Minimize Admission Containers With Allow Privilege Escalation

# 1) Create a baseline Pod Security restricted policy (applies to all namespaces)
# Run on: any machine with kubectl access
cat << 'EOF' | kubectl apply -f -
apiVersion: policy/v1
kind: PodSecurityPolicy
metadata:
  name: restricted-no-priv-esc
  labels:
    app.kubernetes.io/part-of: cis-hardening
    pod-security.kubernetes.io/enforce: "restricted"
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  readOnlyRootFilesystem: false
EOF

# 2) Create a ValidatingAdmissionPolicy to deny allowPrivilegeEscalation=true
cat << 'EOF' | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: deny-privilege-escalation
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE","UPDATE"]
        resources: ["pods"]
  validations:
    - expression: "!(has(object.spec) && object.spec != null && object.spec.containers.exists(c, has(c.securityContext) && has(c.securityContext.allowPrivilegeEscalation) && c.securityContext.allowPrivilegeEscalation == true))"
      message: "Containers must not set securityContext.allowPrivilegeEscalation=true"
EOF

# 3) Bind this policy to all user namespaces (example: all non-system namespaces)
# Adjust the namespaces: list only namespaces with user workloads
kubectl get ns --no-headers | awk '$1 !~ /^(kube-system|kube-public|kube-node-lease)$/ {print $1}' | while read ns; do
  cat << EOF | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: deny-privilege-escalation-${ns}
spec:
  policyName: deny-privilege-escalation
  validationActions: [ "Deny" ]
  matchResources:
    namespaceSelector:
      matchLabels:
        cis/priv-escalation-protected: "true"
EOF
  kubectl label namespace "${ns}" cis/priv-escalation-protected=true --overwrite
done

# 4) (Optional but recommended) Fix existing pods that violate the policy
#    This will restart Deployments/DaemonSets/StatefulSets with corrected securityContext
#    Adjust workloads manually where needed.
# Example for a single deployment in namespace 'app-namespace':
kubectl -n app-namespace patch deployment my-deployment \
  --type='json' \
  -p='[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value":{"allowPrivilegeEscalation":false}}]'

# 5) Verification (same as audit, run on any machine with kubectl access)
kubectl get pods --all-namespaces -o json | \
  jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.allowPrivilegeEscalation == true) then "ALLOWPRIVILEGEESCALTION_FOUND" else "NO_ALLOWPRIVILEGEESCALATION" end'

#!/usr/bin/env bash
set -euo pipefail

# Purpose:
# - For every namespace that contains user workloads (i.e., any pod),
#   create/patch a namespace-scoped PodSecurityPolicy-style restriction
#   using Kyverno to deny allowPrivilegeEscalation=true.
# - Idempotent and safe to re-run.
#
# Requirements:
# - Run on any machine with kubectl access and Kyverno installed in the cluster.
# - kubectl must be configured with cluster-admin privileges.

# 1. Discover namespaces that have user workloads (pods)
echo "Discovering namespaces with pods..."
NS_LIST=$(kubectl get pods --all-namespaces --no-headers 2>/dev/null | awk '{print $1}' | sort -u)

if [[ -z "${NS_LIST}" ]]; then
  echo "No namespaces with pods were found. Nothing to do."
  exit 0
fi

# 2. Create Kyverno ClusterPolicy (global) to deny allowPrivilegeEscalation=true,
#    but scoped by namespace selector based on label:
#    security.kubernetes.io/allow-privilege-escalation=false
#
#    This policy is created once and reused by all namespaces that opt in
#    via the label.
cat <<'EOF' | kubectl apply -f -
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-allow-privilege-escalation
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: disallow-allow-privilege-escalation
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - "*"
              selector:
                matchLabels:
                  security.kubernetes.io/allow-privilege-escalation: "false"
      validate:
        message: "Containers must not set securityContext.allowPrivilegeEscalation=true."
        pattern:
          spec:
            containers:
              - =(securityContext):
                  =(allowPrivilegeEscalation): "false"
            =(initContainers):
              - =(securityContext):
                  =(allowPrivilegeEscalation): "false"
EOF

echo "ClusterPolicy 'disallow-allow-privilege-escalation' ensured."

# 3. Label each namespace with workloads to opt in to the restriction.
for ns in ${NS_LIST}; do
  # Skip kube-system and kyverno namespaces by default, as they often run privileged components.
  if [[ "${ns}" == "kube-system" ]] || [[ "${ns}" == "kyverno" ]]; then
    echo "Skipping system namespace: ${ns}"
    continue
  fi

  echo "Labeling namespace ${ns} with security.kubernetes.io/allow-privilege-escalation=false"
  kubectl label namespace "${ns}" \
    security.kubernetes.io/allow-privilege-escalation=false \
    --overwrite
done

# 4. Verification
#    - Run the benchmark audit command.
#    - Note: existing pods that already have allowPrivilegeEscalation=true
#      will not be changed by admission control; they must be redeployed
#      with corrected securityContext.
echo
echo "Verification: checking for pods with allowPrivilegeEscalation=true..."
kubectl get pods --all-namespaces -o json | \
  jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.allowPrivilegeEscalation == true) then "ALLOWPRIVILEGEESCALTION_FOUND" else "NO_ALLOWPRIVILEGEESCALATION" end'