44 lines
1.6 KiB
Bash
44 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
NS=dsh-poc
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
pass() { echo "PASS: $*"; }
|
|
fail() { echo "FAIL: $*"; exit 1; }
|
|
|
|
kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
|
|
kubectl create configmap dsh-target-script --from-file="$HERE/target.mjs" -n "$NS" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
|
|
|
|
echo "== apply pods =="
|
|
kubectl apply -f "$HERE/pods.yaml" >/dev/null
|
|
kubectl wait -n "$NS" --for=condition=Ready pod/dsh-target --timeout=120s
|
|
kubectl wait -n "$NS" --for=condition=Ready pod/controlplane --timeout=120s
|
|
kubectl wait -n "$NS" --for=condition=Ready pod/attacker --timeout=120s
|
|
|
|
echo "== apply NetworkPolicy (default-deny + allow control-plane) =="
|
|
kubectl apply -f "$HERE/default-deny.yaml" >/dev/null
|
|
kubectl apply -f "$HERE/allow-controlplane.yaml" >/dev/null
|
|
sleep 2
|
|
|
|
IP="$(kubectl get -n "$NS" pod dsh-target -o jsonpath='{.status.podIP}')"
|
|
URL="http://$IP:8081/"
|
|
echo "target pod IP: $IP"
|
|
|
|
echo "== control-plane -> dsh (must succeed) =="
|
|
if kubectl exec -n "$NS" controlplane -- wget -q -T 5 -O- "$URL" 2>/dev/null | grep -q 'dsh-ok'; then
|
|
pass "control-plane reaches dsh:8081"
|
|
else
|
|
fail "control-plane could NOT reach dsh:8081 (policy or CNI not enforced as expected)"
|
|
fi
|
|
|
|
echo "== attacker -> dsh (must be blocked) =="
|
|
if kubectl exec -n "$NS" attacker -- wget -q -T 5 -O- "$URL" >/dev/null 2>&1; then
|
|
fail "attacker reached dsh:8081 — NetworkPolicy NOT enforced (flannel? check CNI)"
|
|
else
|
|
pass "attacker is blocked from dsh:8081 (default-deny enforced)"
|
|
fi
|
|
|
|
echo
|
|
echo "ALL ITEM-3 CHECKS PASSED"
|