Merge branch 'feature/services' of github.com:kubescape/regolibrary i…

…nto feature/services
kubescape · Jul 14, 2024 · 81992f3 · 81992f3
2 parents 759dc32 + 81e9cff
commit 81992f3
Show file tree

Hide file tree

Showing 5 changed files with 58 additions and 2 deletions.
diff --git a/controls/C-0274-unauthenticatedservice.json b/controls/C-0274-unauthenticatedservice.json
@@ -8,6 +8,14 @@
     "attributes": {
         "controlTypeTags": [
             "security"
+        ],
+        "attackTracks": [
+            {
+                "attackTrack": "workload-external-track",
+                "categories": [
+                    "Data Collection"
+                ]
+            }
         ]
     },
     "rulesNames": [

diff --git a/rules/unauthenticated-service/test/service/expected.json b/rules/unauthenticated-service/test/service/expected.json
@@ -1,4 +1,4 @@
-{
+[{
     "alertMessage": "Unauthenticated service operator exposes operator",
     "alertObject": {
       "k8sApiObjects": [
@@ -80,4 +80,5 @@
     ],
     "reviewPaths": ["spec"],
     "ruleStatus": ""
-}
+}
+]
diff --git a/rules/unauthenticated-service/test/service/input/operator2.yaml b/rules/unauthenticated-service/test/service/input/operator2.yaml
@@ -0,0 +1,18 @@
+apiVersion: kubescape.io/v1
+kind: ServiceScanResult
+metadata:
+  creationTimestamp: "2024-07-03T04:40:17Z"
+  generation: 4
+  name: operator2
+  namespace: kubescape
+  resourceVersion: "2772"
+  uid: 24dc622d-ee78-40c2-8654-2a5604715f95
+spec:
+  clusterIP: 10.103.207.220
+  ports:
+  - applicationLayer: ""
+    authenticated: true
+    port: 4002
+    presentationLayer: http
+    protocol: TCP
+    sessionLayer: tcp
diff --git a/rules/unauthenticated-service/test/service/input/pod2.yaml b/rules/unauthenticated-service/test/service/input/pod2.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: operator2
+  namespace: kubescape
+  labels:
+    app: operator2
+spec:
+  containers:
+  - name: operator-container
+    image: your-operator-image:latest
+    ports:
+    - containerPort: 8080
+    resources:
+      limits:
+        cpu: "1"
+        memory: "1Gi"
diff --git a/rules/unauthenticated-service/test/service/input/service2.yaml b/rules/unauthenticated-service/test/service/input/service2.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: operator2
+  namespace: kubescape
+spec:
+  selector:
+    app: operator2
+  ports:
+    - protocol: TCP
+      port: 4002
+      targetPort: 8080