[MTB] added block other tenant resources benchmark

benchmarks/kubectl-mtb/internal/kubectl-mtb/run.go

@@ -80,6 +80,16 @@ func initConfig() error {
 		return err
 	}
 
+	if benchmarkRunOptions.OtherNamespace != "" && benchmarkRunOptions.OtherTenant != "" {
+		otherTenantConfig := config
+		otherTenantConfig.Impersonate.UserName = benchmarkRunOptions.OtherTenant
+
+		benchmarkRunOptions.OClient, err = kubernetes.NewForConfig(tenantConfig)
+		if err != nil {
+			return err
+		}
+	}
+
 	return err
 }
 
@@ -130,6 +140,9 @@ func validateFlags(cmd *cobra.Command) error {
 		return fmt.Errorf("tenant namespace must be set via --namespace or -n")
 	}
 
+	benchmarkRunOptions.OtherNamespace, _ = cmd.Flags().GetString("other-namespace")
+	benchmarkRunOptions.OtherTenant, _ = cmd.Flags().GetString("other-tenant-admin")
+
 	err := initConfig()
 	if err != nil {
 		return err

benchmarks/kubectl-mtb/internal/mtb_builder/tpl.go

@@ -6,13 +6,14 @@ func BenchmarkFileTemplate() []byte {
 
 import (
 	"fmt"
+	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/types"
 
-	"k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/bundle/box"
 	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/pkg/benchmark"
 	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/test"
 )
 
+
 var b = &benchmark.Benchmark{
 
 	PreRun: func(options types.RunOptions) error {

benchmarks/kubectl-mtb/test/benchmarks/block_other_tenant_resources/README.md

@@ -0,0 +1,40 @@
+# Block access to other tenant resources <small>[MTB-PL1-CC-TI-2] </small>
+
+**Profile Applicability:**
+
+2
+
+**Type:**
+
+Configuration
+
+**Category:**
+
+Tenant Protection
+
+**Description:**
+
+Access controls should be configured so that a tenant cannot view, edit, create, or delete namespaced resources belonging to another tenant.
+
+**Rationale:**
+
+Tenant resources should be isolated from other tenants.
+
+
+**Audit:** 
+
+Run the following commands to retrieve the list of namespaced resources available in Tenant B
+```bash
+kubectl --kubeconfig tenant-b api-resources --namespaced=true
+```
+For each namespaced resource, and each verb (get, list, create, update, patch, watch, delete, and deletecollection) issue the following command
+```bash
+kubectl --kubeconfig tenant-a -n b1 &lt;verb&gt; &lt;resource&gt;
+```
+Each command must return &#39;no&#39;
+
+
+**namespaceRequired:** 
+
+2
+

benchmarks/kubectl-mtb/test/benchmarks/block_other_tenant_resources/block_other_tenant_resources.go

@@ -0,0 +1,94 @@
+package blockothertenantresources
+
+import (
+	"fmt"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/test/utils"
+	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/types"
+
+	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/bundle/box"
+	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/pkg/benchmark"
+	"sigs.k8s.io/multi-tenancy/benchmarks/kubectl-mtb/test"
+)
+
+var verbs = []string{"get", "update"}
+
+var b = &benchmark.Benchmark{
+
+	PreRun: func(options types.RunOptions) error {
+
+		return nil
+	},
+
+	Run: func(options types.RunOptions) error {
+		var primaryNamespaceResources []utils.GroupResource
+
+		lists, err := options.KClient.Discovery().ServerPreferredResources()
+		if err != nil {
+			options.Logger.Debug(err.Error())
+			return err
+		}
+
+		for _, list := range lists {
+			if len(list.APIResources) == 0 {
+				continue
+			}
+			gv, err := schema.ParseGroupVersion(list.GroupVersion)
+			if err != nil {
+				continue
+			}
+			for _, resource := range list.APIResources {
+				if len(resource.Verbs) == 0 {
+					continue
+				}
+
+				if resource.Namespaced {
+					continue
+				}
+				primaryNamespaceResources = append(primaryNamespaceResources, utils.GroupResource{
+					APIGroup:    gv.Group,
+					APIResource: resource,
+				})
+			}
+		}
+
+		for _, resource := range primaryNamespaceResources {
+			for _, verb := range verbs {
+				access, msg, err := utils.RunAccessCheck(options.OClient, options.TenantNamespace, resource, verb)
+				if err != nil {
+					options.Logger.Debug(err.Error())
+					return err
+				}
+				if access {
+					return fmt.Errorf(msg)
+				}
+			}
+		}
+
+		for _, resource := range primaryNamespaceResources {
+			for _, verb := range verbs {
+				access, msg, err := utils.RunAccessCheck(options.TClient, options.OtherNamespace, resource, verb)
+				if err != nil {
+					options.Logger.Debug(err.Error())
+					return err
+				}
+				if access {
+					return fmt.Errorf(msg)
+				}
+			}
+		}
+
+		return nil
+	},
+}
+
+func init() {
+	// Get the []byte representation of a file, or an error if it doesn't exist:
+	err := b.ReadConfig(box.Get("block_other_tenant_resources/config.yaml"))
+	if err != nil {
+		fmt.Println(err)
+	}
+
+	test.BenchmarkSuite.Add(b);
+}
+

benchmarks/kubectl-mtb/test/benchmarks/block_other_tenant_resources/block_other_tenant_resources_test.go

@@ -0,0 +1 @@
+package blockothertenantresources

benchmarks/kubectl-mtb/test/benchmarks/block_other_tenant_resources/config.yaml

@@ -0,0 +1,19 @@
+id: MTB-PL1-CC-TI-2
+title: Block access to other tenant resources
+benchmarkType: Configuration
+category: Tenant Protection
+description: Access controls should be configured so that a tenant cannot view, edit, create, or delete namespaced resources belonging to another tenant.
+remediation: 
+profileLevel: 2
+namespaceRequired: 2
+rationale: Tenant resources should be isolated from other tenants.
+Audit: |
+  Run the following commands to retrieve the list of namespaced resources available in Tenant B
+  ```bash
+  kubectl --kubeconfig tenant-b api-resources --namespaced=true
+  ```
+  For each namespaced resource, and each verb (get, list, create, update, patch, watch, delete, and deletecollection) issue the following command
+  ```bash
+  kubectl --kubeconfig tenant-a -n b1 <verb> <resource>
+  ```
+  Each command must return 'no'

benchmarks/kubectl-mtb/test/benchmarks/require_always_pull_image/README.md

@@ -23,5 +23,5 @@ Set `imagePullPolicy` to `always` for the container.
 
 **namespaceRequired:** 
 
-2
+1
 

benchmarks/kubectl-mtb/types/types.go

@@ -14,5 +14,6 @@ type RunOptions struct {
 	Label           string
 	KClient         *kubernetes.Clientset
 	TClient         *kubernetes.Clientset
+	OClient         *kubernetes.Clientset
 	Logger          *zap.SugaredLogger
 }