diff --git a/auditors/apparmor/apparmor_test.go b/auditors/apparmor/apparmor_test.go index dd51cfc7..a59d47b8 100644 --- a/auditors/apparmor/apparmor_test.go +++ b/auditors/apparmor/apparmor_test.go @@ -19,6 +19,8 @@ func TestAuditAppArmor(t *testing.T) { }{ {"apparmor-enabled.yml", nil, true}, {"apparmor-annotation-missing.yml", []string{AppArmorAnnotationMissing}, true}, + {"apparmor-annotation-init-container-enabled.yml", nil, true}, + {"apparmor-annotation-init-container-missing.yml", []string{AppArmorAnnotationMissing}, true}, // These are invalid manifests so we should only test it in manifest mode as kubernetes will fail to apply it {"apparmor-disabled.yml", []string{AppArmorDisabled}, false}, {"apparmor-invalid-annotation.yml", []string{AppArmorInvalidAnnotation}, false}, diff --git a/auditors/apparmor/fixtures/apparmor-annotation-init-container-enabled.yml b/auditors/apparmor/fixtures/apparmor-annotation-init-container-enabled.yml new file mode 100644 index 00000000..8a052604 --- /dev/null +++ b/auditors/apparmor/fixtures/apparmor-annotation-init-container-enabled.yml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: pod + namespace: apparmor-annotation-init-container-enabled + annotations: + container.apparmor.security.beta.kubernetes.io/container: localhost/someval + container.apparmor.security.beta.kubernetes.io/init-container: localhost/someval +spec: + initContainers: + - name: init-container + image: scratch + containers: + - name: container + image: scratch diff --git a/auditors/apparmor/fixtures/apparmor-annotation-init-container-missing.yml b/auditors/apparmor/fixtures/apparmor-annotation-init-container-missing.yml new file mode 100644 index 00000000..072a68c2 --- /dev/null +++ b/auditors/apparmor/fixtures/apparmor-annotation-init-container-missing.yml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Pod +metadata: + name: pod + namespace: apparmor-annotation-init-container-missing + annotations: + container.apparmor.security.beta.kubernetes.io/container: localhost/someval +spec: + initContainers: + - name: init-container + image: scratch + containers: + - name: container + image: scratch diff --git a/pkg/k8s/helpers.go b/pkg/k8s/helpers.go index c4329d2a..1b8cf073 100644 --- a/pkg/k8s/helpers.go +++ b/pkg/k8s/helpers.go @@ -17,9 +17,26 @@ func GetContainers(resource Resource) []*ContainerV1 { return nil } - containers := make([]*ContainerV1, len(podSpec.Containers)) + var containers []*ContainerV1 for i := range podSpec.Containers { - containers[i] = &podSpec.Containers[i] + containers = append(containers, &podSpec.Containers[i]) + } + + if len(podSpec.InitContainers) > 0 { + containers = append(containers, GetInitContainers(resource)...) + } + return containers +} + +func GetInitContainers(resource Resource) []*ContainerV1 { + podSpec := GetPodSpec(resource) + if podSpec == nil { + return nil + } + + containers := make([]*ContainerV1, len(podSpec.InitContainers)) + for i := range podSpec.InitContainers { + containers[i] = &podSpec.InitContainers[i] } return containers }