8.1_8.1.5_restrict-rbac-subjects.yaml

# Copyright 2023 Google LLC
#
# This is “Software” that is licensed under the “General Software” section of
# the Service Specific Terms (https://cloud.google.com/terms/service-terms) for
# usage in accordance with the following “Scope of Use”: This file may only be
# used on an Anthos cluster, including any associated ci/cd use. “Anthos
# cluster” is defined as “A Cluster (of any kind) registered to a fleet project
# where the Anthos API is enabled”.
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRestrictRbacSubjects
metadata:
  name: pci-dss-v3.2.1-extended-restrict-rbac-subjects
  labels:
    policycontroller.gke.io/bundleName: pci-dss-v3.2.1-extended
  annotations:
    policycontroller.gke.io/constraintData: |
      "{
        bundleName: 'pci-dss-v3.2.1-extended',
        bundleDisplayName: 'PCI DSS v3.2.1',
        bundleLink: 'https://github.com/GoogleCloudPlatform/acm-policy-controller-library/tree/master/anthos-bundles/pci-dss-v3.2.1-extended',
        bundleVersion: '202301.0',
        bundleDescription: 'Use the PCI DSS v3.2.1 policy bundle with Policy Controller to evaluate the compliance of your cluster resources against some aspects of the Payment Card Industry (PCI) Data Security Standard (DSS) v3.2.1.',
        controlNumbers: '[8.1,8.1.5]',
        severity: 'UNASSIGNED',
        description: 'Restricts the use of names in RBAC subjects to permitted values.',
        remediation: 'The use of names in RBAC bindings is restricted to permitted values. Remove the restricted RBAC subject entry or add the name to the `allowedSubjects` list. See “Using RBAC Authorization” for more information: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles',
        minimumTemplateLibraryVersion: '1.14.0'
      }"
spec:
  enforcementAction: dryrun
  match:
    kinds:
      - apiGroups:
          - rbac.authorization.k8s.io
        kinds:
          - RoleBinding
          - ClusterRoleBinding
  parameters:
    allowedSubjects:
      # Permit email Domains
      - name: ^.+@google.com$ # Update to your email domain
        regexMatch: true
      - name: ^.+@gcp-sa-mcmetering.iam.gserviceaccount.com$
        regexMatch: true
      - name: ^.+@gcp-sa-gkehub.iam.gserviceaccount.com$
        regexMatch: true
      - name: ^.+@gcp-sa-anthosconfigmanagement.iam.gserviceaccount.com$
        regexMatch: true
      - name: ^.+@gcp-sa-servicemesh.iam.gserviceaccount.com$
        regexMatch: true
      - name: ^.+@system.gserviceaccount.com$
        regexMatch: true
      - name: ^.+@gcp-sa-appdevexperience.iam.gserviceaccount.com$
        regexMatch: true
      - name: ^.+@gcp-sa-gkeonprem.iam.gserviceaccount.com$
        regexMatch: true
      # Permit selected patterns
      - name: ^system:.+$
        regexMatch: true
      - name: ^.+-controller$
        regexMatch: true
      - name: ^istiod-asm-[0-9]{4}-[0-9]$
        regexMatch: true
      - name: ^preflightcheck-operator-[0-9].[0-9]{2}.[0-9]$
        regexMatch: true
      - name: ^capi-controller-manager-[0-9].[0-9]{2}.[0-9]$
        regexMatch: true
      - name: ^capi-kubeadm-bootstrap-system-[0-9].[0-9]{2}.[0-9]$
        regexMatch: true
      - name: ^capi-kubeadm-bootstrap-manager-rolebinding-[0-9].[0-9]{2}.[0-9]$
        regexMatch: true
      - name: ^cap-controller-manager-[0-9].[0-9]{2}.[0-9]$
        regexMatch: true
      - name: ^anthos-cluster-operator-[0-9].[0-9]{2}.[0-9]$
        regexMatch: true
      # Permit selected names
      - name: antrea-cpha
      - name: bootstrap-signer
      - name: canonical-service-account
      - name: cilium
      - name: cloud-provider
      - name: cluster-autoscaler
      - name: config-management-operator
      - name: connect-agent-sa
      - name: default
      - name: event-exporter-sa
      - name: gatekeeper-admin
      - name: generic-garbage-collector
      - name: gke-metadata-server
      - name: gke-metrics-agent
      - name: horizontal-pod-autoscaler
      - name: istio-reader-service-account
      - name: istiod-service-account
      - name: konnectivity-agent-cpha
      - name: kube-apiserver
      - name: kube-controller-manager
      - name: kube-dns
      - name: kube-dns-autoscaler
      - name: kube-proxy
      - name: kube-scheduler
      - name: kubelet
      - name: kubelet-bootstrap
      - name: metrics-server
      - name: monitor
      - name: netd
      - name: pdcsi-node-sa
      - name: persistent-volume-binder
      - name: pod-garbage-collector
      - name: reconciler-manager
      - name: resource-group-sa
      - name: root-ca-cert-publisher
      - name: root-reconciler
      - name: token-cleaner
      - name: stackdriver-prometheus-scrape
      - name: stackdriver-operator
      - name: cert-manager
      - name: edge-sa
      - name: vmruntime-vmruntime-controller-manager
      - name: cert-manager
      - name: clientconfig-operator
      - name: localpv
      - name: metrics-server-operator
      - name: cert-manager-webhook
      - name: sp-controller-manager
      - name: core-dns-autoscale
      - name: metadata-agent
      - name: cert-manager-cainjector
      - name: metallb-speaker
      - name: istio-ingressgateway-service-account
      - name: lifecycle-controllers-manager
      - name: metallb-speaker
      - name: ais-manager
      - name: ansible-runner
      - name: healthcheck-metrics-collector
      - name: core-dns-autoscaler
      - name: lifecycle-controllers-manager
      - name: healthcheck-metrics-collector
      - name: stackdriver-log-forwarder
      - name: coredns
      - name: lifecycle-controllers-deployer
      - name: capi-controller-manager
      - name: cilium-operator
      - name: kube-state-metrics
      - name: istio-cni
      - name: istio-cni-repair-rolebinding
      - name: mdp-controller