Minimize The Admission Of Containers With allowPrivilegeEscalation

# 1) Create a baseline policy in each user workload namespace
# Replace <NAMESPACE> with your workload namespace name
# Run on: any machine with kubectl access

cat << 'EOF' | kubectl apply -f -
apiVersion: policy/v1
kind: PodSecurityPolicy
metadata:
  name: disallow-allow-privilege-escalation
  labels:
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/enforce: restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  defaultAllowPrivilegeEscalation: false
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - '*'
EOF

# 2) Bind the policy in a specific namespace
# Replace <NAMESPACE> with your workload namespace name

cat << 'EOF' | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: use-psp-disallow-allow-privilege-escalation
  namespace: <NAMESPACE>
rules:
- apiGroups: ['policy']
  resources: ['podsecuritypolicies']
  verbs: ['use']
  resourceNames:
  - disallow-allow-privilege-escalation
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: use-psp-disallow-allow-privilege-escalation
  namespace: <NAMESPACE>
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: use-psp-disallow-allow-privilege-escalation
subjects:
# Adjust subjects to match who creates pods in this namespace
- kind: Group
  name: system:serviceaccounts:<NAMESPACE>
  apiGroup: rbac.authorization.k8s.io
EOF

# 3) (Optional) Repeat step 2 for each additional workload namespace
# Example for another namespace:
sed 's/namespace: <NAMESPACE>/namespace: my-workload-namespace-2/g' \
  use-psp-disallow-allow-privilege-escalation.yaml | kubectl apply -f -

# 4) Verification: ensure no admitted pods have allowPrivilegeEscalation=true

kubectl get pods --all-namespaces -o json | \
  jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.allowPrivilegeEscalation == true) then "ALLOWPRIVILEGEESCALTION_FOUND" else "NO_ALLOWPRIVILEGEESCALATION" end'

#!/usr/bin/env bash
set -euo pipefail

# This script:
# - Creates a Pod Security Admission restricted policy that disallows allowPrivilegeEscalation=true
# - Labels all non-system namespaces to use that policy
# - Verifies that no pods with allowPrivilegeEscalation=true exist
#
# Run on: any machine with kubectl access and context pointing to the target cluster.

# 1) Create/Update a restricted Pod Security Admission policy via a ValidatingAdmissionPolicy
#    that forbids allowPrivilegeEscalation=true (in containers and initContainers).
#    This is idempotent (kubectl apply).
cat <<'EOF' | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: disallow-allow-privilege-escalation
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
  validations:
    - expression: "!(has(object.spec.containers) && object.spec.containers.exists(c, c.securityContext != null && c.securityContext.allowPrivilegeEscalation == true))"
      message: "Containers must not set securityContext.allowPrivilegeEscalation=true"
    - expression: "!(has(object.spec.initContainers) && object.spec.initContainers.exists(c, c.securityContext != null && c.securityContext.allowPrivilegeEscalation == true))"
      message: "Init containers must not set securityContext.allowPrivilegeEscalation=true"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: disallow-allow-privilege-escalation-binding
spec:
  policyName: disallow-allow-privilege-escalation
  validationActions:
    - Deny
  matchResources:
    namespaceSelector:
      matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: NotIn
          values:
            - kube-system
            - kube-public
            - kube-node-lease
            - default
EOF

# 2) Label all non-system namespaces that host user workloads, so they are clearly identified.
#    Adjust the excluded list if needed. This is safe and idempotent.
for ns in $(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'); do
  case "$ns" in
    kube-system|kube-public|kube-node-lease)
      continue
      ;;
  esac
  # Label as a user-workload namespace (key is arbitrary but stable).
  kubectl label ns "$ns" pod-security.kubernetes.io/user-workload=true --overwrite
done

# 3) Verification: ensure there are no pods with allowPrivilegeEscalation=true
#    Matches the benchmark audit command.
echo "Running verification..."
kubectl get pods --all-namespaces -o json | \
  jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.allowPrivilegeEscalation == true) then "ALLOWPRIVILEGEESCALTION_FOUND" else "NO_ALLOWPRIVILEGEESCALATION" end'