adding kube-system exceptions (#579)

Signed-off-by: David Wertenteil <dwertent@armosec.io>
kubescape · Feb 18, 2024 · 84627a0 · 84627a0
1 parent bc7b626
commit 84627a0
Show file tree

Hide file tree

Showing 4 changed files with 196 additions and 2 deletions.
diff --git a/exceptions/gke.json b/exceptions/gke.json
@@ -1006,6 +1006,20 @@
                     "name": "validation-webhook.snapshot.storage.gke.io"
                 }
             },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ValidatingWebhookConfiguration",
+                    "name": "gmp-operator.gmp-system.monitoring.googleapis.com"
+                }
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ValidatingWebhookConfiguration",
+                    "name": "warden-validating.config.common-webhooks.networking.gke.io"
+                }
+            },
             {
                 "designatorType": "Attributes",
                 "attributes": {
@@ -1103,6 +1117,20 @@
                     "kind": "Namespace",
                     "name": "kube-system"
                 }
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "Namespace",
+                    "name": "gmp-public"
+                }
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "Namespace",
+                    "name": "gmp-system"
+                }
             }
         ],
         "posturePolicies": [
@@ -1142,11 +1170,107 @@
                     "name": "route-controller",   
                     "namespace": "kube-system"
                 }
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "superadmin",   
+                    "namespace": "kube-system"
+                }	
+
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "pkgextract-service",   
+                    "namespace": "kube-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "pkgextract-service",   
+                    "namespace": "kube-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "default",   
+                    "namespace": "gmp-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "collector",   
+                    "namespace": "gmp-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "operator",   
+                    "namespace": "gmp-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "collector",   
+                    "namespace": "gmp-public"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "StatefulSet",
+                    "name": "alertmanager",   
+                    "namespace": "gmp-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "DaemonSet",
+                    "name": "collector",   
+                    "namespace": "gmp-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "Deployment",
+                    "name": "rule-evaluator",   
+                    "namespace": "gmp-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "Deployment",
+                    "name": "gmp-operator",   
+                    "namespace": "gmp-system"
+                }	
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ConfigMap",
+                    "name": "gke-metrics-agent-conf",   
+                    "namespace": "kube-system"
+                }	
             }
         ],
         "posturePolicies": [
             {
-                "controlID": "c-0053"
             }
         ]
     }

diff --git a/exceptions/kube-apiserver.json b/exceptions/kube-apiserver.json
@@ -29,7 +29,7 @@
                 "controlID": "c-0017"
             },
             {
-                "controlID": "c-0013 "
+                "controlID": "c-0013"
             },
             {
                 "controlID": "c-0020"

diff --git a/exceptions/kubescape.json b/exceptions/kubescape.json
@@ -84,6 +84,14 @@
                     "namespace": "kubescape"
                 }
             },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "Deployment",
+                    "name": "synchronizer",
+                    "namespace": "kubescape"
+                }
+            },
             {
                 "designatorType": "Attributes",
                 "attributes": {
@@ -497,6 +505,14 @@
                     "namespace": "kubescape"
                 }
             },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "ServiceAccount",
+                    "name": "synchronizer",
+                    "namespace": "kubescape"
+                }
+            },
             {
                 "designatorType": "Attributes",
                 "attributes": {
@@ -720,5 +736,27 @@
                 "controlID": "c-0076"
             }
         ]
+    },
+    {
+        "name": "exclude-ns",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+            "alertOnly"
+        ],
+        "attributes": {
+            "systemException": true
+        },
+        "resources": [
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "Namespace",
+                    "name": "kubescape"
+                }
+            }
+        ],
+        "posturePolicies": [
+            {}
+        ]
     }
 ]
diff --git a/exceptions/minikube.json b/exceptions/minikube.json
@@ -41,6 +41,38 @@
                     "name": "coredns"
                 }
             },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "Deployment",
+                    "namespace": "kube-system",
+                    "name": "sealed-secrets-controller"
+                }
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "DaemonSet",
+                    "namespace": "kube-system",
+                    "name": "tpu-device-plugin"
+                }
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "DaemonSet",
+                    "namespace": "kube-system",
+                    "name": "runsc-metric-server"
+                }
+            },
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": "DaemonSet",
+                    "namespace": "kube-system",
+                    "name": "nvidia-gpu-.*"
+                }
+            },
             {
                 "designatorType": "Attributes",
                 "attributes": {