Minimize The Admission Containers With Added Capabilities

# 1) List all pods and their containers’ security contexts (cluster-wide)
# Run on: any machine with kubectl access
kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\n"}{range .spec.initContainers[*]}{"  initContainer: "}{.name}{"\n"}{"    securityContext: "}{@.securityContext}{"\n"}{end}{range .spec.containers[*]}{"  container: "}{.name}{"\n"}{"    securityContext: "}{@.securityContext}{"\n"}{end}{"\n"}{end}' \
  | sed 's/ map\[/ {/g' | sed 's/\]}/}/g'

# 2) Directly list containers that add capabilities (cluster-wide)
# Run on: any machine with kubectl access
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | .metadata as $m
    | (.spec.initContainers // [])[]? as $c
      | select($c.securityContext.capabilities.add != null)
      | "NAMESPACE=\($m.namespace)\tPOD=\($m.name)\tTYPE=initContainer\tCONTAINER=\($c.name)\tADDED_CAPS=\($c.securityContext.capabilities.add)"
    ,
    (.spec.containers // [])[]? as $c
      | select($c.securityContext.capabilities.add != null)
      | "NAMESPACE=\($m.namespace)\tPOD=\($m.name)\tTYPE=container\tCONTAINER=\($c.name)\tADDED_CAPS=\($c.securityContext.capabilities.add)"
  '

# 3) List containers that do NOT drop all capabilities (where securityContext is set)
# Run on: any machine with kubectl access
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | .metadata as $m
    | (.spec.initContainers // [])[]? as $c
      | select($c.securityContext != null)
      | select( (.securityContext.capabilities.drop // []) | index("ALL") | not )
      | "NAMESPACE=\($m.namespace)\tPOD=\($m.name)\tTYPE=initContainer\tCONTAINER=\($c.name)\tDROP=\($c.securityContext.capabilities.drop // [])"
    ,
    (.spec.containers // [])[]? as $c
      | select($c.securityContext != null)
      | select( (.securityContext.capabilities.drop // []) | index("ALL") | not )
      | "NAMESPACE=\($m.namespace)\tPOD=\($m.name)\tTYPE=container\tCONTAINER=\($c.name)\tDROP=\($c.securityContext.capabilities.drop // [])"
  '

# 4) Inspect security policies that control capabilities (PSP, PodSecurityPolicy) – if present
# Run on: any machine with kubectl access
kubectl get psp -o yaml

# 5) For a specific namespace you believe should NOT use capabilities, review all pods
# Replace NAMESPACE with the actual namespace name
# Run on: any machine with kubectl access
NAMESPACE=kube-system  # example; change as needed
kubectl get pods -n "$NAMESPACE" -o json \
  | jq -r '
    .items[]
    | .metadata.name as $pod
    | (.spec.initContainers // [])[]? as $c
      | "POD=\($pod)\tTYPE=initContainer\tCONTAINER=\($c.name)\tCAPS=\($c.securityContext.capabilities // {})"
    ,
    (.spec.containers // [])[]? as $c
      | "POD=\($pod)\tTYPE=container\tCONTAINER=\($c.name)\tCAPS=\($c.securityContext.capabilities // {})"
  '

#!/usr/bin/env bash
# Report pods and controllers that add Linux capabilities beyond the default/drop-all
# Run on: any machine with kubectl access
# Requirements: kubectl, jq

set -euo pipefail

echo "=== POD-LEVEL CAPABILITIES (all namespaces) ==="
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.initContainers[]?, $pod.spec.containers[]?) as $c
    | {
        ns: $pod.metadata.namespace,
        pod: $pod.metadata.name,
        container: $c.name,
        add: $c.securityContext.capabilities.add // [],
        drop: $c.securityContext.capabilities.drop // [],
        privileged: $c.securityContext.privileged // false,
        allowPrivEsc: $c.securityContext.allowPrivilegeEscalation // "unset",
        runAsUser: $c.securityContext.runAsUser // "unset",
        runAsNonRoot: $c.securityContext.runAsNonRoot // "unset"
      }
    | select(
        (.add | length > 0)
        or
        ((.drop | length == 0) and (.add | length > 0))
        or
        (.privileged == true)
      )
    | "NAMESPACE=\(.ns) POD=\(.pod) CONTAINER=\(.container)\n  add_caps=\(.add)\n  drop_caps=\(.drop)\n  privileged=\(.privileged)\n  allowPrivilegeEscalation=\(.allowPrivEsc)\n  runAsUser=\(.runAsUser) runAsNonRoot=\(.runAsNonRoot)\n"
  '

echo
echo "=== CONTROLLER TEMPLATES (Deployments, DaemonSets, StatefulSets, Jobs, CronJobs) ==="
for kind in deployment daemonset statefulset job cronjob; do
  echo "--- $kind(s) ---"
  kubectl get "$kind" --all-namespaces -o json 2>/dev/null \
    | jq -r '
      .items[]
      | . as $obj
      | ( .spec.template.spec.initContainers[]?, .spec.template.spec.containers[]? ) as $c
      | {
          apiVersion: $obj.apiVersion,
          kind: $obj.kind,
          ns: $obj.metadata.namespace,
          name: $obj.metadata.name,
          container: $c.name,
          add: $c.securityContext.capabilities.add // [],
          drop: $c.securityContext.capabilities.drop // [],
          privileged: $c.securityContext.privileged // false,
          allowPrivEsc: $c.securityContext.allowPrivilegeEscalation // "unset",
          runAsUser: $c.securityContext.runAsUser // "unset",
          runAsNonRoot: $c.securityContext.runAsNonRoot // "unset"
        }
      | select(
          (.add | length > 0)
          or
          ((.drop | length == 0) and (.add | length > 0))
          or
          (.privileged == true)
        )
      | "NS=\(.ns) KIND=\(.kind) NAME=\(.name) CONTAINER=\(.container)\n  add_caps=\(.add)\n  drop_caps=\(.drop)\n  privileged=\(.privileged)\n  allowPrivilegeEscalation=\(.allowPrivEsc)\n  runAsUser=\(.runAsUser) runAsNonRoot=\(.runAsNonRoot)\n"
    ' || true
done

echo
echo "=== NAMESPACE-LEVEL POD SECURITY (PodSecurity or PodSecurityPolicies, if present) ==="
echo "-- Namespaces with Pod Security Admission labels (v1.25+ recommended) --"
kubectl get ns --show-labels | grep -E 'pod-security.kubernetes.io/(enforce|audit|warn)=' || echo "No Pod Security labels found."

echo
echo "-- PodSecurityPolicies (if any; deprecated but still relevant where enabled) --"
kubectl get podsecuritypolicies.policy 2>/dev/null -o json \
  | jq -r '
    .items[]
    | {
        name: .metadata.name,
        allowedCaps: .spec.allowedCapabilities // [],
        requiredDropCaps: .spec.requiredDropCapabilities // [],
        defaultAddCaps: .spec.defaultAddCapabilities // []
      }
    | "PSP=\(.name)\n  allowedCapabilities=\(.allowedCaps)\n  requiredDropCapabilities=\(.requiredDropCaps)\n  defaultAddCapabilities=\(.defaultAddCaps)\n"
  ' || echo "No PodSecurityPolicies found."

cat <<'EOF'

INTERPRETING OUTPUT (what indicates a potential problem):

1) POD-LEVEL / CONTROLLER OUTPUT:
   - Any line with non-empty "add_caps" is a candidate for review:
       add_caps=["NET_ADMIN","SYS_ADMIN"]
     Check if each listed capability is strictly required.
   - If "drop_caps" is empty or does not include "ALL", and add_caps is non-empty,
     the container is not dropping all capabilities before adding back a minimal set.
   - Any "privileged=true" container is very high risk and should be scrutinized.

2) NAMESPACE / POLICY OUTPUT:
   - Namespaces lacking Pod Security Admission labels likely have weaker default
     restrictions; consider adding labels to enforce restricted or baseline policies.
   - PodSecurityPolicies (if present) that:
       * have broad "allowedCapabilities" (e.g., ["*"] or many powerful caps), or
       * do NOT include "ALL" in "requiredDropCapabilities"
     may allow admission of overly-privileged pods in those namespaces.

Use this report to:
   - Identify workloads that add Linux capabilities or run privileged.
   - Confirm whether your pod-security mechanisms actually prevent such pods in
     namespaces where they are not required.
   - Decide, per application/namespace, whether to tighten manifests or policies.
EOF