feat(kubernetes): added CKV2_K8S_EXAMPLE_1 only in tests as an example for k8s graph check for pod which is publicly accessible

tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Failing/Pod.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  app: nginx-pod
+  labels:
+    app: nginx-pod
+spec:
+  containers:
+  - name: nginx
+    image: nginx:1.14.2
+    ports:
+    - containerPort: 80

tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Failing/Service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-service
+spec:
+  selector:
+    app: nginx-pod
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 9376
+  clusterIP: 10.0.171.239
+  type: LoadBalancer
+status:
+  loadBalancer:
+    ingress:
+    - ip: 192.0.2.127

tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Passing/Pod.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  app: nginx-pod
+  labels:
+    app: no-service-attached
+spec:
+  containers:
+  - name: nginx
+    image: nginx:1.14.2
+    ports:
+    - containerPort: 80

tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Passing/Service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: not-attached-to-any-pod
+spec:
+  selector:
+    app: not-exist
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 9376
+  clusterIP: 10.0.171.239
+  type: LoadBalancer
+status:
+  loadBalancer:
+    ingress:
+    - ip: 192.0.2.127

tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/expected.yaml

@@ -0,0 +1,4 @@
+pass:
+  - Pod.default.app-no-service-attached
+fail:
+  - Pod.default.app-nginx-pod

tests/kubernetes/graph/checks/test_checks/PodIsPubliclyAccessibleExample.yaml

@@ -0,0 +1,33 @@
+metadata:
+  id: "CKV2_K8S_EXAMPLE_1"
+  name: "Pod is publicly accessible"
+  category: "KUBERNETES"
+definition:
+  and:
+    - cond_type: filter
+      value:
+        - Pod
+      operator: within
+      attribute: kind
+    - or:
+        - cond_type: connection
+          operator: not_exists
+          resource_types:
+            - Pod
+          connected_resource_types:
+            - Service
+        - and:
+          - cond_type: connection
+            operator: exists
+            resource_types:
+              - Pod
+            connected_resource_types:
+              - Service
+          - cond_type: attribute
+            attribute: 'spec.type'
+            operator: not_within
+            value:
+              - 'LoadBalancer'
+              - 'NodePort'
+            resource_types:
+              - Service

tests/kubernetes/graph/checks/test_yaml_policies.py

@@ -62,6 +62,10 @@ def test_ModifyServicesStatus(self) -> None:
     def test_ReadAllSecrets(self) -> None:
         self.go('ReadAllSecrets')
 
+    @with_k8s_graph_flags()
+    def test_PodIsPubliclyAccessibleExample(self) -> None:
+        self.go('PodIsPubliclyAccessibleExample')
+
     def create_report_from_graph_checks_results(self, checks_results, check):
         report = Report("kubernetes")
         first_results_key = list(checks_results.keys())[0]