← Policy catalog
</> ValidatingAdmissionPolicy · Apache-2.0

Permits Egress to Any Destination (Calico)

globalnetworkpolicy-calico-egress-cidr

severityModerate resourceGlobalNetworkPolicies productCalico bundles1

A cluster-wide Allow to 0.0.0.0/0 or ::/0 gives every selected endpoint unrestricted outbound reach, the channel a compromised workload uses to contact command-and-control hosts, pull further tooling and exfiltrate data.

Rejects unless

!object.spec.?egress.orValue([]).exists(r,
  r.?action.orValue('') == 'Allow' &&
  r.?destination.nets.orValue([]).exists(n, n == '0.0.0.0/0' || n == '::/0')
)

Calico GlobalNetworkPolicies must not Allow egress to 0.0.0.0/0 or ::/0.

Remediation

Replace 0.0.0.0/0 and ::/0 in Allow egress rules with the specific destination CIDRs the selected endpoints actually need. Field: spec.egress[*].destination.nets.

Applies to

  • globalnetworkpolicies · crd.projectcalico.org/v1 · CREATE, UPDATE

Manifest

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: globalnetworkpolicy-calico-egress-cidr
  annotations:
    kubeapt.io/uuid: "7d2d7bb3-7250-4b09-9799-2b84f3d68f22"
    security.kubeapt.io/displayName: "Permits Egress to Any Destination (Calico)"
    security.kubeapt.io/description: "A cluster-wide Allow to 0.0.0.0/0 or ::/0 gives every selected endpoint unrestricted outbound reach, the channel a compromised workload uses to contact command-and-control hosts, pull further tooling and exfiltrate data."
    security.kubeapt.io/resource: "GlobalNetworkPolicies"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Replace 0.0.0.0/0 and ::/0 in Allow egress rules with the specific destination CIDRs the selected endpoints actually need. Field: spec.egress[*].destination.nets."
    security.kubeapt.io/product: "Calico"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - crd.projectcalico.org
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - globalnetworkpolicies
  validations:
  - expression: |
      !object.spec.?egress.orValue([]).exists(r,
        r.?action.orValue('') == 'Allow' &&
        r.?destination.nets.orValue([]).exists(n, n == '0.0.0.0/0' || n == '::/0')
      )
    message: |
      Calico GlobalNetworkPolicies must not Allow egress to 0.0.0.0/0 or ::/0.

Save it as globalnetworkpolicy-calico-egress-cidr.yaml — the commands below assume that name.

Validate with kubeapt

Check a workload against this one policy, before anything is installed on a cluster.

$ kubeapt validate -p ./globalnetworkpolicy-calico-egress-cidr.yaml -r ./workload.yaml

Or without the file, from the published policy set — -r takes a directory too:

$ kubeapt policies download && kubeapt validate --policy-name globalnetworkpolicy-calico-egress-cidr -r ./manifests

Or against every namespace in the cluster your kubeconfig points at:

$ kubeapt validate --policy-name globalnetworkpolicy-calico-egress-cidr -A

Bundles

Source

View policy.yaml on GitHub →