Add namespace check for workload connection in gateway rules

kubescape · Jan 14, 2025 · 31c1dfb · 31c1dfb
1 parent 35e6dae
commit 31c1dfb
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 0 deletions.
diff --git a/rules/exposure-to-internet-via-gateway-api/raw.rego b/rules/exposure-to-internet-via-gateway-api/raw.rego
@@ -56,6 +56,11 @@ is_exposed_service(svc) {
     svc.spec.type == "LoadBalancer"
 }
 
+
+wl_connected_to_service(wl, svc) {
+    wl.metadata.namespace == svc.metadata.namespace
+}
+
 wl_connected_to_service(wl, svc) {
     count({x | svc.spec.selector[x] == wl.metadata.labels[x]}) == count(svc.spec.selector)
 }

diff --git a/rules/exposure-to-internet-via-istio-ingress/raw.rego b/rules/exposure-to-internet-via-istio-ingress/raw.rego
@@ -141,6 +141,11 @@ is_exposed_service(svc) {
     svc.spec.type == "LoadBalancer"
 }
 
+
+wl_connected_to_service(wl, svc) {
+    wl.metadata.namespace == svc.metadata.namespace
+}
+
 wl_connected_to_service(wl, svc) {
     count({x | svc.spec.selector[x] == wl.metadata.labels[x]}) == count(svc.spec.selector)
 }

diff --git a/rules/unauthenticated-service/raw.rego b/rules/unauthenticated-service/raw.rego
@@ -34,6 +34,11 @@ has_unauthenticated_service(service_name, namespace, service_scan_result) if {
 	service_scan_result.spec.ports[_].authenticated == false
 }
 
+
+wl_connected_to_service(wl, svc) {
+    wl.metadata.namespace == svc.metadata.namespace
+}
+
 wl_connected_to_service(wl, svc) if {
 	count({x | svc.spec.selector[x] == wl.metadata.labels[x]}) == count(svc.spec.selector)
 }