appvia / psp-migration

Recreation of common Pod Security Policy configuration in other common Kubernetes policy engines
https://appvia.github.io/psp-migration
MIT License
51 stars 4 forks source link

[Bug]: convertion not wroked for kyverno #316

Open antonchernyaev opened 10 months ago

antonchernyaev commented 10 months ago

What happened?

psp is

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
spec:
  allowPrivilegeEscalation: false
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes:
  - configMap
  - emptyDir
  - projected
  - secret
  - downwardAPI
  - persistentVolumeClaim

What policy engine were you generating policy for

No response

Relevant log output

cat vault-injector.yaml | ~/psp-migration-linux-x64 -e kyverno
/snapshot/psp-migration/dist/kyverno.js:234
        let securityContext = { securityContext: { runAsUser: `>=${PSP.spec.runAsUser.ranges[0].min} & <=${PSP.spec.runAsUser.ranges[0].max}` } };
                                                                                            ^

TypeError: Cannot read properties of undefined (reading '0')
    at transform_kyverno (/snapshot/psp-migration/dist/kyverno.js:234:93)
    at transform (/snapshot/psp-migration/dist/index.js:41:48)
    at Object.<anonymous> (/snapshot/psp-migration/dist/run.js:45:43)
    at Module._compile (pkg/prelude/bootstrap.js:1930:22)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1159:10)
    at Module.load (node:internal/modules/cjs/loader:981:32)
    at Function.Module._load (node:internal/modules/cjs/loader:822:12)
    at Function.runMain (pkg/prelude/bootstrap.js:1983:12)
    at node:internal/main/run_main_module:17:47
antonchernyaev commented 10 months ago

also if i add range i not see into kyverno policies run as not root - for example it's should looks like in doc example https://kyverno.io/policies/pod-security/restricted/require-run-as-nonroot/require-run-as-nonroot/

antonchernyaev commented 10 months ago

also need to change Unsupported value: "Enforce": supported values: "audit", "enforce"