Would like to see Cilium CRDs recognized by Kubescape/rego.

[distributethe6ix]

Overview

I would like to have the ability to run kubescape scan control C-0260 -v and have kubescape recognize the CiliumNetworkPolicy CRD.

Here's a sample YAML:

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  endpointSelector:
    matchLabels: {}
  ingress: []
  egress: []

Problem

Kubernetes offers a simple NetworkPolicy CRD but is limited in functionality and doesn't completely provide all the necessary controls and policy capabilities that most CNIs would. This is a base functionality. If a Platform Engineer leverages the Cilium CNI, and uses its native CRDs, Kubescape won't recognize this configuration.

Solution

If Kubescape's rego configuration can honour the CiliumNetworkPolicy CRD, this will allow for C-0260 to pass, with a simple Deny-all policy.

Alternatives

Additional context

[alegrey91]

Hi @distributethe6ix , thanks for raising the problem. We should definitely start supporting Cilium and Calico network policies as well, since they are widely used.
WDYT @dwertent, @matthyx?

[dwertent]

Great idea.
@YiscahLevySilas1 Can you work on this? Please make sure to add the cilium.io/v2, ciliumnetworkpolicies to the Kubescape RBAC.

@slashben, @yossi77 we should consider this with the NP generation capability.

[gyoza]

Ahh this would be great please.. I just added a bunch of CNPs because of the kubescape report and was dismayed when nothing changed after I added them all lol :D

[slashben]

@dwertent maybe a mentee can work on this?

[VaibhavMalik4187]

Definitely sounds like an interesting project :)

[dwertent]

@slashben Yossi has generating cilium and calico NP up his sleeve. Maybe we should add the controls support as part of that epic.

[slashben]

Yes, but I am not sure what controls. Do you mean those that check if a workload has a bound network policy?

…

On Mon, Feb 12, 2024 at 7:34 AM David Wertenteil ***@***.***> wrote: @slashben <https://github.com/slashben> Yossi has generating cilium and calico NP up his sleeve. Maybe we should add the controls support as part of that epic. — Reply to this email directly, view it on GitHub <#1397 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AODLOPXKG2MAIRMBIZJ3BW3YTGSWLAVCNFSM6AAAAAA473GK7CVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMZYGA4DOMZTGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>