policy_module(kubernetes, 1.0.0)

########################################
#
# Declarations
#

attribute kubernetes_domain;

kubernetes_domain_template(kube_apiserver)
kubernetes_domain_template(kube_controller_manager)
kubernetes_domain_template(kube_proxy)
kubernetes_domain_template(kubelet)

permissive kube_apiserver_t;
permissive kube_controller_manager_t;
permissive kube_proxy_t;
permissive kubelet_t;

type kubelet_var_lib_t;
files_type(kubelet_var_lib_t)

########################################
#
# kubernetes domain local policy
#

# this is kernel bug which is going to be fixed
# needs to be removed then
dontaudit kubernetes_domain self:capability2 block_suspend;

allow kubernetes_domain self:tcp_socket create_stream_socket_perms;

kernel_read_unix_sysctls(kubernetes_domain)
kernel_read_net_sysctls(kubernetes_domain)

auth_read_passwd(kubernetes_domain)

corenet_tcp_bind_generic_node(kubernetes_domain)

corenet_tcp_connect_http_cache_port(kubernetes_domain)
corenet_tcp_connect_kubernetes_port(kubernetes_domain)

########################################
#
# kubelet local policy
#

allow kubelet_t self:capability net_admin;

manage_dirs_pattern(kubelet_t, kubelet_var_lib_t, kubelet_var_lib_t)
manage_files_pattern(kubelet_t, kubelet_var_lib_t, kubelet_var_lib_t)
manage_lnk_files_pattern(kubelet_t, kubelet_var_lib_t, kubelet_var_lib_t)
files_var_lib_filetrans(kubelet_t, kubelet_var_lib_t, dir)

corenet_tcp_bind_kubernetes_port(kubelet_t)

########################################
#
# kube_controller local policy
#


########################################
#
# kube_apiserver local policy
#

corenet_tcp_bind_http_cache_port(kube_apiserver_t)

########################################
#
# kube_proxy local policy
#

allow kube_proxy_t self:capability net_admin;
