Minimize The Admission Of Containers With Added Capabilities

# 1) List all PodSecurityPolicies
# Run on: any machine with kubectl access
kubectl get podsecuritypolicies.policy

# 2) Inspect all PSPs and surface capabilities configuration
kubectl get podsecuritypolicies.policy -o yaml | sed -n '/^---/p;/^metadata:/,/^---/p' | grep -E '^(metadata:|  name:| *allowedCapabilities:| *requiredDropCapabilities:| *defaultAddCapabilities:| *allowedCapabilities: \[\])'

# 3) For detailed review of a specific PSP (replace <psp-name>)
kubectl get podsecuritypolicies.policy <psp-name> -o yaml

#!/usr/bin/env bash
# Report PodSecurityPolicies that allow added capabilities (CIS GKE 4.2.8)
# Run on: any machine with kubectl access and current context set to the target cluster

set -euo pipefail

echo "Checking for PodSecurityPolicies with non-empty allowedCapabilities ..."

# 1) Summary: which PSPs define allowedCapabilities and whether they are empty
echo
echo "=== Summary of allowedCapabilities per PodSecurityPolicy ==="
kubectl get psp -o json \
  | jq -r '
    .items[]
    | {
        name: .metadata.name,
        allowedCapabilities: (
          .spec.allowedCapabilities
          // []
        )
      }
    | [
        .name,
        (if (.allowedCapabilities | length) == 0 then "EMPTY" else "NON-EMPTY" end),
        (.allowedCapabilities | join(","))
      ]
    | @tsv
  ' \
  | column -t -s$'\t'

# 2) Detailed listing of PSPs that violate the recommendation
echo
echo "=== PSPs with NON-EMPTY allowedCapabilities (REVIEW REQUIRED) ==="
kubectl get psp -o json \
  | jq -r '
    .items[]
    | select((.spec.allowedCapabilities // []) | length > 0)
    | [
        .metadata.name,
        (.spec.allowedCapabilities | join(",")),
        (.metadata.annotations."kubernetes.io/description" // "")
      ]
    | @tsv
  ' \
  | column -t -s$'\t' || echo "None found."

# 3) Show which service accounts / pods are using those PSPs (where possible)
#    This relies on the psp admission plugin behavior / annotations in many clusters.
echo
echo "=== Pods bound to PSPs with NON-EMPTY allowedCapabilities (best-effort) ==="
PROBLEM_PSPS=$(kubectl get psp -o json \
  | jq -r '.items[]
           | select((.spec.allowedCapabilities // []) | length > 0)
           | .metadata.name')

if [ -z "$PROBLEM_PSPS" ]; then
  echo "No PSPs with non-empty allowedCapabilities detected."
  exit 0
fi

for psp in $PROBLEM_PSPS; do
  echo
  echo "PSP: $psp"
  # Look for pods that advertise the PSP they were admitted under
  kubectl get pods --all-namespaces -o json \
    | jq -r --arg psp "$psp" '
        .items[]
        | select(
            .metadata.annotations."kubernetes.io/psp" == $psp
            or .metadata.annotations."eks.amazonaws.com/psp" == $psp
            or .metadata.annotations."psp" == $psp
          )
        | [
            .metadata.namespace,
            .metadata.name,
            (.spec.serviceAccountName // "default")
          ]
        | @tsv
      ' \
    | awk 'BEGIN { OFS="\t"; print "NAMESPACE","POD","SERVICEACCOUNT" } { print }' \
    || echo "  No pods found with explicit PSP annotation = $psp"
done

echo
echo "=== Interpretation ==="
echo "- Any PSP shown as NON-EMPTY in the summary is a potential policy problem."
echo "- PSPs listed under 'PSPs with NON-EMPTY allowedCapabilities' violate the CIS recommendation"
echo "  unless there is a documented, justified exception."
echo "- Pods listed under each PSP show which workloads are currently relying on that PSP."