gatekeeper-library
gatekeeper-library copied to clipboard
chore: adding psp-users CEL policy
What this PR does / why we need it:
Which issue(s) does this PR fix (optional, using fixes #<issue number>(, fixes #<issue_number>, ...)
format, will close the issue(s) when the PR gets merged):
Fixes #541
Special notes for your reviewer:
Rego policy nehavior is -
-
filed
in below list is reference to securityContext fields -[ runAsUser, runAsGroup, fsGroup, supplementalGroup ]
- Input:
field:
rule: MustRunAs
ranges:
- min: 100
max: 200
- Behavior: if
field
is missing from object then throw missing violation, else throw violation isfield
is not in required range
- Input:
runAsUser:
rule: MustRunAsNonRoot
- Behavior: if
runAsUser
andrunAsNonRoot
both are missing from object then throw missing violation, else throw violation isrunAsUser == 0
- Input:
field:
rule: mayRunAs
ranges:
- min: 100
max: 200
- Behavior: No missing field violation, but is field is present and violating the range then throw the violation
- Input:
field:
rule: RunAsAny
- Behavior: No violations