Pod level testing (#546)

* update runAsPrivileged to test at pod level

* update runAsPrivileged to test at pod level

* add pod level success/failure tests

* add insuecure capabilities pod level testing

* update checks to include good/bad security

* update checks for good/bad security

* remove good security from runAsPrivileged

checks/insecureCapabilities.yaml

@@ -53,5 +53,4 @@ schema:
                 - contains:
                     const: KILL
                 - contains:
-                    const: AUDIT_WRITE
-
+                    const: AUDIT_WRITE

checks/privilegeEscalationAllowed.yaml

@@ -2,15 +2,42 @@ successMessage: Privilege escalation not allowed
 failureMessage: Privilege escalation should not be allowed
 category: Security
 target: Container
+schemaTarget: Pod
 schema:
   '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  required:
-  - securityContext
-  properties:
-    securityContext:
-      required:
-      - allowPrivilegeEscalation
+  definitions:
+    goodSecurityContext:
+      type: object
+      anyOf:
+      - required:
+        - allowPrivilegeEscalation
+        properties:
+          allowPrivilegeEscalation:
+            const: false
+    notBadSecurityContext:
+      type: object
       properties:
         allowPrivilegeEscalation:
           const: false
+  type: object
+  anyOf:
+  - required:
+    - securityContext
+    properties:
+      securityContext:
+        $ref: "#/definitions/goodSecurityContext"
+      containers:
+        type: array
+        items:
+          properties:
+            securityContext:
+              $ref: "#/definitions/notBadSecurityContext"
+  - properties:
+      containers:
+        type: array
+        items:
+          required:
+          - securityContext
+          properties:
+            securityContext:
+              $ref: "#/definitions/goodSecurityContext"

checks/runAsPrivileged.yaml

@@ -2,12 +2,23 @@ successMessage: Not running as privileged
 failureMessage: Should not be running as privileged
 category: Security
 target: Container
+schemaTarget: Pod
 schema:
   '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  properties:
-    securityContext:
+  definitions:
+    notBadSecurityContext:
+      type: object
       properties:
         privileged:
           not:
             const: true
+  type: object
+  properties:
+    securityContext:
+      $ref: "#/definitions/notBadSecurityContext"
+    containers:
+      type: array
+      items:
+        properties:
+          securityContext:
+            $ref: "#/definitions/notBadSecurityContext"

test/checks/insecureCapabilities/failure.pod.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext:
+    capabilities:
+      drop:
+        - ALL
+  containers:
+  - name: nginx
+    image: nginx
+

test/checks/insecureCapabilities/success.pod.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext:
+    capabilities:
+      drop:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+          - NET_ADMIN
+          - CHOWN
+          - DAC_OVERRIDE
+          - FSETID
+          - FOWNER
+          - MKNOD
+          - NET_RAW
+          - SETGID
+          - SETUID
+          - SETFCAP
+          - SETPCAP
+          - NET_BIND_SERVICE
+          - SYS_CHROOT
+          - KILL
+          - AUDIT_WRITE

test/checks/privilegeEscalationAllowed/failure.pod.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext:
+    allowPrivilegeEscalation: false
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      allowPrivilegeEscalation: true

test/checks/privilegeEscalationAllowed/failure.pod_unspecified.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext:
+    allowPrivilegeEscalation: false
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:

test/checks/privilegeEscalationAllowed/success.pod.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext:
+    allowPrivilegeEscalation: true
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      allowPrivilegeEscalation: false

test/checks/runAsPrivileged/failure.pod.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext: 
+    privileged: false
+  containers:
+  - securityContext: 
+      privileged: true

test/checks/runAsPrivileged/failure.two_cont.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext: 
+    privileged: false
+  containers:
+  - securityContext: 
+      privileged: true
+  - securityContext: 
+      privileged: false

test/checks/runAsPrivileged/failure.two_cont_one_unspecified.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext: 
+    privileged: false
+  containers:
+  - securityContext: 
+      privileged: true
+  - securityContext: 

test/checks/runAsPrivileged/success.pod.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext: 
+    privileged: true
+  containers:
+  - securityContext: 
+      privileged: false

test/checks/runAsPrivileged/success.pod_no_cont.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  securityContext: 
+    privileged: false
+  containers:
+    - securityContext:  
+