Open Policy Agent
Policies fail even after file is updated #235
Answered
by
anderseknert
jeremyhager
asked this question in
Conftest
-
|
Hello, I've been testing conftest and ran into something that makes me think I'm doing something wrong. Every time I update a policy the same error keeps popping up. Any help or pointers are greatly appreciated! ProblemWhen running Expected behaviourOnce the yaml is updated, I would expect Steps
apiVersion: apps/v1
kind: Deployment
metadata:
name: hello-kubernetes
labels:
app.kubernetes.io/name: mysql
app.kubernetes.io/version: "5.7.21"
app.kubernetes.io/component: database
app.kubernetes.io/part-of: wordpress
app.kubernetes.io/managed-by: helm
spec:
replicas: 3
selector:
matchLabels:
app: hello-kubernetes
template:
metadata:
labels:
app: hello-kubernetes
spec:
containers:
- name: hello-kubernetes
image: paulbouwer/hello-kubernetes:1.5
ports:
- containerPort: 8080
securityContext:
runAsNonRoot: true
System infoconftest: OS: Further troubleshootingI know this post is long, but I also wanted to add some other info here:
package main
import data.kubernetes
name = input.metadata.name
deny[msg] {
kubernetes.is_deployment
not input.spec.template.spec.securityContext.runAsNonRoot
msg = sprintf("Containers must not run as root in Deployment %s", [name])
}
# required_deployment_selectors {
# input.spec.selector.matchLabels.app
# input.spec.selector.matchLabels.release
# }
# deny[msg] {
# kubernetes.is_deployment
# not required_deployment_selectors
# msg = sprintf("Deployment %s must provide app/release labels for pod selectors", [name])
# }
# ...
spec:
containers:
- name: hello-kubernetes
image: paulbouwer/hello-kubernetes:1.5
ports:
- containerPort: 8080
securityContext:
runAsNonRoot: true
|
Beta Was this translation helpful? Give feedback.
Answered by
anderseknert
Jul 11, 2022
Replies: 1 comment 1 reply
-
|
Hi @jeremyhager! I have not been involved in authoring that policy, but it seems to check for the securityContext only on the spec itself, an not the individual containers, i.e. deny[msg] {
kubernetes.is_deployment
container := input.spec.template.spec.containers[_]
not container.securityContext.runAsNonRoot
msg = sprintf("Container %s must not run as root in Deployment %s", [container.name, name])
}(you might want to repeat the process for initContainers as well, by the way) |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
🤦♂️Thank you @anderseknert ! This was the fix, after updating the Thanks again! |
Beta Was this translation helpful? Give feedback.
Answer selected by
jeremyhager
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi @jeremyhager! I have not been involved in authoring that policy, but it seems to check for the securityContext only on the spec itself, an not the individual containers, i.e.
input.spec.template.spec.securityContext.runAsNonRoot. I believe this is valid configuration, but if you'd rather want to check each container instead, perhaps in order to allow some containers without the setting, you could do something like:deny[msg] { kubernetes.is_deployment container := input.spec.template.spec.containers[_] not container.securityContext.runAsNonRoot msg = sprintf("Container %s must not run as root in Deployment %s", [container.name, name]) }(you might want to repeat the process…