Security & Policy Labs

# Lab 1 — save each document below to its OWN file, in this order:
#   1-deny.yaml   2-dns.yaml   3-web-ingress.yaml   4-client-egress.yaml
# The point of the lab is applying them one at a time and watching the
# failure mode change, so do not paste all four into a single file.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: guarded
spec:
  podSelector: {}                    # empty selector = every pod in the namespace
  policyTypes: [Ingress, Egress]     # no rules below = nothing in, nothing out
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: guarded
spec:
  podSelector: {}                    # every pod may still resolve names
  policyTypes: [Egress]
  egress:
    - to:
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: kube-system }
          podSelector:
            matchLabels: { k8s-app: kube-dns }
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-client-to-web
  namespace: guarded
spec:
  podSelector:
    matchLabels: { app: web }        # this policy protects the web pods
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels: { app: client }
      ports:
        - { protocol: TCP, port: 80 }
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-client-egress-to-web
  namespace: guarded
spec:
  podSelector:
    matchLabels: { app: client }     # ...and the caller needs egress too
  policyTypes: [Egress]
  egress:
    - to:
        - podSelector:
            matchLabels: { app: web }
      ports:
        - { protocol: TCP, port: 80 }

# conforming.yaml — the shape a "restricted" namespace demands (Lab 3)
apiVersion: v1
kind: Pod
metadata:
  name: polite
  namespace: locked
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    seccompProfile: { type: RuntimeDefault }
  containers:
    - name: app
      image: busybox:1.36
      command: ["sh", "-c", "sleep 3600"]
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]

# kyverno-validate.yaml — Lab 4. Start in Audit, finish in Enforce.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  validationFailureAction: Audit   # flip to Enforce in step 4
  background: true                 # also report on already-running pods
  rules:
    - name: require-image-tag
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "An explicit image tag is required — ':latest' is not allowed."
        pattern:
          spec:
            containers:
              - image: "!*:latest"

# kyverno-mutate.yaml — Lab 5. Mutating webhooks run BEFORE validating ones.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-secure-defaults
spec:
  rules:
    - name: harden-containers
      match:
        any:
          - resources:
              kinds: ["Pod"]
              namespaces: ["guarded"]
      mutate:
        patchStrategicMerge:
          metadata:
            labels:
              +(hardened-by): kyverno     # "+" = add only if absent
          spec:
            automountServiceAccountToken: false
            containers:
              - (name): "*"               # "()" = match every container
                securityContext:
                  +(allowPrivilegeEscalation): false
                  +(runAsNonRoot): true
                  +(capabilities):
                    drop: ["ALL"]

# kyverno-generate.yaml — Lab 6. Every new namespace is born locked down.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kyverno:generate-netpol
  labels:                                        # the aggregation label is the gotcha:
    rbac.kyverno.io/aggregate-to-background-controller: "true"
rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]
    verbs: ["create", "update", "delete", "get", "list", "watch"]
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: seed-default-deny
spec:
  rules:
    - name: add-default-deny-to-new-namespaces
      match:
        any:
          - resources:
              kinds: ["Namespace"]
      generate:
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        name: default-deny-all
        namespace: "{{request.object.metadata.name}}"
        synchronize: true                        # re-create it if someone deletes it
        data:
          spec:
            podSelector: {}
            policyTypes: [Ingress, Egress]

# gatekeeper.yaml — Lab 7. The logic (template) and the rule (constraint) are separate.
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names: { kind: K8sRequiredLabels }         # this creates a NEW CRD you can use
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels: { type: array, items: { type: string } }
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("missing required labels: %v", [missing])
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels                          # the kind your template just defined
metadata:
  name: ns-must-have-owner
spec:
  enforcementAction: deny                        # "dryrun" audits only; "warn" nags
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
  parameters:
    labels: ["owner"]

# peer-auth.yaml — Lab 8. STRICT means "show me a mesh certificate or go away".
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  # namespace-wide here; the same object in istio-system with no
  # selector is how you make it mesh-wide
  namespace: mesh
spec:
  mtls:
    mode: STRICT                 # STRICT | PERMISSIVE | DISABLE | UNSET

# Lab 9 — two files again: 9a-deny-all.yaml, then 9b-allow-sleep.yaml.
# Deny-all first, then one narrow ALLOW.
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-nothing
  namespace: mesh
spec: {}                                   # an empty spec denies ALL traffic in the ns
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-sleep-get
  namespace: mesh
spec:
  selector:
    matchLabels: { app: httpbin }
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/mesh/sa/sleep"]   # identity, not IP
      to:
        - operation:
            methods: ["GET"]
            paths: ["/get"]

# Lab 11 — two identical images, one signed. ttl.sh is anonymous and ephemeral,
# so the only thing that differs is whether anyone vouched for the bytes.
# The random suffix matters: ttl.sh has a flat, public namespace and a fixed
# name like ttl.sh/cnpe-good is very likely to already belong to someone else.
export SUFFIX=$(openssl rand -hex 4)
export GOOD=ttl.sh/cnpe-good-$SUFFIX:1h
export BAD=ttl.sh/cnpe-bad-$SUFFIX:1h

docker pull nginx:1.27
docker tag nginx:1.27 $GOOD && docker push $GOOD
docker tag nginx:1.27 $BAD  && docker push $BAD

# writes cosign.key (password-protected) and cosign.pub
cosign generate-key-pair
# -y accepts the transparency-log upload prompt non-interactively
cosign sign -y --key cosign.key $GOOD

cosign verify --key cosign.pub $GOOD    # succeeds
cosign verify --key cosign.pub $BAD     # fails: no matching signatures

# verify-images.yaml — Lab 11. Paste YOUR cosign.pub between the BEGIN/END lines,
# keeping this indentation. Same validationFailureAction drift as Lab 4 applies.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-signed-images
spec:
  validationFailureAction: Enforce
  webhookTimeoutSeconds: 30          # signature checks hit the registry — give them room
  rules:
    - name: check-cosign-signature
      match:
        any:
          - resources:
              kinds: ["Pod"]
              namespaces: ["signed"]
      verifyImages:
        - imageReferences: ["ttl.sh/*"]
          attestors:
            - count: 1
              entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      REPLACE-WITH-THE-CONTENTS-OF-cosign.pub
                      -----END PUBLIC KEY-----