Minimize The Admission Containers With The Net Raw Capability

# 1. List all namespaces
# Run on: any machine with kubectl access
kubectl get ns -o name

# 2. List all PodSecurityPolicy objects (if the API is enabled)
# Run on: any machine with kubectl access
kubectl get podsecuritypolicy.policy -o yaml

spec:
  requiredDropCapabilities:
    - NET_RAW

spec:
  requiredDropCapabilities:
    - ALL

# 3. For each namespace, list pods and see what capabilities they actually have
# (this is evidence; enforcement is via PSP/PodSecurityPolicy-like controls)
# Run on: any machine with kubectl access

# Example: review all pods (can be large)
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}'

# For a specific namespace (replace <namespace>):
kubectl get pods -n <namespace> -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'

# Show full pod spec including securityContext and capabilities
# Run for any suspicious pod
kubectl get pod <pod-name> -n <namespace> -o yaml

# 4. Quickly search all pod specs for NET_RAW (evidence of usage)
# Run on: any machine with kubectl access
kubectl get pods -A -o yaml | grep -n "NET_RAW"

# 5. Check for namespace-level Pod Security (if applicable) that might allow NET_RAW
# Run on: any machine with kubectl access
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.metadata.labels}{"\n"}{end}'

#!/usr/bin/env bash
# Report pods/containers that can use NET_RAW capability (add or not dropped)

set -euo pipefail

# REQUIREMENTS:
# - Run on any machine with kubectl access and correct KUBECONFIG
# - kubectl 1.14+ with JSONPath support

echo "=== Scanning all pods/containers for NET_RAW capability exposure ===" >&2

# 1. List pods that explicitly ADD NET_RAW in securityContext.capabilities.add
echo
echo "== Pods with containers that explicitly ADD NET_RAW =="
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | {
        ns: .metadata.namespace,
        pod: .metadata.name,
        containers: (
          (.spec.containers + (.spec.initContainers // []))
          | map(
              {
                name: .name,
                addCaps: (.securityContext.capabilities.add // [] | map(. // ""))
              }
            )
        )
      }
    | {
        ns,
        pod,
        containers: (
          .containers
          | map(select(.addCaps | index("NET_RAW")))
        )
      }
    | select(.containers | length > 0)
    | [
        "NAMESPACE=" + .ns,
        "POD=" + .pod,
        "CONTAINER(S)=" + (.containers | map(.name) | join(",")),
        "ADDED_CAPS=" + (.containers | map(.addCaps | join(",")) | join(" | "))
      ]
    | join(" | ")
  ' 2>/dev/null || {
    echo "ERROR: This script requires 'jq' on PATH." >&2
    exit 1
  }

# 2. List pods where NET_RAW is NOT in drop list and there is some capability use
#    This surfaces containers that might retain NET_RAW by omission
echo
echo "== Pods with capabilities configured but NET_RAW is NOT in drop list =="
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | {
        ns: .metadata.namespace,
        pod: .metadata.name,
        containers: (
          (.spec.containers + (.spec.initContainers // []))
          | map(
              {
                name: .name,
                addCaps: (.securityContext.capabilities.add // [] | map(. // "")),
                dropCaps: (.securityContext.capabilities.drop // [] | map(. // ""))
              }
            )
        )
      }
    | {
        ns,
        pod,
        containers: (
          .containers
          | map(
              select(
                # Only consider containers that touch capabilities at all
                ((.addCaps | length) > 0 or (.dropCaps | length) > 0)
                # AND do not explicitly drop NET_RAW nor ALL
                and ((.dropCaps | index("NET_RAW")) | not)
                and ((.dropCaps | index("ALL")) | not)
              )
          )
        )
      }
    | select(.containers | length > 0)
    | [
        "NAMESPACE=" + .ns,
        "POD=" + .pod,
        "CONTAINER(S)=" + (.containers | map(.name) | join(",")),
        "ADD_CAPS=" + (.containers | map(.addCaps | join(",")) | join(" | ")),
        "DROP_CAPS=" + (.containers | map(.dropCaps | join(",")) | join(" | "))
      ]
    | join(" | ")
  '

# 3. (Optional) List any PodSecurityPolicies that DO NOT drop NET_RAW or ALL
#    Only relevant if PSP is still enabled in your cluster
echo
echo "== PodSecurityPolicies that do NOT require dropping NET_RAW or ALL (if PSP is enabled) =="
if kubectl get podsecuritypolicies.policy >/dev/null 2>&1; then
  kubectl get podsecuritypolicies.policy -o json \
    | jq -r '
      .items[]
      | {
          name: .metadata.name,
          drop: (.spec.requiredDropCapabilities // [] | map(. // ""))
        }
      | select(
          # PSPs that do NOT include NET_RAW and do NOT include ALL
          ((.drop | index("NET_RAW")) | not)
          and ((.drop | index("ALL")) | not)
        )
      | "PSP=" + .name + " | requiredDropCapabilities=" + (.drop | join(","))
    '
else
  echo "No PodSecurityPolicies found or PSP API disabled; skip PSP check." >&2
fi

echo
echo "=== Interpretation ==="
cat <<'EOF'
- Any line under "Pods with containers that explicitly ADD NET_RAW" indicates a clear problem:
  those containers are explicitly granted the NET_RAW capability.

- Any line under
  "Pods with capabilities configured but NET_RAW is NOT in drop list"
  is a potential problem:
  these containers manipulate capabilities but do not explicitly drop NET_RAW
  (or ALL), so you must review if their effective capabilities include NET_RAW.

- Any PSP listed under
  "PodSecurityPolicies that do NOT require dropping NET_RAW or ALL"
  should be reviewed: benchmark guidance expects requiredDropCapabilities
  to include NET_RAW or ALL.

This script does NOT automatically fix anything; use it to identify and review
workloads and policies that might violate the requirement to drop NET_RAW.
EOF