Add sig-multitenancy-bench conformance

docs/operator/mtb/allow-self-service-management-of-network-policies.md

@@ -0,0 +1,77 @@
+# Allow self-service management of Network Policies
+
+**Profile Applicability:** L2
+
+**Type:** Behavioral
+
+**Category:** Self-Service Operations
+
+**Description:** Tenants should be able to perform self-service operations by creating own network policies in their namespaces.
+
+**Rationale:** Enables self-service management of network-policies.
+
+**Audit:**
+
+As cluster admin, create a tenant
+
+```yaml
+kubectl create -f - <<EOF
+apiVersion: capsule.clastix.io/v1beta1
+kind: Tenant
+metadata:
+  name: oil
+spec:
+  owners:
+  - kind: User
+    name: alice
+  networkPolicies:
+    items:
+      ingress:
+      - from:
+        - namespaceSelector:
+            matchLabels:
+              capsule.clastix.io/tenant: oil
+      podSelector: {}
+      policyTypes:
+      - Egress
+      - Ingress
+EOF
+
+./create-user.sh alice oil
+
+```
+
+As tenant owner, run the following command to create a namespace in the given tenant
+
+```bash 
+kubectl --kubeconfig alice create ns oil-production
+kubectl --kubeconfig alice config set-context --current --namespace oil-production
+```
+
+As tenant owner, retrieve the networkpolicies resources in the tenant namespace
+
+```bash 
+kubectl --kubeconfig alice get networkpolicies 
+NAME            POD-SELECTOR   AGE
+capsule-oil-0   <none>         7m5s
+```
+
+As tenant owner check for permissions to manage networkpolicy for each verb
+
+```bash 
+kubectl --kubeconfig alice auth can-i get networkpolicies
+kubectl --kubeconfig alice auth can-i create networkpolicies
+kubectl --kubeconfig alice auth can-i update networkpolicies
+kubectl --kubeconfig alice auth can-i patch networkpolicies
+kubectl --kubeconfig alice auth can-i delete networkpolicies
+kubectl --kubeconfig alice auth can-i deletecollection networkpolicies
+```
+
+Each command must return 'yes'
+
+**Cleanup:**
+As cluster admin, delete all the created resources
+
+```bash 
+kubectl --kubeconfig cluster-admin delete tenant oil
+```

docs/operator/mtb/allow-self-service-management-of-rolebindings.md

@@ -0,0 +1,58 @@
+# Allow self-service management of Role Bindings
+
+**Profile Applicability:** L2
+
+**Type:** Behavioral
+
+**Category:** Self-Service Operations
+
+**Description:** Tenants should be able to perform self-service operations by creating own rolebindings in their namespaces.
+
+**Rationale:** Enables self-service management of roles.
+
+**Audit:**
+
+As cluster admin, create a tenant
+
+```yaml
+kubectl create -f - <<EOF
+apiVersion: capsule.clastix.io/v1beta1
+kind: Tenant
+metadata:
+  name: oil
+spec:
+  owners:
+  - kind: User
+    name: alice
+EOF
+
+./create-user.sh alice oil
+
+```
+
+As tenant owner, run the following command to create a namespace in the given tenant
+
+```bash 
+kubectl --kubeconfig alice create ns oil-production
+kubectl --kubeconfig alice config set-context --current --namespace oil-production
+```
+
+As tenant owner check for permissions to manage rolebindings for each verb
+
+```bash 
+kubectl --kubeconfig alice auth can-i get rolebindings
+kubectl --kubeconfig alice auth can-i create rolebindings
+kubectl --kubeconfig alice auth can-i update rolebindings
+kubectl --kubeconfig alice auth can-i patch rolebindings
+kubectl --kubeconfig alice auth can-i delete rolebindings
+kubectl --kubeconfig alice auth can-i deletecollection rolebindings
+```
+
+Each command must return 'yes'
+
+**Cleanup:**
+As cluster admin, delete all the created resources
+
+```bash 
+kubectl --kubeconfig cluster-admin delete tenant oil
+```

docs/operator/mtb/allow-self-service-management-of-roles.md

@@ -0,0 +1,58 @@
+# Allow self-service management of Roles
+
+**Profile Applicability:** L2
+
+**Type:** Behavioral
+
+**Category:** Self-Service Operations
+
+**Description:** Tenants should be able to perform self-service operations by creating own roles in their namespaces.
+
+**Rationale:** Enables self-service management of roles.
+
+**Audit:**
+
+As cluster admin, create a tenant
+
+```yaml
+kubectl create -f - <<EOF
+apiVersion: capsule.clastix.io/v1beta1
+kind: Tenant
+metadata:
+  name: oil
+spec:
+  owners:
+  - kind: User
+    name: alice
+EOF
+
+./create-user.sh alice oil
+
+```
+
+As tenant owner, run the following command to create a namespace in the given tenant
+
+```bash 
+kubectl --kubeconfig alice create ns oil-production
+kubectl --kubeconfig alice config set-context --current --namespace oil-production
+```
+
+As tenant owner check for permissions to manage roles for each verb
+
+```bash 
+kubectl --kubeconfig alice auth can-i get roles
+kubectl --kubeconfig alice auth can-i create roles
+kubectl --kubeconfig alice auth can-i update roles
+kubectl --kubeconfig alice auth can-i patch roles
+kubectl --kubeconfig alice auth can-i delete roles
+kubectl --kubeconfig alice auth can-i deletecollection roles
+```
+
+Each command must return 'yes'
+
+**Cleanup:**
+As cluster admin, delete all the created resources
+
+```bash 
+kubectl --kubeconfig cluster-admin delete tenant oil
+```

docs/operator/mtb/block-access-to-cluster-resources.md

@@ -0,0 +1,48 @@
+# Block access to cluster resources
+
+**Profile Applicability:** L1
+
+**Type:** Configuration Check
+
+**Category:** Control Plane Isolation
+
+**Description:** Tenants should not be able to view, edit, create, or delete cluster (non-namespaced) resources such Node, ClusterRole, ClusterRoleBinding, etc.
+
+**Rationale:** Access controls should be configured for tenants so that a tenant cannot list, create, modify or delete cluster resources
+
+**Audit:**
+
+As cluster admin, create a tenant
+
+```yaml
+kubectl create -f - <<EOF
+apiVersion: capsule.clastix.io/v1beta1
+kind: Tenant
+metadata:
+  name: oil
+spec:
+  owners:
+  - kind: User
+    name: alice
+EOF
+
+./create-user.sh alice oil
+```
+
+As cluster admin, run the following command to retrieve the list of non-namespaced resources
+```bash 
+kubectl --kubeconfig cluster-admin api-resources --namespaced=false
+```
+For all non-namespaced resources, and each verb (get, list, create, update, patch, watch, delete, and deletecollection) issue the following command:
+
+```bash 
+kubectl --kubeconfig alice auth can-i <verb> <resource>
+```
+Each command must return `no`
+
+**Cleanup:**
+As cluster admin, delete all the created resources
+
+```bash 
+kubectl --kubeconfig cluster-admin delete tenant oil
+```