CME-711

Admission Controller Policy Enforcement (OPA/Gatekeeper/Kyverno)

Harden Application Unquantified evidence Preventive

Description

Policy-as-code enforcement at the Kubernetes admission gate. Admission controllers intercept API requests before persistence and reject workloads that violate security policies: no privileged containers, no host namespace sharing, required labels/annotations, image registry allowlists. Provides defense-in-depth on top of Pod Security Standards (CME-706) with custom policy granularity. OPA/Gatekeeper uses Rego policies via ConstraintTemplate CRDs; Kyverno uses Kubernetes-native ClusterPolicy resources. OpenShift SecurityContextConstraints serve as a built-in admission control mechanism.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Attacker must bypass the policy engine to deploy a malicious or privileged workload; simply having API access is insufficient without a policy-compliant manifest — the attacker must find a policy gap, exempt namespace, or webhook bypass

CWE Relationships

CWE-269 CWE-284 CWE-250

Verification

Verify admission controller is deployed and enforcing policies

$ kubectl get constraint --no-headers 2>/dev/null | wc -l
# Expected: >=1

Platform: kubernetes

$ kubectl get clusterpolicy --no-headers 2>/dev/null | wc -l
# Expected: >=1

Platform: kubernetes

$ oc get scc --no-headers 2>/dev/null | wc -l
# Expected: >=1

Platform: kubernetes

$ kubectl get constraint -o jsonpath='{range .items[*]}{.spec.enforcementAction}{"\n"}{end}' 2>/dev/null | grep -c -i 'deny'
# Expected: >=1

Platform: kubernetes

$ kubectl run cme-test --image=busybox --restart=Never --dry-run=server --overrides='{"spec":{"containers":[{"name":"test","image":"busybox","securityContext":{"privileged":true}}]}}' 2>&1 | grep -c -i 'denied\|forbidden\|violated'
# Expected: >=1

Platform: kubernetes

Remediation

kubernetes Kyverno ClusterPolicy blocking privileged containers


kubectl apply -f https://github.com/kyverno/kyverno/releases/download/<version>/install.yaml
kubectl wait --for=condition=Ready pods -l app.kubernetes.io/part-of=kyverno -n kyverno --timeout=120s
kubectl apply -f - <<'EOF'
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged-containers
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: deny-privileged
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Privileged containers are not allowed."
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: "!true"
EOF

kubernetes OpenShift SecurityContextConstraints enforcement (restricted-v2)


oc get scc restricted-v2 -o name
oc adm policy remove-scc-from-user anyuid system:serviceaccount:<namespace>:<serviceaccount>
oc adm policy remove-scc-from-user privileged system:serviceaccount:<namespace>:<serviceaccount>