JSON and Rego updated (#787)

tenable · May 18, 2021 · 636515e · 636515e
1 parent dc0b428
commit 636515e
Show file tree

Hide file tree

Showing 4 changed files with 3 additions and 34 deletions.
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0155.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0155.json
@@ -7,7 +7,7 @@
     "arg2": "cpu",
     "name": "CpuRequestsCheck",
     "not_allowed": "false",
-    "param": "resources",
+    "param": "requests",
     "param1": "resources",
     "prefix": "",
     "suffix": "",

diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0157.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0157.json
@@ -7,7 +7,7 @@
     "arg2": "memory",
     "name": "MemoryRequestsCheck",
     "not_allowed": "false",
-    "param": "resources",
+    "param": "requests",
     "param1": "resources",
     "prefix": "",
     "suffix": "",

diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/probeCheck.rego b/pkg/policies/opa/rego/k8s/kubernetes_pod/probeCheck.rego
@@ -8,12 +8,6 @@ package accurics
     not container["{{.argument}}"]
 }
 
-#rule for pod terraform
-{{.prefix}}{{.name}}{{.suffix}}[pod.id] {
-    pod := input.kubernetes_pod[_]
-    container := pod.config.spec.containers[_]
-    not container["{{.argumentTF}}"]
-}
 
 #rule for deployment, daemonset, job, replica_Set, replication_controller, stateful_set
 {{.prefix}}{{.name}}{{.suffix}}[kind.id] {
@@ -34,35 +28,10 @@ package accurics
     not container["{{.argument}}"]
 }
 
-#rule for terraform deployment, daemonset, job, replica_Set, replication_controller, stateful_set
-{{.prefix}}{{.name}}{{.suffix}}[kind.id] {
-    item_list := [
-        object.get(input, "kubernetes_daemonset", "undefined"),
-        object.get(input, "kubernetes_deployment", "undefined"),
-        object.get(input, "kubernetes_job", "undefined"),
-        object.get(input, "kubernetes_replica_set", "undefined"),
-        object.get(input, "kubernetes_replication_controller", "undefined"),
-        object.get(input, "kubernetes_stateful_set", "undefined")
-    ]
-
-    item = item_list[_]
-    item != "undefined"
-
-    kind := item[_]
-    container := kind.config.spec.template.spec.containers[_]
-    not container["{{.argumentTF}}"]
-}
 
 #rule for cronjob
 {{.prefix}}{{.name}}{{.suffix}}[cron_job.id] {
     cron_job := input.kubernetes_cron_job[_]
     container := cron_job.config.spec.jobTemplate.spec.template.spec.containers[_]
     not container["{{.argument}}"]
-}
-
-#rule for terraform cronjob
-{{.prefix}}{{.name}}{{.suffix}}[cron_job.id] {
-    cron_job := input.kubernetes_cron_job[_]
-    container := cron_job.config.spec.jobTemplate.spec.template.spec.containers[_]
-    not container["{{.argumentTF}}"]
 }
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/securityContextCheck.rego b/pkg/policies/opa/rego/k8s/kubernetes_pod/securityContextCheck.rego
@@ -57,7 +57,7 @@ containerSecurityCheck(container) {
 }
 
 containerSecurityCheck(container) {
-    not container.{{.param1}}.{{.param}}
+    object.get(container.{{.param1}}, "{{.param}}", "undefined") == "undefined"
 }
 
 containerSecurityCheck(container) {