Deployments should have at least one ingress Network Policy

No violationsstackroxmediumdeploy

Alerts if deployments are missing an ingress Network Policy

Rationale: Pods that lack ingress Network Policies have unrestricted reachability on the network and may be exposed to attacks
Remediation: Create and apply an appropriate Network Policy of type ingress to all Deployments. See https://kubernetes.io/docs/concepts/services-networking/network-policies/ for details

CategoriesSecurity Best PracticesZero Trust

Compliance mappingsView coverage →

CIS Kubernetes Benchmark v1.8: 5.3.2
DORA EU 2022/2554: Art. 9.2Art. 9.4(b)
ISO/IEC 27001 2022: A.8.20A.8.9
NIST SP 800-53 rev. 5: CM-2SC-7
PCI DSS 4.0: 1.3.12.2.17.2.1
SOC 2 2017 TSC: CC6.1CC6.6

Generated artifacts

2 of 5 targets supported

deployments-should-have-at-least-one-ingress-network-policy-template.yaml

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: deploymentsshouldhaveatleastoneingressnetworkpolicy
spec:
  crd:
    spec:
      names:
        kind: DeploymentsShouldHaveAtLeastOneIngressNetworkPolicy
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |-
        package main


        violation[{"msg": msg}] {
          obj := input.review.object
          # rule 1
          # Requires sidecar data: data.netpols[obj.metadata.namespace] must list NetworkPolicies
            count(data.netpols[obj.metadata.namespace]) == 0
          msg := "[medium] Deployments should have at least one ingress Network Policy: Alerts if deployments are missing an ingress Network Policy"
        }

deployments-should-have-at-least-one-ingress-network-policy-constraint.yaml

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: DeploymentsShouldHaveAtLeastOneIngressNetworkPolicy
metadata:
  name: deployments-should-have-at-least-one-ingress-network-policy
spec:
  match:
    kinds:
      - apiGroups:
          - ""
        kinds:
          - Pod
    excludedNamespaces:
      - kube-system
      - openshift-kube-apiserver
      - openshift-kube-scheduler
      - openshift-kube-controller-manager
      - openshift-sdn
      - openshift-network-operator
      - openshift-multus
      - openshift-cluster-version
      - openshift-image-registry
      - openshift-etcd
      - openshift-machine-config-operator
      - openshift-monitoring
      - openshift-machine-api
      - openshift-cluster-node-tuning-operator
  enforcementAction: warn

IR (canonical)

{
  "id": "38bf79e7-48bf-4ab1-b72f-38e8ad8b4ec3",
  "name": "Deployments should have at least one ingress Network Policy",
  "description": "Alerts if deployments are missing an ingress Network Policy",
  "rationale": "Pods that lack ingress Network Policies have unrestricted reachability on the network and may be exposed to attacks",
  "remediation": "Create and apply an appropriate Network Policy of type ingress to all Deployments. See https://kubernetes.io/docs/concepts/services-networking/network-policies/ for details",
  "severity": "medium",
  "categories": [
    "Security Best Practices",
    "Zero Trust"
  ],
  "lifecycle": [
    "deploy"
  ],
  "eventSource": "none",
  "scope": [],
  "exclusions": [
    {
      "name": "Don't alert on kube-system namespace",
      "namespace": "kube-system"
    },
    {
      "name": "Don't alert on openshift-kube-apiserver namespace",
      "namespace": "openshift-kube-apiserver"
    },
    {
      "name": "Don't alert on openshift-kube-scheduler namespace",
      "namespace": "openshift-kube-scheduler"
    },
    {
      "name": "Don't alert on openshift-kube-controller-manager namespace",
      "namespace": "openshift-kube-controller-manager"
    },
    {
      "name": "Don't alert on openshift-sdn namespace",
      "namespace": "openshift-sdn"
    },
    {
      "name": "Don't alert on openshift-network-operator namespace",
      "namespace": "openshift-network-operator"
    },
    {
      "name": "Don't alert on openshift-multus namespace",
      "namespace": "openshift-multus"
    },
    {
      "name": "Don't alert on openshift-cluster-version namespace",
      "namespace": "openshift-cluster-version"
    },
    {
      "name": "node-ca",
      "namespace": "openshift-image-registry"
    },
    {
      "name": "Don't alert on host network usage within the openshift-etcd namespace",
      "namespace": "openshift-etcd"
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-config-operator namespace",
      "namespace": "openshift-machine-config-operator"
    },
    {
      "name": "Don't alert on host network usage within the openshift-monitoring namespace",
      "namespace": "openshift-monitoring"
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-api namespace",
      "namespace": "openshift-machine-api"
    },
    {
      "name": "Don't alert on host network usage within the openshift-cluster-node-tuning-operator namespace",
      "namespace": "openshift-cluster-node-tuning-operator"
    }
  ],
  "enforcement": {
    "failBuild": false
  },
  "expression": {
    "op": "criterion",
    "field": "has-ingress-network-policy",
    "values": [
      "false"
    ],
    "valuesOp": "or",
    "negate": false
  },
  "disabled": true
}

Original StackRox JSON

{
  "id": "38bf79e7-48bf-4ab1-b72f-38e8ad8b4ec3",
  "name": "Deployments should have at least one ingress Network Policy",
  "description": "Alerts if deployments are missing an ingress Network Policy",
  "rationale": "Pods that lack ingress Network Policies have unrestricted reachability on the network and may be exposed to attacks",
  "remediation": "Create and apply an appropriate Network Policy of type ingress to all Deployments. See https://kubernetes.io/docs/concepts/services-networking/network-policies/ for details",
  "disabled": true,
  "categories": [
    "Security Best Practices",
    "Zero Trust"
  ],
  "lifecycleStages": [
    "DEPLOY"
  ],
  "eventSource": "NOT_APPLICABLE",
  "exclusions": [
    {
      "name": "Don't alert on kube-system namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "kube-system",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-kube-apiserver namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-apiserver",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-kube-scheduler namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-scheduler",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-kube-controller-manager namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-controller-manager",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-sdn namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-sdn",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-network-operator namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-network-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-multus namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-multus",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-cluster-version namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-version",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on node-ca DaemonSet in the openshift-image-registry namespace",
      "deployment": {
        "name": "node-ca",
        "scope": {
          "cluster": "",
          "namespace": "openshift-image-registry",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-etcd namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-etcd",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-config-operator namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-machine-config-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-monitoring namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-monitoring",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-machine-api namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-machine-api",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on host network usage within the openshift-cluster-node-tuning-operator namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-node-tuning-operator",
          "label": null
        }
      },
      "image": null
    }
  ],
  "scope": [],
  "severity": "MEDIUM_SEVERITY",
  "enforcementActions": [],
  "policySections": [
    {
      "sectionName": "Alert on missing ingres Network Policy",
      "policyGroups": [
        {
          "fieldName": "Has Ingress Network Policy",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "false"
            }
          ]
        }
      ]
    }
  ],
  "notifiers": [],
  "lastUpdated": null,
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "1.1",
  "mitreAttackVectors": [],
  "criteriaLocked": true,
  "mitreVectorsLocked": true,
  "isDefault": true,
  "source": "IMPERATIVE"
}