# 容器安全排查规则
# 来源: 容器安全排查指导.xlsx

rules:
  # === 容器权限安全 ===

  - id: sec-container-no-privileged
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#1"
    message: "禁止以特权模式运行容器 (privileged: true)"
    pattern: "privileged\\s*[:=]\\s*true"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
    excludes:
      - "**/*.test.*"

  - id: sec-container-no-docker-sock
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#1"
    message: "禁止挂载宿主机的/var/run/docker.sock"
    pattern: "/var/run/docker\\.sock"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
    excludes:
      - "**/*.test.*"

  - id: sec-container-no-root-user
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#1"
    message: "容器内应用程序不应以root用户运行"
    pattern: "(?:user\\s*[:=]\\s*(?:0|root)|RUN\\s+useradd|USER\\s+root)"
    match_mode: absent
    includes:
      - "**/Dockerfile"
      - "**/*.yaml"
      - "**/*.yml"
    excludes:
      - "**/*.test.*"

  # === 敏感信息保护 ===

  - id: sec-container-no-plaintext-aksk
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#2"
    message: "禁止在容器内明文保存AK/SK等敏感信息"
    pattern: "(?:AK|SK|accessKey|secretKey|apiKey)\\s*[:=]\\s*['\"][A-Za-z0-9+/=]{16,}['\"]"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
      - "**/*.json"
      - "**/*.env"
    excludes:
      - "**/*.test.*"
      - "**/secrets/**"

  # === 服务安全配置 ===

  - id: sec-container-docker-api-auth
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#4"
    message: "Docker Remote API不应绑定到0.0.0.0，应启用HTTPS认证"
    pattern: "-H\\s+tcp://0\\.0\\.0\\.0:2375"
    match_mode: absent
    includes:
      - "**/*.service"
      - "**/daemon.json"
      - "**/*.yaml"
    excludes:
      - "**/*.test.*"

  - id: sec-container-etcd-auth
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#5"
    message: "ETCD数据库应开启认证访问"
    pattern: "(?:--listen-client-urls|listenClientUrls)\\s*=\\s*['\"]http://"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
      - "**/*.sh"
    excludes:
      - "**/*.test.*"

  - id: sec-container-kubelet-auth
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#6"
    message: "kubelet应开启认证访问，禁止未认证访问"
    pattern: "--authorization-mode\\s*=\\s*AlwaysAllow"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
      - "**/kubelet.conf"
    excludes:
      - "**/*.test.*"

  # === 网络安全 ===

  - id: sec-container-network-isolation
    type: regex-check
    blocking: false
    severity: warning
    scope: full-only
    source: "容器安全排查指导#8"
    message: "容器和宿主机之间应进行网络隔离 (需人工确认)"
    pattern: "(?!)"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
    excludes: []

  - id: sec-container-no-metadata-access
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#10"
    message: "禁止容器访问openstack metadata api (169.254.169.254)"
    pattern: "169\\.254\\.169\\.254"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
      - "**/*.js"
      - "**/*.ts"
    excludes:
      - "**/*.test.*"

  # === 存储安全 ===

  - id: sec-container-no-hostpath
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#11"
    message: "谨慎使用hostPath挂载宿主机目录，可能导致容器间文件共享问题"
    pattern: "hostPath"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
    excludes:
      - "**/*.test.*"

  # === RBAC安全 ===

  - id: sec-container-rbac-enabled
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#7"
    message: "K8S集群应开启RBAC认证，禁止使用AlwaysAllow"
    pattern: "--authorization-mode\\s*=\\s*AlwaysAllow"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
    excludes:
      - "**/*.test.*"

  - id: sec-container-serviceaccount-token
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "容器安全排查指导#7"
    message: "默认ServiceAccount应关闭automountServiceAccountToken"
    pattern: "automountServiceAccountToken\\s*[:=]\\s*true"
    match_mode: absent
    includes:
      - "**/*.yaml"
      - "**/*.yml"
    excludes:
      - "**/*.test.*"