Minimize The Admission Of Containers With The Net_Raw Capability

# 1) List all PodSecurityPolicies (PSPs) and see if any drop NET_RAW
# Run on: any machine with kubectl access
kubectl get podsecuritypolicies.policy -o yaml

# 2) Identify which PSPs are actually usable in each namespace
# (via RBAC bindings referencing them)
# Run on: any machine with kubectl access
kubectl get clusterrole,clusterrolebinding,role,rolebinding -A -o yaml

# 3) Inspect current pod specs for explicit capability use
# Run on: any machine with kubectl access

# List all pods and their securityContext sections
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{.spec.containers[*].securityContext.capabilities}{"\n\n"}{end}'

# 4) Focus on high‑risk namespaces (e.g., default, dev, multi‑tenant)
# Run on: any machine with kubectl access

NAMESPACE=default
kubectl get pods -n "$NAMESPACE" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{.spec.containers[*].securityContext.capabilities}{"\n\n"}{end}'

# 5) (If PSP is not used) Check Pod Security Admission labels as context
# Run on: any machine with kubectl access

kubectl get ns --show-labels

#!/usr/bin/env bash
# Report containers that are allowed to keep NET_RAW, by namespace
# Run on: any machine with kubectl access and current-context set to the target cluster

set -euo pipefail

echo "=== 1) Cluster-wide PodSecurityPolicy (if any) and capabilities settings ==="
if kubectl api-resources | awk '{print $1}' | grep -qx PodSecurityPolicy; then
  kubectl get psp -o json \
  | jq -r '
      .items[]
      | .metadata.name as $name
      | "PSP: \($name)\n  allowedCapabilities: \(.spec.allowedCapabilities // [] | join(",") | .? // "-")\n  requiredDropCapabilities: \(.spec.requiredDropCapabilities // [] | join(",") | .? // "-")\n"
    '
else
  echo "PodSecurityPolicy API not present in this cluster."
fi

echo
echo "=== 2) Namespaces and their Pod Security Admission (PSA) labels, if present ==="
kubectl get ns --show-labels

echo
echo "=== 3) Workloads that explicitly ADD NET_RAW capability (cluster-wide) ==="
# This catches pod specs that request NET_RAW in any container
kubectl get pods --all-namespaces -o json \
| jq -r '
    .items[]
    | .metadata as $m
    | .spec as $s
    | (
        ($s.containers // []) + ($s.initContainers // [])
      )[]
    | select(
        (.securityContext.capabilities.add // []) 
        | index("NET_RAW")
      )
    | "\($m.namespace)\t\($m.name)\tCONTAINER:\(.name)\tadds NET_RAW"
  ' | sort || echo "No pods explicitly adding NET_RAW found."

echo
echo "=== 4) Workloads that DO NOT drop NET_RAW or ALL (potentially allowed to keep NET_RAW) ==="
echo "# NOTE: These pods/containers do not declare NET_RAW in 'add',"
echo "# but also do not drop NET_RAW or ALL; admission controls may still restrict them."
echo "# Review by namespace and workload type."

# Helper function implemented inline with jq to print containers missing required drops
kubectl get pods --all-namespaces -o json \
| jq -r '
  .items[]
  | .metadata as $m
  | .spec as $s
  | ($s.containers // [] | map(. + {type:"container"})) +
    ($s.initContainers // [] | map(. + {type:"initContainer"}))
  | map(
      select(
        # Skip if container explicitly drops NET_RAW or ALL
        ((.securityContext.capabilities.drop // []) | index("NET_RAW") or index("ALL")) 
        | not
      )
    )
  | select(length > 0)
  | [
      $m.namespace,
      $m.name,
      (map("\(.type):\(.name)") | join(",")),
      "no drop:NET_RAW/ALL"
    ]
  | @tsv
' | sort || echo "No pods missing drop of NET_RAW/ALL detected."

echo
echo "=== 5) Summary guidance ==="
cat <<'EOF'
Interpretation:

1) PSP / Admission:
   - If any PSP has spec.requiredDropCapabilities including NET_RAW or ALL,
     and that PSP is bound (via RBAC) to the relevant subjects, those
     namespaces are better protected.
   - If no PSPs exist, or requiredDropCapabilities does not include NET_RAW/ALL,
     admission is not enforcing a drop of NET_RAW.

2) Namespaces:
   - Use the namespace labels to correlate with your admission setup
     (e.g. Pod Security Admission, OPA/Gatekeeper, Kyverno policies).

3) Explicit NET_RAW use (Section 3):
   - Any line here is a definite problem candidate: that container is
     explicitly requesting NET_RAW.
   - Review why the application needs NET_RAW and move it to a tightly
     controlled namespace or remove the capability.

4) Missing required drops (Section 4):
   - These pods/containers do not explicitly add NET_RAW, but also do not
     drop NET_RAW or ALL in their securityContext.
   - If your admission policies do NOT enforce dropping NET_RAW/ALL,
     these workloads are at higher risk and should be reviewed:
       * Add securityContext.capabilities.drop: ["NET_RAW"] or ["ALL"], and/or
       * Enforce requiredDropCapabilities via PSP/PSA/OPA/Kyverno, per your platform.

There is no fully automated fix: a human must decide where NET_RAW is strictly
required, then adjust admission policy and workload manifests accordingly.
EOF