Add namespace check for workload connections in exposure rules

kubescape · Jan 15, 2025 · 7c55420 · 7c55420
1 parent e4e9e7c
commit 7c55420
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/rules/exposure-to-internet/raw.rego b/rules/exposure-to-internet/raw.rego
@@ -9,6 +9,7 @@ deny[msga] {
     wl := input[_]
     spec_template_spec_patterns := {"Deployment", "ReplicaSet", "DaemonSet", "StatefulSet", "Pod", "Job", "CronJob"}
     spec_template_spec_patterns[wl.kind]
+    is_same_namespace(wl.metadata, service.metadata)
     pod := get_pod_spec(wl)["spec"]
     wl_connected_to_service(pod, service)
     failPath := ["spec.type"]