Skip to content

Instantly share code, notes, and snippets.

@ankitsaini2609

ankitsaini2609/deny_public_elb_creation_with_whitelisting.yaml

Last active July 8, 2021 08:40
Show Gist options
  • Save ankitsaini2609/11af2bc3affd92da3fd2e56db48d2e5d to your computer and use it in GitHub Desktop.
Save ankitsaini2609/11af2bc3affd92da3fd2e56db48d2e5d to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. ankitsaini2609 revised this gist Jul 8, 2021. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions deny_public_elb_creation_with_whitelisting.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -10,7 +10,7 @@ spec:
    context:
    - name: allowed-elbs
    configMap:
    name: allowed-elbs
    name: public-services
    namespace: security
    match:
    resources:
    @@ -28,4 +28,4 @@ spec:
    value: "LoadBalancer"
    - key: "{{request.namespace}}/{{request.name}}"
    operator: NotIn
    value: "{{ \"allowed-elbs\".data.\"allowed-elbs\" }}"
    value: "{{ \"public-services\".data.\"public-services-whitelist\" }}"
  2. ankitsaini2609 revised this gist Jun 3, 2021. 1 changed file with 0 additions and 10 deletions.
    10 changes: 0 additions & 10 deletions config_map.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,10 +0,0 @@
    apiVersion: v1
    kind: ConfigMap
    metadata:
    name: allowed-elbs
    namespace: security
    data:
    allowed-elbs: |-
    donottouchthis/*
    d0n0tt0uchth15/*
  3. ankitsaini2609 created this gist Jun 3, 2021.
    10 changes: 10 additions & 0 deletions config_map.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,10 @@
    apiVersion: v1
    kind: ConfigMap
    metadata:
    name: allowed-elbs
    namespace: security
    data:
    allowed-elbs: |-
    donottouchthis/*
    d0n0tt0uchth15/*
    31 changes: 31 additions & 0 deletions deny_public_elb_creation_with_whitelisting.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,31 @@
    apiVersion: kyverno.io/v1
    kind: ClusterPolicy
    metadata:
    name: deny-public-elb-creation
    spec:
    validationFailureAction: enforce
    background: false
    rules:
    - name: block-public-elb-service-creations
    context:
    - name: allowed-elbs
    configMap:
    name: allowed-elbs
    namespace: security
    match:
    resources:
    kinds:
    - Service
    validate:
    message: "Service of the type: LoadBalancer found to be exposed publicly. Please expose the service as a private ELB via 'service.beta.kubernetes.io/aws-load-balancer-internal' annotation. In case of any doubts reach out to security team."
    deny:
    conditions:
    - key: "{{request.object.metadata.annotations.\"service.beta.kubernetes.io/aws-load-balancer-internal\"||'~'}}"
    operator: Equals
    value: "~"
    - key: "{{request.object.spec.type}}"
    operator: Equals
    value: "LoadBalancer"
    - key: "{{request.namespace}}/{{request.name}}"
    operator: NotIn
    value: "{{ \"allowed-elbs\".data.\"allowed-elbs\" }}"