Skip to content

fix: correct CEL evaluation for strict seccomp inheritance #1496

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aerosouund merged 5 commits into from
Jul 2, 2026
Merged

fix: correct CEL evaluation for strict seccomp inheritance #1496

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
25b94bb
fix: correct CEL evaluation for strict seccomp inheritance
harinandhreddy0411 Jun 11, 2026
8533b9c
Enforce Seccomp profile restrictions in YAML
harinandhreddy0411 Jun 26, 2026
67c4bc6
Update artifacthub-pkg.yml
harinandhreddy0411 Jun 29, 2026
5995a58
Update kyverno-test.yaml
harinandhreddy0411 Jun 29, 2026
c5d0f9d
Add new Pod resources for testing seccomp profiles
harinandhreddy0411 Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions pod-security-cel/restricted/restrict-seccomp-strict/.kyverno-test/kyverno-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ results:
- badpod05
- badpod06
- badpod07
- badpod08
result: fail
rule: check-seccomp-strict
- kind: CronJob
Expand Down Expand Up @@ -86,5 +87,6 @@ results:
- goodpod08
- goodpod09
- goodpod10
- goodpod11
result: pass
rule: check-seccomp-strict
21 changes: 21 additions & 0 deletions pod-security-cel/restricted/restrict-seccomp-strict/.kyverno-test/resource.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,15 @@ spec:
- name: container01
image: dummyimagename
---
apiVersion: v1
kind: Pod
metadata:
name: badpod08
spec:
containers:
- name: container01
image: dummyimagename
---
###### Pods - Good
apiVersion: v1
kind: Pod
Expand Down Expand Up @@ -275,6 +284,18 @@ spec:
seccompProfile:
type: RuntimeDefault
---
apiVersion: v1
kind: Pod
metadata:
name: goodpod11
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: container01
image: dummyimagename
---
###### Deployments - Bad
apiVersion: apps/v1
kind: Deployment
Expand Down
2 changes: 1 addition & 1 deletion pod-security-cel/restricted/restrict-seccomp-strict/artifacthub-pkg.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,5 +19,5 @@ annotations:
kyverno/category: "Pod Security Standards (Restricted)"
kyverno/kubernetesVersion: "1.26-1.27"
kyverno/subject: "Pod"
digest: 66cf094f57c592abe9378262ca46d3860bf5cbdb67cc9d53654eaf784549b916
digest: 48f7fa6426ef41733bbb9a9292c199a3b5abcf664cc3e2b0eb32c030188e1f3a
createdAt: "2023-12-04T09:04:49Z"
36 changes: 18 additions & 18 deletions pod-security-cel/restricted/restrict-seccomp-strict/restrict-seccomp-strict.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,40 +32,40 @@ spec:
validate:
cel:
expressions:
- expression: >-
- expression: >-
!object.spec.?securityContext.?seccompProfile.?type.hasValue() ||
object.spec.securityContext.seccompProfile.type == 'RuntimeDefault' ||
object.spec.securityContext.seccompProfile.type == 'Localhost'
message: >-
Use of custom Seccomp profiles is disallowed. The field
spec.securityContext.seccompProfile.type must be set to `RuntimeDefault` or `Localhost`.
- expression: >-

- expression: >-
object.spec.containers.all(container,
!container.?securityContext.?seccompProfile.?type.hasValue() ||
container.securityContext.seccompProfile.type == 'RuntimeDefault' ||
container.securityContext.seccompProfile.type == 'Localhost'
(container.?securityContext.?seccompProfile.?type.orValue('') in ['RuntimeDefault', 'Localhost']) ||
(!container.?securityContext.?seccompProfile.?type.hasValue() && object.spec.?securityContext.?seccompProfile.?type.orValue('') in ['RuntimeDefault', 'Localhost'])
Comment thread
harinandhreddy0411 marked this conversation as resolved.
)
message: >-
Use of custom Seccomp profiles is disallowed. The field
spec.containers[*].securityContext.seccompProfile.type must be set to `RuntimeDefault` or `Localhost`.

- expression: >-
spec.containers[*].securityContext.seccompProfile.type must be set to `RuntimeDefault` or `Localhost`,
or inherited from spec.securityContext.seccompProfile.type.

- expression: >-
object.spec.?initContainers.orValue([]).all(container,
!container.?securityContext.?seccompProfile.?type.hasValue() ||
container.securityContext.seccompProfile.type == 'RuntimeDefault' ||
container.securityContext.seccompProfile.type == 'Localhost'
(container.?securityContext.?seccompProfile.?type.orValue('') in ['RuntimeDefault', 'Localhost']) ||
(!container.?securityContext.?seccompProfile.?type.hasValue() && object.spec.?securityContext.?seccompProfile.?type.orValue('') in ['RuntimeDefault', 'Localhost'])
)
message: >-
Use of custom Seccomp profiles is disallowed. The field
spec.initContainers[*].securityContext.seccompProfile.type must be set to `RuntimeDefault` or `Localhost`.
spec.initContainers[*].securityContext.seccompProfile.type must be set to `RuntimeDefault` or `Localhost`,
or inherited from spec.securityContext.seccompProfile.type.

- expression: >-
- expression: >-
object.spec.?ephemeralContainers.orValue([]).all(container,
!container.?securityContext.?seccompProfile.?type.hasValue() ||
container.securityContext.seccompProfile.type == 'RuntimeDefault' ||
container.securityContext.seccompProfile.type == 'Localhost'
(container.?securityContext.?seccompProfile.?type.orValue('') in ['RuntimeDefault', 'Localhost']) ||
(!container.?securityContext.?seccompProfile.?type.hasValue() && object.spec.?securityContext.?seccompProfile.?type.orValue('') in ['RuntimeDefault', 'Localhost'])
)
message: >-
Use of custom Seccomp profiles is disallowed. The field
spec.ephemeralContainers[*].securityContext.seccompProfile.type must be set to `RuntimeDefault` or `Localhost`.
spec.ephemeralContainers[*].securityContext.seccompProfile.type must be set to `RuntimeDefault` or `Localhost`,
or inherited from spec.securityContext.seccompProfile.type.
Loading