Service With External Load Balancer

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-network-002
  labels:
    severity: "critical"
    category: "network"
  annotations:
    rules.spotter.dev/title: "Service With External Load Balancer"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-501"
    rules.spotter.dev/description: "Services of type LoadBalancer are exposed externally. This may be unintentional and could expose internal services to the internet."
spec:
  match:
    resources:
      kubernetes:
        apiGroups:
          - ""
        versions:
          - "v1"
        kinds:
          - Service
        namespaces:
          include: ["*"]
          exclude: ["kube-system", "kube-public"]
  cel: |
    has(object.spec.type) && object.spec.type == "LoadBalancer" &&
    !(
      (has(object.metadata.annotations) &&
       (
         ("cloud.google.com/load-balancer-type" in object.metadata.annotations &&
          object.metadata.annotations["cloud.google.com/load-balancer-type"] == "Internal") ||
         ("service.beta.kubernetes.io/aws-load-balancer-internal" in object.metadata.annotations &&
          object.metadata.annotations["service.beta.kubernetes.io/aws-load-balancer-internal"] == "true") ||
         ("service.beta.kubernetes.io/azure-load-balancer-internal" in object.metadata.annotations &&
          object.metadata.annotations["service.beta.kubernetes.io/azure-load-balancer-internal"] == "true") ||
         ("networking.gke.io/load-balancer-type" in object.metadata.annotations &&
          object.metadata.annotations["networking.gke.io/load-balancer-type"] == "Internal")
       ))
    )
  remediation:
    manual: "If the service is not intended to be public, change the service type to ClusterIP and expose it using a Ingress resource."
  references:
    - title: "Kubernetes Service Types"
      url: "https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 05
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx
- name: insecure sample 2 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 05334443
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-internal: 'false'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx
- name: insecure sample 3 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 07
      annotations:
        service.beta.kubernetes.io/azure-load-balancer-internal: 'false'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx
- name: insecure sample 4 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 08
      annotations:
        networking.gke.io/load-balancer-type: 'External'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx
- name: insecure sample 5 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 09
      annotations:
        cloud.google.com/load-balancer-type: 'External'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx

- name: secure sample 1 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 01
      annotations:
        cloud.google.com/load-balancer-type: 'Internal'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx
- name: secure sample 2 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 02
      annotations:
        service.beta.kubernetes.io/aws-load-balancer-internal: 'true'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx
- name: secure sample 3 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 03
      annotations:
        service.beta.kubernetes.io/azure-load-balancer-internal: 'true'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx
- name: secure sample 4 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Service
    metadata:
      name: sample-service 04
      annotations:
        networking.gke.io/load-balancer-type: 'Internal'
    spec:
      ports:
        - port: 80
          targetPort: 80
          protocol: TCP
      type: LoadBalancer
      selector:
        app: nginx

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-network-002
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-network-002
spec:
  # Add your VAP configuration here

Rule Metadata

Service With External Load Balancer

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub