Seccomp mutation for both notations

artifacthub/library/pod-security-policy/seccomp/1.0.0/samples/psp-seccomp/example_allowed3.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-seccomp-allowed3
+  labels:
+    app: nginx-seccomp
+spec:
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - name: nginx
+    image: nginx

artifacthub/library/pod-security-policy/seccomp/1.0.0/samples/psp-seccomp/example_disallowed3.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-seccomp-disallowed3
+  labels:
+    app: nginx-seccomp
+spec:
+  securityContext:
+    seccompProfile:
+      type: Unconfined
+  containers:
+  - name: nginx
+    image: nginx

artifacthub/library/pod-security-policy/seccomp/1.0.0/suite.yaml

@@ -30,3 +30,12 @@ tests:
     assertions:
     - violations: 1
       message: "Seccomp profile 'unconfined' is not allowed for container 'nginx'. Found at: annotation container.seccomp.security.alpha.kubernetes.io/nginx"
+  - name: example-allowed-global-securityContext
+    object: samples/psp-seccomp/example_allowed3.yaml
+    assertions:
+    - violations: no
+  - name: example-disallowed-global-securityContext
+    object: samples/psp-seccomp/example_disallowed3.yaml
+    assertions:
+    - violations: 1
+      message: "Seccomp profile 'Unconfined' is not allowed for container 'nginx'. Found at: pod securityContext"

library/pod-security-policy/seccomp/samples/psp-seccomp/example_allowed3.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-seccomp-allowed3
+  labels:
+    app: nginx-seccomp
+spec:
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - name: nginx
+    image: nginx

library/pod-security-policy/seccomp/samples/psp-seccomp/example_disallowed3.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-seccomp-disallowed3
+  labels:
+    app: nginx-seccomp
+spec:
+  securityContext:
+    seccompProfile:
+      type: Unconfined
+  containers:
+  - name: nginx
+    image: nginx

library/pod-security-policy/seccomp/suite.yaml

@@ -30,3 +30,12 @@ tests:
     assertions:
     - violations: 1
       message: "Seccomp profile 'unconfined' is not allowed for container 'nginx'. Found at: annotation container.seccomp.security.alpha.kubernetes.io/nginx"
+  - name: example-allowed-global-securityContext
+    object: samples/psp-seccomp/example_allowed3.yaml
+    assertions:
+    - violations: no
+  - name: example-disallowed-global-securityContext
+    object: samples/psp-seccomp/example_disallowed3.yaml
+    assertions:
+    - violations: 1
+      message: "Seccomp profile 'Unconfined' is not allowed for container 'nginx'. Found at: pod securityContext"

mutation/pod-security-policy/seccomp/samples/mutation.yaml → mutation/pod-security-policy/seccomp/samples/mutation-annotation.yaml

@@ -1,7 +1,7 @@
 apiVersion: mutations.gatekeeper.sh/v1alpha1
 kind: AssignMetadata
 metadata:
-  name: k8spspseccomp
+  name: k8spspseccompannotation
 spec:
   match:
     scope: Namespaced

mutation/pod-security-policy/seccomp/samples/mutation-securityContext.yaml

@@ -0,0 +1,21 @@
+apiVersion: mutations.gatekeeper.sh/v1alpha1
+kind: Assign
+metadata:
+  name: k8spspseccompcontext
+spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["*"]
+      kinds: ["Pod"]
+  location: "spec.securityContext.seccompProfile.type"
+  parameters:
+    pathTests:
+    - subPath: "spec.securityContext.seccompProfile.type"
+      condition: MustNotExist
+    assign:
+      value: RuntimeDefault

website/docs/mutation-examples/seccomp.md

@@ -7,23 +7,30 @@ title: seccomp
 
 ### Usage
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/mutation/pod-security-policy/seccomp/samples/mutation.yaml
+kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/mutation/pod-security-policy/seccomp/samples/mutation-securityContext.yaml
 ```
 ## Mutation Examples
 ```yaml
 apiVersion: mutations.gatekeeper.sh/v1alpha1
-kind: AssignMetadata
+kind: Assign
 metadata:
-  name: k8spspseccomp
+  name: k8spspseccompcontext
 spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
   match:
     scope: Namespaced
     kinds:
-    - apiGroups: [""]
+    - apiGroups: ["*"]
       kinds: ["Pod"]
-  location: metadata.annotations."seccomp.security.alpha.kubernetes.io/pod"
+  location: "spec.securityContext.seccompProfile.type"
   parameters:
+    pathTests:
+    - subPath: "spec.securityContext.seccompProfile.type"
+      condition: MustNotExist
     assign:
-      value: runtime/default
+      value: RuntimeDefault
 
 ```

website/docs/validation/seccomp.md

@@ -459,6 +459,60 @@ Usage
 kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/library/pod-security-policy/seccomp/samples/psp-seccomp/disallowed_ephemeral.yaml
 ```
 
+</details>
+<details>
+<summary>example-allowed-global-securityContext</summary>
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-seccomp-allowed3
+  labels:
+    app: nginx-seccomp
+spec:
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - name: nginx
+    image: nginx
+
+```
+
+Usage
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/library/pod-security-policy/seccomp/samples/psp-seccomp/example_allowed3.yaml
+```
+
+</details>
+<details>
+<summary>example-disallowed-global-securityContext</summary>
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-seccomp-disallowed3
+  labels:
+    app: nginx-seccomp
+spec:
+  securityContext:
+    seccompProfile:
+      type: Unconfined
+  containers:
+  - name: nginx
+    image: nginx
+
+```
+
+Usage
+
+```shell
+kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/library/pod-security-policy/seccomp/samples/psp-seccomp/example_disallowed3.yaml
+```
+
 </details>