← Policy catalog
</> ValidatingAdmissionPolicy · Apache-2.0

Runs an Image Not Pinned to a Digest

ephemeralcontainer-image-digest

severityModerate resourceEphemeralContainers productKubernetes bundles1

An image reference without a digest resolves through a mutable tag, so registry content can be replaced between pulls and an ephemeral debug container attached with kubectl debug runs attacker-supplied code inside a live pod.

Rejects unless

!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(ec,
  ec.image.matches(".*@sha256:[0-9A-Fa-f]{64}")
)

spec.ephemeralContainers[*].image must be pinned by an immutable @sha256 digest.

Remediation

Replace the mutable tag with an immutable digest reference of the form registry/image@sha256:<64-hex-digest>. Field: spec.ephemeralContainers[*].image.

Applies to

  • pods/ephemeralcontainers · v1 · CREATE, UPDATE

Manifest

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: ephemeralcontainer-image-digest
  annotations:
    kubeapt.io/uuid: "416403a0-7869-4716-8011-97d7f49b1a71"
    security.kubeapt.io/displayName: "Runs an Image Not Pinned to a Digest"
    security.kubeapt.io/description: "An image reference without a digest resolves through a mutable tag, so registry content can be replaced between pulls and an ephemeral debug container attached with kubectl debug runs attacker-supplied code inside a live pod."
    security.kubeapt.io/resource: "EphemeralContainers"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Replace the mutable tag with an immutable digest reference of the form registry/image@sha256:<64-hex-digest>. Field: spec.ephemeralContainers[*].image."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods/ephemeralcontainers
  validations:
  - expression: |
      !has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(ec,
        ec.image.matches(".*@sha256:[0-9A-Fa-f]{64}")
      )
    message: |
      spec.ephemeralContainers[*].image must be pinned by an immutable @sha256 digest.

Save it as ephemeralcontainer-image-digest.yaml — the commands below assume that name.

Validate with kubeapt

Check a workload against this one policy, before anything is installed on a cluster.

$ kubeapt validate -p ./ephemeralcontainer-image-digest.yaml -r ./workload.yaml

Or without the file, from the published policy set — -r takes a directory too:

$ kubeapt policies download && kubeapt validate --policy-name ephemeralcontainer-image-digest -r ./manifests

Or against every namespace in the cluster your kubeconfig points at:

$ kubeapt validate --policy-name ephemeralcontainer-image-digest -A

Bundles

Source

View policy.yaml on GitHub →