kube/policies.libsonnet

local kube = import "kube.libsonnet";

{
    local policies = self,

    policyNameAllowInsecure: "policy:allow-insecure",
    policyNameAllowSecure: "policy:allow-secure",

    Cluster: {
        insecure: kube._Object("policy/v1beta1", "PodSecurityPolicy", "insecure") {
            spec: {
                privileged: true,
                allowPrivilegeEscalation: true,
                allowedCapabilities: ['*'],
                volumes: ['*'],
                hostNetwork: true,
                hostIPC: true,
                hostPID: true,
                runAsUser: {
                    rule: 'RunAsAny',
                },
                seLinux: {
                    rule: 'RunAsAny',
                },
                supplementalGroups: {
                    rule: 'RunAsAny',
                },
                fsGroup: {
                    rule: 'RunAsAny',
                },
            },
        },
        insecureRole: kube.ClusterRole(policies.policyNameAllowInsecure) {
            rules: [
                {
                    apiGroups: ['policy'],
                    resources: ['podsecuritypolicies'],
                    verbs: ['use'],
                    resourceNames: ['insecure'],
                }
            ],
        },
        secure: kube._Object("policy/v1beta1", "PodSecurityPolicy", "secure") {
            spec: {
                privileged: false,
                # Required to prevent escalations to root.
                allowPrivilegeEscalation: false,
                # This is redundant with non-root + disallow privilege escalation,
                # but we can provide it for defense in depth.
                requiredDropCapabilities: ["ALL"],
                # Allow core volume types.
                volumes: [
                    'configMap',
                    'emptyDir',
                    'projected',
                    'secret',
                    'downwardAPI',
                    'persistentVolumeClaim',
                ],
                hostNetwork: false,
                hostIPC: false,
                hostPID: false,
                runAsUser: {
                    # Allow to run as root - docker, we trust you here.
                    rule: 'RunAsAny',
                },
                seLinux: {
                    rule: 'RunAsAny',
                },
                supplementalGroups: {
                    rule: 'MustRunAs',
                    ranges: [
                        {
                            # Forbid adding the root group.
                            min: 1,
                            max: 65535,
                        }
                    ],
                },
                fsGroup: {
                    rule: 'MustRunAs',
                    ranges: [
                        {
                            # Forbid adding the root group.
                            min: 1,
                            max: 65535,
                        }
                    ],
                },
                readOnlyRootFilesystem: false,
            },
        },
        secureRole: kube.ClusterRole(policies.policyNameAllowSecure) {
            rules: [
                {
                    apiGroups: ['policy'],
                    resources: ['podsecuritypolicies'],
                    verbs: ['use'],
                    resourceNames: ['secure'],
                },
            ],
        },
    },

    # Allow insecure access to all service accounts in a given namespace.
    AllowNamespaceInsecure(namespace): {
        rb: kube.RoleBinding("policy:allow-insecure-in-" + namespace) {
            metadata+: {
                namespace: namespace,
            },
            roleRef_: policies.Cluster.insecureRole,
            subjects: [
                {
                    kind: "Group",
                    apiGroup: "rbac.authorization.k8s.io",
                    name: "system:serviceaccounts",
                }
            ],
        },
    },
}