ContainerDisallowedCapabilities.json

{
  "properties": {
    "displayName": "Kubernetes clusters should not use specific security capabilities",
    "policyType": "BuiltIn",
    "mode": "Microsoft.Kubernetes.Data",
    "description": "Prevent specific security capabilities in Kubernetes clusters to prevent ungranted privileges on the Pod resource. For more information, see https://aka.ms/kubepolicydoc.",
    "metadata": {
      "version": "5.2.0",
      "category": "Kubernetes"
    },
    "version": "5.2.0",
    "parameters": {
      "source": {
        "type": "String",
        "metadata": {
          "displayName": "Source",
          "description": "The source k8s object for constraint evaluation. 'Original' means only evaluate against the specific GroupVersionKind specified in the policy definition. 'Generated' means only evaluate against k8s objects generated by Gatekeeper ExpansionTemplates. 'All' means evaluate against both the original object and any generated ones."
        },
        "defaultValue": "Original",
        "allowedValues": [
          "All",
          "Generated",
          "Original"
        ]
      },
      "warn": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Warn",
          "description": "Whether or not to return warnings back to the user in the kubectl cli"
        },
        "defaultValue": false
      },
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "'Audit' allows a non-compliant resource to be created or updated, but flags it as non-compliant. 'Deny' blocks the non-compliant resource creation or update. 'Disabled' turns off the policy.",
          "portalReview": true
        },
        "allowedValues": [
          "audit",
          "Audit",
          "deny",
          "Deny",
          "disabled",
          "Disabled"
        ],
        "defaultValue": "Audit"
      },
      "excludedNamespaces": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace exclusions",
          "description": "List of Kubernetes namespaces to exclude from policy evaluation. System namespaces \"kube-system\", \"gatekeeper-system\" and \"azure-arc\" are always excluded by design. \"azure-extensions-usage-system\" is optional to remove."
        },
        "defaultValue": [
          "kube-system",
          "gatekeeper-system",
          "azure-arc",
          "azure-extensions-usage-system"
        ]
      },
      "namespaces": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace inclusions",
          "description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
        },
        "defaultValue": []
      },
      "labelSelector": {
        "type": "object",
        "metadata": {
          "displayName": "Kubernetes label selector",
          "description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
        },
        "defaultValue": {},
        "schema": {
          "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
          "type": "object",
          "properties": {
            "matchLabels": {
              "description": "matchLabels is a map of {key,value} pairs.",
              "type": "object",
              "additionalProperties": {
                "type": "string"
              },
              "minProperties": 1
            },
            "matchExpressions": {
              "description": "matchExpressions is a list of values, a key, and an operator.",
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "key": {
                    "description": "key is the label key that the selector applies to.",
                    "type": "string"
                  },
                  "operator": {
                    "description": "operator represents a key's relationship to a set of values.",
                    "type": "string",
                    "enum": [
                      "In",
                      "NotIn",
                      "Exists",
                      "DoesNotExist"
                    ]
                  },
                  "values": {
                    "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                },
                "required": [
                  "key",
                  "operator"
                ],
                "additionalProperties": false
              },
              "minItems": 1
            }
          },
          "additionalProperties": false
        }
      },
      "disallowedCapabilities": {
        "type": "Array",
        "metadata": {
          "displayName": "Blocked capabilities",
          "description": "List of capabilities that containers are not able to use",
          "portalReview": true
        },
        "defaultValue": []
      },
      "excludedContainers": {
        "type": "Array",
        "metadata": {
          "displayName": "Containers exclusions",
          "description": "The list of InitContainers and Containers to exclude from policy evaluation. The identify is the name of container. Use an empty list to apply this policy to all containers in all namespaces."
        },
        "defaultValue": []
      },
      "excludedImages": {
        "type": "Array",
        "metadata": {
          "displayName": "Image exclusions",
          "description": "The list of InitContainers and Containers to exclude from policy evaluation. The identifier is the image of container. Prefix-matching can be signified with `*`. For example: `myregistry.azurecr.io/istio:*`. It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
          "portalReview": true
        },
        "defaultValue": []
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.Kubernetes/connectedClusters",
          "Microsoft.ContainerService/managedClusters"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "source": "[parameters('source')]",
          "warn": "[parameters('warn')]",
          "templateInfo": {
            "sourceType": "PublicURL",
            "url": "https://store.policy.core.windows.net/kubernetes/container-disallowed-capabilities/v3/template.yaml"
          },
          "apiGroups": [
            ""
          ],
          "kinds": [
            "Pod"
          ],
          "excludedNamespaces": "[parameters('excludedNamespaces')]",
          "namespaces": "[parameters('namespaces')]",
          "labelSelector": "[parameters('labelSelector')]",
          "values": {
            "disallowedCapabilities": "[parameters('disallowedCapabilities')]",
            "excludedContainers": "[parameters('excludedContainers')]",
            "excludedImages": "[parameters('excludedImages')]"
          }
        }
      }
    },
    "versions": [
      "5.2.0",
      "5.1.0"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/a27c700f-8a22-44ec-961c-41625264370b",
  "name": "a27c700f-8a22-44ec-961c-41625264370b"
}