Add supply-chain and secrets access checks

pkg/builtinchecks/yamls/cluster-wide-secrets-access.yaml

@@ -0,0 +1,17 @@
+name: cluster-wide-secrets-access
+description: >-
+  ClusterRoleBinding granting secrets access (get, list, watch, create,
+  update, patch, delete) across all namespaces. When bound to an operator
+  service account that reconciles tenant-controlled custom resources, this
+  enables cross-namespace secret exfiltration (confused deputy).
+remediation: >-
+  Use namespaced RoleBindings to limit secrets access to required namespaces,
+  or restrict the ClusterRole to specific resource names if cluster-wide
+  access is necessary.
+scope:
+  objectKinds:
+    - ClusterRoleBinding
+template: "access-to-resources"
+params:
+  resources: ["^secrets$"]
+  verbs: ["^get$", "^list$", "^watch$", "^create$", "^update$", "^patch$", "^delete$", "^\\*$"]

pkg/builtinchecks/yamls/configmap-with-credentials.yaml

@@ -0,0 +1,20 @@
+name: configmap-with-credentials
+description: >-
+  ConfigMap contains keys with credential-like names (password, secret,
+  token, api_key). Credentials should be stored in Secrets, not ConfigMaps.
+remediation: >-
+  Move credential values to a Secret resource. Reference the Secret from
+  pod specs using secretKeyRef instead of configMapKeyRef.
+scope:
+  objectKinds:
+    - Any
+template: cel-expression
+params:
+  check: >
+    object.kind == 'ConfigMap' &&
+    has(object.data) &&
+    object.data.exists(k,
+      k.contains('password') || k.contains('secret') || k.contains('token') ||
+      k.contains('api_key') || k.contains('apikey') || k.contains('private_key') ||
+      k.contains('credential')
+    ) ? 'ConfigMap contains credential-like keys — use Secrets instead' : ''

pkg/builtinchecks/yamls/externalname-service-redirect.yaml

@@ -0,0 +1,17 @@
+name: externalname-service-redirect
+description: >-
+  Service with type: ExternalName redirects internal traffic to an external
+  DNS name. If the external name resolves to an attacker-controlled host,
+  this enables SSRF at the infrastructure level.
+remediation: >-
+  Use type: ClusterIP with an Endpoints object pointing to a known-safe IP,
+  or validate that the externalName resolves to a trusted destination.
+scope:
+  objectKinds:
+    - Any
+template: cel-expression
+params:
+  check: >
+    object.spec.type == 'ExternalName' &&
+    has(object.spec.externalName)
+    ? 'ExternalName service redirects cluster traffic to external DNS — potential SSRF vector' : ''

pkg/builtinchecks/yamls/image-not-pinned-by-digest.yaml

@@ -0,0 +1,12 @@
+name: "image-not-pinned-by-digest"
+description: >-
+  Container images referenced by tag are mutable — a tag can be moved to
+  point to a different image at any time. Pinning by digest guarantees
+  the exact image content that will run.
+remediation: >-
+  Reference container images by digest (e.g. image@sha256:abc123...)
+  instead of by tag.
+scope:
+  objectKinds:
+    - DeploymentLike
+template: "image-not-pinned-by-digest"

pkg/templates/all/all.go

@@ -26,6 +26,7 @@ import (
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostnetwork"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostpid"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hpareplicas"
+	_ "golang.stackrox.io/kube-linter/pkg/templates/imagedigest"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/imagepullpolicy"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/jobttlsecondsafterfinished"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/kubeconform"

pkg/templates/imagedigest/internal/params/params.go

@@ -0,0 +1,8 @@
+package params
+
+// Params represents the params accepted by this template.
+type Params struct {
+
+	// list of regular expressions specifying pattern(s) for container images to exempt from the digest check.
+	AllowList []string
+}

pkg/templates/imagedigest/template.go

@@ -0,0 +1,64 @@
+package imagedigest
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"golang.stackrox.io/kube-linter/pkg/check"
+	"golang.stackrox.io/kube-linter/pkg/config"
+	"golang.stackrox.io/kube-linter/pkg/diagnostic"
+	"golang.stackrox.io/kube-linter/pkg/objectkinds"
+	"golang.stackrox.io/kube-linter/pkg/templates"
+	"golang.stackrox.io/kube-linter/pkg/templates/imagedigest/internal/params"
+	"golang.stackrox.io/kube-linter/pkg/templates/util"
+	v1 "k8s.io/api/core/v1"
+)
+
+const (
+	templateKey = "image-not-pinned-by-digest"
+)
+
+func init() {
+	templates.Register(check.Template{
+		HumanName:   "Image Not Pinned By Digest",
+		Key:         templateKey,
+		Description: "Flag container images that are not pinned to a specific digest",
+		SupportedObjectKinds: config.ObjectKindsDesc{
+			ObjectKinds: []string{objectkinds.DeploymentLike},
+		},
+		Parameters:             params.ParamDescs,
+		ParseAndValidateParams: params.ParseAndValidate,
+		Instantiate: params.WrapInstantiateFunc(func(p params.Params) (check.Func, error) {
+			allowedRegexes := make([]*regexp.Regexp, 0, len(p.AllowList))
+			for _, res := range p.AllowList {
+				rg, err := regexp.Compile(res)
+				if err != nil {
+					return nil, fmt.Errorf("invalid regex %s: %w", res, err)
+				}
+				allowedRegexes = append(allowedRegexes, rg)
+			}
+
+			return util.PerContainerCheck(func(container *v1.Container) (results []diagnostic.Diagnostic) {
+				if isAllowed(allowedRegexes, container.Image) {
+					return nil
+				}
+				if !strings.Contains(container.Image, "@sha256:") {
+					results = append(results, diagnostic.Diagnostic{
+						Message: fmt.Sprintf("container %q image %q is not pinned by digest", container.Name, container.Image),
+					})
+				}
+				return results
+			}), nil
+		}),
+	})
+}
+
+func isAllowed(regexlist []*regexp.Regexp, name string) bool {
+	for _, regex := range regexlist {
+		if regex.MatchString(name) {
+			return true
+		}
+	}
+	return false
+}

tests/checks/cluster-wide-secrets-access.yml

@@ -0,0 +1,46 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: secrets-reader
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: fire-cluster-secrets
+subjects:
+  - kind: ServiceAccount
+    name: operator-sa
+    namespace: operators
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: secrets-reader
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ns-secrets-reader
+  namespace: default
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dont-fire-ns-scoped
+  namespace: default
+subjects:
+  - kind: ServiceAccount
+    name: app-sa
+    namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ns-secrets-reader

tests/checks/configmap-with-credentials.yml

@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dont-fire
+data:
+  config.yaml: |
+    logLevel: info
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fire-password-key
+data:
+  database_password: "hunter2"
+  connection_string: "postgres://localhost:5432"

tests/checks/externalname-service-redirect.yml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dont-fire
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: fire-externalname
+spec:
+  type: ExternalName
+  externalName: attacker.example.com

tests/checks/image-not-pinned-by-digest.yml

@@ -0,0 +1,33 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dont-fire
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry.example.com/app@sha256:abc123def456
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fire-tag-only
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry.example.com/app:v1.2.3
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fire-no-tag
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry.example.com/app