Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

runAsUser.rule = MustRunAsNonRoot doesn't work as expected #27

Open
4 tasks done
chrisns opened this issue Dec 21, 2021 · 1 comment
Open
4 tasks done

runAsUser.rule = MustRunAsNonRoot doesn't work as expected #27

chrisns opened this issue Dec 21, 2021 · 1 comment
Labels
bug Something isn't working

Comments

@chrisns
Copy link
Contributor

chrisns commented Dec 21, 2021

Is there an existing issue for this?

  • I have searched the existing issues

What happened?

A bug happened!

What policy engine(s) are you using?

  • Kyverno
  • Kubewarden
  • Gatekeeper

Input PSP

# https://github.com/kubernetes/website/blob/main/content/en/examples/policy/example-psp.yaml 
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: example
spec:
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: MustRunAsNonRoot
  fsGroup:
    rule: RunAsAny
  volumes:
  - '*'

Gatekeeper output

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowedUsers
metadata:
  name: psp-k8spspallowedusers-97934
spec:
  match:
    kinds:
      - apiGroups:
          - ""
        kinds:
          - Pod
  parameters:
    runAsUser:
      rule: MustRunAsNonRoot

Kubewarden output

apiVersion: policies.kubewarden.io/v1alpha2
kind: ClusterAdmissionPolicy
metadata:
  name: psp-usergroup-070cd
spec:
  module: registry://ghcr.io/kubewarden/policies/user-group-psp:v0.1.3
  rules:
    - apiGroups:
        - ""
      apiVersions:
        - v1
      resources:
        - pods
      operations:
        - CREATE
        - UPDATE
  mutating: false
  settings:
    run_as_user:
      rule: MustRunAsNonRoot
    supplemental_groups:
      rule: RunAsAny

Kyverno output

Cannot read properties of undefined (reading '0')

GIT

54f53bc

@chrisns chrisns added the bug Something isn't working label Dec 21, 2021
@Clijsters
Copy link

After facing the same problem...
Judging from https://github.com/appvia/psp-migration/blob/main/src/kyverno.ts#L274 and the according group equivalent some lines further down I'd guess the range should be optional in both cases.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants