Ensure Pod Security Policy Is Enabled And Set As Appropriate

#!/usr/bin/env bash
#
# Audit Pod Security Policy (PSP) usage and risk indicators in a GKE cluster.
# Runs read-only checks using kubectl.
#
# Requirements:
#   - Run on any machine with kubectl access and context set to the target cluster.
#   - kubectl must be authorized with cluster-admin or equivalent read access.

set -euo pipefail

echo "=== 1) CLUSTER-LEVEL INDICATORS (GKE FEATURES) ==="
echo
echo "NOTE: Enabling/disabling Pod Security Policy itself is done via gcloud, not kubectl."
echo "      This script only inspects PSP objects and workload risk indicators."
echo

echo "--- a) Check for PodSecurityPolicy resources ---"
kubectl get podsecuritypolicies.policy 2>/dev/null || \
  kubectl get psp 2>/dev/null || \
  echo "No PodSecurityPolicy resources found (or PSP API disabled)."

echo
echo "Interpretation:"
echo "  - If no PSPs are listed but the cluster is configured to use PSPs, pods may be blocked"
echo "    from scheduling unless other admission controls are in place."
echo "  - If the cluster is not configured to use PSPs (gcloud --enable-pod-security-policy not set),"
echo "    then this benchmark finding is NOT satisfied: PSP is not enabled at the control plane."

echo
echo "--- b) List PSPs with key security-relevant settings ---"
# This surfaces PSPs that allow privileged or broad host access
kubectl get podsecuritypolicies.policy -o custom-columns=NAME:.metadata.name,PRIV:.spec.privileged,HOSTPID:.spec.hostPID,HOSTIPC:.spec.hostIPC,HOSTNET:.spec.hostNetwork,ALLOW_PRIV_ESC:.spec.allowPrivilegeEscalation,SELINUX:.spec.seLinux.rule,RUNASUSER:.spec.runAsUser.rule,FSGROUP:.spec.fsGroup.rule,SUPPGRP:.spec.supplementalGroups.rule 2>/dev/null || true

echo
echo "Problem indicators here include:"
echo "  - PRIV=true                : PSP allows privileged containers."
echo "  - HOSTPID/HOSTIPC/HOSTNET=true : PSP allows host namespace sharing."
echo "  - ALLOW_PRIV_ESC=true or empty : PSP allows privilege escalation."
echo "  - SELINUX/RUNASUSER/FSGROUP/SUPPGRP = RunAsAny : no restriction on IDs/labels."

echo
echo "=== 2) RBAC BINDINGS TO PSPs (WHO CAN USE WHICH PSP) ==="
echo
echo "--- a) ClusterRoleBindings referencing use of PSPs ---"
kubectl get clusterrolebindings -o json | \
  jq -r '
    .items[]
    | select(.roleRef.kind=="ClusterRole")
    | . as $crb
    | $crb
    | .metadata.name as $crbName
    | $crb
    | .roleRef.name as $roleName
    | "CRB:\($crbName) -> ClusterRole:\($roleName)"
  ' 2>/dev/null || echo "jq not available; skipping detailed RBAC inspection."

echo
echo "--- b) ClusterRoles that grant use of PSPs ---"
kubectl get clusterroles -o json 2>/dev/null | \
  jq -r '
    .items[]
    | . as $cr
    | select(
        (.rules[]? | .resources[]? == "podsecuritypolicies" and .verbs[]? == "use")
      )
    | "ClusterRole:\(.metadata.name)"
  ' 2>/dev/null || true

echo
echo "Review guidance:"
echo "  - Any ClusterRole with rules on resource=podsecuritypolicies, verb=use grants PSP usage."
echo "  - Check which subjects (users/groups/serviceaccounts) are bound to those ClusterRoles."
echo "  - A problem is indicated if broad groups (e.g., system:authenticated, system:masters, or"
echo "    large app teams) are bound to overly-permissive PSPs."

echo
echo "--- c) Show which subjects can use each PSP (approximate) ---"
echo "This uses RBAC info to approximate PSP usage:"
kubectl get clusterroles -o json 2>/dev/null | \
  jq -r '
    .items[]
    | . as $cr
    | select(
        (.rules[]? | .resources[]? == "podsecuritypolicies" and .verbs[]? == "use")
      )
    | "ClusterRole:\($cr.metadata.name)"
  ' 2>/dev/null | while read -r role; do
    rname="${role#ClusterRole:}"
    echo
    echo "ClusterRole: ${rname}"
    echo "  Bound via ClusterRoleBinding(s):"
    kubectl get clusterrolebindings -o json 2>/dev/null | \
      jq -r --arg ROLE "$rname" '
        .items[]
        | select(.roleRef.kind=="ClusterRole" and .roleRef.name==$ROLE)
        | "    CRB:\(.metadata.name) subjects: " +
          ( .subjects // [] | map(.kind + "/" + .name) | join(", ") )
      ' || true
  done

echo
echo "Problem indicators in this section:"
echo "  - ClusterRoles that allow use of PSPs with PRIV=true or broad host access,"
echo "    bound to wide subjects like system:authenticated."
echo "  - Service accounts used by less-trusted workloads bound to very permissive PSPs."

echo
echo "=== 3) WORKLOAD RISK SAMPLING (PODS THAT WOULD REQUIRE PERMISSIVE PSPs) ==="
echo
echo "--- a) List pods running privileged or with host namespaces ---"
kubectl get pods --all-namespaces -o json | \
  jq -r '
    .items[]
    | .metadata as $m
    | .spec as $s
    | .status as $st
    | [
        ($m.namespace),
        ($m.name),
        ([$s.initContainers[], $s.containers[]]?
          | map(
              {
                name: .name,
                privileged: (.securityContext.privileged // false),
                hostPID: ($s.hostPID // false),
                hostIPC: ($s.hostIPC // false),
                hostNetwork: ($s.hostNetwork // false),
                allowPrivEsc: (.securityContext.allowPrivilegeEscalation // "null")
              }
            )
        )
      ]
    | select(.[2] != null)
    | . as [$ns, $pod, $cs]
    | $cs[]
    | select(.privileged == true or .hostPID == true or .hostIPC == true or .hostNetwork == true or .allowPrivEsc == true)
    | "NS=\($ns) POD=\($pod) CONTAINER=\(.name) privileged=\(.privileged) hostPID=\(.hostPID) hostIPC=\(.hostIPC) hostNetwork=\(.hostNetwork) allowPrivEsc=\(.allowPrivEsc)"
  ' 2>/dev/null || echo "jq not available; skipping pod-level risk sampling."

echo
echo "Problem indicators here:"
echo "  - Non-system workloads (namespaces other than kube-system, gke-system, etc.)"
echo "    running privileged or sharing host namespaces."
echo "  - If such workloads exist and require permissive PSPs, strong segregation and"
echo "    explicit justification are required."

echo
echo "=== 4) SUMMARY OF WHAT INDICATES A PROBLEM FOR THIS BENCHMARK ==="
echo
echo "The benchmark finding is NOT satisfied if ANY of the following apply:"
echo "  1) The cluster control-plane is not configured with Pod Security Policy admission"
echo "     (gcloud --enable-pod-security-policy not set for the cluster)."
echo "  2) PSPs exist but:"
echo "       - Default / commonly used PSPs allow privileged=true or broad host* access,"
echo "         AND are bound to wide subjects (e.g. system:authenticated)."
echo "       - Most workloads could run with stricter PSPs but are not constrained."
echo
echo "To remediate the control-plane setting itself, use the provider tooling, e.g.:"
echo "  gcloud beta container clusters update CLUSTER_NAME --zone COMPUTE_ZONE --enable-pod-security-policy"
echo
echo "This script only helps you identify the current state and potential misconfigurations."