CIS Policy 5.1.1 - disallow clusterrole binding to cluster-admin

policies/CIS.5.1.1.rego

@@ -0,0 +1,20 @@
+package cis_5_1_1
+
+import data.lib.kubernetes
+
+violation[msg] {
+    kubernetes.clusterrolebindings[clusterrolebinding]
+    is_clusterrole_admin(clusterrolebinding)
+    msg = kubernetes.format(sprintf("ClusterRoleBinding %v - Binding to cluster-admin role is not allowed", [clusterrolebinding.metadata.name]))
+}
+
+violation[msg] {
+    kubernetes.rolebindings[rolebinding]
+    is_clusterrole_admin(rolebinding)
+    msg = kubernetes.format(sprintf("RoleBinding %v - Binding to cluster-admin role is not allowed", [rolebinding.metadata.name]))
+}
+
+is_clusterrole_admin(rolebinding) {
+    rolebinding.roleRef.name == "cluster-admin"
+    startswith(rolebinding.metadata.name, "system:") == false
+}

policies/CIS.5.1.1_test.rego

@@ -0,0 +1,47 @@
+package cis_5_1_1
+
+import data.lib.test
+
+test_violation {
+    test.violations(violation) with input as policy_input("ClusterRoleBinding", "example:view:binding", "cluster-admin")
+}
+
+test_violation_2 {
+    test.violations(violation) with input as policy_input("RoleBinding", "example:view:binding", "cluster-admin")
+}
+
+test_no_violation {
+    test.no_violations(violation) with input as policy_input("ClusterRoleBinding", "system:cluster-admin", "cluster-admin")
+}
+
+test_no_violation_2 {
+    test.no_violations(violation) with input as policy_input("RoleBinding", "system:cluster-admin", "cluster-admin")
+}
+
+test_no_violation_3 {
+    test.no_violations(violation) with input as policy_input("ClusterRoleBinding", "stackdriver:fluentd-gcp", "stackdriver:fluentd-gcp")
+}
+
+test_no_violation_4 {
+    test.no_violations(violation) with input as policy_input("RoleBinding", "stackdriver:fluentd-gcp", "stackdriver:fluentd-gcp")
+}
+
+policy_input(rolebindingkind, name, ref) = {
+    "apiVersion": "rbac.authorization.k8s.io/v1",
+    "kind": rolebindingkind,
+    "metadata": {
+        "name": name
+    },
+    "roleRef": {
+        "apiGroup": "rbac.authorization.k8s.io",
+        "kind": "ClusterRole",
+        "name": ref
+    },
+    "subjects": [
+        {
+            "apiGroup": "rbac.authorization.k8s.io",
+            "kind": "Group",
+            "name": "system:masters"
+        }
+    ]
+}

policies/lib/kubernetes.rego

@@ -149,6 +149,19 @@ clusterroles[clusterrole] {
     clusterrole = object
 }
 
+is_clusterrole_binding {
+    kind = "ClusterRoleBinding"
+}
+
+is_clusterrole_binding {
+    kind = "ClusterRoleBindings"
+}
+
+clusterrolebindings[clusterrolebinding] {
+    is_clusterrole_binding
+    clusterrolebinding = object
+}
+
 pod_containers(pod) = all_containers {
 	keys = {"containers", "initContainers"}
 	all_containers = [c | keys[k]; c = pod.spec[k][_]]