Minimize Admission Privileged Containers

kubectl label --overwrite ns team-a pod-security.kubernetes.io/enforce=restricted
kubectl label --overwrite ns team-b pod-security.kubernetes.io/enforce=restricted
kubectl label --overwrite ns prod-apps pod-security.kubernetes.io/enforce=restricted

kubectl label --overwrite ns --all pod-security.kubernetes.io/warn=baseline

kubectl get ns --show-labels | grep pod-security.kubernetes.io

kubectl get pods --all-namespaces -o json | \
  jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.privileged == true) then "PRIVILEGED_FOUND" else "NO_PRIVILEGED" end'

#!/usr/bin/env bash
set -euo pipefail

# This script:
# - Identifies namespaces that currently allow privileged containers
# - Applies Pod Security Admission labels to minimize privileged containers
# - Verifies that no privileged containers are admitted
#
# Run from: any machine with kubectl access and jq installed.

# 1) Safety checks
if ! command -v kubectl >/dev/null 2>&1; then
  echo "kubectl not found in PATH" >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "jq not found in PATH" >&2
  exit 1
fi

# Ensure we can talk to the cluster
kubectl cluster-info >/dev/null

echo "=== Detecting namespaces with privileged containers ==="

# 2) Detect namespaces that currently have privileged containers
#    (for operator awareness; labeling is applied broadly below)
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | select(any(.spec.containers[]?; .securityContext?.privileged == true))
    | .metadata.namespace
  ' | sort -u || true

echo "=== Applying Pod Security Admission labels to restrict privileged containers ==="

# 3) Enforce 'restricted' PSA level on all namespaces that may host user workloads
#    Adjust the namespace selector as appropriate for your environment.
#    Below we:
#      - enforce=restricted on all namespaces that are NOT in a small system list
#      - warn=baseline on all namespaces (for visibility)
#
#    Edit SYSTEM_NAMESPACES if you need a different set.

SYSTEM_NAMESPACES=("kube-system" "kube-public" "kube-node-lease" "default")

# Build a regex of system namespaces for grep -Ev
SYSTEM_REGEX="$(printf '%s\n' "${SYSTEM_NAMESPACES[@]}" | paste -sd '|' -)"

# Label all namespaces with warn=baseline (idempotent)
echo "Labeling all namespaces with pod-security.kubernetes.io/warn=baseline= (idempotent)..."
kubectl label ns --all pod-security.kubernetes.io/warn=baseline --overwrite

# Label non-system namespaces with enforce=restricted (idempotent)
echo "Labeling non-system namespaces with pod-security.kubernetes.io/enforce=restricted (idempotent)..."
USER_NAMESPACES=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' \
  | grep -Ev "^(${SYSTEM_REGEX})$" || true)

if [ -n "$USER_NAMESPACES" ]; then
  # shellcheck disable=SC2086
  kubectl label ns $USER_NAMESPACES pod-security.kubernetes.io/enforce=restricted --overwrite
else
  echo "No user namespaces detected to label with enforce=restricted."
fi

echo "=== Current PSA labels per namespace ==="
kubectl get ns --show-labels

# 4) Verification - ensure no privileged containers are admitted
echo "=== Verifying no privileged containers are present ==="
VERIFY_OUTPUT=$(kubectl get pods --all-namespaces -o json | \
  jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.privileged == true)
         then "PRIVILEGED_FOUND" else "NO_PRIVILEGED" end')

if [ "$VERIFY_OUTPUT" = "NO_PRIVILEGED" ]; then
  echo "Verification passed: NO_PRIVILEGED"
  exit 0
else
  echo "Verification failed: PRIVILEGED_FOUND"
  echo "There are still pods running with securityContext.privileged=true."
  echo "Inspect them with:"
  echo "  kubectl get pods --all-namespaces -o json | \\"
  echo "    jq -r ''.items[] | select(any(.spec.containers[]?; .securityContext?.privileged == true)) | .metadata.namespace + \"/\" + .metadata.name'''"
  exit 1
fi