feat: add support for CONNECT operations

[thomaschaplin]

What this PR does / why we need it:

Adds support for CONNECT operations as described in issue - #3458

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):
Fixes #3458

Special notes for your reviewer:

This is the rego policy I want to use:

package opakubectlexec

import future.keywords.every

# Violation for interactive exec
violation[{"msg": msg}] {
	input.review.object.stdin == true
	msg := "Interactive exec is not permitted."
}

# Define the role with unrestricted access
# You can add more roles if needed
# and add them to the is_unrestricted_user function below
full_admin_role := "arn:aws:sts::1234567890:assumed-role/my_role_name"

# Check if the user has the unrestricted role
is_unrestricted_user {
	startswith(input.review.userInfo.username, full_admin_role)
}

# List of allowed commands
allowed_commands := {"ls", "ps", "ping", "curl"}

# Function to check if command is allowed
is_command_allowed(command) {
	command in allowed_commands
}

# Function to check if the command is safe (does not contain dangerous characters)
is_command_safe(command) {
	not contains(command, ";")
	not contains(command, "&")
	not contains(command, "|")
	not contains(command, "`")
	not contains(command, "$(")
	not contains(command, "<")
	not contains(command, ">")
}

# Violation for disallowed or unsafe commands
violation[{"msg": msg}] {
	input.review.object.command
	command := input.review.object.command[0]

	not is_unrestricted_user
	not is_command_allowed(command)
	msg := sprintf("Command '%s' is not allowed. Only %v commands are allowed.", [command, allowed_commands])
}

violation[{"msg": msg}] {
	input.review.object.command
	full_command := concat(" ", input.review.object.command)

	not is_command_safe(full_command)
	msg := sprintf("Command '%s' is not allowed due to unsafe characters.", [full_command])
}

The use-case is to only allow certain exec commands to be run via kubectl unless you're using a certain role (to allow for break-glass scenario)

So for example running kubectl exec <POD_NAME> -- ls will work but running kubectl exec <POD_NAME> -- echo "Hello World" will result in the following error:

Error from server (Forbidden): admission webhook "validation.gatekeeper.sh" denied the request: [opakubectlexec] Command 'echo' is not allowed. Only {"curl", "ls", "ping", "ps"} commands are allowed.

I have confirmed that this works with my suggested change (adding CONNECT operation)

[sozercan]

@thomaschaplin can you revert changes in /charts? /manifest_staging/charts is automatically promoted to /charts when we cut a release

[thomaschaplin]

@sozercan I've done that now, thanks for confirming - I wasn't sure as the docs wasn't clear to me if this was auto-generated or not.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 47.97%. Comparing base (3350319) to head (0513434).
Report is 111 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (3350319) and HEAD (0513434). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (3350319)	HEAD (0513434)
unittests	2	1

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3459      +/-   ##
==========================================
- Coverage   54.49%   47.97%   -6.53%     
==========================================
  Files         134      219      +85     
  Lines       12329    14844    +2515     
==========================================
+ Hits         6719     7121     +402     
- Misses       5116     6914    +1798     
- Partials      494      809     +315     

Flag	Coverage Δ
unittests	47.97% <ø> (-6.53%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[thomaschaplin]

@sozercan / @anlandu please could I get another review? Sorry for the typo

[ritazh]

LGTM

[thomaschaplin]

Thanks for the approval @ritazh!

I see this has been added to the v3.17.0 milestone - does that mean it'll get merged and deployed around the 30th July?

[ritazh]

Thanks for the approval @ritazh!

I see this has been added to the v3.17.0 milestone - does that mean it'll get merged and deployed around the 30th July?

yes the exact release date is TBD. we may need to delay by a week due to other pending PRs.

[maxsmythe]

LGTM

[sozercan]

LGTM