feat(pv-pvc-classification): ensure statically provisioned PVs match binding PVCs

README.md

@@ -13,11 +13,12 @@ This repo contains general policies that can be used to enforce common Kubernete
 | Container Allowed Images         | [container-allowed-images](general/container-allowed-images)                 |
 | Container Image Must Have Digest | [container-image-must-have-digest](general/container-image-must-have-digest) |
 | Container Limits                 | [container-limits](general/container-limits)                                 |
-| Deny External Users              | [deny-external-users](general/deny-external-users)                                 |
+| Deny External Users              | [deny-external-users](general/deny-external-users)                           |
 | Ingress No Hostnames             | [ingress-no-hostnames](general/ingress-no-hostnames)                         |
 | Ingress Hostnames Conflict       | [ingress-hostnames-conflict](general/ingress-hostnames-conflict)             |
 | Load Balancer No Public IPs      | [loadbalancer-no-public-ips](general/loadbalancer-no-public-ips)             |
 | Pod Enforce Labels               | [pod-enforce-labels](general/pod-enforce-labels)                             |
+| PV PVC Classification            | [pv-pvc-classification](general/pv-pvc-classification)                       |
 
 ## Pod Security Policies
 

gatekeeper-opa-sync.yaml

@@ -24,6 +24,9 @@ spec:
       - group: "security.istio.io"
         version: "v1beta1"
         kind: "AuthorizationPolicy"
+      - group: ""
+        version: "v1"
+        kind: "PersistentVolume"
       - group: ""
         version: "v1"
         kind: "PersistentVolumeClaim"

general/pv-pvc-classification/examples/constraint.yaml

@@ -0,0 +1,14 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: VolumeClassification
+metadata:
+  name: pv-pvc-classification-match
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["PersistentVolumeClaim"]
+    #namespaceSelector:
+    #  matchExpressions:
+    #    - key: app.kubernetes.io/part-of
+    #      operator: In
+    #      values: ["kubeflow-profile"]

general/pv-pvc-classification/kustomization.yaml

@@ -0,0 +1,12 @@
+# ----------------------------------------------------
+# apiVersion and kind of Kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Each entry in this list must resolve to an existing
+# resource definition in YAML.  These are the resource
+# files that kustomize reads, modifies and emits as a
+# YAML string, with resources separated by document
+# markers ("---").
+resources:
+  - template.yaml

general/pv-pvc-classification/template.yaml

@@ -0,0 +1,49 @@
+apiVersion: templates.gatekeeper.sh/v1beta1
+kind: ConstraintTemplate
+metadata:
+  name: volumeclassification
+spec:
+  crd:
+    spec:
+      names:
+        kind: VolumeClassification
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package volumeclassification
+
+        violation[{"msg": msg}] {
+
+          # Binding to an statically provisioned PV
+          pvc := input.review.object
+          pvc.kind == "PersistentVolumeClaim"
+          pvc.spec.storageClassName == ""
+
+          # Check volume is in the inventory
+          pvRef := pvc.spec.volumeName
+          pv := data.inventory.cluster["v1"]["PersistentVolume"][pvRef]
+
+          # If one is PB, the other must be
+          pv.metadata.labels["data.statcan.gc.ca/classification"]  == "protected-b"
+          not pvc.metadata.labels["data.statcan.gc.ca/classification"] == "protected-b"
+
+          msg := sprintf("PVC <%v> is unclassified but the PV is protected-b", [pvc.metadata.name])
+        }
+
+        violation[{"msg": msg}] {
+
+          # Binding to an statically provisioned PV
+          pvc := input.review.object
+          pvc.kind == "PersistentVolumeClaim"
+          pvc.spec.storageClassName == ""
+
+          # Check volume is in the inventory
+          pvRef := pvc.spec.volumeName
+          pv := data.inventory.cluster["v1"]["PersistentVolume"][pvRef]
+
+          # If one is PB, the other must be
+          not pv.metadata.labels["data.statcan.gc.ca/classification"] == "protected-b"
+          pvc.metadata.labels["data.statcan.gc.ca/classification"] == "protected-b"
+
+          msg := sprintf("PVC <%v> is protected-b but the PV is unclassified", [pvc.metadata.name])
+        }