Documentation ¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var CheckNoPublicEgress = rules.Register( scan2.Rule{ AVDID: "AVD-KUBE-0002", Provider: providers2.KubernetesProvider, Service: "network", ShortCode: "no-public-egress", Summary: "Public egress should not be allowed via network policies", Impact: "Exfiltration of data to the public internet", Resolution: "Remove public access except where explicitly required", Explanation: `You should not expose infrastructure to the public internet except where explicitly required`, Links: []string{}, Terraform: &scan2.EngineMetadata{ GoodExamples: terraformNoPublicEgressGoodExamples, BadExamples: terraformNoPublicEgressBadExamples, Links: terraformNoPublicEgressLinks, RemediationMarkdown: terraformNoPublicEgressRemediationMarkdown, }, Severity: severity2.High, }, func(s *state2.State) (results scan2.Results) { for _, policy := range s.Kubernetes.NetworkPolicies { if policy.IsUnmanaged() { continue } for _, destination := range policy.Spec.Egress.DestinationCIDRs { if cidr.IsPublic(destination.Value()) { results.Add( "Network policy allows egress to the public internet.", destination, ) } else { results.AddPassed(destination) } } } return }, )
View Source
var CheckNoPublicIngress = rules.Register( scan2.Rule{ AVDID: "AVD-KUBE-0001", Provider: providers2.KubernetesProvider, Service: "network", ShortCode: "no-public-ingress", Summary: "Public ingress should not be allowed via network policies", Impact: "Exposure of infrastructure to the public internet", Resolution: "Remove public access except where explicitly required", Explanation: `You should not expose infrastructure to the public internet except where explicitly required`, Links: []string{}, Terraform: &scan2.EngineMetadata{ GoodExamples: terraformNoPublicIngressGoodExamples, BadExamples: terraformNoPublicIngressBadExamples, Links: terraformNoPublicIngressLinks, RemediationMarkdown: terraformNoPublicIngressRemediationMarkdown, }, Severity: severity2.High, }, func(s *state2.State) (results scan2.Results) { for _, policy := range s.Kubernetes.NetworkPolicies { if policy.IsUnmanaged() { continue } for _, source := range policy.Spec.Ingress.SourceCIDRs { if cidr.IsPublic(source.Value()) { results.Add( "Network policy allows ingress from the public internet.", source, ) } else { results.AddPassed(source) } } } return }, )
Functions ¶
This section is empty.
Types ¶
This section is empty.
Click to show internal directories.
Click to hide internal directories.