Minimize Admission Root Containers

kubectl get ns
kubectl get podsecuritypolicies.policy

kubectl get podsecuritypolicies.policy -o yaml

spec:
  runAsUser:
    rule: RunAsAny

spec:
  runAsUser:
    rule: MustRunAs
    ranges:
      - min: 0
        max: 0

spec:
  runAsUser:
    rule: MustRunAsNonRoot

spec:
  runAsUser:
    rule: MustRunAs
    ranges:
      - min: 10000
        max: 20000   # example non-root range, must not include 0

kubectl get serviceaccounts --all-namespaces
kubectl get clusterrolebindings.rbac.authorization.k8s.io
kubectl get rolebindings.rbac.authorization.k8s.io --all-namespaces

kubectl get clusterrole -o yaml | grep -A5 "podsecuritypolicies.policy"
kubectl get role -A -o yaml | grep -A5 "podsecuritypolicies.policy"

kubectl get pods --all-namespaces -o yaml | \
  grep -E "runAsUser:|runAsNonRoot:" -n

kubectl get podsecuritypolicies.policy -o yaml

#!/usr/bin/env bash
# Run on: any machine with kubectl access and current context set to the target cluster
# Purpose: Report namespaces and workloads that can admit root containers (no enforced non-root policy)

set -euo pipefail

echo "=== Cluster-wide admission/root-container posture report ==="
echo "Context: $(kubectl config current-context)"
echo

############################################
# 1) PodSecurity (built-in admission) NS labels
############################################
echo "== 1) Namespaces and PodSecurity labels (privileged/baseline/restricted) =="
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range $k,$v := .metadata.labels}{$k}={"$v"}{";"}{end}{"\n"}{end}' \
  | column -t
echo
cat <<'EOF'
INTERPRETATION (PodSecurity):
- Namespaces WITHOUT any pod-security.kubernetes.io/* labels:
    -> PROBLEM: No PodSecurity standard level is enforced; pods may run as root unless restricted elsewhere.
- Namespaces labeled with:
    pod-security.kubernetes.io/enforce: privileged
    -> PROBLEM: Effectively no PodSecurity restrictions; root containers are allowed.
- Namespaces labeled with:
    pod-security.kubernetes.io/enforce: baseline
    -> REVIEW: Baseline allows many images that default to root; you must rely on other policies (PSP, PSP-equivalent, or admission).
- Namespaces labeled with:
    pod-security.kubernetes.io/enforce: restricted
    -> BETTER: Restricted profile *tends* to require non-root, but still review workload-level settings below.
EOF
echo

############################################
# 2) PodSecurityPolicy (if present)
############################################
echo "== 2) PodSecurityPolicies and runAsUser rules =="
if kubectl get psp >/dev/null 2>&1; then
  kubectl get psp -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.runAsUser.rule}{"\t"}{.spec.runAsUser.ranges}{"\n"}{end}' \
    | column -t
else
  echo "No PodSecurityPolicy resources detected (PSP likely disabled or removed)."
fi
echo
cat <<'EOF'
INTERPRETATION (PSP):
- PSP with spec.runAsUser.rule = RunAsAny:
    -> PROBLEM: Does not prevent root containers.
- PSP with spec.runAsUser.rule = MustRunAsNonRoot:
    -> GOOD: Prevents root UID 0 from being used.
- PSP with spec.runAsUser.rule = MustRunAs with ranges that include 0:
    -> PROBLEM: Explicitly allows UID 0.
- PSP with spec.runAsUser.rule = MustRunAs with ranges that EXCLUDE 0:
    -> GOOD: Only non-root UIDs are allowed.
NOTE: You must also check which PSPs are bound via RBAC to which subjects/namespaces.
EOF
echo

############################################
# 3) Workload-level securityContext that may allow / force root
############################################
echo "== 3) Workloads with securityContext that may allow or force root (per namespace) =="

NAMESPACES=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{" "}{end}')

for ns in $NAMESPACES; do
  echo "--- Namespace: ${ns} ---"

  # Pods owned by controllers (for effective spec review)
  kubectl get pods -n "$ns" -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.securityContext.runAsUser}{"\t"}{.spec.securityContext.runAsNonRoot}{"\t"}{range .spec.containers[*]}{.name}{"="}{.securityContext.runAsUser}","{.securityContext.runAsNonRoot}{";"}{end}{"\n"}{end}' \
    2>/dev/null | sed '1iPOD\tPOD.runAsUser\tPOD.runAsNonRoot\tCONTAINER(name=runAsUser,runAsNonRoot)' | column -t

  echo
done

cat <<'EOF'
INTERPRETATION (Workloads):
For each namespace row:
- If POD or CONTAINER runAsUser is 0:
    -> PROBLEM: Explicitly configured to run as root.
- If runAsUser is empty AND runAsNonRoot is empty:
    -> RISK: UID defaults to image/user; often root (0) if image not hardened.
- If runAsNonRoot is true (pod or container) and runAsUser is NOT 0:
    -> BETTER: Admission should reject containers running as root.
NOTE: This only shows spec hints. Actual admission behavior depends on PodSecurity, PSP, and any external admission controllers.
EOF
echo

############################################
# 4) Quick summary of potential problem namespaces
############################################
echo "== 4) Summary: Namespaces likely to admit root containers (heuristic) =="

echo "Namespaces with NO PodSecurity labels:"
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{" "}{range $k,$v := .metadata.labels}{$k}{"="}{$v}{" "}{end}{"\n"}{end}' \
  | awk '!/pod-security.kubernetes.io\/enforce=|pod-security.kubernetes.io\/audit=|pod-security.kubernetes.io\/warn=/' \
  | awk '{print $1}' | sort -u

echo
echo "Namespaces explicitly labeled as privileged:"
kubectl get ns -l 'pod-security.kubernetes.io/enforce=privileged' --no-headers -o custom-columns='NAMESPACE:.metadata.name' || true

echo
echo "Namespaces with pods explicitly setting runAsUser: 0 (root):"
for ns in $NAMESPACES; do
  if kubectl get pods -n "$ns" >/dev/null 2>&1; then
    ROOTPODS=$(kubectl get pods -n "$ns" -o json | \
      jq -r '.items[]
        | select(
            (.spec.securityContext.runAsUser == 0)
            or ([(.spec.containers[]?.securityContext.runAsUser)] | any(.==0))
          )
        | .metadata.name' 2>/dev/null || true)
    if [ -n "$ROOTPODS" ]; then
      echo "Namespace: $ns"
      echo "$ROOTPODS" | sed 's/^/  pod: /'
    fi
  fi
done

cat <<'EOF'

HOW TO USE THIS REPORT:
- Any namespace listed above, or with:
    * pod-security.kubernetes.io/enforce=privileged, OR
    * workloads explicitly setting runAsUser: 0,
  indicates a PROBLEM for this control and requires manual review and policy tightening.
- This script does NOT change the cluster; it only surfaces where root containers are allowed or used so you can make informed decisions.
EOF