInfo.fixPath) == 2\n} else = [{\"path\":replace(alertInfo.fixPath[0].path,\"container_ndx\",format_int(i,10)), \"value\":alertInfo.fixPath[0].value}] {\n\tcount(alertInfo.fixPath) == 1\n} else = []\n\n#################################################################################\n# Workload evaluation \n\nevaluate_workload_non_root_container(container, pod, beggining_of_path) = alertInfo {\n\trunAsNonRootValue := get_run_as_non_root_value(container, pod, beggining_of_path)\n\trunAsNonRootValue.value == false\n\t\n\trunAsUserValue := get_run_as_user_value(container, pod, beggining_of_path)\n\trunAsUserValue.value == 0\n\n\talertInfo := choose_first_if_defined(runAsUserValue, runAsNonRootValue)\n} else = alertInfo {\n allowPrivilegeEscalationValue := get_allow_privilege_escalation(container, pod, beggining_of_path)\n allowPrivilegeEscalationValue.value == true\n\n alertInfo := allowPrivilegeEscalationValue\n}\n\n\n#################################################################################\n# Value resolution functions\n\n\nget_run_as_non_root_value(container, pod, beggining_of_path) = runAsNonRoot {\n failed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : container.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [] ,\"defined\" : true}\n} else = runAsNonRoot {\n\tfailed_path := sprintf(\"%v.securityContext.runAsNonRoot\", [beggining_of_path]) \n runAsNonRoot := {\"value\" : pod.spec.securityContext.runAsNonRoot, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}], \"defined\" : false} {\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : false, \"failed_path\" : \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]) , \"value\":\"true\"}, {\"path\":sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nget_run_as_user_value(container, pod, beggining_of_path) = runAsUser {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : container.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [], \"defined\" : true}\n} else = runAsUser {\n\tfailed_path := sprintf(\"%v.securityContext.runAsUser\", [beggining_of_path]) \n runAsUser := {\"value\" : pod.spec.securityContext.runAsUser, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}],\"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n\t\"defined\" : false}\n\nget_run_as_group_value(container, pod, beggining_of_path) = runAsGroup {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : container.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = runAsGroup {\n\tfailed_path := sprintf(\"%v.securityContext.runAsGroup\", [beggining_of_path])\n runAsGroup := {\"value\" : pod.spec.securityContext.runAsGroup, \"failed_path\" : failed_path, \"fixPath\":[], \"defined\" : true}\n} else = {\"value\" : 0, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"}], \"defined\" : false}{\n\tis_allow_privilege_escalation_field(container, pod)\n} else = {\"value\" : 0, \"failed_path\": \"\", \n\t\"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.runAsNonRoot\", [beggining_of_path]), \"value\":\"true\"},{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}],\n \t\"defined\" : false\n}\n\nget_allow_privilege_escalation(container, pod, beggining_of_path) = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : container.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = allowPrivilegeEscalation {\n\tfailed_path := sprintf(\"%v.securityContext.allowPrivilegeEscalation\", [beggining_of_path])\n allowPrivilegeEscalation := {\"value\" : pod.spec.securityContext.allowPrivilegeEscalation, \"failed_path\" : failed_path, \"fixPath\": [],\"defined\" : true}\n} else = {\"value\" : true, \"failed_path\": \"\", \"fixPath\": [{\"path\": sprintf(\"%v.containers[container_ndx].securityContext.allowPrivilegeEscalation\", [beggining_of_path]), \"value\":\"false\"}], \"defined\" : false}\n\nchoose_first_if_defined(l1, l2) = c {\n l1.defined\n c := l1\n} else = l2\n\n\nis_allow_privilege_escalation_field(container, pod) {\n\tcontainer.securityContext.allowPrivilegeEscalation == false\n}\n\nis_allow_privilege_escalation_field(container, pod) {\n\tpod.spec.securityContext.allowPrivilegeEscalation == false\n}\n\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container can run as root", + "remediation": "Make sure that the user/group in the securityContext of pod/container is set to an id less than 1000, or the runAsNonRoot flag is set to true. Also make sure that the allowPrivilegeEscalation field is set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Allow privilege escalation", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0016", + "creationTime": "", + "description": "Attackers may gain access to a container and uplift its privilege to enable excessive capabilities.", + "remediation": "If your application does not need it, make sure the allowPrivilegeEscalation field of the securityContext is set to false.", + "rules": [ + { + "guid": "", + "name": "rule-allow-privilege-escalation", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has container that allow privilege escalation\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v allow privilege escalation\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has a container that allow privilege escalation\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v allow privilege escalation\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has a container that allow privilege escalation\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_allow_privilege_escalation_container(container, i, beggining_of_path)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v allow privilege escalation\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n not container.securityContext.allowPrivilegeEscalation == false\n\tnot container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) == 0\n\tfailed_path = \"\"\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)]), \"value\":\"false\"} \n}\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n not container.securityContext.allowPrivilegeEscalation == false\n\tnot container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) \u003e 0\n\tpsp := psps[_]\n\tnot psp.spec.allowPrivilegeEscalation == false\n\tfailed_path = \"\"\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)]), \"value\":\"false\"} \n}\n\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path) = [failed_path, fixPath] {\n container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) == 0\n\tfixPath = \"\"\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)])\n}\n\nis_allow_privilege_escalation_container(container, i, beggining_of_path)= [failed_path, fixPath] {\n container.securityContext.allowPrivilegeEscalation == true\n\tpsps := [psp | psp= input[_]; psp.kind == \"PodSecurityPolicy\"]\n\tcount(psps) \u003e 0\n\tpsp := psps[_]\n\tnot psp.spec.allowPrivilegeEscalation == false\n\tfixPath = \"\"\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.allowPrivilegeEscalation\", [beggining_of_path, format_int(i, 10)])\n}\n\n get_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + }, + { + "apiGroups": [ + "policy" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "PodSecurityPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container allows privilege escalation", + "remediation": "Make sure that the allowPrivilegeEscalation field in the securityContext of pod/container is set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Immutable container filesystem", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Execution", + "Persistence" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0017", + "creationTime": "", + "description": "Mutable container filesystem can be abused to inject malicious code or data into containers. Use immutable (read-only) filesystem to limit potential attacks.", + "remediation": "Set the filesystem of the container to read-only when possible (POD securityContext, readOnlyRootFilesystem: true). If containers application needs to write into the filesystem, it is recommended to mount secondary filesystems for specific directories where application require write access.", + "rules": [ + { + "guid": "", + "name": "immutable-container-filesystem", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pods has container with mutable filesystem\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v has mutable filesystem\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has container with mutable filesystem \ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v has mutable filesystem\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has container with mutable filesystem \ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_mutable_filesystem(container, beggining_of_path, i)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container :%v in %v: %v has mutable filesystem\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": failed_path,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Default of readOnlyRootFilesystem is false. This field is only in container spec and not pod spec\nis_mutable_filesystem(container, beggining_of_path, i) = [failed_path, fixPath] {\n\tcontainer.securityContext.readOnlyRootFilesystem == false\n\tfailed_path = sprintf(\"%vcontainers[%v].securityContext.readOnlyRootFilesystem\", [beggining_of_path, format_int(i, 10)])\n\tfixPath = \"\"\n }\n\n is_mutable_filesystem(container, beggining_of_path, i) = [failed_path, fixPath] {\n\tnot container.securityContext.readOnlyRootFilesystem == false\n not container.securityContext.readOnlyRootFilesystem == true\n\tfixPath = {\"path\": sprintf(\"%vcontainers[%v].securityContext.readOnlyRootFilesystem\", [beggining_of_path, format_int(i, 10)]), \"value\": \"true\"}\n\tfailed_path = \"\"\n }\n\n\n get_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container has mutable filesystem", + "remediation": "Make sure that the securityContext.readOnlyRootFilesystem field in the container/pod spec is set to true", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Ingress and Egress blocked", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ] + }, + "controlID": "C-0030", + "creationTime": "", + "description": "Disable Ingress and Egress traffic on all pods wherever possible. It is recommended to define restrictive network policy on all new PODs, and then enable sources/destinations that this POD must communicate with.", + "remediation": "Define a network policy that restricts ingress and egress connections.", + "rules": [ + { + "guid": "", + "name": "ingress-and-egress-blocked", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# For pods\ndeny[msga] {\n \t\tpods := [pod | pod= input[_]; pod.kind == \"Pod\"]\n\t\tnetworkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\t\tpod := pods[_]\n\t\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; pod_connected_to_network_policy(pod, networkpolicie)]\n\t\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\t\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v does not have ingress/egress defined\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n\n}\n\n# For pods\ndeny[msga] {\n \t\tpods := [pod | pod= input[_]; pod.kind == \"Pod\"]\n\t\tnetworkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\t\tpod := pods[_]\n\t\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; pod_connected_to_network_policy(pod, networkpolicie)]\n\t\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v does not have ingress/egress defined\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n\n}\n\n# For workloads\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; wlConnectedToNetworkPolicy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# For workloads\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; wlConnectedToNetworkPolicy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# For Cronjobs\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; cronjob_connected_to_network_policy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003e 0\n goodPolicies := [goodpolicie | goodpolicie= network_policies_connected_to_pod[_]; is_ingerss_egress_policy(goodpolicie)]\n\tcount(goodPolicies) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# For Cronjobs\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n networkpolicies := [networkpolicie | networkpolicie= input[_]; networkpolicie.kind == \"NetworkPolicy\"]\n\tnetwork_policies_connected_to_pod := [networkpolicie | networkpolicie= networkpolicies[_]; cronjob_connected_to_network_policy(wl, networkpolicie)]\n\tcount(network_policies_connected_to_pod) \u003c 1\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has Pods which don't have ingress/egress defined\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tmetadata1.namespace == metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tnot metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata2.namespace\n\tmetadata1.namespace == \"default\"\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tmetadata2.namespace == \"default\"\n}\n\npod_connected_to_network_policy(pod, networkpolicie){\n\tis_same_namespace(networkpolicie.metadata, pod.metadata)\n count(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == pod.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\npod_connected_to_network_policy(pod, networkpolicie){\n\tis_same_namespace(networkpolicie.metadata ,pod.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\nwlConnectedToNetworkPolicy(wl, networkpolicie){\n\tis_same_namespace(wl.metadata , networkpolicie.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\n\nwlConnectedToNetworkPolicy(wl, networkpolicie){\n\tis_same_namespace(wl.metadata, networkpolicie.metadata)\n\tcount(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == wl.spec.template.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\n\ncronjob_connected_to_network_policy(cj, networkpolicie){\n\tis_same_namespace(cj.metadata , networkpolicie.metadata)\n count(networkpolicie.spec.podSelector) == 0\n}\n\ncronjob_connected_to_network_policy(cj, networkpolicie){\n\tis_same_namespace(cj.metadata , networkpolicie.metadata)\n\tcount(networkpolicie.spec.podSelector) \u003e 0\n count({x | networkpolicie.spec.podSelector.matchLabels[x] == cj.spec.jobTemplate.spec.template.metadata.labels[x]}) == count(networkpolicie.spec.podSelector.matchLabels)\n}\n\nis_ingerss_egress_policy(networkpolicie) {\n list_contains(networkpolicie.spec.policyTypes, \"Ingress\")\n list_contains(networkpolicie.spec.policyTypes, \"Egress\")\n }\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if there are no ingress and egress defined for pod", + "remediation": "Make sure you define ingress and egress policies for all your Pods", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Automatic mapping of service account", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Impact - K8s API access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0034", + "creationTime": "", + "description": "Potential attacker may gain access to a POD and steal its service account token. Therefore, it is recommended to disable automatic mapping of the service account tokens in service account configuration and enable it only for PODs that need to use them.", + "remediation": "Disable automatic mounting of service account tokens to PODs either at the service account level or at the individual POD level, by specifying the automountServiceAccountToken: false. Note that POD level takes precedence.", + "rules": [ + { + "guid": "", + "name": "automount-service-account", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if user account mount tokens in pod by default\ndeny [msga]{\n service_accounts := [service_account | service_account= input[_]; service_account.kind == \"ServiceAccount\"]\n service_account := service_accounts[_]\n result := is_auto_mount(service_account)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t \"alertMessage\": sprintf(\"the following service account: %v in the following namespace: %v mounts service account tokens in pods by default\", [service_account.metadata.name, service_account.metadata.namespace]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [service_account]\n\t\t}\n\t}\n} \n\n\n # -- ---- For workloads -- ---- \n# Fails if pod mount tokens by default (either by its config or by its SA config)\n\n # POD \ndeny [msga]{\n pod := input[_]\n\tpod.kind == \"Pod\"\n\n\tbeggining_of_path := \"spec.\"\n\twl_namespace := pod.metadata.namespace\n\tresult := is_sa_auto_mounted(pod.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t \"alertMessage\": sprintf(\"Pod: %v in the following namespace: %v mounts service account tokens by default\", [pod.metadata.name, pod.metadata.namespace]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n} \n\n# WORKLOADS\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tbeggining_of_path := \"spec.template.spec.\"\n\n\twl_namespace := wl.metadata.namespace\n\tresult := is_sa_auto_mounted(wl.spec.template.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v in the following namespace: %v mounts service account tokens by default\", [wl.kind, wl.metadata.name, wl.metadata.namespace]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# CRONJOB\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n \n\twl_namespace := wl.metadata.namespace\n\tresult := is_sa_auto_mounted(wl.spec.jobTemplate.spec.template.spec, beggining_of_path, wl_namespace)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v in the following namespace: %v mounts service account tokens by default\", [wl.kind, wl.metadata.name, wl.metadata.namespace]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\n # -- ---- For workloads -- ---- \nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken not in pod spec\n\tnot spec.automountServiceAccountToken == false\n\tnot spec.automountServiceAccountToken == true\n\n\t# check if SA automount by default\n\tsa := input[_]\n\tis_same_sa(spec, sa.metadata.name)\n\tis_same_namespace(sa.metadata.namespace , wl_namespace)\n\tnot sa.automountServiceAccountToken == false\n\n\t# path is pod spec\n\tfix_path = { \"path\": sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path]), \"value\": \"false\"}\n\tfailed_path = \"\"\n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken set to true in pod spec\n\tspec.automountServiceAccountToken == true\n\t\n\t# SA automount by default\n\tservice_accounts := [service_account | service_account = input[_]; service_account.kind == \"ServiceAccount\"]\n\tcount(service_accounts) \u003e 0\n\tsa := service_accounts[_]\n\tis_same_sa(spec, sa.metadata.name)\n\tis_same_namespace(sa.metadata.namespace , wl_namespace)\n\tnot sa.automountServiceAccountToken == false\n\n\tfailed_path = sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path])\n\tfix_path = \"\"\n}\n\nis_sa_auto_mounted(spec, beggining_of_path, wl_namespace) = [failed_path, fix_path] {\n\t# automountServiceAccountToken set to true in pod spec\n\tspec.automountServiceAccountToken == true\n\t\n\t# No SA (yaml scan)\n\tservice_accounts := [service_account | service_account = input[_]; service_account.kind == \"ServiceAccount\"]\n\tcount(service_accounts) == 0\n\tfailed_path = sprintf(\"%vautomountServiceAccountToken\", [beggining_of_path])\n\tfix_path = \"\"\n}\n\n\n\n # -- ---- For SAs -- ---- \nis_auto_mount(service_account) = [failed_path, fix_path] {\n\tservice_account.automountServiceAccountToken == true\n\tfailed_path = \"automountServiceAccountToken\"\n\tfix_path = \"\"\n}\n\nis_auto_mount(service_account)= [failed_path, fix_path] {\n\tnot service_account.automountServiceAccountToken == false\n\tnot service_account.automountServiceAccountToken == true\n\tfix_path = {\"path\": \"automountServiceAccountToken\", \"value\": \"false\"}\n\tfailed_path = \"\"\n}\n\nis_same_sa(spec, serviceAccountName) {\n\tspec.serviceAccountName == serviceAccountName\n}\n\nis_same_sa(spec, serviceAccountName) {\n\tnot spec.serviceAccountName \n\tserviceAccountName == \"default\"\n}\n\n\nis_same_namespace(metadata1, metadata2) {\n\tmetadata1.namespace == metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tnot metadata2.namespace\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata2.namespace\n\tmetadata1.namespace == \"default\"\n}\n\nis_same_namespace(metadata1, metadata2) {\n\tnot metadata1.namespace\n\tmetadata2.namespace == \"default\"\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "ServiceAccount" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if service account and workloads mount service account token by default", + "remediation": "Make sure that the automountServiceAccountToken field on the service account spec if set to false", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Cluster-admin binding", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ], + "rbacQuery": "Show cluster_admin" + }, + "controlID": "C-0035", + "creationTime": "", + "description": "Attackers who have cluster admin permissions (can perform any action on any resource), can take advantage of their privileges for malicious activities. This control determines which subjects have cluster admin permissions.", + "remediation": "You should apply least privilege principle. Make sure cluster admin permissions are granted only when it is absolutely necessary. Don't use subjects with such high permissions for daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-list-all-cluster-admins-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Cluster-admin binding", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# returns subjects with cluster admin permissions\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"*\", \"\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s have high privileges, such as cluster-admin\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have cluster admin permissions", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Host PID/IPC privileges", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0038", + "creationTime": "", + "description": "Containers should be isolated from the host machine as much as possible. The hostPID and hostIPC fields in deployment yaml may allow cross-container influence and may expose the host itself to potentially malicious or destructive actions. This control identifies all PODs using hostPID or hostIPC privileges.", + "remediation": "Remove hostPID and hostIPC from the yaml file(s) privileges unless they are absolutely necessary.", + "rules": [ + { + "guid": "", + "name": "host-pid-ipc-privileges", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has hostPID enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tis_host_pid(pod.spec)\n\tpath := \"spec.hostPID\"\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v has hostPID enabled\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if pod has hostIPC enabled\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tis_host_ipc(pod.spec)\n\tpath := \"spec.hostIPC\"\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Pod: %v has hostIPC enabled\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has hostPID enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_pid(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostPID\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod with hostPID enabled\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if workload has hostIPC enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_ipc(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostIPC\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod with hostIPC enabled\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has hostPID enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_pid(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostPID\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod with hostPID enabled\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n# Fails if cronjob has hostIPC enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_ipc(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostIPC\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod with hostIPC enabled\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Check that hostPID and hostIPC are set to false. Default is false. Only in pod spec\n\n\nis_host_pid(podspec){\n podspec.hostPID == true\n}\n\nis_host_ipc(podspec){\n podspec.hostIPC == true\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Containers should be as isolated as possible from the host machine. The hostPID and hostIPC fields in Kubernetes may excessively expose the host to potentially malicious actions.", + "remediation": "Make sure that the fields hostIPC and hostPID in the pod spec are not set to true (set to false or not present)", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "HostNetwork access", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery", + "Lateral movement", + "Impact - service access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0041", + "creationTime": "", + "description": "Potential attackers may gain access to a POD and inherit access to the entire host network. For example, in AWS case, they will have access to the entire VPC. This control identifies all the PODs with host network access enabled.", + "remediation": "Only connect PODs to host network when it is necessary. If not, set the hostNetwork field of the pod spec to false, or completely remove it (false is the default). Whitelist only those PODs that must have access to host network by design.", + "rules": [ + { + "guid": "", + "name": "host-network-access", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if pod has hostNetwork enabled\ndeny[msga] {\n pods := [ pod | pod = input[_] ; pod.kind == \"Pod\"]\n pod := pods[_]\n\n\tis_host_network(pod.spec)\n\tpath := \"spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"Pod: %v is connected to the host network\", [pod.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has hostNetwork enabled\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tis_host_network(wl.spec.template.spec)\n\tpath := \"spec.template.spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"%v: %v has a pod connected to the host network\", [wl.kind, wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has hostNetwork enabled\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tis_host_network(wl.spec.jobTemplate.spec.template.spec)\n\tpath := \"spec.jobTemplate.spec.template.spec.hostNetwork\"\n msga := {\n\t\"alertMessage\": sprintf(\"CronJob: %v has a pod connected to the host network\", [wl.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\":[],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_host_network(podspec) {\n podspec.hostNetwork == true\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if pod has hostNetwork enabled", + "remediation": "Make sure that the hostNetwork field of the pod spec is not set to true (set to false or not present)", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Container hostPort", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "devops" + ] + }, + "controlID": "C-0044", + "creationTime": "", + "description": "Configuring hostPort requires a particular port number. If two objects specify the same HostPort, they could not be deployed to the same node. It may prevent the second object from starting, even if Kubernetes will try reschedule it on another node, provided there are available nodes with sufficient amount of resources. Also, if the number of replicas of such workload is higher than the number of nodes, the deployment will consistently fail.", + "remediation": "Avoid usage of hostPort unless it is absolutely necessary, in which case define appropriate exception. Use NodePort / ClusterIP instead.", + "rules": [ + { + "guid": "", + "name": "container-hostPort", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Fails if pod has container with hostPort\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n container := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n\tpath := is_host_port(container, i, beggining_of_path)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v has Host-port\", [ container.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# Fails if workload has container with hostPort\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n path := is_host_port(container, i, beggining_of_path)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v has Host-port\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# Fails if cronjob has container with hostPort\ndeny[msga] {\n \twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n path := is_host_port(container, i, beggining_of_path)\n msga := {\n\t\t\"alertMessage\": sprintf(\"Container: %v in %v: %v has Host-port\", [ container.name, wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 4,\n\t\t\"failedPaths\": path,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_host_port(container, i, beggining_of_path) = path {\n\tpath = [sprintf(\"%vcontainers[%v].ports[%v].hostPort\", [beggining_of_path, format_int(i, 10), format_int(j, 10)]) | port = container.ports[j]; port.hostPort]\n\tcount(path) \u003e 0\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container has hostPort", + "remediation": "Make sure you do not configure hostPort for the container, if necessary use NodePort / ClusterIP", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Insecure capabilities", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0046", + "creationTime": "", + "description": "Giving insecure or excessive capabilities to a container can increase the impact of the container compromise. This control identifies all the PODs with dangerous capabilities (see documentation pages for details).", + "remediation": "Remove all insecure capabilities which are not necessary for the container.", + "rules": [ + { + "guid": "", + "name": "insecure-capabilities", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data\nimport data.cautils as cautils\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in pod: %v have dangerous capabilities\", [container.name, pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in workload: %v have dangerous capabilities\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n result := is_dangerous_capabilities(container, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"container: %v in cronjob: %v have dangerous capabilities\", [container.name, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nis_dangerous_capabilities(container, beggining_of_path, i) = path {\n\t# see default-config-inputs.json for list values\n insecureCapabilities := data.postureControlInputs.insecureCapabilities\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capability = container.securityContext.capabilities.add[k]; cautils.list_contains(insecureCapabilities, capability)]\n\tcount(path) \u003e 0\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.insecureCapabilities" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.insecureCapabilities", + "name": "Insecure capabilities", + "description": "You can see the list of capabilities in https://man7.org/linux/man-pages/man7/capabilities.7.html. Kubescape looks for the following capabilities in containers which might lead to attackers getting high privileges in your system." + } + ], + "description": "fails if container has insecure capabilities", + "remediation": "Remove all insecure capabilities which aren’t necessary for the container.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Cluster internal networking", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery", + "Lateral movement" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Lateral movement" + ] + }, + "controlID": "C-0054", + "creationTime": "", + "description": "If no network policy is defined, attackers who gain access to a container may use it to move laterally in the cluster. This control lists namespaces in which no network policy is defined.", + "remediation": "Define Kubernetes network policies or use alternative products to protect cluster network.", + "rules": [ + { + "guid": "", + "name": "internal-networking", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Container internal networking, Discovery::Network mapping" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: network policies\n# apiversion: networking.k8s.io/v1\n# fails if no network policies are defined in a certain namespace\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\tpolicy_names := [policy.metadata.namespace | policy = input[_]; policy.kind == \"NetworkPolicy\"]\n\tnot list_contains(policy_names, namespace.metadata.name)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "package armo_builtins\n\n# input: network policies + namespaces\n# apiversion: networking.k8s.io/v1\n# returns all namespaces\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Namespace" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "lists namespaces in which no network policies are defined", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Linux hardening", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0055", + "creationTime": "", + "description": "Containers may be given more privileges than they actually need. This can increase the potential impact of a container compromise.", + "remediation": "You can use AppArmor, Seccomp, SELinux and Linux Capabilities mechanisms to restrict containers abilities to utilize unwanted privileges.", + "rules": [ + { + "guid": "", + "name": "linux-hardening", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# Fails if pod does not define linux security hardening \ndeny[msga] {\n\tobj := input[_]\n\tfix_paths := is_unsafe_obj(obj)\n\tcount(fix_paths) \u003e 0\n\n\t# final_fix_pathes := array.concat(fix_paths) # -\u003e produce only one failed result\n\tfinal_fix_pathes := fix_paths[_] # -\u003e produce failed result for each container\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%s: %s does not define any linux security hardening\", [obj.kind, obj.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": final_fix_pathes,\n\t\t\"alertObject\": {\"k8sApiObjects\": [obj]},\n\t}\n}\n\nis_unsafe_obj(obj) := fix_paths {\n\tobj.kind == \"Pod\"\n\tfix_paths := are_unsafe_specs(obj, [\"spec\"], [\"metadata\", \"annotations\"])\n} else := fix_paths {\n\tobj.kind == \"CronJob\"\n\tfix_paths := are_unsafe_specs(obj, [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"spec\"], [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"metadata\", \"annotations\"])\n} else := fix_paths {\n\tobj.kind in [\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\"]\n\tfix_paths := are_unsafe_specs(obj, [\"spec\", \"template\", \"spec\"], [\"spec\", \"template\", \"metadata\", \"annotations\"])\n}\n\nare_unsafe_specs(obj, specs_path, anotation_path) := paths {\n\t# spec\n\tspecs := object.get(obj, specs_path, null)\n\tspecs != null\n\tare_seccomp_and_selinux_disabled(specs)\n\n\t# annotation\n\tannotations := object.get(obj, anotation_path, [])\n\tapp_armor_annotations := [annotations[i] | annotation = i; startswith(i, \"container.apparmor.security.beta.kubernetes.io\")]\n\tcount(app_armor_annotations) == 0\n\n\t# container\n\tcontainers_path := array.concat(specs_path, [\"containers\"])\n\tcontainers := object.get(obj, containers_path, [])\n\n\t# Psuedo code explanation:\n\t# for i, container in containers\n\t# \t\tif is_unsafe_container:\n\t# \t\t\tfix_paths += [(containers_path[i] + field) for j, field in fix_fields]\n\t# \n\t# At the end we get [[\u003ccontainer1_path1\u003e, \u003ccontainer1_path2\u003e, ...], ...]\n\tcontainers_fix_path := concat(\".\", containers_path)\n\tfix_fields := [\"seccompProfile\", \"seLinuxOptions\", \"capabilities.drop[0]\"]\n\tpaths := [[{\n\t\t\"path\": sprintf(\"%s[%d].securityContext.%s\", [containers_fix_path, i, field]),\n\t\t\"value\": \"YOUR_VALUE\",\n\t} |\n\t\tfield := fix_fields[j]\n\t] |\n\t\tcontainer = containers[i]\n\t\tis_unsafe_container(container)\n\t]\n\n\tcount(paths) \u003e 0\n}\n\nare_seccomp_and_selinux_disabled(obj) {\n\tnot obj.securityContext.seccompProfile\n\tnot obj.securityContext.seLinuxOptions\n}\n\nis_unsafe_container(container) {\n\tare_seccomp_and_selinux_disabled(container)\n\tnot container.securityContext.capabilities.drop\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if container does not define any linux security hardening", + "remediation": "Make sure you define at least one linux security hardening property out of Seccomp, SELinux or Capabilities.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Privileged container", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ] + }, + "controlID": "C-0057", + "creationTime": "", + "description": "Potential attackers may gain access to privileged containers and inherit access to the host resources. Therefore, it is not recommended to deploy privileged containers unless it is absolutely necessary. This control identifies all the privileged Pods.", + "remediation": "Remove privileged capabilities by setting the securityContext.privileged to false. If you must deploy a Pod as privileged, add other restriction to it, such as network policy, Seccomp etc and still remove all unnecessary capabilities. Use the exception mechanism to remove unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "rule-privilege-escalation", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::privileged container", + "mitre": "Privilege Escalation", + "mitreCode": "TA0004" + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n#privileged pods\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following pods are defined as privileged: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is defined as privileged:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined as privileged: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n\n# Only SYS_ADMIN capabilite\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tnot container.securityContext.privileged == true\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path) \u003e 0\n}\n\n# Only securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tcontainer.securityContext.privileged == true\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003c 1\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])]\n}\n\n# SYS_ADMIN capabilite \u0026\u0026 securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003e 0\n\tcontainer.securityContext.privileged == true\n\tpath = array.concat(path1, [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])])\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if pods/deployments defined as privileged true", + "remediation": "avoid defining pods as privilleged", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Persistence", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0058", + "creationTime": "", + "description": "A user may be able to create a container with subPath or subPathExpr volume mounts to access files \u0026 directories anywhere on the host filesystem. Following Kubernetes versions are affected: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. This control checks the vulnerable versions and the actual usage of the subPath feature in all Pods in the cluster. If you want to learn more about the CVE, please refer to the CVE link: https://nvd.nist.gov/vuln/detail/CVE-2021-25741", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, or remove any existing Pods using subPath or subPathExpr feature.", + "rules": [ + { + "guid": "", + "name": "Symlink-Exchange-Can-Allow-Host-Filesystem-Access", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in pod : %v with subPath/subPathExpr\", [container.name, pod.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\nis_sub_path_container(container, i, beggining_of_path) = path {\n\tpath = [sprintf(\"%vcontainers[%v].volumeMounts[%v].subPath\" ,[beggining_of_path, format_int(i, 10), format_int(j, 10)]) | volume_mount = container.volumeMounts[j]; volume_mount.subPath]\n\tcount(path) \u003e 0\n}\n\nis_vulnerable_version(version) {\n version \u003c= \"v1.19.14\"\n}\n\nis_vulnerable_version(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nis_vulnerable_version(version){\n\tversion == \"v1.20.10\"\n}\n\n\n", + "resourceEnumerator": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n pod := input[_]\n pod.kind == \"Pod\"\n\n\tmsga := {\n\t\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n \n\tmsga := {\n\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\twl.kind == \"CronJob\"\n \n\tmsga := {\n\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\nisVulnerableVersion(version) {\n version \u003c= \"v1.19.14\"\n}\n\nisVulnerableVersion(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nisVulnerableVersion(version){\n\tversion == \"v1.20.10\"\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Node" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "A user may be able to create a container with subPath volume mounts to access files \u0026 directories outside of the volume, including on the host filesystem. This was affected at the following versions: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. ", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, and remove any existing Pods making use of the feature.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0059", + "creationTime": "", + "description": "Security issue in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster (see more at https://github.com/kubernetes/ingress-nginx/issues/7837)", + "remediation": "To mitigate this vulnerability: 1. Upgrade to a version that allows mitigation (\u003e= v0.49.1 or \u003e= v1.0.1), 2. Set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx", + "rules": [ + { + "guid": "", + "name": "nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tis_nginx_image(image)\n\tis_tag_image(image)\n\n\t# Extracting version from image tag\n\ttag_version_match := regex.find_all_string_submatch_n(\"[0-9]+\\\\.[0-9]+\\\\.[0-9]+\", image, -1)[0][0]\n image_version_str_arr := split(tag_version_match,\".\")\n\timage_version_arr := [to_number(image_version_str_arr[0]),to_number(image_version_str_arr[1]),to_number(image_version_str_arr[2])]\n\n\t# Check if vulnerable \n\tis_vulnerable(image_version_arr, deployment.metadata.namespace)\n\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. Deployment %v\", [deployment.metadata.name]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nis_nginx_image(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nis_allow_snippet_annotation_on(namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmap_on_ingress_namespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfig_maps_with_snippet := [configmap | configmap= configmap_on_ingress_namespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(config_maps_with_snippet) \u003c 1\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] \u003c 49\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] == 49\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\t\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 1\n\timage_version[1] == 0\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tisNginxImage(image)\n\tis_tag_image(image)\n\tisVulnerable(image, deployment.metadata.namespace)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. %v\", [deployment]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nisNginxImage(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag \u003c= \"v0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag == \"v1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag \u003c= \"v0.49\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag == \"v1.0.0\"\n}\n\n###### without 'v'\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag \u003c= \"0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag \u003c= \"0.49\"\n}\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmapOnIngressNamespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfigMapsWithSnippet := [configmap | configmap= configmapOnIngressNamespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(configMapsWithSnippet) \u003c 1\n}\n\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Deployment", + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Secret/ETCD encryption enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Impact" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0066", + "creationTime": "", + "description": "All Kubernetes Secrets are stored primarily in etcd therefore it is important to encrypt it.", + "remediation": "Turn on the etcd encryption in your cluster, for more see the vendor documentation.", + "rules": [ + { + "guid": "", + "name": "secret-etcd-encryption-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Check if encryption in etcd in enabled for AKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"management.azure.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"aks\"\t\n\tconfig = cluster_config.data\n\n\tnot isEncryptedAKS(config)\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"az aks nodepool add --name hostencrypt --cluster-name \u003cmyAKSCluster\u003e --resource-group \u003cmyResourceGroup\u003e -s Standard_DS2_v2 -l \u003cmyRegion\u003e --enable-encryption-at-host\",\n\t\t\"alertObject\": {\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n# Check if encryption in etcd in enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"eks\"\t\n\tconfig = cluster_config.data\n\n\tis_not_encrypted_EKS(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"eksctl utils enable-secrets-encryption --cluster=\u003ccluster\u003e --key-arn=arn:aws:kms:\u003ccluster_region\u003e:\u003caccount\u003e:key/\u003ckey\u003e --region=\u003cregion\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n\n# Check if encryption in etcd in enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n\n\tnot is_encrypted_GKE(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"data.database_encryption.state\"],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud container clusters update \u003ccluster_name\u003e --region=\u003ccompute_region\u003e --database-encryption-key=\u003ckey_project_id\u003e/locations/\u003clocation\u003e/keyRings/\u003cring_name\u003e/cryptoKeys/\u003ckey_name\u003e --project=\u003ccluster_project_id\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"1\"\n}\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"ENCRYPTED\"\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n goodResources := [resource | resource = cluster_config.Cluster.EncryptionConfig.Resources[_]; resource == \"secrets\"]\n\tcount(goodResources) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcluster_config.Cluster.EncryptionConfig == null\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcount(cluster_config.Cluster.EncryptionConfig) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n count(encryptionConfig.Resources) == 0\n}\n\nisEncryptedAKS(cluster_config) {\n\tcluster_config.properties.agentPoolProfiles.enableEncryptionAtHost == true\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "management.azure.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "container.googleapis.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "AKS", + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "etcd-encryption-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport data.cautils as cautils\n\n# Check if encryption in etcd is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n\tcmd := apiserverpod.spec.containers[0].command\n\tenc_command := [command | command := cmd[_]; contains(command, \"--encryption-provider-config=\")]\n\tcount(enc_command) \u003c 1\n\tfixpath := {\"path\":sprintf(\"spec.containers[0].command[%d]\", [count(cmd)]), \"value\": \"--encryption-provider-config=YOUR_VALUE\"}\n\n\tmsga := {\n\t\t\"alertMessage\": \"etcd encryption is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [fixpath],\n\t\t\"alertObject\": {\"k8sApiObjects\": [apiserverpod]},\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Audit logs enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Defense evasion - KubeAPI" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0067", + "creationTime": "", + "description": "Audit logging is an important security feature in Kubernetes, it enables the operator to track requests to the cluster. It is important to use it so the operator has a record of events happened in Kubernetes", + "remediation": "Turn on audit logging for your cluster. Look at the vendor guidelines for more details", + "rules": [ + { + "guid": "", + "name": "k8s-audit-logs-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.every\n\n# =============================== GKE ===============================\n# Check if audit logs is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"gke\"\n\tconfig := cluster_config.data\n\n\t# If enableComponents is empty, it will disable logging\n\t# https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#loggingcomponentconfig\n\tis_logging_disabled(config)\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nis_logging_disabled(cluster_config) {\n\tnot cluster_config.logging_config.component_config.enable_components\n}\n\nis_logging_disabled(cluster_config) {\n\tcluster_config.logging_config.component_config.enable_components\n\tcount(cluster_config.logging_config.component_config.enable_components) == 0\n}\n\n# =============================== EKS ===============================\n# Check if audit logs is enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"eks\"\n\tconfig := cluster_config.data\n\n\t# logSetup is an object representing the enabled or disabled Kubernetes control plane logs for your cluster.\n\t# types - available cluster control plane log types\n\t# https://docs.aws.amazon.com/eks/latest/APIReference/API_LogSetup.html\n\tlogging_types := {\"api\", \"audit\", \"authenticator\", \"controllerManager\", \"scheduler\"}\n\tlogSetups = config.Cluster.Logging.ClusterLogging\n\tnot all_auditlogs_enabled(logSetups, logging_types)\n\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixCommand\": \"aws eks update-cluster-config --region '${REGION_CODE}' --name '${CLUSTER_NAME}' --logging '{'clusterLogging':[{'types':['api','audit','authenticator','controllerManager','scheduler'],'enabled':true}]}'\",\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nall_auditlogs_enabled(logSetups, types) {\n\tevery type in types {\n\t\tauditlogs_enabled(logSetups, type)\n\t}\n}\n\nauditlogs_enabled(logSetups, type) {\n\tlogSetup := logSetups[_]\n\tlogSetup.Enabled == true\n\tlogSetup.Types[_] == type\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "k8s-audit-logs-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command\n\taudit_policy := [ command |command := cmd[_] ; contains(command, \"--audit-policy-file=\")]\n count(audit_policy) \u003c 1\n\tpath := \"spec.containers[0].command\"\t\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "PSP enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0068", + "creationTime": "", + "description": "PSP enable fine-grained authorization of pod creation and it is important to enable it", + "remediation": "Turn Pod Security Policies on in your cluster, if you use other admission controllers to control the behavior that PSP controls, exclude this control from your scans", + "rules": [ + { + "guid": "", + "name": "psp-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if PSP is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n not config.pod_security_policy_config.enabled == true\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"pod security policy configuration is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud beta container clusters update \u003ccluster_name\u003e --enable-pod-security-policy\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "psp-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command[j]\n contains(cmd, \"--enable-admission-plugins=\")\n output := split(cmd, \"=\")\n not contains(output[1], \"PodSecurityPolicy\")\n\tpath := sprintf(\"spec.containers[0].command[%v]\", [format_int(j, 10)])\t\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"PodSecurityPolicy is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 1 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Disable anonymous access to Kubelet service", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0069", + "creationTime": "", + "description": "By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.", + "remediation": "Start the kubelet with the --anonymous-auth=false flag.", + "rules": [ + { + "guid": "", + "name": "anonymous-requests-to-kubelet-service-updated", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n#CIS 4.2.1 https://workbench.cisecurity.org/sections/1126668/recommendations/1838638\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tcontains(command, \"--anonymous-auth\")\n\tcontains(command, \"--anonymous-auth=true\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tnot contains(command, \"--config\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tdecodedConfigContent := base64.decode(obj.data.configFile.content)\n\tyamlConfig := yaml.unmarshal(decodedConfigContent)\n\tnot yamlConfig.authentication.anonymous.enabled == false\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [\"authentication.anonymous.enabled\"],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"metadata\": obj.metadata,\n\t\t\t\"data\": {\"configFile\": {\"content\": decodedConfigContent}},\n\t\t}},\n\t}\n}\n\n## Host sensor failed to get config file content\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tnot obj.data.configFile.content\n\n\tmsga := {\n\t\t\"alertMessage\": \"Failed to analyze config file\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"data\": obj.data,\n\t\t}},\n\t}\n}\n\nis_kubelet_info(obj) {\n\tobj.kind == \"KubeletInfo\"\n\tobj.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletInfo" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if anonymous requests to the kubelet service are allowed.", + "remediation": "Disable anonymous requests by setting the anonymous-auth flag to false, or using the kubelet configuration file.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 10 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Enforce Kubelet client TLS authentication", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0070", + "creationTime": "", + "description": "Kubelets are the node level orchestrator in Kubernetes control plane. They are publishing service port 10250 where they accept commands from API server. Operator must make sure that only API server is allowed to submit commands to Kubelet. This is done through client certificate verification, must configure Kubelet with client CA file to use for this purpose.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "rules": [ + { + "guid": "", + "name": "enforce-kubelet-client-tls-authentication", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.kubernetes.api.client as client\n\n# Both config and cli present\ndeny[msga] {\n\t\tkubelet_config := input[_]\n\t\tkubelet_config.kind == \"KubeletConfiguration\"\n\t\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\t\tkubelet_cli := input[_] \n\t\tkubelet_cli.kind == \"KubeletCommandLine\"\n\t\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\t\tkubelet_cli_data := kubelet_cli.data\n\n\t\tresult := is_client_tls_disabled_both(kubelet_config, kubelet_cli_data)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [kubelet_config, kubelet_cli]\n\t\t\t},\n\t\t}\n\t}\n\n\n# Only of them present\ndeny[msga] {\n\t\tresult := is_client_tls_disabled_single(input)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [external_obj]\n\t\t\t},\n\t\t}\n\t}\n\n# CLI overrides config\nis_client_tls_disabled_both(kubelet_config, kubelet_cli_data) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n not kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\n# Only cli\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": []} {\n\tkubelet_cli := resources[_] \n\tkubelet_cli.kind == \"KubeletCommandLine\"\n\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_config := [config | config = resources[_]; config.kind == \"KubeletConfiguration\"]\n\tcount(kubelet_config) == 0\n\n\tobj = isClientTlsDisabledCli(kubelet_cli)\n\t\n}\n\n# Only config\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tkubelet_config := resources[_] \n\tkubelet_config.kind == \"KubeletConfiguration\"\n\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_cmd := [cmd | cmd = resources[_]; cmd.kind == \"KubeletCommandLine\"]\n\tcount(kubelet_cmd) == 0\n\n\tobj = is_Client_tls_disabled_config(kubelet_config)\n}\n\n\nis_Client_tls_disabled_config(kubelet_config) = obj {\n\tnot kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\nisClientTlsDisabledCli(kubelet_cli) = obj {\n\tkubelet_cli_data = kubelet_cli.data\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n\tobj = kubelet_cli\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletConfiguration", + "KubeletCommandLine" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "cautils" + }, + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if kubelet client tls authentication is enabled.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + } + ], + "controlsIDs": [ + "C-0002", + "C-0005", + "C-0009", + "C-0012", + "C-0013", + "C-0016", + "C-0017", + "C-0030", + "C-0034", + "C-0035", + "C-0038", + "C-0041", + "C-0044", + "C-0046", + "C-0054", + "C-0055", + "C-0057", + "C-0058", + "C-0059", + "C-0066", + "C-0067", + "C-0068", + "C-0069", + "C-0070" + ] + }, + { + "guid": "", + "name": "MITRE", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "description": "Testing MITRE for Kubernetes as suggested by microsoft in https://www.microsoft.com/security/blog/wp-content/uploads/2020/04/k8s-matrix.png", + "controls": [ + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Exec into container", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Execution" + ], + "rbacQuery": "Show who can access into pods" + }, + "controlID": "C-0002", + "creationTime": "", + "description": "Attackers with relevant permissions can run malicious commands in the context of legitimate containers in the cluster using “kubectl exec” command. This control determines which subjects have permissions to use this command.", + "remediation": "It is recommended to prohibit “kubectl exec” command in production environments. It is also recommended not to use subjects with this permission for daily cluster operations.", + "rules": [ + { + "guid": "", + "name": "exec-into-container-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Exec into container", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# input: regoResponseVectorObject\n# returns subjects that can exec into container\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"create\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"pods/exec\", \"pods/*\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can exec into containers\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "rbac.authorization.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "RoleBinding", + "ClusterRoleBinding", + "Role", + "ClusterRole" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have permissions to exec into pods", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Data Destruction", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Impact" + ], + "rbacQuery": "Data destruction" + }, + "controlID": "C-0007", + "creationTime": "", + "description": "Attackers may attempt to destroy data and resources in the cluster. This includes deleting deployments, configurations, storage, and compute resources. This control identifies all subjects that can delete resources.", + "remediation": "You should follow the least privilege principle and minimize the number of subjects that can delete resources.", + "rules": [ + { + "guid": "", + "name": "rule-excessive-delete-rights-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Impact::Data Destruction", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can can delete important resources\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"delete\", \"deletecollection\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\", \"apps\", \"batch\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"secrets\", \"pods\", \"services\", \"deployments\", \"replicasets\", \"daemonsets\", \"statefulsets\", \"jobs\", \"cronjobs\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can delete important resources\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if user can delete important resources", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Applications credentials in configuration files", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Credential access" + ] + }, + { + "attackTrack": "container", + "categories": [ + "Credential access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Credential access", + "Lateral Movement" + ] + }, + "controlID": "C-0012", + "creationTime": "", + "description": "Attackers who have access to configuration files can steal the stored secrets and use them. This control checks if ConfigMaps or pod specifications have sensitive information in their configuration.", + "remediation": "Use Kubernetes secrets or Key Management Systems to store credentials.", + "rules": [ + { + "guid": "", + "name": "rule-credentials-in-env-var", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "\tpackage armo_builtins\n\t# import data.cautils as cautils\n\t# import data.kubernetes.api.client as client\n\timport data\n\n\tdeny[msga] {\n\t\tpod := input[_]\n\t\tpod.kind == \"Pod\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := pod.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Pod: %v has sensitive information in environment variables\", [pod.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [pod]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\t\tspec_template_spec_patterns[wl.kind]\n\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\n\t\tis_not_reference(env)\n\n\t\tpath := sprintf(\"spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\t\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"%v: %v has sensitive information in environment variables\", [wl.kind, wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\tdeny[msga] {\n\t\twl := input[_]\n\t\twl.kind == \"CronJob\"\n\t\t# see default-config-inputs.json for list values\n\t\tsensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n\t\tkey_name := sensitive_key_names[_]\n\t\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\t\tenv := container.env[j]\n\n\t\tcontains(lower(env.name), key_name)\n\n\t\tenv.value != \"\"\n\t\t# check that value wasn't allowed by user\n\t\tnot is_allowed_value(env.value) \n\t\t\n\t\tis_not_reference(env)\n\t\t\n\t\tpath := sprintf(\"spec.jobTemplate.spec.template.spec.containers[%v].env[%v].name\", [format_int(i, 10), format_int(j, 10)])\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"Cronjob: %v has sensitive information in environment variables\", [wl.metadata.name]),\n\t\t\t\"alertScore\": 9,\n\t\t\t\"fixPaths\": [],\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [wl]\n\t\t\t}\n\t\t}\n\t}\n\n\n\nis_not_reference(env)\n{\n\tnot env.valueFrom.secretKeyRef\n\tnot env.valueFrom.configMapKeyRef\n}\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if Pods have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + }, + { + "guid": "", + "name": "rule-credentials-configmap", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential access::Applications credentials in configuration files, Lateral Movement::Applications credentials in configuration files" + }, + "creationTime": "", + "rule": "package armo_builtins\n# import data.cautils as cautils\n# import data.kubernetes.api.client as client\nimport data\n\n# fails if config map has keys with suspicious name\ndeny[msga] {\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n # see default-config-inputs.json for list values\n sensitive_key_names := data.postureControlInputs.sensitiveKeyNames\n key_name := sensitive_key_names[_]\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n \n contains(lower(map_key), lower(key_name))\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n \n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - not base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n regex.match(value , map_secret)\n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n# fails if config map has values with suspicious content - base 64\ndeny[msga] {\n # see default-config-inputs.json for list values\n sensitive_values := data.postureControlInputs.sensitiveValues\n value := sensitive_values[_]\n\n\tconfigmap := input[_]\n configmap.kind == \"ConfigMap\"\n map_secret := configmap.data[map_key]\n map_secret != \"\"\n\n decoded_secret := base64.decode(map_secret)\n \n # check that value wasn't allowed by user\n not is_allowed_value(map_secret)\n\n regex.match(value , decoded_secret)\n\n path := sprintf(\"data[%v]\", [map_key])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"this configmap has sensitive information: %v\", [configmap.metadata.name]),\n\t\t\"alertScore\": 9,\n \"failedPaths\": [path],\n \"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [configmap]\n\t\t}\n }\n}\n\n\nis_allowed_value(value) {\n allow_val := data.postureControlInputs.sensitiveValuesAllowed[_]\n value == allow_val\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": [ + "settings.postureControlInputs.sensitiveValues", + "settings.postureControlInputs.sensitiveKeyNames", + "settings.postureControlInputs.sensitiveValuesAllowed" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveValues", + "name": "Values", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Below you can find some examples of popular value phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveKeyNames", + "name": "Keys", + "description": "Secrets are stored as a key/value pair. The names of the keys/values may change from one company to the other. Here you can find some examples of popular key phrases that Kubescape is searching for" + }, + { + "path": "settings.postureControlInputs.sensitiveValuesAllowed", + "name": "AllowedValues", + "description": "Allowed values" + } + ], + "description": "fails if ConfigMaps have sensitive information in configuration", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "", + "", + "" + ], + "guid": "", + "name": "Access Kubernetes dashboard", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery", + "Lateral Movement" + ], + "rbacQuery": "Access k8s Dashboard" + }, + "controlID": "C-0014", + "creationTime": "", + "description": "Attackers who gain access to the dashboard service account or have its RBAC permissions can use its network access to retrieve information about resources in the cluster or change them. This control checks if a subject that is not dashboard service account is bound to dashboard role/clusterrole, or - if anyone that is not the dashboard pod is associated with dashboard service account.", + "remediation": "Make sure that the “Kubernetes Dashboard” service account is only bound to the Kubernetes dashboard following the least privilege principle.", + "rules": [ + { + "guid": "", + "name": "rule-access-dashboard-subject-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Access Kubernetes dashboard, Discovery::Access Kubernetes dashboard", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: regoResponseVectorObject\n# fails if a subject that is not dashboard service account is bound to dashboard role\n\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(subjectVector.relatedObjects[i].kind, \"Role\")\n\tendswith(subjectVector.relatedObjects[j].kind, \"Binding\")\n\n\trole.metadata.name == \"kubernetes-dashboard\"\n\tsubjectVector.name != \"kubernetes-dashboard\"\n\n\tsubject := rolebinding.subjects[k]\n path := [sprintf(\"relatedObjects[%v].subjects[%v]\", [format_int(j, 10), format_int(k, 10)])]\n\tfinalpath := array.concat(path, [sprintf(\"relatedObjects[%v].roleRef.name\", [format_int(j, 10)])])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %v-%v is bound to dashboard role/clusterrole\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 9,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if subject that is not dashboard service account is bound to dashboard role/clusterrole, or- if anyone that is not dashboard pod is associated with its service account.", + "remediation": "", + "ruleQuery": "", + "relevantCloudProviders": null + }, + { + "guid": "", + "name": "rule-access-dashboard-wl-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Access Kubernetes dashboard, Discovery::Access Kubernetes dashboard", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: \n# apiversion: \n# fails if pod that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n pod := input[_]\n pod.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(pod.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following pods: %s are associated with dashboard service account\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [\"spec.serviceaccountname\"],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n# input: \n# apiversion: \n# fails if workload that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n wl.spec.template.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(wl.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is associated with dashboard service account\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"spec.template.spec.serviceaccountname\"],\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n# input: \n# apiversion: \n# fails if CronJob that is not dashboard is associated to dashboard service account\n\ndeny[msga] {\n wl := input[_]\n\twl.kind == \"CronJob\"\n wl.spec.jobTemplate.spec.template.spec.serviceAccountName == \"kubernetes-dashboard\"\n not startswith(wl.metadata.name, \"kubernetes-dashboard\")\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjob: %s is associated with dashboard service account\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": [\"spec.jobTemplate.spec.template.spec.serviceaccountname\"],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "fails if subject that is not dashboard service account is bound to dashboard role/clusterrole, or- if anyone that is not dashboard pod is associated with its service account.", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 2 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "List Kubernetes secrets", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Credential access" + ] + } + ], + "controlTypeTags": [ + "security-impact", + "compliance" + ], + "microsoftMitreColumns": [ + "Credential access" + ], + "rbacQuery": "Show who can access secrets" + }, + "controlID": "C-0015", + "creationTime": "", + "description": "Attackers who have permissions to access secrets can access sensitive information that might include credentials to various services. This control determines which user, group or service account can list/get secrets.", + "remediation": "Monitor and approve list of users, groups and service accounts that can access secrets. Use exception mechanism to prevent repetitive the notifications.", + "rules": [ + { + "guid": "", + "name": "rule-can-list-get-secrets-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Discovery::Access the K8s API server", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can list/get secrets \ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"get\", \"list\", \"watch\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"secrets\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can read secrets\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can list/get secrets", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Mount service principal", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Credential Access" + ] + }, + "controlID": "C-0020", + "creationTime": "", + "description": "When a cluster is deployed in the cloud, in some cases attackers can leverage their access to a container in the cluster to gain cloud credentials. This control determines if any workload contains a volume with potential access to cloud credential.", + "remediation": "Refrain from using path mount to known cloud credentials folders or files .", + "rules": [ + { + "guid": "", + "name": "alert-mount-potential-credentials-paths", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\nimport future.keywords.if\n\n\ndeny[msga] {\n\tprovider := data.dataControlInputs.cloudProvider\n\tprovider != \"\"\n\tresources := input[_]\n\tvolumes_data := get_volumes(resources)\n volumes := volumes_data[\"volumes\"]\n volume := volumes[i]\n\tbeggining_of_path := volumes_data[\"beggining_of_path\"]\n result := is_unsafe_paths(volume, beggining_of_path, provider,i)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as volume with potential credentials access.\", [resources.kind, resources.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [resources]\n\t\t}\n\t}\t\n}\n\n\t\n# get_volume - get resource volumes paths for {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\nget_volumes(resources) := result {\n\tresources_kinds := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tresources_kinds[resources.kind]\n\tresult = {\"volumes\": resources.spec.template.spec.volumes, \"beggining_of_path\": \"spec.template.spec.\"}\n}\n\n# get_volume - get resource volumes paths for \"Pod\"\nget_volumes(resources) := result {\n\tresources.kind == \"Pod\"\n\tresult = {\"volumes\": resources.spec.volumes, \"beggining_of_path\": \"spec.\"}\n}\n\n# get_volume - get resource volumes paths for \"CronJob\"\nget_volumes(resources) := result {\n\tresources.kind == \"CronJob\"\n\tresult = {\"volumes\": resources.spec.jobTemplate.spec.template.spec.volumes, \"beggining_of_path\": \"spec.jobTemplate.spec.template.spec.\"}\n}\n\n\n# is_unsafe_paths - looking for cloud provider (eks/gke/aks) paths that have the potential of accessing credentials\nis_unsafe_paths(volume, beggining_of_path, provider, i) = result {\n\tunsafe := unsafe_paths(provider)\n\tunsafe[_] == fix_path(volume.hostPath.path)\n\tresult= sprintf(\"%vvolumes[%d].hostPath.path\", [beggining_of_path, i])\n}\n\n\n# fix_path - adding \"/\" at the end of the path if doesn't exist and if not a file path.\nfix_path(path) := result if {\n\n\t# filter file path\n not regex.match(`[\\\\w-]+\\\\.`, path)\n\n\t# filter path that doesn't end with \"/\"\n not endswith(path, \"/\")\n\n\t# adding \"/\" to the end of the path\n result = sprintf(\"%v/\", [path])\n} else := path\n\n\n\n# eks unsafe paths\nunsafe_paths(x) := [\"/.aws/\", \n\t\t\t\t\t\"/.aws/config/\", \n\t\t\t\t\t\"/.aws/credentials/\"] if {x==\"eks\"}\n\n# aks unsafe paths\nunsafe_paths(x) := [\"/etc/\",\n\t\t\t\t\t\"/etc/kubernetes/\",\n\t\t\t\t\t\"/etc/kubernetes/azure.json\", \n\t\t\t\t\t\"/.azure/\",\n\t\t\t\t\t\"/.azure/credentials/\", \n\t\t\t\t\t\"/etc/kubernetes/azure.json\"] if {x==\"aks\"}\n\n# gke unsafe paths\nunsafe_paths(x) := [\"/.config/gcloud/\", \n\t\t\t\t\t\"/.config/\", \n\t\t\t\t\t\"/gcloud/\", \n\t\t\t\t\t\"/.config/gcloud/application_default_credentials.json\",\n\t\t\t\t\t\"/gcloud/application_default_credentials.json\"] if {x==\"gke\"}\n\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume", + "remediation": "Try to refrain from using hostPath mounts", + "ruleQuery": "", + "relevantCloudProviders": [ + "EKS", + "GKE", + "AKS" + ] + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Exposed sensitive interfaces", + "attributes": { + "actionRequired": "configuration", + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Initial access" + ] + }, + "controlID": "C-0021", + "creationTime": "", + "description": "Exposing a sensitive interface to the internet poses a security risk. It might enable attackers to run malicious code or deploy containers in the cluster. This control checks if known components (e.g. Kubeflow, Argo Workflows, etc.) are deployed and exposed services externally.", + "remediation": "Consider blocking external interfaces or protect them with appropriate security tools.", + "rules": [ + { + "guid": "", + "name": "exposed-sensitive-interfaces-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Initial access::Exposed sensitive interfaces", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.kubernetes.api.client as client\nimport data\n\n# loadbalancer\ndeny[msga] {\n\twl := input[_]\n\tworkload_types = {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"Pod\", \"CronJob\"}\n\tworkload_types[wl.kind]\n\n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"LoadBalancer\"\n\n\tresult := wl_connectedto_service(wl, service)\n \n # externalIP := service.spec.externalIPs[_]\n\texternalIP := service.status.loadBalancer.ingress[0].ip\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\n\n# nodePort\n# get a pod connected to that service, get nodeIP (hostIP?)\n# use ip + nodeport\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"Pod\"\n \n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n \n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"NodePort\"\n\n\tresult := wl_connectedto_service(wl, service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n} \n\n# nodePort\n# get a workload connected to that service, get nodeIP (hostIP?)\n# use ip + nodeport\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"CronJob\"}\n\tspec_template_spec_patterns[wl.kind]\n \n # see default-config-inputs.json for list values\n wl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n \n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.spec.type == \"NodePort\"\n\n\tresult := wl_connectedto_service(wl, service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": [service]}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service: %v is exposed\", [service.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": result,\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\n# ====================================================================================\n\nwl_connectedto_service(wl, service) = paths{\n\tcount({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)\n\tpaths = [\"spec.selector.matchLabels\", \"service.spec.selector\"]\n}\n\nwl_connectedto_service(wl, service) = paths {\n\twl.spec.selector.matchLabels == service.spec.selector\n\tpaths = [\"spec.selector.matchLabels\", \"service.spec.selector\"]\n}", + "resourceEnumerator": "package armo_builtins\nimport data.kubernetes.api.client as client\nimport data\n\ndeny[msga] {\n\twl := input[_]\n\tworkload_types = {\"Deployment\", \"ReplicaSet\", \"DaemonSet\", \"StatefulSet\", \"Job\", \"Pod\", \"CronJob\"}\n\tworkload_types[wl.kind]\n\n\t# see default-config-inputs.json for list values\n\twl_names := data.postureControlInputs.sensitiveInterfaces\n\twl_name := wl_names[_]\n\tcontains(wl.metadata.name, wl_name)\n\n\tsrvc := get_wl_connectedto_service(wl)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": srvc}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"wl: %v is in the cluster\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n\t}\n}\n\nget_wl_connectedto_service(wl) = s {\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\twl_connectedto_service(wl, service)\n\ts = [service]\n}\n\nget_wl_connectedto_service(wl) = s {\n\tservices := [service | service = input[_]; service.kind == \"Service\"]\n\tcount({i | services[i]; wl_connectedto_service(wl, services[i])}) == 0\n\ts = []\n}\n\nwl_connectedto_service(wl, service){\n\tcount({x | service.spec.selector[x] == wl.metadata.labels[x]}) == count(service.spec.selector)\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Service" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": [ + "settings.postureControlInputs.sensitiveInterfaces" + ], + "controlConfigInputs": [ + { + "path": "settings.postureControlInputs.sensitiveInterfaces", + "name": "Sensitive interfaces", + "description": "The following interfaces were seen exploited. Kubescape checks it they are externally exposed." + } + ], + "description": "fails if known interfaces have exposed services", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Kubernetes CronJob", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Persistence" + ] + }, + "controlID": "C-0026", + "creationTime": "", + "description": "Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a POD in the cluster. This control lists all the CronJobs that exist in the cluster for the user to approve.", + "remediation": "Watch Kubernetes CronJobs and make sure they are legitimate.", + "rules": [ + { + "guid": "", + "name": "rule-deny-cronjobs", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Kubernetes Cronjob" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# alert cronjobs\n\n#handles cronjob\ndeny[msga] {\n\n\twl := input[_]\n\twl.kind == \"CronJob\"\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined: %v\", [wl.metadata.name]),\n\t\t\"alertScore\": 2,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if it's cronjob", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 1 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Delete Kubernetes events", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Defense evasion" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Defense evasion" + ], + "rbacQuery": "Show who can delete k8s events" + }, + "controlID": "C-0031", + "creationTime": "", + "description": "Attackers may delete Kubernetes events to avoid detection of their activity in the cluster. This control identifies all the subjects that can delete Kubernetes events.", + "remediation": "You should follow the least privilege principle. Minimize the number of subjects who can delete Kubernetes events. Avoid using these subjects in the daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-can-delete-k8s-events-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Defense Evasion::Delete K8S events", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# fails if user can delete events\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"delete\", \"deletecollection\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"events\", \"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can delete events\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can delete events", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Cluster-admin binding", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ], + "rbacQuery": "Show cluster_admin" + }, + "controlID": "C-0035", + "creationTime": "", + "description": "Attackers who have cluster admin permissions (can perform any action on any resource), can take advantage of their privileges for malicious activities. This control determines which subjects have cluster admin permissions.", + "remediation": "You should apply least privilege principle. Make sure cluster admin permissions are granted only when it is absolutely necessary. Don't use subjects with such high permissions for daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-list-all-cluster-admins-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::Cluster-admin binding", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# returns subjects with cluster admin permissions\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nis_same_subjects(subjectVector, subject)\n\trule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"*\", \"\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"*\"]\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s have high privileges, such as cluster-admin\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users have cluster admin permissions", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Malicious admission controller (validating)", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - data destruction", + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Credential access" + ] + }, + "controlID": "C-0036", + "creationTime": "", + "description": "Attackers can use validating webhooks to intercept and discover all the resources in the cluster. This control lists all the validating webhook configurations that must be verified.", + "remediation": "Ensure all the webhooks are necessary. Use exception mechanism to prevent repititive notifications.", + "rules": [ + { + "guid": "", + "name": "list-all-validating-webhooks", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential Access::Malicious admission controller" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny [msga] {\n admissionwebhooks := [admissionwebhook | admissionwebhook = input[_]; admissionwebhook.kind == \"ValidatingWebhookConfiguration\"]\n admissionwebhook := admissionwebhooks[_]\n\n \tmsga := {\n\t\t\"alertMessage\": sprintf(\"The following validating webhook configuration should be checked %v.\", [admissionwebhook.metadata.name]),\n\t\t\"alertScore\": 6,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [admissionwebhook]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "admissionregistration.k8s.io" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "ValidatingWebhookConfiguration" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Returns validating webhook configurations to be verified", + "remediation": "Analyze webhook for malicious behavior", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "CoreDNS poisoning", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Lateral Movement" + ] + }, + "controlID": "C-0037", + "creationTime": "", + "description": "If attackers have permissions to modify the coredns ConfigMap they can change the behavior of the cluster’s DNS, poison it, and override the network identity of other services. This control identifies all subjects allowed to update the 'coredns' configmap.", + "remediation": "You should follow the least privilege principle. Monitor and approve all the subjects allowed to modify the 'coredns' configmap. It is also recommended to remove this permission from the users/service accounts used in the daily operations.", + "rules": [ + { + "guid": "", + "name": "rule-can-update-configmap-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Lateral Movement::CoreDNS poisoning", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.in\n\n# Fails if user can modify all configmaps\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"update\", \"patch\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"configmaps\", \"*\"]\n\tnot rule.resourceNames\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can modify 'coredns' configmap\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n# Fails if user can modify the 'coredns' configmap (default for coredns)\ndeny[msga] {\n\tsubjectVector := input[_]\n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n\trule := role.rules[p]\n\tsubject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\nrule_path := sprintf(\"relatedObjects[%d].rules[%d]\", [i, p])\n\n\tverbs := [\"update\", \"patch\", \"*\"]\n\tverb_path := [sprintf(\"%s.verbs[%d]\", [rule_path, l]) | verb = rule.verbs[l]; verb in verbs]\n\tcount(verb_path) \u003e 0\n\n\tapi_groups := [\"\", \"*\"]\n\tapi_groups_path := [sprintf(\"%s.apiGroups[%d]\", [rule_path, a]) | apiGroup = rule.apiGroups[a]; apiGroup in api_groups]\n\tcount(api_groups_path) \u003e 0\n\n\tresources := [\"configmaps\", \"*\"]\n\t\"coredns\" in rule.resourceNames\n\tresources_path := [sprintf(\"%s.resources[%d]\", [rule_path, l]) | resource = rule.resources[l]; resource in resources]\n\tcount(resources_path) \u003e 0\n\n\tpath := array.concat(resources_path, verb_path)\n\tpath2 := array.concat(path, api_groups_path)\n\tfinalpath := array.concat(path2, [\n\t\tsprintf(\"relatedObjects[%d].subjects[%d]\", [j, k]),\n\t\tsprintf(\"relatedObjects[%d].roleRef.name\", [j]),\n\t])\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Subject: %s-%s can modify 'coredns' configmap\", [subjectVector.kind, subjectVector.name]),\n\t\t\"alertScore\": 3,\n\t\t\"failedPaths\": finalpath,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": subjectVector,\n\t\t},\n\t}\n}\n\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}\n\n# for users/ groups\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.apiGroup == subject.apiGroup\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Role", + "ClusterRole", + "ClusterRoleBinding", + "RoleBinding" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which users can update/patch the 'coredns' configmap", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Malicious admission controller (mutating)", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Persistence" + ] + }, + "controlID": "C-0039", + "creationTime": "", + "description": "Attackers may use mutating webhooks to intercept and modify all the resources in the cluster. This control lists all mutating webhook configurations that must be verified.", + "remediation": "Ensure all the webhooks are necessary. Use exception mechanism to prevent repititive notifications.", + "rules": [ + { + "guid": "", + "name": "list-all-mutating-webhooks", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Malicious admission controller" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny [msga] {\n mutatingwebhooks := [mutatingwebhook | mutatingwebhook = input[_]; mutatingwebhook.kind == \"MutatingWebhookConfiguration\"]\n mutatingwebhook := mutatingwebhooks[_]\n\n \tmsga := {\n\t\t\"alertMessage\": sprintf(\"The following mutating webhook configuration should be checked %v.\", [mutatingwebhook.metadata.name]),\n\t\t\"alertScore\": 6,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [mutatingwebhook]\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "admissionregistration.k8s.io" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "MutatingWebhookConfiguration" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Returns mutating webhook configurations to be verified", + "remediation": "Analyze webhook for malicious behavior", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "SSH server running inside container", + "attributes": { + "armoBuiltin": true, + "controlTypeTags": [ + "compliance" + ], + "microsoftMitreColumns": [ + "Execution" + ] + }, + "controlID": "C-0042", + "creationTime": "", + "description": "An SSH server that is running inside a container may be used by attackers to get remote access to the container. This control checks if pods have an open SSH port (22/2222).", + "remediation": "Remove SSH from the container image or limit the access to the SSH server using network policies.", + "rules": [ + { + "guid": "", + "name": "rule-can-ssh-to-pod-v1", + "attributes": { + "armoBuiltin": true, + "microsoftK8sThreatMatrix": "Execution::SSH server running inside container", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: pod\n# apiversion: v1\n# does:\treturns the external facing services of that pod\n\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tpodns := pod.metadata.namespace\n\tpodname := pod.metadata.name\n\tlabels := pod.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n path := \"metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == podns\n\tservice.spec.selector == filtered_labels\n \n\thasSSHPorts(service)\n\n\twlvector = {\"name\": pod.metadata.name,\n\t\t\t\t\"namespace\": pod.metadata.namespace,\n\t\t\t\t\"kind\": pod.kind,\n\t\t\t\t\"relatedObjects\": service}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed by SSH services: %v\", [podns, podname, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tlabels := wl.spec.template.metadata.labels\n path := \"spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\thasSSHPorts(service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tlabels := wl.spec.jobTemplate.spec.template.metadata.labels\n path := \"spec.jobTemplate.spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\thasSSHPorts(service)\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 2222\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 2222\n}\n", + "resourceEnumerator": "package armo_builtins\n\n# input: pod\n# apiversion: v1\n# does:\treturns the external facing services of that pod\n\ndeny[msga] {\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tpodns := pod.metadata.namespace\n\tpodname := pod.metadata.name\n\tlabels := pod.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n path := \"metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == podns\n\tservice.spec.selector == filtered_labels\n\n\n\twlvector = {\"name\": pod.metadata.name,\n\t\t\t\t\"namespace\": pod.metadata.namespace,\n\t\t\t\t\"kind\": pod.kind,\n\t\t\t\t\"relatedObjects\": service}\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed by SSH services: %v\", [podns, podname, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tlabels := wl.spec.template.metadata.labels\n path := \"spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tlabels := wl.spec.jobTemplate.spec.template.metadata.labels\n path := \"spec.jobTemplate.spec.template.metadata.labels\"\n\tservice := \tinput[_]\n\tservice.kind == \"Service\"\n\tservice.metadata.namespace == wl.metadata.namespace\n\tservice.spec.selector == labels\n\n\n\twlvector = {\"name\": wl.metadata.name,\n\t\t\t\t\"namespace\": wl.metadata.namespace,\n\t\t\t\t\"kind\": wl.kind,\n\t\t\t\t\"relatedObjects\": service}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is exposed by SSH services: %v\", [wl.kind, wl.metadata.name, service]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [path],\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": wlvector\n\t\t}\n }\n}\n", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Service" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "denies pods with SSH ports opened(22/222)", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 3 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Writable hostPath mount", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Persistence", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance", + "devops", + "security-impact" + ], + "microsoftMitreColumns": [ + "Persistence", + "Lateral Movement" + ] + }, + "controlID": "C-0045", + "creationTime": "", + "description": "Mounting host directory to the container can be used by attackers to get access to the underlying host and gain persistence.", + "remediation": "Refrain from using the hostPath mount or use the exception mechanism to remove unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "alert-rw-hostpath", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Persistence::Writable hostPath mount, Lateral Movement::Writable volume mounts on the host" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Fails if container has a hostPath volume which is not readOnly\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := pod.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n podname := pod.metadata.name\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has: %v as hostPath volume\", [podname, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := wl.spec.template.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.template.spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k)\n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"fixPaths\": fixed_path,\n\t\t\"failedPaths\": failed_path,\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t\n\t}\n}\n\n#handles CronJobs\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n volumes := wl.spec.jobTemplate.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tvolume_mount := container.volumeMounts[k]\n\tvolume_mount.name == volume.name\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := is_rw_mount(volume_mount, beggining_of_path, i, k) \n\tfailed_path := get_failed_path(result)\n fixed_path := get_fixed_path(result)\n\n\n\tmsga := {\n\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\"packagename\": \"armo_builtins\",\n\t\"alertScore\": 7,\n\t\"fixPaths\": fixed_path,\n\t\"failedPaths\": failed_path,\n\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nget_failed_path(paths) = [paths[0]] {\n\tpaths[0] != \"\"\n} else = []\n\n\nget_fixed_path(paths) = [paths[1]] {\n\tpaths[1] != \"\"\n} else = []\n\n\nis_rw_mount(mount, beggining_of_path, i, k) = [failed_path, fix_path] {\n\tnot mount.readOnly == true\n \tnot mount.readOnly == false\n\tfailed_path = \"\"\n fix_path = {\"path\": sprintf(\"%vcontainers[%v].volumeMounts[%v].readOnly\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]), \"value\":\"true\"}\n}\n\nis_rw_mount(mount, beggining_of_path, i, k) = [failed_path, fix_path] {\n \tmount.readOnly == false\n \tfailed_path = sprintf(\"%vcontainers[%v].volumeMounts[%v].readOnly\", [beggining_of_path, format_int(i, 10), format_int(k, 10)])\n fix_path = \"\"\n} ", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "cautils" + }, + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume with rw permissions", + "remediation": "Set the readOnly field of the mount to true", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "HostPath mount", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ] + }, + "controlID": "C-0048", + "creationTime": "", + "description": "Mounting host directory to the container can be used by attackers to get access to the underlying host. This control identifies all the PODs using hostPath mount.", + "remediation": "Remove hostPath mounts unless they are absolutely necessary and use exception mechanism to remove notifications.", + "rules": [ + { + "guid": "", + "name": "alert-any-hostpath", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::hostPath mount" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.\"\n\tresult := is_dangerous_host_path(volume, beggining_of_path, i)\n podname := pod.metadata.name\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has: %v as hostPath volume\", [podname, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n result := is_dangerous_host_path(volume, beggining_of_path, i)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n#handles CronJobs\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n volumes := wl.spec.jobTemplate.spec.template.spec.volumes\n volume := volumes[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n result := is_dangerous_host_path(volume, beggining_of_path, i)\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"fixPaths\":[],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\n\n\nis_dangerous_host_path(volume, beggining_of_path, i) = path {\n startswith(volume.hostPath.path, \"/etc\")\n\tpath = sprintf(\"%vvolumes[%v].hostPath.path\", [beggining_of_path, format_int(i, 10)])\n}\n\nis_dangerous_host_path(volume, beggining_of_path, i) = path {\n startswith(volume.hostPath.path, \"/var\")\n\tpath = sprintf(\"%vvolumes[%v].hostPath.path\", [beggining_of_path, format_int(i, 10)])\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if any workload contains a hostPath volume", + "remediation": "Try to refrain from using hostPath mounts", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Instance Metadata API", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Discovery", + "Impact - service access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Discovery" + ] + }, + "controlID": "C-0052", + "creationTime": "", + "description": "Attackers who gain access to a container, may query the metadata API service for getting information about the underlying node. This control checks if there is access from the nodes to cloud providers instance metadata services.", + "remediation": "Disable metadata services for pods in cloud provider settings.", + "rules": [ + { + "guid": "", + "name": "instance-metadata-api-access", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true", + "m$K8sThreatMatrix": "Credential Access::Instance Metadata API" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msg] {\n\tobj = input[_]\n\tis_cloud_provider_info(obj)\n\n\tobj.data.providerMetaDataAPIAccess == true\n\n\n\tmsg := {\n\t\t\"alertMessage\": sprintf(\"Node '%s' has access to Instance Metadata Services of cloud provider.\", [obj.metadata.name]),\n\t\t\"alert\": true,\n\t\t\"alertScore\": 1,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"externalObjects\": obj\n\t\t},\n\t\t\"packagename\": \"armo_builtins\"\n\t}\n\n}\n\n\n\nis_cloud_provider_info(obj) {\n\tobj.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\tobj.kind == \"cloudProviderInfo\"\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "cloudProviderInfo" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Checks if there is access from the nodes to cloud prividers instance metadata services", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 7 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Access container service account", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Credential access", + "Impact - K8s API access" + ] + } + ], + "controlTypeTags": [ + "compliance", + "security-impact" + ], + "microsoftMitreColumns": [ + "Credential access" + ], + "rbacQuery": "Container service account mapping" + }, + "controlID": "C-0053", + "creationTime": "", + "description": "Attackers who obtain access to a pod can use its SA token to communicate with KubeAPI server. All PODs with SA token mounted (if such token has a Role or a ClusterRole binding) are considerred potentially dangerous.", + "remediation": "Verify that RBAC is enabled. Follow the least privilege principle and ensure that only necessary PODs have SA token mounted into them.", + "rules": [ + { + "guid": "", + "name": "access-container-service-account-v1", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Credential Access::Access container service account, Lateral Movement::Container service account", + "resourcesAggregator": "subject-role-rolebinding", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Returns the rbac permission of each service account\ndeny[msga] {\n subjectVector := input[_]\n subjectVector.kind == \"ServiceAccount\"\n \n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n subject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service account: %v has the following permissions in the cluster\", [subjectVector.name]),\n\t\t\"packagename\": \"armo_builtins\",\n \"failedPaths\": [],\n \"fixPaths\":[],\n\t\t\"alertScore\": 7,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": subjectVector\n\t\t}\n\t}\n}\n\n# ===============================================================\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}", + "resourceEnumerator": "package armo_builtins\n\n\n# Returns the rbac permission of each service account\ndeny[msga] {\n subjectVector := input[_]\n subjectVector.kind == \"ServiceAccount\"\n \n\trole := subjectVector.relatedObjects[i]\n\trolebinding := subjectVector.relatedObjects[j]\n\tendswith(role.kind, \"Role\")\n\tendswith(rolebinding.kind, \"Binding\")\n\n subject := rolebinding.subjects[k]\n\tis_same_subjects(subjectVector, subject)\n\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"service account: %v has the following permissions in the cluster\", [subjectVector.name]),\n\t\t\"packagename\": \"armo_builtins\",\n \"failedPaths\": [],\n \"fixPaths\":[],\n\t\t\"alertScore\": 7,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": subjectVector\n\t\t}\n\t}\n}\n\n# ===============================================================\n\n# for service accounts\nis_same_subjects(subjectVector, subject) {\n\tsubjectVector.kind == subject.kind\n\tsubjectVector.name == subject.name\n\tsubjectVector.namespace == subject.namespace\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "rbac.authorization.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "RoleBinding", + "ClusterRoleBinding", + "Role", + "ClusterRole" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines which service accounts can be used to access other resources in the cluster", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Cluster internal networking", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Discovery", + "Lateral movement" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ], + "microsoftMitreColumns": [ + "Lateral movement" + ] + }, + "controlID": "C-0054", + "creationTime": "", + "description": "If no network policy is defined, attackers who gain access to a container may use it to move laterally in the cluster. This control lists namespaces in which no network policy is defined.", + "remediation": "Define Kubernetes network policies or use alternative products to protect cluster network.", + "rules": [ + { + "guid": "", + "name": "internal-networking", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Lateral Movement::Container internal networking, Discovery::Network mapping" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# input: network policies\n# apiversion: networking.k8s.io/v1\n# fails if no network policies are defined in a certain namespace\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\tpolicy_names := [policy.metadata.namespace | policy = input[_]; policy.kind == \"NetworkPolicy\"]\n\tnot list_contains(policy_names, namespace.metadata.name)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}\n\nlist_contains(list, element) {\n some i\n list[i] == element\n}", + "resourceEnumerator": "package armo_builtins\n\n# input: network policies + namespaces\n# apiversion: networking.k8s.io/v1\n# returns all namespaces\n\ndeny[msga] {\n\tnamespaces := [namespace | namespace = input[_]; namespace.kind == \"Namespace\"]\n\tnamespace := namespaces[_]\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"no policy is defined for namespace %v\", [namespace.metadata.name]),\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [namespace]\n\t\t}\n\t}\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Namespace" + ] + }, + { + "apiGroups": [ + "networking.k8s.io" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "NetworkPolicy" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "lists namespaces in which no network policies are defined", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 4 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Privileged container", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Privilege escalation" + ] + } + ], + "controlTypeTags": [ + "security" + ], + "microsoftMitreColumns": [ + "Privilege escalation" + ] + }, + "controlID": "C-0057", + "creationTime": "", + "description": "Potential attackers may gain access to privileged containers and inherit access to the host resources. Therefore, it is not recommended to deploy privileged containers unless it is absolutely necessary. This control identifies all the privileged Pods.", + "remediation": "Remove privileged capabilities by setting the securityContext.privileged to false. If you must deploy a Pod as privileged, add other restriction to it, such as network policy, Seccomp etc and still remove all unnecessary capabilities. Use the exception mechanism to remove unnecessary notifications.", + "rules": [ + { + "guid": "", + "name": "rule-privilege-escalation", + "attributes": { + "armoBuiltin": true, + "m$K8sThreatMatrix": "Privilege Escalation::privileged container", + "mitre": "Privilege Escalation", + "mitreCode": "TA0004" + }, + "creationTime": "", + "rule": "package armo_builtins\n# Deny mutating action unless user is in group owning the resource\n\n\n#privileged pods\ndeny[msga] {\n\n\tpod := input[_]\n\tpod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following pods are defined as privileged: %v\", [pod.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n }\n}\n\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainer := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v is defined as privileged:\", [wl.kind, wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n#handles cronjob\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer := wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n\tpath := isPrivilegedContainer(container, i, beggining_of_path)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined as privileged: %v\", [wl.metadata.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 3,\n\t\t\"fixPaths\": [],\n\t\t\"failedPaths\": path,\n \"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n }\n}\n\n\n# Only SYS_ADMIN capabilite\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tnot container.securityContext.privileged == true\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path) \u003e 0\n}\n\n# Only securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tcontainer.securityContext.privileged == true\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003c 1\n\tpath = [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])]\n}\n\n# SYS_ADMIN capabilite \u0026\u0026 securityContext.privileged == true\nisPrivilegedContainer(container, i, beggining_of_path) = path {\n\tpath1 = [sprintf(\"%vcontainers[%v].securityContext.capabilities.add[%v]\", [beggining_of_path, format_int(i, 10), format_int(k, 10)]) | capabilite = container.securityContext.capabilities.add[k]; capabilite == \"SYS_ADMIN\"]\n\tcount(path1) \u003e 0\n\tcontainer.securityContext.privileged == true\n\tpath = array.concat(path1, [sprintf(\"%vcontainers[%v].securityContext.privileged\", [beggining_of_path, format_int(i, 10)])])\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "determines if pods/deployments defined as privileged true", + "remediation": "avoid defining pods as privilleged", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25741 - Using symlink for arbitrary host file system access.", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Persistence", + "Impact - Data access in container" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0058", + "creationTime": "", + "description": "A user may be able to create a container with subPath or subPathExpr volume mounts to access files \u0026 directories anywhere on the host filesystem. Following Kubernetes versions are affected: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. This control checks the vulnerable versions and the actual usage of the subPath feature in all Pods in the cluster. If you want to learn more about the CVE, please refer to the CVE link: https://nvd.nist.gov/vuln/detail/CVE-2021-25741", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, or remove any existing Pods using subPath or subPathExpr feature.", + "rules": [ + { + "guid": "", + "name": "Symlink-Exchange-Can-Allow-Host-Filesystem-Access", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n pod := input[_]\n pod.kind == \"Pod\"\n\tcontainer := pod.spec.containers[i]\n\tbeggining_of_path := \"spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in pod : %v with subPath/subPathExpr\", [container.name, pod.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n container := wl.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n is_vulnerable_version(current_version)\n wl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tbeggining_of_path := \"spec.jobTemplate.spec.template.spec.\"\n final_path := is_sub_path_container(container, i, beggining_of_path)\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr\", [container.name, wl.kind, wl.metadata.name]),\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": final_path,\n\t\t\t\"fixPaths\": [],\n\t\t}\n}\n\n\n\nis_sub_path_container(container, i, beggining_of_path) = path {\n\tpath = [sprintf(\"%vcontainers[%v].volumeMounts[%v].subPath\" ,[beggining_of_path, format_int(i, 10), format_int(j, 10)]) | volume_mount = container.volumeMounts[j]; volume_mount.subPath]\n\tcount(path) \u003e 0\n}\n\nis_vulnerable_version(version) {\n version \u003c= \"v1.19.14\"\n}\n\nis_vulnerable_version(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nis_vulnerable_version(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nis_vulnerable_version(version){\n\tversion == \"v1.20.10\"\n}\n\n\n", + "resourceEnumerator": "package armo_builtins\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n pod := input[_]\n pod.kind == \"Pod\"\n\n\tmsga := {\n\t\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [pod]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n \n\tmsga := {\n\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\n\ndeny[msga] {\n\tnodes := input[_]\n\tcurrent_version := nodes.status.nodeInfo.kubeletVersion\n isVulnerableVersion(current_version)\n\tversionPath = \"status.nodeInfo.kubeletVersion\"\n wl := input[_]\n\twl.kind == \"CronJob\"\n \n\tmsga := {\n\t\t\"alertMessage\": \"\",\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [wl]},\n\t\t\t\"failedPaths\": [],\n\t}\n}\n\n\nisVulnerableVersion(version) {\n version \u003c= \"v1.19.14\"\n}\n\nisVulnerableVersion(version){\n version \u003e= \"v1.22.0\"\n version \u003c= \"v1.22.1\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.21.0\"\n version \u003c= \"v1.21.4\"\n}\n\n\nisVulnerableVersion(version){\n version \u003e= \"v1.20.0\"\n version \u003c= \"v1.20.9\"\n}\n\nisVulnerableVersion(version){\n\tversion == \"v1.20.10\"\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod", + "Node" + ] + }, + { + "apiGroups": [ + "apps" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Deployment", + "ReplicaSet", + "DaemonSet", + "StatefulSet" + ] + }, + { + "apiGroups": [ + "batch" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Job", + "CronJob" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "A user may be able to create a container with subPath volume mounts to access files \u0026 directories outside of the volume, including on the host filesystem. This was affected at the following versions: v1.22.0 - v1.22.1, v1.21.0 - v1.21.4, v1.20.0 - v1.20.10, version v1.19.14 and lower. ", + "remediation": "To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, and remove any existing Pods making use of the feature.", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Initial access", + "Execution" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0059", + "creationTime": "", + "description": "Security issue in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster (see more at https://github.com/kubernetes/ingress-nginx/issues/7837)", + "remediation": "To mitigate this vulnerability: 1. Upgrade to a version that allows mitigation (\u003e= v0.49.1 or \u003e= v1.0.1), 2. Set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx", + "rules": [ + { + "guid": "", + "name": "nginx-ingress-snippet-annotation-vulnerability", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tis_nginx_image(image)\n\tis_tag_image(image)\n\n\t# Extracting version from image tag\n\ttag_version_match := regex.find_all_string_submatch_n(\"[0-9]+\\\\.[0-9]+\\\\.[0-9]+\", image, -1)[0][0]\n image_version_str_arr := split(tag_version_match,\".\")\n\timage_version_arr := [to_number(image_version_str_arr[0]),to_number(image_version_str_arr[1]),to_number(image_version_str_arr[2])]\n\n\t# Check if vulnerable \n\tis_vulnerable(image_version_arr, deployment.metadata.namespace)\n\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. Deployment %v\", [deployment.metadata.name]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"fixPaths\":[],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nis_nginx_image(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nis_nginx_image(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nis_allow_snippet_annotation_on(namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmap_on_ingress_namespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfig_maps_with_snippet := [configmap | configmap= configmap_on_ingress_namespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(config_maps_with_snippet) \u003c 1\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] \u003c 49\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 0\n\timage_version[1] == 49\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\t\nis_vulnerable(image_version, namespace) {\n\timage_version[0] == 1\n\timage_version[1] == 0\n\timage_version[2] == 0\n\tis_allow_snippet_annotation_on(namespace)\n}\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "resourceEnumerator": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\n\timage := deployment.spec.template.spec.containers[i].image\n\tisNginxImage(image)\n\tis_tag_image(image)\n\tisVulnerable(image, deployment.metadata.namespace)\n\tpath := sprintf(\"spec.template.spec.containers[%v].image\", [format_int(i, 10)])\n\tmsga := {\n\t\t\t\"alertMessage\": sprintf(\"You may be vulnerable to CVE-2021-25742. %v\", [deployment]),\n\t\t\t\"failedPaths\": [path],\n\t\t\t\"alertObject\": {\"k8SApiObjects\": [deployment]},\n\t\t}\n}\n\n\t\nisNginxImage(image) {\n\tcontains(image, \"nginx-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-controller\")\n}\n\nisNginxImage(image) {\n\tcontains(image, \"ingress-nginx\")\n}\n\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag \u003c= \"v0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n startswith(tag, \"v\")\n tag == \"v1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag \u003c= \"v0.49\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n startswith(tag, \"v\")\n\ttag == \"v1.0.0\"\n}\n\n###### without 'v'\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag \u003c= \"0.49\"\n}\n\t\nisVulnerable(image, namespace) {\n\tcontains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := split(version[count(version)-2], \"@\")[0]\n not startswith(tag, \"v\")\n tag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag \u003c= \"0.49\"\n}\nisVulnerable(image, namespace) {\n\tnot contains(image, \"@\")\n\tversion := split(image, \":\")\n\ttag := version[count(version)-1]\n not startswith(tag, \"v\")\n\ttag == \"1.0.0\"\n}\n\nisVulnerable(image, namespace) {\n configmaps := [configmap | configmap = input[_]; configmap.kind == \"ConfigMap\"]\n\tconfigmapOnIngressNamespace := [configmap | configmap= configmaps[_]; configmap.metadata.namespace == namespace]\n\tconfigMapsWithSnippet := [configmap | configmap= configmapOnIngressNamespace[_]; configmap.data[\"allow-snippet-annotations\"] == \"false\"]\n\tcount(configMapsWithSnippet) \u003c 1\n}\n\n\nis_tag_image(image) {\n reg := \":[\\\\w][\\\\w.-]{0,127}(\\/)?\"\n version := regex.find_all_string_submatch_n(reg, image, -1)\n v := version[_]\n img := v[_]\n not endswith(img, \"/\")\n}", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "*" + ], + "apiVersions": [ + "*" + ], + "resources": [ + "Deployment", + "ConfigMap" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 8 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Secret/ETCD encryption enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Impact" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0066", + "creationTime": "", + "description": "All Kubernetes Secrets are stored primarily in etcd therefore it is important to encrypt it.", + "remediation": "Turn on the etcd encryption in your cluster, for more see the vendor documentation.", + "rules": [ + { + "guid": "", + "name": "secret-etcd-encryption-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n# Check if encryption in etcd in enabled for AKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"management.azure.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"aks\"\t\n\tconfig = cluster_config.data\n\n\tnot isEncryptedAKS(config)\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"az aks nodepool add --name hostencrypt --cluster-name \u003cmyAKSCluster\u003e --resource-group \u003cmyResourceGroup\u003e -s Standard_DS2_v2 -l \u003cmyRegion\u003e --enable-encryption-at-host\",\n\t\t\"alertObject\": {\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n# Check if encryption in etcd in enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"eks\"\t\n\tconfig = cluster_config.data\n\n\tis_not_encrypted_EKS(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"eksctl utils enable-secrets-encryption --cluster=\u003ccluster\u003e --key-arn=arn:aws:kms:\u003ccluster_region\u003e:\u003caccount\u003e:key/\u003ckey\u003e --region=\u003cregion\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\n\n\n# Check if encryption in etcd in enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n\n\tnot is_encrypted_GKE(config)\n \n\t\n\tmsga := {\n\t\t\"alertMessage\": \"etcd/secret encryption is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [\"data.database_encryption.state\"],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud container clusters update \u003ccluster_name\u003e --region=\u003ccompute_region\u003e --database-encryption-key=\u003ckey_project_id\u003e/locations/\u003clocation\u003e/keyRings/\u003cring_name\u003e/cryptoKeys/\u003ckey_name\u003e --project=\u003ccluster_project_id\u003e\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}\n\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"1\"\n}\nis_encrypted_GKE(config) {\n\t config.database_encryption.state == \"ENCRYPTED\"\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n goodResources := [resource | resource = cluster_config.Cluster.EncryptionConfig.Resources[_]; resource == \"secrets\"]\n\tcount(goodResources) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcluster_config.Cluster.EncryptionConfig == null\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tcount(cluster_config.Cluster.EncryptionConfig) == 0\n}\n\nis_not_encrypted_EKS(cluster_config) {\n\tencryptionConfig := cluster_config.Cluster.EncryptionConfig[_]\n count(encryptionConfig.Resources) == 0\n}\n\nisEncryptedAKS(cluster_config) {\n\tcluster_config.properties.agentPoolProfiles.enableEncryptionAtHost == true\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "management.azure.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + }, + { + "apiGroups": [ + "container.googleapis.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "AKS", + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "etcd-encryption-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport data.cautils as cautils\n\n# Check if encryption in etcd is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n\tcmd := apiserverpod.spec.containers[0].command\n\tenc_command := [command | command := cmd[_]; contains(command, \"--encryption-provider-config=\")]\n\tcount(enc_command) \u003c 1\n\tfixpath := {\"path\":sprintf(\"spec.containers[0].command[%d]\", [count(cmd)]), \"value\": \"--encryption-provider-config=YOUR_VALUE\"}\n\n\tmsga := {\n\t\t\"alertMessage\": \"etcd encryption is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [fixpath],\n\t\t\"alertObject\": {\"k8sApiObjects\": [apiserverpod]},\n\t}\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 6 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "Audit logs enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "container", + "categories": [ + "Defense evasion - KubeAPI" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0067", + "creationTime": "", + "description": "Audit logging is an important security feature in Kubernetes, it enables the operator to track requests to the cluster. It is important to use it so the operator has a record of events happened in Kubernetes", + "remediation": "Turn on audit logging for your cluster. Look at the vendor guidelines for more details", + "rules": [ + { + "guid": "", + "name": "k8s-audit-logs-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\nimport future.keywords.every\n\n# =============================== GKE ===============================\n# Check if audit logs is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"gke\"\n\tconfig := cluster_config.data\n\n\t# If enableComponents is empty, it will disable logging\n\t# https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#loggingcomponentconfig\n\tis_logging_disabled(config)\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nis_logging_disabled(cluster_config) {\n\tnot cluster_config.logging_config.component_config.enable_components\n}\n\nis_logging_disabled(cluster_config) {\n\tcluster_config.logging_config.component_config.enable_components\n\tcount(cluster_config.logging_config.component_config.enable_components) == 0\n}\n\n# =============================== EKS ===============================\n# Check if audit logs is enabled for EKS\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"eks.amazonaws.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n\tcluster_config.metadata.provider == \"eks\"\n\tconfig := cluster_config.data\n\n\t# logSetup is an object representing the enabled or disabled Kubernetes control plane logs for your cluster.\n\t# types - available cluster control plane log types\n\t# https://docs.aws.amazon.com/eks/latest/APIReference/API_LogSetup.html\n\tlogging_types := {\"api\", \"audit\", \"authenticator\", \"controllerManager\", \"scheduler\"}\n\tlogSetups = config.Cluster.Logging.ClusterLogging\n\tnot all_auditlogs_enabled(logSetups, logging_types)\n\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is disabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixCommand\": \"aws eks update-cluster-config --region '${REGION_CODE}' --name '${CLUSTER_NAME}' --logging '{'clusterLogging':[{'types':['api','audit','authenticator','controllerManager','scheduler'],'enabled':true}]}'\",\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n\t\t\t\"externalObjects\": cluster_config,\n\t\t},\n\t}\n}\n\nall_auditlogs_enabled(logSetups, types) {\n\tevery type in types {\n\t\tauditlogs_enabled(logSetups, type)\n\t}\n}\n\nauditlogs_enabled(logSetups, type) {\n\tlogSetup := logSetups[_]\n\tlogSetup.Enabled == true\n\tlogSetup.Types[_] == type\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "k8s-audit-logs-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command\n\taudit_policy := [ command |command := cmd[_] ; contains(command, \"--audit-policy-file=\")]\n count(audit_policy) \u003c 1\n\tpath := \"spec.containers[0].command\"\t\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"audit logs is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 5 + }, + { + "rulesIDs": [ + "", + "" + ], + "guid": "", + "name": "PSP enabled", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Impact - service injection" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0068", + "creationTime": "", + "description": "PSP enable fine-grained authorization of pod creation and it is important to enable it", + "remediation": "Turn Pod Security Policies on in your cluster, if you use other admission controllers to control the behavior that PSP controls, exclude this control from your scans", + "rules": [ + { + "guid": "", + "name": "psp-enabled-cloud", + "attributes": { + "armoBuiltin": true + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if PSP is enabled for GKE\ndeny[msga] {\n\tcluster_config := input[_]\n\tcluster_config.apiVersion == \"container.googleapis.com/v1\"\n\tcluster_config.kind == \"ClusterDescribe\"\n cluster_config.metadata.provider == \"gke\"\t\n\tconfig := cluster_config.data\n not config.pod_security_policy_config.enabled == true\n\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"pod security policy configuration is not enabled\",\n\t\t\"alertScore\": 3,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"fixCommand\": \"gcloud beta container clusters update \u003ccluster_name\u003e --enable-pod-security-policy\",\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [],\n \"externalObjects\": cluster_config\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "container.googleapis.com", + "eks.amazonaws.com" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "ClusterDescribe" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": [ + "EKS", + "GKE" + ] + }, + { + "guid": "", + "name": "psp-enabled-native", + "attributes": { + "armoBuiltin": true, + "resourcesAggregator": "apiserver-pod", + "useFromKubescapeVersion": "v1.0.133" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod := input[_]\n cmd := apiserverpod.spec.containers[0].command[j]\n contains(cmd, \"--enable-admission-plugins=\")\n output := split(cmd, \"=\")\n not contains(output[1], \"PodSecurityPolicy\")\n\tpath := sprintf(\"spec.containers[0].command[%v]\", [format_int(j, 10)])\t\n\t\n\tmsga := {\n\t\t\"alertMessage\": \"PodSecurityPolicy is not enabled\",\n\t\t\"alertScore\": 9,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"failedPaths\": [path],\n\t\t\"fixPaths\": [],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [apiserverpod],\n\t\t\n\t\t}\n\t}\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [ + "" + ], + "apiVersions": [ + "v1" + ], + "resources": [ + "Pod" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "", + "remediation": "", + "ruleQuery": "armo_builtins", + "relevantCloudProviders": null + } + ], + "baseScore": 1 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Disable anonymous access to Kubelet service", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "kubeapi", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0069", + "creationTime": "", + "description": "By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.", + "remediation": "Start the kubelet with the --anonymous-auth=false flag.", + "rules": [ + { + "guid": "", + "name": "anonymous-requests-to-kubelet-service-updated", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\n\n#CIS 4.2.1 https://workbench.cisecurity.org/sections/1126668/recommendations/1838638\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tcontains(command, \"--anonymous-auth\")\n\tcontains(command, \"--anonymous-auth=true\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tnot contains(command, \"--config\")\n\n\texternal_obj := json.filter(obj, [\"apiVersion\", \"data/cmdLine\", \"kind\", \"metadata\"])\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": external_obj},\n\t}\n}\n\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tdecodedConfigContent := base64.decode(obj.data.configFile.content)\n\tyamlConfig := yaml.unmarshal(decodedConfigContent)\n\tnot yamlConfig.authentication.anonymous.enabled == false\n\n\tmsga := {\n\t\t\"alertMessage\": \"Anonymous requests is enabled.\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [\"authentication.anonymous.enabled\"],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"metadata\": obj.metadata,\n\t\t\t\"data\": {\"configFile\": {\"content\": decodedConfigContent}},\n\t\t}},\n\t}\n}\n\n## Host sensor failed to get config file content\ndeny[msga] {\n\tobj := input[_]\n\tis_kubelet_info(obj)\n\n\tcommand := obj.data.cmdLine\n\n\tnot contains(command, \"--anonymous-auth\")\n\tcontains(command, \"--config\")\n\n\tnot obj.data.configFile.content\n\n\tmsga := {\n\t\t\"alertMessage\": \"Failed to analyze config file\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [],\n\t\t\"fixPaths\": [],\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"externalObjects\": {\n\t\t\t\"apiVersion\": obj.apiVersion,\n\t\t\t\"kind\": obj.kind,\n\t\t\t\"data\": obj.data,\n\t\t}},\n\t}\n}\n\nis_kubelet_info(obj) {\n\tobj.kind == \"KubeletInfo\"\n\tobj.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n}\n", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletInfo" + ] + } + ], + "ruleDependencies": [], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if anonymous requests to the kubelet service are allowed.", + "remediation": "Disable anonymous requests by setting the anonymous-auth flag to false, or using the kubelet configuration file.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 10 + }, + { + "rulesIDs": [ + "" + ], + "guid": "", + "name": "Enforce Kubelet client TLS authentication", + "attributes": { + "armoBuiltin": true, + "attackTracks": [ + { + "attackTrack": "node", + "categories": [ + "Initial access" + ] + } + ], + "controlTypeTags": [ + "security", + "compliance" + ] + }, + "controlID": "C-0070", + "creationTime": "", + "description": "Kubelets are the node level orchestrator in Kubernetes control plane. They are publishing service port 10250 where they accept commands from API server. Operator must make sure that only API server is allowed to submit commands to Kubelet. This is done through client certificate verification, must configure Kubelet with client CA file to use for this purpose.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "rules": [ + { + "guid": "", + "name": "enforce-kubelet-client-tls-authentication", + "attributes": { + "armoBuiltin": true, + "hostSensorRule": "true" + }, + "creationTime": "", + "rule": "package armo_builtins\nimport data.kubernetes.api.client as client\n\n# Both config and cli present\ndeny[msga] {\n\t\tkubelet_config := input[_]\n\t\tkubelet_config.kind == \"KubeletConfiguration\"\n\t\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\t\tkubelet_cli := input[_] \n\t\tkubelet_cli.kind == \"KubeletCommandLine\"\n\t\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\t\tkubelet_cli_data := kubelet_cli.data\n\n\t\tresult := is_client_tls_disabled_both(kubelet_config, kubelet_cli_data)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [kubelet_config, kubelet_cli]\n\t\t\t},\n\t\t}\n\t}\n\n\n# Only of them present\ndeny[msga] {\n\t\tresult := is_client_tls_disabled_single(input)\n\t\texternal_obj := result.obj\n\t\tfailed_paths := result.failedPaths\n\t\tfixPaths := result.fixPaths\n\n\t\tmsga := {\n\t\t\t\"alertMessage\": \"kubelet client TLS authentication is not enabled\",\n\t\t\t\"alertScore\": 2,\n\t\t\t\"failedPaths\": failed_paths,\n\t\t\t\"fixPaths\": fixPaths,\n\t\t\t\"packagename\": \"armo_builtins\",\n\t\t\t\"alertObject\": {\n\t\t\t\t\"k8sApiObjects\": [external_obj]\n\t\t\t},\n\t\t}\n\t}\n\n# CLI overrides config\nis_client_tls_disabled_both(kubelet_config, kubelet_cli_data) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n not kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\n# Only cli\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": []} {\n\tkubelet_cli := resources[_] \n\tkubelet_cli.kind == \"KubeletCommandLine\"\n\tkubelet_cli.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_config := [config | config = resources[_]; config.kind == \"KubeletConfiguration\"]\n\tcount(kubelet_config) == 0\n\n\tobj = isClientTlsDisabledCli(kubelet_cli)\n\t\n}\n\n# Only config\nis_client_tls_disabled_single(resources) = {\"obj\": obj,\"failedPaths\": [], \"fixPaths\": [{\"path\": \"data.authentication.x509.clientCAFile\", \"value\": \"YOUR_VALUE\"}]} {\n\tkubelet_config := resources[_] \n\tkubelet_config.kind == \"KubeletConfiguration\"\n\tkubelet_config.apiVersion == \"hostdata.kubescape.cloud/v1beta0\"\n\n\tkubelet_cmd := [cmd | cmd = resources[_]; cmd.kind == \"KubeletCommandLine\"]\n\tcount(kubelet_cmd) == 0\n\n\tobj = is_Client_tls_disabled_config(kubelet_config)\n}\n\n\nis_Client_tls_disabled_config(kubelet_config) = obj {\n\tnot kubelet_config.data.authentication.x509.clientCAFile\n\tobj = kubelet_config\n}\n\nisClientTlsDisabledCli(kubelet_cli) = obj {\n\tkubelet_cli_data = kubelet_cli.data\n\tnot contains(kubelet_cli_data[\"fullCommand\"], \"client-ca-file\")\n\tobj = kubelet_cli\n}", + "resourceEnumerator": "", + "ruleLanguage": "Rego", + "match": [ + { + "apiGroups": [], + "apiVersions": [], + "resources": [] + } + ], + "dynamicMatch": [ + { + "apiGroups": [ + "hostdata.kubescape.cloud" + ], + "apiVersions": [ + "v1beta0" + ], + "resources": [ + "KubeletConfiguration", + "KubeletCommandLine" + ] + } + ], + "ruleDependencies": [ + { + "packageName": "cautils" + }, + { + "packageName": "kubernetes.api.client" + } + ], + "configInputs": null, + "controlConfigInputs": null, + "description": "Determines if kubelet client tls authentication is enabled.", + "remediation": "Start the kubelet with the --client-ca-file flag, providing a CA bundle to verify client certificates with.", + "ruleQuery": "", + "relevantCloudProviders": null + } + ], + "baseScore": 9 + } + ], + "controlsIDs": [ + "C-0002", + "C-0007", + "C-0012", + "C-0014", + "C-0015", + "C-0020", + "C-0021", + "C-0026", + "C-0031", + "C-0035", + "C-0036", + "C-0037", + "C-0039", + "C-0042", + "C-0045", + "C-0048", + "C-0052", + "C-0053", + "C-0054", + "C-0057", + "C-0058", + "C-0059", + "C-0066", + "C-0067", + "C-0068", + "C-0069", + "C-0070" + ] + } + ], + "Exceptions": [ + { + "guid": "", + "name": "exclude-gke-kube-system-resources-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "coredns-[A-Za-z0-9]+-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "kube-proxy-[A-Za-z0-9-]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "etcd-.*", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "metadata-proxy-v[0-9.]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "node-local-dns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "gke-metrics-agent.*", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-7", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "pdcsi-node-windows", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "anetd", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "netd", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "fluentbit-gke-big", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "fluentbit-gke-small", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-12", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "fluentbit-gke-max", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-13", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "fluentbit-gke.*", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-14", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "nccl-fastsocket-installer", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-15", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "filestore-node", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-16", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "pdcsi-node", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-17", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "ip-masq-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-18", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "anetd-win", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-19", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "gke-metadata-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-20", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "gke-metrics-agent-windows", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-21", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "kube-proxy", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-22", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "nvidia-gpu-device-plugin", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-23", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Service", + "name": "metrics-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-24", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kube-dns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-25", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "egress-nat-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-26", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "event-exporter-gke", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-27", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "antrea-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-28", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "antrea-controller-horizontal-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-29", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kube-dns-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-30", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "metrics-server-v[0-9.]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-31", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "konnectivity-agent-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-32", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "fluentd-elasticsearch", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-33", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "konnectivity-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-system-resources-34", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "l7-default-backend", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-public-resources", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "default", + "namespace": "kube-public" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-gke-kube-node-lease-resources", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "default", + "namespace": "kube-node-lease" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "konnectivity-agent-cpha", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "metrics-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "endpointslicemirroring-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "replicaset-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "endpointslice-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "service-account-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-7", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "namespace-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "clusterrole-aggregation-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "generic-garbage-collector", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "certificate-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "daemon-set-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-12", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "cloud-provider", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-13", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "ephemeral-volume-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-14", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "root-ca-cert-publisher", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-16", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "bootstrap-signer", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-18", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "expand-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-19", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "disruption-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-20", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "ttl-after-finished-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-21", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "job-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-22", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "pv-protection-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-23", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "persistent-volume-binder", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-24", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "pvc-protection-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-25", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "statefulset-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-26", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "deployment-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-27", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "node-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-28", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "cronjob-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-29", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "resourcequota-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-30", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "endpoint-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-31", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "pod-garbage-collector", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-32", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "ttl-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-33", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "token-cleaner", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-34", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "kube-dns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-35", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "attachdetach-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-36", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "kube-proxy", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-37", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "konnectivity-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-38", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "replication-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-39", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "default", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-40", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "service-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-41", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "kube-dns-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-42", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "netd", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-43", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "metadata-proxy", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-44", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "antrea-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-45", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "cilium", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-46", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "node-local-dns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-47", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "gke-metrics-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-48", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "egress-nat-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-49", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "antrea-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-50", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "event-exporter-sa", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-51", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "antrea-cpha", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-52", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "fluentbit-gke", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-53", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "pdcsi-node-sa", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-54", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "ip-masq-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-55", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "filestorecsi-node-sa", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-56", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "gke-metadata-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-users-and-groups-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:vpa-recommender", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-users-and-groups-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:anet-operator", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:clustermetrics" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:controller:glbc" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:l7-lb-controller" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:managed-certificate-controller" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:gke-common-webhooks" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:kube-scheduler" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:gcp-controller-manager" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:resource-tracker" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:storageversionmigrator" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:kube-controller-manager" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-12", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "system:kubestore-collector" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-13", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Group", + "name": "system:masters" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ValidatingWebhookConfiguration", + "name": "ca-validate-cfg" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ValidatingWebhookConfiguration", + "name": "flowcontrol-guardrails.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ValidatingWebhookConfiguration", + "name": "validation-webhook.snapshot.storage.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ValidatingWebhookConfiguration", + "name": "nodelimit.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ValidatingWebhookConfiguration", + "name": "gkepolicy.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ValidatingWebhookConfiguration", + "name": "validation-webhook.snapshot.storage.k8s.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-7", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "APIService", + "name": "v1beta1.metrics.k8s.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "pod-ready.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "ca-mutate-cfg" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "neg-annotation.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "mutate-scheduler-profile.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-12", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "sasecret-redacter.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-13", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "workload-defaulter.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-14", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "admissionwebhookcontroller.config.common-webhooks.networking.gke.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-15", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "gke-vpa-webhook-config" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-16", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "filestorecsi-mutation-webhook.storage.k8s.io" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-resources-17", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Namespace", + "name": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-pod-kube-apiserver", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "kube-apiserver-.*", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0013" + }, + { + "frameworkName": "", + "controlID": "c-0077" + }, + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0013 " + }, + { + "frameworkName": "", + "controlID": "c-0020" + }, + { + "frameworkName": "", + "controlID": "c-0030" + }, + { + "frameworkName": "", + "controlID": "c-0034" + }, + { + "frameworkName": "", + "controlID": "c-0016" + }, + { + "frameworkName": "", + "controlID": "c-0004" + }, + { + "frameworkName": "", + "controlID": "c-0050" + }, + { + "frameworkName": "", + "controlID": "c-0009" + }, + { + "frameworkName": "", + "controlID": "c-0048" + }, + { + "frameworkName": "", + "controlID": "c-0041" + } + ] + }, + { + "guid": "", + "name": "exclude-default-namespace-resources-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "kubescape", + "namespace": "default" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-default-namespace-resources-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Namespace", + "name": "default" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-default-namespace-resources-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "default", + "namespace": "default" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-prometheus-security-context", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubescape", + "namespace": "kubescape-prometheus" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0055" + }, + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0210" + }, + { + "frameworkName": "", + "controlID": "c-0211" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-prometheus-deployment-allowed-registry", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubescape", + "namespace": "kubescape-prometheus" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0001" + }, + { + "frameworkName": "", + "controlID": "c-0078" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-prometheus-deployment-ingress-and-egress", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubescape", + "namespace": "kubescape-prometheus" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0030" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "coredns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "coredns-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "konnectivity-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "metrics-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "csi-azuredisk-node-win", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "azure-ip-masq-agent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "cloud-node-manager", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "cloud-node-manager-windows", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-deployments-13", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "omsagent-rs", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "azure-ip-masq-agent-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "cloud-node-manager-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "coredns-autoscaler--[A-Za-z0-9]+-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "csi-azuredisk-node-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "csi-azurefile-node-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-7", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "konnectivity-agent-[A-Za-z0-9]+-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "kube-proxy-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "metrics-server-[A-Za-z0-9]+-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "omsagent-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-pods-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "omsagent-rs-[A-Za-z0-9]+-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-services-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Service", + "name": "kube-dns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-services-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Service", + "name": "metrics-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-daemonsets-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "csi-azuredisk-node", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-daemonsets-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "csi-azurefile-node", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-daemonsets-7", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "csi-azurefile-node-win", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-daemonsets-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "kube-proxy", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-daemonsets-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "omsagent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-daemonsets-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "omsagent-win", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-replicasets-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ReplicaSet", + "name": "coredns-autoscaler-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-replicasets-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ReplicaSet", + "name": "coredns-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-replicasets-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ReplicaSet", + "name": "konnectivity-agent-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-replicasets-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ReplicaSet", + "name": "metrics-server-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-replicasets-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ReplicaSet", + "name": "omsagent-rs-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-namespaces-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Namespace", + "name": "kube-public" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-namespaces-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Namespace", + "name": "kube-node-lease" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "azure-cloud-provider", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "cloud-node-manager", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "coredns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "coredns-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "csi-azuredisk-node-sa", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-12", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "csi-azurefile-node-sa", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-23", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "horizontal-pod-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-30", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "omsagent", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-46", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "kube-root-ca.crt", + "namespace": "default" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-47", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "kube-root-ca.crt", + "namespace": "kube-node-lease" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-48", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "kube-root-ca.crt", + "namespace": "kube-public" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-49", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "azure-ip-masq-agent-config-reconciled", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-50", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "cluster-autoscaler-status", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-51", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "container-azm-ms-aks-k8scluster", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-52", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "coredns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-53", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "coredns-autoscaler", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-54", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "coredns-custom", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-55", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "extension-apiserver-authentication", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-56", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "kube-root-ca.crt", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-57", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "omsagent-rs-config", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-58", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ConfigMap", + "name": "overlay-upgrade-data", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-59", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "aks-webhook-admission-controller" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-60", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "MutatingWebhookConfiguration", + "name": "aks-node-mutating-webhook" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-61", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ValidatingWebhookConfiguration", + "name": "aks-node-validating-webhook" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-63", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Group", + "name": "system:nodes" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-aks-kube-system-sa-64", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "clusterAdmin" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-minikube-kube-system-resources-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "kube-proxy-.*", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-minikube-kube-system-resources-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "coredns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-minikube-kube-system-resources-6", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Namespace", + "name": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-minikube-kube-system-resources-7", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "storage-provisioner", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-minikube-kube-system-resources-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "kube-scheduler-.*", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-minikube-kube-system-resources-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "kube-controller-manager-.*", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-kube-system-service-accounts-84", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "storage-provisioner", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-14", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "apiVersion": "rbac.authorization.k8s.io", + "kind": "User", + "name": "system:kube-scheduler" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-15", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "apiVersion": "rbac.authorization.k8s.io", + "kind": "User", + "name": "system:kube-controller-manager" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-system-users-and-groups-16", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "apiVersion": "rbac.authorization.k8s.io", + "kind": "Group", + "name": "system:masters" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-security-context-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubescape", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0055" + }, + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0210" + }, + { + "frameworkName": "", + "controlID": "c-0211" + }, + { + "frameworkName": "", + "controlID": "c-0058" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-security-context-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "operator", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0055" + }, + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0210" + }, + { + "frameworkName": "", + "controlID": "c-0211" + }, + { + "frameworkName": "", + "controlID": "c-0058" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-security-context-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "gateway", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0055" + }, + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0210" + }, + { + "frameworkName": "", + "controlID": "c-0211" + }, + { + "frameworkName": "", + "controlID": "c-0058" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-security-context-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubevuln", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0055" + }, + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0210" + }, + { + "frameworkName": "", + "controlID": "c-0211" + }, + { + "frameworkName": "", + "controlID": "c-0058" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-security-context-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "StatefulSet", + "name": "kollector", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0055" + }, + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0210" + }, + { + "frameworkName": "", + "controlID": "c-0211" + }, + { + "frameworkName": "", + "controlID": "c-0058" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-allowed-registry-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubescape", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0001" + }, + { + "frameworkName": "", + "controlID": "c-0078" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-allowed-registry-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "operator", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0001" + }, + { + "frameworkName": "", + "controlID": "c-0078" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-allowed-registry-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "gateway", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0001" + }, + { + "frameworkName": "", + "controlID": "c-0078" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-allowed-registry-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubevuln", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0001" + }, + { + "frameworkName": "", + "controlID": "c-0078" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-allowed-registry-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "StatefulSet", + "name": "kollector", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0001" + }, + { + "frameworkName": "", + "controlID": "c-0078" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-ingress-and-egress-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubescape", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0030" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-ingress-and-egress-2", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "operator", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0030" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-ingress-and-egress-3", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "gateway", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0030" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-ingress-and-egress-4", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "kubevuln", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0030" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-deployment-ingress-and-egress-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "StatefulSet", + "name": "kollector", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0030" + } + ] + }, + { + "guid": "", + "name": "exclude-ks-service-account", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "ks-sa", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0007" + }, + { + "frameworkName": "", + "controlID": "c-0015" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-service-account", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "kubescape-sa", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0007" + }, + { + "frameworkName": "", + "controlID": "c-0015" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-default-service-account", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "default", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0034" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-otel", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "otel-collector", + "namespace": "kubescape" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "c-0017" + }, + { + "frameworkName": "", + "controlID": "c-0018" + }, + { + "frameworkName": "", + "controlID": "c-0030" + }, + { + "frameworkName": "", + "controlID": "c-0055" + }, + { + "frameworkName": "", + "controlID": "c-0056" + } + ] + }, + { + "guid": "", + "name": "exclude-kubescape-host-scanner-resources", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "host-scanner", + "namespace": "kubescape-host-scanner" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-1", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Pod", + "name": "aws-node-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-5", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "aws-node", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-8", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "eventrouter", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-9", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "ebs-csi-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-10", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "ebs-csi-node", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-11", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "DaemonSet", + "name": "ebs-csi-node-windows", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-12", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Deployment", + "name": "metrics-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-13", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ReplicaSet", + "name": "coredns-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-14", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ReplicaSet", + "name": "metrics-server-[A-Za-z0-9]+", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-16", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Service", + "name": "kube-dns", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-17", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "aws-cloud-provider", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-18", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "aws-node", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-19", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "eks-admin", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-20", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "eks-vpc-resource-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-21", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "metrics-server", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-22", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "tagging-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-23", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "vpc-resource-controller", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-24", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "eventrouter", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-25", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "ebs-csi-controller-sa", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-26", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "ServiceAccount", + "name": "ebs-csi-node-sa", + "namespace": "kube-system" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-27", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "eks:fargate-manager" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-28", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "eks:addon-manager" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-29", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "eks:certificate-controller" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-30", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "User", + "name": "eks:node-manager" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + }, + { + "guid": "", + "name": "exclude-eks-resources-31", + "attributes": { + "systemException": true + }, + "policyType": "postureExceptionPolicy", + "actions": [ + "alertOnly" + ], + "resources": [ + { + "designatorType": "Attributes", + "attributes": { + "kind": "Group", + "name": "system:masters" + } + } + ], + "posturePolicies": [ + { + "frameworkName": "", + "controlID": "C-.*" + } + ] + } + ], + "OmitRawResources": false +} \ No newline at end of file diff --git a/core/pkg/opaprocessor/testdata/resourcesMock1.json b/core/pkg/opaprocessor/testdata/resourcesMock1.json new file mode 100644 index 00000000..f475c9a9 --- /dev/null +++ b/core/pkg/opaprocessor/testdata/resourcesMock1.json @@ -0,0 +1,220 @@ +{ + "/v1/default/Pod/fake-pod-1-22gck": { + "apiVersion": "v1", + "kind": "Pod", + "metadata": { + "annotations": { + "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"name\":\"fake-pod-1-22gck\",\"namespace\":\"default\"},\"spec\":{\"containers\":[{\"image\":\"redis\",\"name\":\"fake-pod-1-22gck\",\"volumeMounts\":[{\"mountPath\":\"/etc/foo\",\"name\":\"foo\",\"readOnly\":true}]}],\"volumes\":[{\"name\":\"foo\",\"secret\":{\"optional\":true,\"secretName\":\"mysecret\"}}]}}\n" + }, + "creationTimestamp": "2023-06-22T07:47:38Z", + "name": "fake-pod-1-22gck", + "namespace": "default", + "resourceVersion": "1087189", + "uid": "046753fa-c7b6-46dd-ae18-dd68b8b20cd3", + "labels": {"app": "argo-server"} + }, + "spec": { + "containers": [ + { + "image": "redis", + "imagePullPolicy": "Always", + "name": "fake-pod-1-22gck", + "resources": {}, + "terminationMessagePath": "/dev/termination-log", + "terminationMessagePolicy": "File", + "volumeMounts": [ + { + "mountPath": "/etc/foo", + "name": "foo", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount", + "name": "kube-api-access-lrpxm", + "readOnly": true + } + ] + } + ], + "dnsPolicy": "ClusterFirst", + "enableServiceLinks": true, + "nodeName": "minikube-yiscah", + "preemptionPolicy": "PreemptLowerPriority", + "priority": 0, + "restartPolicy": "Always", + "schedulerName": "default-scheduler", + "securityContext": {}, + "serviceAccount": "default", + "serviceAccountName": "default", + "terminationGracePeriodSeconds": 30, + "tolerations": [ + { + "effect": "NoExecute", + "key": "node.kubernetes.io/not-ready", + "operator": "Exists", + "tolerationSeconds": 300 + }, + { + "effect": "NoExecute", + "key": "node.kubernetes.io/unreachable", + "operator": "Exists", + "tolerationSeconds": 300 + } + ], + "volumes": [ + { + "name": "foo", + "secret": { + "defaultMode": 420, + "optional": true, + "secretName": "mysecret" + } + }, + { + "name": "kube-api-access-lrpxm", + "projected": { + "defaultMode": 420, + "sources": [ + { + "serviceAccountToken": { + "expirationSeconds": 3607, + "path": "token" + } + }, + { + "configMap": { + "items": [ + { + "key": "ca.crt", + "path": "ca.crt" + } + ], + "name": "kube-root-ca.crt" + } + }, + { + "downwardAPI": { + "items": [ + { + "fieldRef": { + "apiVersion": "v1", + "fieldPath": "metadata.namespace" + }, + "path": "namespace" + } + ] + } + } + ] + } + } + ] + }, + "status": { + "conditions": [ + { + "lastProbeTime": null, + "lastTransitionTime": "2023-06-22T07:47:38Z", + "status": "True", + "type": "Initialized" + }, + { + "lastProbeTime": null, + "lastTransitionTime": "2023-07-18T05:07:57Z", + "status": "True", + "type": "Ready" + }, + { + "lastProbeTime": null, + "lastTransitionTime": "2023-07-18T05:07:57Z", + "status": "True", + "type": "ContainersReady" + }, + { + "lastProbeTime": null, + "lastTransitionTime": "2023-06-22T07:47:38Z", + "status": "True", + "type": "PodScheduled" + } + ], + "containerStatuses": [ + { + "containerID": "docker://a3a1aac00031c6ab85f75cfa17d14ebd71ab15f1fc5c82a262449621a77d7a7e", + "image": "redis:latest", + "imageID": "docker-pullable://redis@sha256:08a82d4bf8a8b4dd94e8f5408cdbad9dd184c1cf311d34176cd3e9972c43f872", + "lastState": { + "terminated": { + "containerID": "docker://1ae623f4faf8cda5dabdc65c342752dfdf1675cb173b46875596c2eb0dae472f", + "exitCode": 255, + "finishedAt": "2023-07-18T05:03:55Z", + "reason": "Error", + "startedAt": "2023-07-17T16:32:35Z" + } + }, + "name": "fake-pod-1-22gck", + "ready": true, + "restartCount": 9, + "started": true, + "state": { + "running": { + "startedAt": "2023-07-18T05:07:56Z" + } + } + } + ], + "hostIP": "192.168.85.2", + "phase": "Running", + "podIP": "10.244.1.131", + "podIPs": [ + { + "ip": "10.244.1.131" + } + ], + "qosClass": "BestEffort", + "startTime": "2023-06-22T07:47:38Z" + } + }, + "/v1/default/Service/fake-service-1": { + "apiVersion": "v1", + "kind": "Service", + "metadata": { + "annotations": { + "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Service\",\"metadata\":{\"annotations\":{},\"name\":\"fake-service-1\",\"namespace\":\"default\"},\"spec\":{\"clusterIP\":\"10.96.0.11\",\"ports\":[{\"port\":80,\"protocol\":\"TCP\",\"targetPort\":9376}],\"selector\":{\"app\":\"argo-server\"},\"type\":\"LoadBalancer\"},\"status\":{\"loadBalancer\":{\"ingress\":[{\"ip\":\"192.0.2.127\"}]}}}\n" + }, + "creationTimestamp": "2023-07-09T06:22:27Z", + "name": "fake-service-1", + "namespace": "default", + "resourceVersion": "981856", + "uid": "dd629eb1-6779-4298-a70f-0bdbd046d409" + }, + "spec": { + "allocateLoadBalancerNodePorts": true, + "clusterIP": "10.96.0.11", + "clusterIPs": [ + "10.96.0.11" + ], + "externalTrafficPolicy": "Cluster", + "internalTrafficPolicy": "Cluster", + "ipFamilies": [ + "IPv4" + ], + "ipFamilyPolicy": "SingleStack", + "ports": [ + { + "nodePort": 30706, + "port": 80, + "protocol": "TCP", + "targetPort": 9376 + } + ], + "selector": { + "app": "argo-server" + }, + "sessionAffinity": "None", + "type": "LoadBalancer" + }, + "status": { + "loadBalancer": {} + } + } +} \ No newline at end of file diff --git a/core/pkg/resourcesprioritization/prioritizationhandler_test.go b/core/pkg/resourcesprioritization/prioritizationhandler_test.go index 510e537f..b94abd14 100644 --- a/core/pkg/resourcesprioritization/prioritizationhandler_test.go +++ b/core/pkg/resourcesprioritization/prioritizationhandler_test.go @@ -19,7 +19,7 @@ import ( type AttackTracksGetterMock struct{} func (mock *AttackTracksGetterMock) GetAttackTracks() ([]v1alpha1.AttackTrack, error) { - mock_1 := v1alpha1.AttackTrackMock(v1alpha1.AttackTrackStep{ + mock_1 := v1alpha1.GetAttackTrackMock(v1alpha1.AttackTrackStep{ Name: "A", SubSteps: []v1alpha1.AttackTrackStep{ { @@ -39,12 +39,13 @@ func (mock *AttackTracksGetterMock) GetAttackTracks() ([]v1alpha1.AttackTrack, e }, }) - mock_2 := v1alpha1.AttackTrackMock(v1alpha1.AttackTrackStep{ + mock_2 := v1alpha1.GetAttackTrackMock(v1alpha1.AttackTrackStep{ Name: "Z", }) - mock_2.Metadata["name"] = "TestAttackTrack_2" - - return []v1alpha1.AttackTrack{*mock_1, *mock_2}, nil + m1 := mock_1.(*v1alpha1.AttackTrack) + m2 := mock_2.(*v1alpha1.AttackTrack) + m2.Metadata["name"] = "TestAttackTrack_2" + return []v1alpha1.AttackTrack{*m1, *m2}, nil } func ControlMock(id string, baseScore float32, tags, categories []string) reporthandling.Control { diff --git a/go.mod b/go.mod index 4b3f2a6c..6470a41c 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.20 require ( cloud.google.com/go/containeranalysis v0.9.0 - github.com/armosec/armoapi-go v0.0.173 + github.com/armosec/armoapi-go v0.0.202 github.com/armosec/utils-go v0.0.14 github.com/armosec/utils-k8s-go v0.0.13 github.com/briandowns/spinner v1.18.1 @@ -19,7 +19,7 @@ require ( github.com/kubescape/go-git-url v0.0.25 github.com/kubescape/go-logger v0.0.13 github.com/kubescape/k8s-interface v0.0.116 - github.com/kubescape/opa-utils v0.0.250 + github.com/kubescape/opa-utils v0.0.253 github.com/kubescape/rbac-utils v0.0.20 github.com/kubescape/regolibrary v1.0.286-rc.0 github.com/libgit2/git2go/v33 v33.0.9 @@ -36,7 +36,7 @@ require ( github.com/whilp/git-urls v1.0.0 go.opentelemetry.io/otel v1.16.0 go.opentelemetry.io/otel/metric v1.16.0 - golang.org/x/mod v0.8.0 + golang.org/x/mod v0.11.0 golang.org/x/sync v0.1.0 google.golang.org/api v0.114.0 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 @@ -336,7 +336,7 @@ require ( go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.24.0 // indirect golang.org/x/crypto v0.5.0 // indirect - golang.org/x/exp v0.0.0-20230519143937-03e91628a987 // indirect + golang.org/x/exp v0.0.0-20230711023510-fffb14384f22 // indirect golang.org/x/net v0.10.0 // indirect golang.org/x/oauth2 v0.6.0 // indirect golang.org/x/sys v0.8.0 // indirect @@ -366,4 +366,5 @@ require ( ) replace github.com/libgit2/git2go/v33 => ./git2go -replace google.golang.org/grpc => google.golang.org/grpc v1.54.0 \ No newline at end of file + +replace google.golang.org/grpc => google.golang.org/grpc v1.54.0 diff --git a/go.sum b/go.sum index 3656fa49..ffdf310d 100644 --- a/go.sum +++ b/go.sum @@ -599,8 +599,8 @@ github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/armosec/armoapi-go v0.0.173 h1:TwNxmTxx9ATJPZBlld/53s/WvSVUfoF4gxgHT6UbFng= -github.com/armosec/armoapi-go v0.0.173/go.mod h1:xlW8dGq0vVzbuk+kDZqMQIkfU9P/iiiiDavoCIboqgI= +github.com/armosec/armoapi-go v0.0.202 h1:0PM89laC4rplz4eSELJ5ueVxxDIuEfIlDwlGa/c0pkg= +github.com/armosec/armoapi-go v0.0.202/go.mod h1:Fq2xtueM2ha0VK1b/PcbtbkAzHUgjqMz4MEdabNpdwY= github.com/armosec/utils-go v0.0.14 h1:Q6HGxOyc5aPObgUM2FQpkYGXjj7/LSrUPkppFJGTexU= github.com/armosec/utils-go v0.0.14/go.mod h1:F/K1mI/qcj7fNuJl7xktoCeHM83azOF0Zq6eC2WuPyU= github.com/armosec/utils-k8s-go v0.0.13 h1:MzrRotrtZjpz4Yq1VRGbxDOfd6b5qRqZupzLnpj+W1A= @@ -985,8 +985,8 @@ github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8w github.com/go-rod/rod v0.111.0 h1:aMNNdz10GYPYec9z1WsFqwAdRYVsuufVTOrah7whG3I= github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w= github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w= -github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE= github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= +github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4= github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= @@ -1384,8 +1384,8 @@ github.com/kubescape/go-logger v0.0.13 h1:Rio+grBhpcdExZIVT+HcBVcgbvwrU/aVSV99iK github.com/kubescape/go-logger v0.0.13/go.mod h1:Tod++iNn5kofkhjpfwjUrqie2YHkLZNoH0Pq0+KldMo= github.com/kubescape/k8s-interface v0.0.116 h1:Sn76gsMLAArc5kbHZVoRMS6QlM4mOz9Dolpym9BOul8= github.com/kubescape/k8s-interface v0.0.116/go.mod h1:ENpA9SkkS6E3PIT+AaMu/JGkuyE04aUamY+a7WLqsJQ= -github.com/kubescape/opa-utils v0.0.250 h1:SpMjtDB3EgyvbwxpCpZXAtQ/TixOeVQAmkcfi+w66KA= -github.com/kubescape/opa-utils v0.0.250/go.mod h1:SkNqbhUGipSYVE+oAUaHko6aggp8XVVbDChoNg48lao= +github.com/kubescape/opa-utils v0.0.253 h1:LOEum6gVscgjFlPT5WUHPsYbjELnMOJTcOrEJUKIRlM= +github.com/kubescape/opa-utils v0.0.253/go.mod h1:SkNqbhUGipSYVE+oAUaHko6aggp8XVVbDChoNg48lao= github.com/kubescape/rbac-utils v0.0.20 h1:1MMxsCsCZ3ntDi8f9ZYYcY+K7bv50bDW5ZvnGnhMhJw= github.com/kubescape/rbac-utils v0.0.20/go.mod h1:t57AhSrjuNGQ+mpZWQM/hBzrCOeKBDHegFoVo4tbikQ= github.com/kubescape/regolibrary v1.0.286-rc.0 h1:OzhtQEx1npAxTbgkbEpMLZvPWg6sh2CmCgQLs0j6pQ4= @@ -2125,8 +2125,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw= -golang.org/x/exp v0.0.0-20230519143937-03e91628a987 h1:3xJIFvzUFbu4ls0BTBYcgbCGhA63eAOEMxIHugyXJqA= -golang.org/x/exp v0.0.0-20230519143937-03e91628a987/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w= +golang.org/x/exp v0.0.0-20230711023510-fffb14384f22 h1:FqrVOBQxQ8r/UwwXibI0KMolVhvFiGobSfdE33deHJM= +golang.org/x/exp v0.0.0-20230711023510-fffb14384f22/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc= golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs= golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= @@ -2162,8 +2162,9 @@ golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU= +golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= diff --git a/httphandler/go.mod b/httphandler/go.mod index d8cc981c..c92f2f62 100644 --- a/httphandler/go.mod +++ b/httphandler/go.mod @@ -13,7 +13,7 @@ require ( github.com/kubescape/go-logger v0.0.13 github.com/kubescape/k8s-interface v0.0.116 github.com/kubescape/kubescape/v2 v2.0.0-00010101000000-000000000000 - github.com/kubescape/opa-utils v0.0.250 + github.com/kubescape/opa-utils v0.0.253 github.com/stretchr/testify v1.8.3 go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.38.0 go.opentelemetry.io/otel v1.16.0 @@ -26,8 +26,8 @@ require ( go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.24.0 // indirect golang.org/x/crypto v0.5.0 // indirect - golang.org/x/exp v0.0.0-20230519143937-03e91628a987 // indirect - golang.org/x/mod v0.8.0 // indirect + golang.org/x/exp v0.0.0-20230711023510-fffb14384f22 // indirect + golang.org/x/mod v0.11.0 // indirect golang.org/x/net v0.10.0 // indirect golang.org/x/oauth2 v0.6.0 // indirect google.golang.org/appengine v1.6.7 // indirect @@ -83,7 +83,7 @@ require ( github.com/alibabacloud-go/tea-utils v1.4.4 // indirect github.com/alibabacloud-go/tea-xml v1.1.2 // indirect github.com/aliyun/credentials-go v1.2.3 // indirect - github.com/armosec/armoapi-go v0.0.173 // indirect + github.com/armosec/armoapi-go v0.0.202 // indirect github.com/armosec/utils-k8s-go v0.0.13 // indirect github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect github.com/aws/aws-sdk-go v1.44.114 // indirect diff --git a/httphandler/go.sum b/httphandler/go.sum index 17c41368..d60e6567 100644 --- a/httphandler/go.sum +++ b/httphandler/go.sum @@ -599,8 +599,8 @@ github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/armosec/armoapi-go v0.0.173 h1:TwNxmTxx9ATJPZBlld/53s/WvSVUfoF4gxgHT6UbFng= -github.com/armosec/armoapi-go v0.0.173/go.mod h1:xlW8dGq0vVzbuk+kDZqMQIkfU9P/iiiiDavoCIboqgI= +github.com/armosec/armoapi-go v0.0.202 h1:0PM89laC4rplz4eSELJ5ueVxxDIuEfIlDwlGa/c0pkg= +github.com/armosec/armoapi-go v0.0.202/go.mod h1:Fq2xtueM2ha0VK1b/PcbtbkAzHUgjqMz4MEdabNpdwY= github.com/armosec/utils-go v0.0.14 h1:Q6HGxOyc5aPObgUM2FQpkYGXjj7/LSrUPkppFJGTexU= github.com/armosec/utils-go v0.0.14/go.mod h1:F/K1mI/qcj7fNuJl7xktoCeHM83azOF0Zq6eC2WuPyU= github.com/armosec/utils-k8s-go v0.0.13 h1:MzrRotrtZjpz4Yq1VRGbxDOfd6b5qRqZupzLnpj+W1A= @@ -987,8 +987,8 @@ github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8w github.com/go-rod/rod v0.111.0 h1:aMNNdz10GYPYec9z1WsFqwAdRYVsuufVTOrah7whG3I= github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w= github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w= -github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE= github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= +github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4= github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= @@ -1389,8 +1389,8 @@ github.com/kubescape/go-logger v0.0.13 h1:Rio+grBhpcdExZIVT+HcBVcgbvwrU/aVSV99iK github.com/kubescape/go-logger v0.0.13/go.mod h1:Tod++iNn5kofkhjpfwjUrqie2YHkLZNoH0Pq0+KldMo= github.com/kubescape/k8s-interface v0.0.116 h1:Sn76gsMLAArc5kbHZVoRMS6QlM4mOz9Dolpym9BOul8= github.com/kubescape/k8s-interface v0.0.116/go.mod h1:ENpA9SkkS6E3PIT+AaMu/JGkuyE04aUamY+a7WLqsJQ= -github.com/kubescape/opa-utils v0.0.250 h1:SpMjtDB3EgyvbwxpCpZXAtQ/TixOeVQAmkcfi+w66KA= -github.com/kubescape/opa-utils v0.0.250/go.mod h1:SkNqbhUGipSYVE+oAUaHko6aggp8XVVbDChoNg48lao= +github.com/kubescape/opa-utils v0.0.253 h1:LOEum6gVscgjFlPT5WUHPsYbjELnMOJTcOrEJUKIRlM= +github.com/kubescape/opa-utils v0.0.253/go.mod h1:SkNqbhUGipSYVE+oAUaHko6aggp8XVVbDChoNg48lao= github.com/kubescape/rbac-utils v0.0.20 h1:1MMxsCsCZ3ntDi8f9ZYYcY+K7bv50bDW5ZvnGnhMhJw= github.com/kubescape/rbac-utils v0.0.20/go.mod h1:t57AhSrjuNGQ+mpZWQM/hBzrCOeKBDHegFoVo4tbikQ= github.com/kubescape/regolibrary v1.0.286-rc.0 h1:OzhtQEx1npAxTbgkbEpMLZvPWg6sh2CmCgQLs0j6pQ4= @@ -2132,8 +2132,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw= -golang.org/x/exp v0.0.0-20230519143937-03e91628a987 h1:3xJIFvzUFbu4ls0BTBYcgbCGhA63eAOEMxIHugyXJqA= -golang.org/x/exp v0.0.0-20230519143937-03e91628a987/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w= +golang.org/x/exp v0.0.0-20230711023510-fffb14384f22 h1:FqrVOBQxQ8r/UwwXibI0KMolVhvFiGobSfdE33deHJM= +golang.org/x/exp v0.0.0-20230711023510-fffb14384f22/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc= golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs= golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= @@ -2169,8 +2169,9 @@ golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU= +golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=