Minimize The Admission Privileged Containers

# 1) List all namespaces
# Run on: any machine with kubectl access
kubectl get namespaces

# 2) Find pods that request privileged containers (current state)
# Run on: any machine with kubectl access
kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{" ")
{.metadata.name}{"\t"}{range .spec.containers[*]}{.name}{"="}
{.securityContext.privileged}{"; "}{end}{"\n"}{end}' | grep "=true"

# 3) Inspect full pod spec for a specific result from step 2
# Replace <namespace> and <pod-name> from the previous output
kubectl get pod <pod-name> -n <namespace> -o yaml

# 4) Find workloads that can create privileged containers via templates
# (Deployments, StatefulSets, DaemonSets, ReplicaSets, Jobs, CronJobs)
kubectl get deploy,sts,ds,rs,job,cronjob --all-namespaces -o json | \
  jq -r '
    .items[] |
    .kind as $k |
    .metadata.namespace as $ns |
    .metadata.name as $n |
    ((.spec.template.spec.containers // []) + (.spec.template.spec.initContainers // []))[]? |
    select(.securityContext.privileged == true) |
    "\($k)\t\($ns)\t\($n)\t" + (.name + "=privileged=true")
  '

# 5) Check for default PodSecurity admission behavior that might allow privileged pods
# (GKE uses PodSecurity Admission by default in recent versions)
kubectl get ns -o json | \
  jq -r '
    .items[] |
    .metadata.name as $ns |
    (.metadata.labels["pod-security.kubernetes.io/enforce"] // "none") as $enforce |
    (.metadata.labels["pod-security.kubernetes.io/audit"] // "none") as $audit |
    (.metadata.labels["pod-security.kubernetes.io/warn"] // "none") as $warn |
    "\($ns)\tenforce=\($enforce)\taudit=\($audit)\twarn=\($warn)"
  '

# 6) (If PSPs are still enabled in your cluster) list any PodSecurityPolicies
kubectl get podsecuritypolicies.policy -o yaml

#!/usr/bin/env bash
# Run on: any machine with kubectl access
# Purpose: Report where privileged pods/containers are allowed or in use

set -euo pipefail

echo "== 1. Namespaces with any privileged pods (current workload state) =="
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers + ($pod.spec.initContainers // []))[]
    | select(.securityContext.privileged == true)
    | "\($pod.metadata.namespace)\t\($pod.metadata.name)\t\(.name)\tPRIVILEGED=true"
  ' 2>/dev/null | sort || echo "jq not installed or no privileged containers found."

echo
echo "Explanation: Any line here shows a running pod with at least one container running privileged."
echo "These should be reviewed; most workloads should not appear here."

echo
echo "== 2. Pods whose spec *requests* privileged containers (even if not running now) =="
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers + ($pod.spec.initContainers // []))[]
    | select(.securityContext.privileged == true)
    | "\($pod.metadata.namespace)\t\($pod.metadata.name)\t\(.name)\tPRIVILEGED_REQUESTED=true"
  ' 2>/dev/null | sort || echo "jq not installed or no pods request privileged containers."

echo
echo "Explanation: Any line indicates a pod spec that explicitly sets securityContext.privileged: true."
echo "These are candidates for redesign or exception documentation."

echo
echo "== 3. Namespaces that allow privileged pods via PodSecurity admission labels (v1.25+) =="
kubectl get ns --show-labels | awk '
  NR==1 { print; next }
  /pod-security.kubernetes.io/ { print }
'

echo
echo "Explanation:"
echo "- For clusters using Pod Security Admission, look at labels:"
echo "    pod-security.kubernetes.io/enforce"
echo "    pod-security.kubernetes.io/audit"
echo "    pod-security.kubernetes.io/warn"
echo "- Namespaces labeled with \"privileged\" or a custom policy that permits privileged containers"
echo "  effectively allow privileged workloads. Those namespaces should be explicitly justified."

echo
echo "== 4. (If present) PodSecurityPolicy objects that allow privileged containers =="
if kubectl api-resources 2>/dev/null | grep -q "^podsecuritypolicies"; then
  kubectl get podsecuritypolicies.policy -o json \
    | jq -r '
      .items[]
      | select(.spec.privileged == true)
      | "\(.metadata.name)\tPRIVILEGED_ALLOWED=true"
    ' 2>/dev/null | sort || echo "jq not installed or no PSPs allow privileged=true."
else
  echo "PodSecurityPolicy API not present in this cluster (likely removed in v1.25+)."
fi

echo
echo "Explanation: Any PSP listed here has spec.privileged: true and allows privileged pods."
echo "Review which namespaces/service accounts can use these PSPs (RBAC bindings) and justify or tighten."

echo
echo "== How to interpret problematic output =="
echo "- Any non-empty output in sections 1 or 2 indicates pods/containers explicitly running or requesting"
echo "  privileged=true. Each should be reviewed; only tightly controlled infrastructure components"
echo "  should need this."
echo "- Namespaces in section 3 with pod-security.* labels set to \"privileged\" (or equivalent) allow"
echo "  privileged workloads; they should be minimized and well-documented."
echo "- Any PSP listed in section 4 indicates a cluster-wide policy object that permits privileged pods."
echo "  Its usage and scope should be carefully reviewed."