CME-711
Admission Controller Policy Enforcement (OPA/Gatekeeper/Kyverno)
Description
Policy-as-code enforcement at the Kubernetes admission gate. Admission controllers intercept API requests before persistence and reject workloads that violate security policies: no privileged containers, no host namespace sharing, required labels/annotations, image registry allowlists. Provides defense-in-depth on top of Pod Security Standards (CME-706) with custom policy granularity. OPA/Gatekeeper uses Rego policies via ConstraintTemplate CRDs; Kyverno uses Kubernetes-native ClusterPolicy resources. OpenShift SecurityContextConstraints serve as a built-in admission control mechanism.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Privileges Required (PR) | N → L | Unauthorized workloads cannot be deployed without policy exemption; admission controller rejects API requests that violate security constraints before the workload is persisted |
| Attack Complexity (AC) | L → H | Attacker must bypass the policy engine to deploy a malicious or privileged workload; simply having API access is insufficient without a policy-compliant manifest |
CWE Relationships
Verification
Verify admission controller is deployed and enforcing policies
$ kubectl get constraint --no-headers 2>/dev/null | wc -l
# Expected: One or more constraints active (OPA/Gatekeeper)
# Expected: One or more constraints active (OPA/Gatekeeper)
Platform: kubernetes
$ kubectl get clusterpolicy --no-headers 2>/dev/null | wc -l
# Expected: One or more cluster policies active (Kyverno)
# Expected: One or more cluster policies active (Kyverno)
Platform: kubernetes
$ oc get scc --no-headers | wc -l
# Expected: SecurityContextConstraints present (OpenShift built-in admission)
# Expected: SecurityContextConstraints present (OpenShift built-in admission)
Platform: kubernetes