Containers Should Drop All Linux Capabilities

#!/usr/bin/env bash
#
# Enforce: all containers drop ALL Linux capabilities (CBP C1.5)
# Scope: EKS – Kubernetes API objects via kubectl
# Requirements: kubectl, jq installed; current context points to target cluster.

set -euo pipefail

# Temporary workspace
WORKDIR="$(mktemp -d)"
trap 'rm -rf "$WORKDIR"' EXIT

echo "Discovering non-compliant Pods..."
# Capture non-compliant pod JSON (excluding control-plane/system namespaces per check)
kubectl get pods --all-namespaces -o json > "${WORKDIR}/all-pods.json"

# Function: list non-compliant pod namespaced-names
list_non_compliant() {
  jq -r '
    .items[]
    | select(.metadata.namespace as $n
             | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
    | .metadata as $m
    | ((.spec.containers // []) + (.spec.initContainers // [])) as $cs
    | select(
        any($cs[];
          .securityContext.capabilities.drop as $drop
          | (($drop | index("ALL")) or ($drop | index("all"))) | not
        )
      )
    | "\($m.namespace) \($m.name)"
  ' "${WORKDIR}/all-pods.json" | sort -u
}

NON_COMPLIANT_LIST="$(list_non_compliant || true)"

if [ -z "$NON_COMPLIANT_LIST" ]; then
  echo "No non-compliant Pods found. Cluster is already compliant."
  exit 0
fi

echo "Found non-compliant Pods:"
echo "$NON_COMPLIANT_LIST"

# Helper: ensure securityContext.capabilities.drop contains "ALL"
patch_pod_json='
  # For each container-like list (containers, initContainers):
  def ensure_drop_all:
    if . == null then
      [] # no containers
    else
      map(
        . as $c
        | ($c.securityContext // {}) as $sc
        | ($sc.capabilities // {}) as $cap
        | ($cap.drop // []) as $drop
        | $c
        | .securityContext = $sc
        | .securityContext.capabilities = $cap
        | .securityContext.capabilities.drop =
            (if ( ($drop | index("ALL")) or ($drop | index("all")) )
             then $drop
             else ($drop + ["ALL"] | unique)
             end)
      )
    end;

  . as $pod
  | $pod
  | .spec.containers = (.spec.containers | ensure_drop_all)
  | .spec.initContainers = (.spec.initContainers | ensure_drop_all)
'

echo
echo "Patching non-compliant Pods by updating their Pod specs."
echo "NOTE: If Pods are controlled by Deployments/ReplicaSets/DaemonSets/etc.,"
echo "      you MUST update the controller manifests instead; otherwise this"
echo "      change will be overwritten on reschedule."

# Attempt to patch each non-compliant Pod (best-effort).
# This is idempotent: reruns will keep drop=["ALL", ...] unchanged.
while read -r ns name; do
  [ -z "$ns" ] && continue
  echo "Processing Pod ${ns}/${name}..."

  kubectl get pod "${name}" -n "${ns}" -o json > "${WORKDIR}/${ns}-${name}.orig.json" || {
    echo "  Skipping ${ns}/${name}: unable to fetch (may have been deleted)."
    continue
  }

  jq "$patch_pod_json" "${WORKDIR}/${ns}-${name}.orig.json" > "${WORKDIR}/${ns}-${name}.patched.json"

  # Use server-side apply via "kubectl replace" (patching full Pod object)
  # This will restart the Pod.
  kubectl replace -n "${ns}" -f "${WORKDIR}/${ns}-${name}.patched.json" >/dev/null || {
    echo "  WARNING: Failed to replace Pod ${ns}/${name}. It may be controlled by a higher-level resource."
    echo "           Update the owning controller (Deployment/DaemonSet/StatefulSet/Job, etc.) manifest instead."
    continue
  }

  echo "  Patched ${ns}/${name}."
done <<< "$NON_COMPLIANT_LIST"

echo
echo "Re-running compliance check for verification..."

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | ((.spec.containers // []) + (.spec.initContainers // []))[]
  | (.securityContext.capabilities.drop // []) as $drop
  | (($drop | index("ALL")) or ($drop | index("all"))) as $ok
  | select($ok | not)
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else "is_compliant=false" end
' > "${WORKDIR}/compliance-status.txt"

cat "${WORKDIR}/compliance-status.txt"

STATUS="$(cat "${WORKDIR}/compliance-status.txt")"
if [ "$STATUS" != "is_compliant=true" ]; then
  echo
  echo "Some workloads remain non-compliant."
  echo "They are most likely managed by higher-level controllers."
  echo "Identify them with:"
  echo
  echo '  kubectl get pods --all-namespaces -o json | jq -r '\'''
  echo '    [ .items[]'
  echo '    | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)'
  echo '    | .metadata as $m'
  echo '    | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own'
  echo '    | ((.spec.containers // []) + (.spec.initContainers // []))[]'
  echo '    | (.securityContext.capabilities.drop // []) as $drop'
  echo '    | (($drop | index("ALL")) or ($drop | index("all"))) as $ok'
  echo '    | select($ok | not)'
  echo '    | "ns=\($m.namespace) pod=\($m.name) owner=\($own.kind)/\($m.namespace)/\($own.name)"'
  echo '    ][]'\'''
  echo
  echo "Then modify the corresponding Deployment/DaemonSet/StatefulSet/Job manifests"
  echo "to include securityContext.capabilities.drop: [\"ALL\"] for each container."
  exit 1
fi

echo "Cluster now compliant for this control."