Implementa security policies con OPA y compliance automation

Configura vulnerability scanning y security policies

Setup CIS benchmark compliance y security automation

@skill:security-compliance - Security y compliance automation

Policy Definition (OPA)
    ↓
Policy Enforcement
    ↓
Compliance Checking
    ↓
Automated Remediation

# policies/kubernetes-security.rego
package kubernetes.security

# Deny containers running as root
deny[msg] {
    container := input.review.object.spec.containers[_]
    container.securityContext.runAsUser == 0
    msg := "Container must not run as root"
}

# Require resource limits
deny[msg] {
    container := input.review.object.spec.containers[_]
    not container.resources.limits.memory
    msg := "Container must have memory limits"
}

deny[msg] {
    container := input.review.object.spec.containers[_]
    not container.resources.limits.cpu
    msg := "Container must have CPU limits"
}

# Require image from approved registry
deny[msg] {
    container := input.review.object.spec.containers[_]
    not startswith(container.image, "gcr.io/")
    not startswith(container.image, "docker.io/approved/")
    msg := "Container image must be from approved registry"
}

# Require non-privileged containers
deny[msg] {
    container := input.review.object.spec.containers[_]
    container.securityContext.privileged == true
    msg := "Container must not run in privileged mode"
}

# scanning/trivy-scan.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: vulnerability-scan
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: trivy
            image: aquasec/trivy:latest
            args:
              - image
              - --severity
              - HIGH,CRITICAL
              - --format
              - json
              - --exit-code
              - 1
              - gcr.io/my-project/my-app:latest
            env:
            - name: TRIVY_CACHE_DIR
              value: /tmp/trivy-cache
          restartPolicy: OnFailure

# security/vulnerability_scanner.py
import subprocess
import json
from typing import List, Dict

class VulnerabilityScanner:
    def scan_image(self, image: str) -> List[Dict]:
        """Scan container image for vulnerabilities."""
        result = subprocess.run(
            ['trivy', 'image', '--format', 'json', image],
            capture_output=True,
            text=True
        )
        
        data = json.loads(result.stdout)
        vulnerabilities = []
        
        for result in data.get('Results', []):
            for vuln in result.get('Vulnerabilities', []):
                if vuln['Severity'] in ['HIGH', 'CRITICAL']:
                    vulnerabilities.append({
                        'id': vuln['VulnerabilityID'],
                        'severity': vuln['Severity'],
                        'package': vuln['PkgName'],
                        'installed_version': vuln['InstalledVersion'],
                        'fixed_version': vuln.get('FixedVersion'),
                        'title': vuln['Title'],
                    })
        
        return vulnerabilities

    def check_compliance(self, image: str) -> Dict:
        """Check image against CIS benchmarks."""
        result = subprocess.run(
            ['trivy', 'image', '--security-checks', 'config', image],
            capture_output=True,
            text=True
        )
        
        # Parse compliance results
        return self._parse_compliance(result.stdout)

    def _parse_compliance(self, output: str) -> Dict:
        # Parse compliance output
        return {'status': 'compliant', 'issues': []}

# Verificar CIS benchmark
python scripts/compliance_checker.py check-cis

# Verificar regla específica
python scripts/compliance_checker.py check-rule --rule-name access-keys-rotated

# Generar reporte
python scripts/compliance_checker.py report --output compliance-report.txt

# policies/security-policies.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: security-policies
data:
  policies.yaml: |
    policies:
      - name: require-https
        description: "All services must use HTTPS"
        enforcement: deny
        rules:
          - path: "spec.ports[*].protocol"
            operator: equals
            value: TCP
          - path: "spec.ports[*].port"
            operator: not_in
            values: [443, 8443]
      
      - name: require-resource-limits
        description: "All containers must have resource limits"
        enforcement: warn
        rules:
          - path: "spec.containers[*].resources.limits"
            operator: exists
      
      - name: no-root-containers
        description: "Containers must not run as root"
        enforcement: deny
        rules:
          - path: "spec.containers[*].securityContext.runAsUser"
            operator: not_equals
            value: 0

# Remediar namespace completo
python scripts/auto_remediation.py remediate --namespace production

# Dry run (ver qué se remediaría)
python scripts/auto_remediation.py remediate --namespace production --dry-run

# Remediar recurso específico
python scripts/auto_remediation.py remediate-resource \
  --kind Pod \
  --name my-pod \
  --namespace default