Skip to content

Commit 2fed718

Browse files
matthyxmatthyx
committed
add rule CRD and update cluster role permissions
Signed-off-by: Matthias Bertschy <[email protected]>
1 parent 06133d8 commit 2fed718

File tree

10 files changed

+2430
-386
lines changed

10 files changed

+2430
-386
lines changed

‎charts/kubescape-operator/crds/rules.crd.yaml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
name: rules.kubescape.io
5+
spec:
6+
group: kubescape.io
7+
names:
8+
kind: Rules
9+
listKind: RulesList
10+
plural: rules
11+
singular: rule
12+
scope: Namespaced
13+
versions:
14+
- name: v1
15+
served: true
16+
storage: true
17+
schema:
18+
openAPIV3Schema:
19+
type: object
20+
properties:
21+
apiVersion:
22+
type: string
23+
kind:
24+
type: string
25+
metadata:
26+
type: object
27+
spec:
28+
type: object
29+
properties:
30+
rules:
31+
type: array
32+
items:
33+
type: object
34+
properties:
35+
enabled:
36+
type: boolean
37+
description: "Whether the rule is enabled"
38+
id:
39+
type: string
40+
description: "Unique identifier for the rule"
41+
name:
42+
type: string
43+
description: "Name of the rule"
44+
description:
45+
type: string
46+
description: "Description of the rule"
47+
expressions:
48+
type: object
49+
properties:
50+
message:
51+
type: string
52+
description: "Message expression"
53+
unique_id:
54+
type: string
55+
description: "Unique identifier expression"
56+
rule_expression:
57+
type: array
58+
items:
59+
type: object
60+
properties:
61+
event_type:
62+
type: string
63+
enum:
64+
- "exec"
65+
- "open"
66+
- "capabilities"
67+
- "dns"
68+
- "network"
69+
- "syscall"
70+
- "randomx"
71+
- "symlink"
72+
- "hardlink"
73+
- "ssh"
74+
- "http"
75+
- "ptrace"
76+
- "iouring"
77+
- "fork"
78+
- "exit"
79+
- "procfs"
80+
description: "Type of event this expression handles"
81+
expression:
82+
type: string
83+
description: "The rule expression string"
84+
required:
85+
- event_type
86+
- expression
87+
required:
88+
- message
89+
- unique_id
90+
- rule_expression
91+
profile_dependency:
92+
type: integer
93+
enum: [0, 1, 2]
94+
description: "Profile dependency level (0=Required, 1=Optional, 2=NotRequired)"
95+
severity:
96+
type: integer
97+
description: "Severity level of the rule"
98+
support_policy:
99+
type: boolean
100+
description: "Whether the rule supports rule policy enforcement"
101+
default: false
102+
tags:
103+
type: array
104+
items:
105+
type: string
106+
description: "Tags associated with the rule"
107+
state:
108+
type: object
109+
additionalProperties: true
110+
description: "State information for the rule"
111+
agent_version_requirement:
112+
type: string
113+
description: "Agent version requirement to evaluate this rule (supports semver ranges like ~1.0, >=1.2.0, etc.)"
114+
required:
115+
- enabled
116+
- id
117+
- name
118+
- description
119+
- expressions
120+
- profile_dependency
121+
- severity
122+
- support_policy
123+
- tags
124+
required:
125+
- rules
126+
subresources:
127+
status: {}

‎charts/kubescape-operator/templates/node-agent/clusterrole.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,7 @@ rules:
4242
- apiGroups: ["events.k8s.io"]
4343
resources: ["events"]
4444
verbs: ["create", "patch", "get"]
45+
- apiGroups: ["kubescape.io"]
46+
resources: ["rules"]
47+
verbs: ["list", "watch"]
4548
{{- end }}

‎charts/kubescape-operator/templates/node-agent/daemonset.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,8 @@ spec:
228228
- name: MULTIPLY
229229
value: "true"
230230
{{- end }}
231+
- name: AGENT_VERSION
232+
value: "{{ .Values.nodeAgent.image.tag }}"
231233
{{- range .Values.nodeAgent.env }}
232234
- name: {{ .name }}
233235
{{- if .value }}

‎charts/kubescape-operator/templates/node-agent/daemonsets.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,8 @@ spec:
231231
- name: MULTIPLY
232232
value: "true"
233233
{{- end }}
234+
- name: AGENT_VERSION
235+
value: "{{ .Values.nodeAgent.image.tag }}"
234236
{{- range .Values.nodeAgent.env }}
235237
- name: {{ .name }}
236238
{{- if .value }}

‎charts/kubescape-operator/templates/node-agent/default-rule-binding.yaml‎

Lines changed: 16 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -29,58 +29,29 @@ spec:
2929
{{- end }}
3030
rules:
3131
- ruleName: "Unexpected process launched"
32-
- ruleName: "Unexpected file access"
33-
parameters:
34-
ignoreMounts: true
35-
ignorePrefixes: ["/proc", "/run/secrets/kubernetes.io/serviceaccount", "/var/run/secrets/kubernetes.io/serviceaccount", "/tmp"]
36-
includePrefixes: [ "/etc", "/var/spool/cron/", "/var/log/", "/var/run/", "/dev/shm/", "/run/", "/var/www/", "/var/lib/docker/", "/opt/", "/usr/local/", "/app/", "/.dockerenv", "/proc/self/environ", "/var/lib/kubelet/", "/etc/cni/net.d/", "/var/run/secrets/kubernetes.io/", "/var/run/secrets/kubernetes.io/serviceaccount/", "/run/containerd/", "/run/flannel/", "/run/calico/"]
37-
- ruleName: "Unexpected system call"
38-
- ruleName: "Unexpected capability used"
39-
- ruleName: "Unexpected domain request"
40-
- ruleName: "Unexpected Service Account Token Access"
41-
- ruleName: "Kubernetes Client Executed"
42-
- ruleName: "Exec from malicious source"
43-
- ruleName: "Kernel Module Load"
44-
- ruleName: "Exec Binary Not In Base Image"
45-
# - ruleName: "Malicious SSH Connection"
46-
- ruleName: "Fileless Execution"
47-
- ruleName: "XMR Crypto Mining Detection"
48-
- ruleName: "Exec from mount"
32+
- ruleName: "Files Access Anomalies in container"
33+
- ruleName: "Syscalls Anomalies in container"
34+
- ruleName: "Linux Capabilities Anomalies in container"
35+
- ruleName: "DNS Anomalies in container"
36+
- ruleName: "Unexpected service account token access"
37+
- ruleName: "Workload uses Kubernetes API unexpectedly"
38+
- ruleName: "Process executed from malicious source"
39+
- ruleName: "Process tries to load a kernel module"
40+
- ruleName: "Drifted process executed"
41+
- ruleName: "Disallowed ssh connection"
42+
- ruleName: "Fileless execution detected"
43+
- ruleName: "Crypto miner launched"
44+
- ruleName: "Process executed from mount"
4945
- ruleName: "Crypto Mining Related Port Communication"
5046
- ruleName: "Crypto Mining Domain Communication"
5147
- ruleName: "Read Environment Variables from procfs"
5248
- ruleName: "eBPF Program Load"
53-
- ruleName: "Symlink Created Over Sensitive File"
49+
- ruleName: "Soft link created over sensitive file"
5450
- ruleName: "Unexpected Sensitive File Access"
55-
- ruleName: "Hardlink Created Over Sensitive File"
51+
- ruleName: "Hard link created over sensitive file"
5652
- ruleName: "Exec to pod"
5753
- ruleName: "Port forward"
58-
# - ruleName: "Unexpected Egress Network Traffic"
54+
- ruleName: "Unexpected Egress Network Traffic"
5955
- ruleName: "Malicious Ptrace Usage"
60-
- ruleName: "Cross-Site Scripting (XSS) Attempt"
61-
- ruleName: "SQL Injection Attempt"
62-
- ruleName: "Server-Side Request Forgery Attack Attempt"
63-
- ruleName: "Remote File Inclusion Attack Attempt"
64-
- ruleName: "Local File Inclusion Attempt"
65-
- ruleName: "XML External Entity Attack Attempt"
66-
- ruleName: "Server-Side Template Injection Attack"
67-
- ruleName: "Command Injection Attempt"
68-
- ruleName: "Unexpected Exec Source"
69-
- ruleName: "Unexpected Open Source"
70-
- ruleName: "Unexpected Symlink Source"
71-
- ruleName: "Unexpected Hardlink Source"
7256
- ruleName: "Unexpected io_uring Operation Detected"
73-
- ruleName: "ReDoS Attack"
74-
- ruleName: "Prototype Pollution Attack"
75-
- ruleName: "Execution of base64 Encoded Command"
76-
- ruleName: "Execution of interpreter command"
77-
- ruleName: "Code Sharing Site Access"
78-
- ruleName: "Web Application File Write Access"
79-
- ruleName: "Cron Job File Created or Modified"
80-
- ruleName: "Hidden File Created"
81-
- ruleName: "Reverse Shell Patterens Detected"
82-
- ruleName: "Unauthorized IMDS Connection Attempt"
83-
- ruleName: "Credentials Detection Attempts"
84-
- ruleName: "HTTP Request Smuggling Attempt"
85-
- ruleName: "P2P Tracker Connection Created"
8657
{{- end }}

0 commit comments

Comments
 (0)