Ensure The Cluster Has At Least One Active Policy Control Mechanism

# 1) List all namespaces and their PSA labels (if any)
# Run on: any machine with kubectl access
kubectl get ns -o custom-columns=NAME:.metadata.name, \
POD-SECURITY-ENFORCE:.metadata.labels.pod-security\.kubernetes\.io/enforce, \
POD-SECURITY-AUDIT:.metadata.labels.pod-security\.kubernetes\.io/audit, \
POD-SECURITY-WARN:.metadata.labels.pod-security\.kubernetes\.io/warn

# 2) Show full labels for specific namespaces that run user workloads
# Replace <namespace> with the actual namespace name
kubectl get ns <namespace> -o yaml

# 3) Check for known external policy engines (by common labels/CRDs)
# OPA Gatekeeper
kubectl get pods -A -l app=gatekeeper
kubectl get constrainttemplates.constraint.gatekeeper.sh 2>/dev/null
kubectl get constraints --all-namespaces 2>/dev/null

# Kyverno
kubectl get pods -A -l app.kubernetes.io/name=kyverno
kubectl get clusterpolicy,policy -A 2>/dev/null

# 4) List namespaces that have NO Pod Security Admission labels at all
kubectl get ns -o json | jq -r '
  .items[]
  | select(.metadata.labels["pod-security.kubernetes.io/enforce"] == null
           and .metadata.labels["pod-security.kubernetes.io/audit"] == null
           and .metadata.labels["pod-security.kubernetes.io/warn"] == null)
  | .metadata.name
'

#!/usr/bin/env bash
set -euo pipefail

# This script must run on any machine with kubectl access and a kubeconfig
# that can list namespaces and pods cluster‑wide.

# Namespaces to ignore (system/control-plane)
IGNORED_NS_REGEX='^(kube-system|kube-public|kube-node-lease|kube-storage-version-migrator|kube-*|tigera-operator|calico-system|cilium-system|gatekeeper-system|opa|istio-system|linkerd|velero|cert-manager)$'

echo "=== Detecting namespaces with user workloads and checking policy controls ==="
echo

# 1. List namespaces that have at least one non-terminated pod (user workloads candidates)
echo "# Namespaces with running/non-terminated pods (candidate user-workload namespaces):"
kubectl get pods --all-namespaces --field-selector=status.phase!=Succeeded,status.phase!=Failed -o custom-columns='NAMESPACE:.metadata.namespace' --no-headers \
  | sort -u \
  | grep -Ev "$IGNORED_NS_REGEX" || true
echo

# 2. Show pod-security admission labels on those namespaces
echo "# Pod Security Admission labels on user-workload namespaces:"
echo "# (psa labels: pod-security.kubernetes.io/enforce, warn, audit + version)"
kubectl get ns \
  -o custom-columns='NAMESPACE:.metadata.name,ENFORCE:metadata.labels.pod-security\.kubernetes\.io/enforce,ENFORCE_VER:metadata.labels.pod-security\.kubernetes\.io/enforce-version,WARN:metadata.labels.pod-security\.kubernetes\.io/warn,WARN_VER:metadata.labels.pod-security\.kubernetes\.io/warn-version,AUDIT:metadata.labels.pod-security\.kubernetes\.io/audit,AUDIT_VER:metadata.labels.pod-security\.kubernetes\.io/audit-version' \
  --no-headers \
  | grep -Ev "$IGNORED_NS_REGEX" \
  | sort
echo

# 3. Highlight user-workload namespaces that appear to lack a PSA enforce level
echo "# POSSIBLE PROBLEM: user-workload namespaces with no Pod Security 'enforce' label:"
echo "# (These namespaces have running/non-terminated pods but no enforce label set)"
user_ns_with_pods=$(
  kubectl get pods --all-namespaces --field-selector=status.phase!=Succeeded,status.phase!=Failed \
    -o custom-columns='NAMESPACE:.metadata.namespace' --no-headers \
    | sort -u \
    | grep -Ev "$IGNORED_NS_REGEX" || true
)

if [ -n "$user_ns_with_pods" ]; then
  # Join list into grep pattern
  pattern=$(printf '%s\n' "$user_ns_with_pods" | paste -sd'|' -)

  kubectl get ns \
    -o custom-columns='NAMESPACE:.metadata.name,ENFORCE:metadata.labels.pod-security\.kubernetes\.io/enforce' \
    --no-headers \
    | grep -E "$pattern" \
    | awk '$2=="" {print $1}' \
    | sort -u || true
else
  echo "# None (no user-workload namespaces with running pods found)."
fi
echo

# 4. OPTIONAL: Look for common external policy engines (Gatekeeper, Kyverno, OPA) by label/namespace
echo "# Detected external policy engine components (best-effort heuristics):"
echo "## Gatekeeper:"
kubectl get pods -A -l gatekeeper.sh/system=yes 2>/dev/null || echo "  (none detected)"
echo
echo "## Kyverno:"
kubectl get pods -A -l app=kyverno 2>/dev/null || echo "  (none detected)"
echo
echo "## OPA (gatekeeper-system or opa-related namespaces):"
kubectl get pods -A -n gatekeeper-system 2>/dev/null || echo "  (no gatekeeper-system namespace)"
kubectl get ns | grep -Ei 'opa|policy' || true
echo

cat <<'EOF'
INTERPRETING OUTPUT (what indicates a problem):

1. Candidate user-workload namespaces:
   - Any namespace listed under:
       "# Namespaces with running/non-terminated pods (candidate user-workload namespaces):"
     is considered to host user workloads (and so SHOULD have a policy control mechanism).

2. Pod Security Admission labels:
   - For these namespaces, check the line under:
       "# Pod Security Admission labels on user-workload namespaces:"
   - If ENFORCE (and ideally ENFORCE_VER) is empty for a user-workload namespace,
     that namespace does NOT have Pod Security Admission enforcement configured.

3. Problem indicator:
   - The section:
       "# POSSIBLE PROBLEM: user-workload namespaces with no Pod Security 'enforce' label:"
     lists namespaces that:
       * Have running/non-terminated pods (candidate user workloads), AND
       * Do NOT have a pod-security.kubernetes.io/enforce label.
   - Each namespace listed here is a REVIEW REQUIRED condition for this control:
       * Either add/adjust Pod Security Admission labels, OR
       * Confirm that an external policy engine is actively governing that namespace.

4. External policy engines:
   - The detections under "Detected external policy engine components" are heuristic.
   - Presence alone does NOT prove policies are enforced on every user namespace.
   - For any namespace flagged as a possible problem, you must manually verify
     that your external policy engine has constraints/clusterpolicies that apply
     to that namespace and enforce appropriate pod security standards.

This script does NOT automatically fix anything. It surfaces namespaces that
likely need manual review and policy decisions to comply with CIS 5.2.1.
EOF