Add container debug evidence gates

skills/cloud/container-security/SKILL.md

@@ -61,6 +61,9 @@ NIST SP 800-190 identifies five risk categories: image risks, registry risks, or
 - RBAC configuration files (Roles, ClusterRoles, RoleBindings)
 - NetworkPolicy definitions
 - Pod Security Standard configurations or OPA/Gatekeeper policies
+- Evidence for runtime debug-container controls when available: RBAC for
+  `pods/ephemeralcontainers`, admission policy coverage for that subresource,
+  audit events for debug-container creation, and approved debug image policy
 - Container registry configurations (if available)
 
 ---
@@ -105,12 +108,42 @@ Use Glob to locate all relevant configuration files.
 
 Classify findings by type: Dockerfiles, Kubernetes manifests, Helm charts, Kustomize overlays, and supporting configs. Record all discovered files.
 
+Also record the workload container arrays that were actually evaluated:
+
+- `spec.containers`
+- `spec.initContainers`
+- `spec.ephemeralContainers`
+
+If no `ephemeralContainers` are present in static manifests, do not assume the
+debug-container path is safe. Mark it as **Not Evaluable** unless cluster
+evidence proves that `pods/ephemeralcontainers` creation is restricted,
+admitted through the same policy controls as normal pod creation, audited, and
+limited to approved debug images.
+
 ---
 
 ### Step 2 through Step 6: CIS Benchmark and NIST SP 800-190 Evaluation
 
 Evaluate all container and Kubernetes configurations against CIS Docker Benchmark v1.6.0, CIS Kubernetes Benchmark v1.9.0, and NIST SP 800-190 countermeasures. This covers Dockerfile security, Pod Security Standards, RBAC, Network Policies, Secrets Management, Control Plane configuration, and Container Runtime Hardening.
 
+When applying Pod Security Standards, run every relevant control across regular,
+init, and ephemeral containers. A workload is not Restricted-compliant if the
+application container is hardened but a debug or ephemeral container can be
+added with `privileged: true`, UID 0, added capabilities, host namespace access,
+unconfined seccomp/AppArmor, writable root filesystem, or an unapproved mutable
+debug image.
+
+For clusters that rely on runtime `kubectl debug` workflows, require a separate
+debug-container evidence gate:
+
+| Evidence | Pass condition | Fail condition |
+|----------|----------------|----------------|
+| RBAC | Only approved break-glass groups can `create`/`update` `pods/ephemeralcontainers` | Developers or broad service accounts can add ephemeral containers in production |
+| Admission | Policy engine covers the `pods/ephemeralcontainers` subresource and all container arrays | Policies check only pod create/update and ignore the subresource |
+| Audit | Audit logs capture who added debug containers, target pod, image, and security context | No audit trail for debug-container creation |
+| Image policy | Debug images are pinned, approved, scanned, and pulled from trusted registries | Arbitrary public debug images can be used |
+| Runtime controls | Debug containers satisfy the same non-root, capabilities, seccomp, and filesystem controls as app containers | Debug containers can bypass normal Restricted controls |
+
 For detailed CIS benchmark checklist items, NIST SP 800-190 countermeasure tables, and comprehensive security context evaluation criteria, see [cis-benchmarks.md](cis-benchmarks.md) in this skill directory.
 
 ---
@@ -180,10 +213,10 @@ Produce the final report using the structure defined in the Output Format sectio
 
 ### Pod Security Standards Compliance Matrix
 
-| Workload | Namespace | PSS Level | Violations |
-|----------|-----------|-----------|------------|
-| deploy/app | production | Baseline (not Restricted) | runAsRoot, no seccomp |
-| deploy/worker | production | Privileged | privileged: true |
+| Workload | Namespace | PSS Level | Containers Checked | Ephemeral Debug Evidence | Violations |
+|----------|-----------|-----------|--------------------|--------------------------|------------|
+| deploy/app | production | Baseline (not Restricted) | regular / init / not evaluable | Not evaluable | runAsRoot, no seccomp |
+| deploy/worker | production | Privileged | regular / init / ephemeral | Fail | privileged: true in ephemeral debug container |
 
 ### Prioritized Remediation Plan
 

skills/cloud/container-security/cis-benchmarks.md

@@ -264,6 +264,21 @@ Evaluate workload configurations against Kubernetes Pod Security Standards. The
 | **Baseline** | Minimally restrictive. Prevents known privilege escalations. | Standard workloads |
 | **Restricted** | Heavily restricted. Follows current hardening best practices. | Security-sensitive and untrusted workloads |
 
+**Container coverage requirement:** Apply every Pod Security Standard check to
+all container arrays in the pod spec:
+
+- `spec.containers`
+- `spec.initContainers`
+- `spec.ephemeralContainers`
+
+Kubernetes Pod Security Standards list ephemeral containers alongside regular
+and init containers for controls such as privileged mode, capabilities,
+AppArmor, seccomp, non-root execution, and `allowPrivilegeEscalation`. Do not
+mark a workload Restricted-compliant unless the review evidence proves that all
+present container arrays were checked. If the workload has no static
+`ephemeralContainers`, review runtime controls for the
+`pods/ephemeralcontainers` subresource before treating debug workflows as safe.
+
 #### CIS 5.2.1 -- Ensure that the cluster has at least one active policy control mechanism installed
 
 Check for Pod Security Admission labels on namespaces:
@@ -293,8 +308,37 @@ spec:
         privileged: true  # CRITICAL FAIL
 ```
 
+Also inspect `initContainers` and `ephemeralContainers`:
+
+```yaml
+# BAD: Privileged ephemeral debug container bypasses the hardened app container
+spec:
+  containers:
+    - name: app
+      securityContext:
+        runAsNonRoot: true
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        seccompProfile:
+          type: RuntimeDefault
+  ephemeralContainers:
+    - name: debug
+      image: busybox:1.36
+      targetContainerName: app
+      securityContext:
+        privileged: true
+        runAsUser: 0
+        allowPrivilegeEscalation: true
+        capabilities:
+          add: ["SYS_ADMIN"]
+```
+
 **Grep pattern:** `privileged: true`
 
+**Required result:** A privileged ephemeral debug container is a Critical
+finding even when every regular container is Restricted-compliant.
+
 #### CIS 5.2.3 -- Minimize the admission of containers wishing to share the host process ID namespace
 
 ```yaml
@@ -605,6 +649,7 @@ Evaluate container runtime configurations against NIST SP 800-190 countermeasure
 | **CM-8:** Implement network segmentation | NetworkPolicy in every namespace |
 | **CM-9:** Use Pod Security Standards | PSA labels on namespaces or equivalent policy engine |
 | **CM-10:** Enable audit logging | Audit policy configured on API server |
+| **CM-10a:** Govern runtime debug containers | RBAC, admission, audit, and image policy cover `pods/ephemeralcontainers` |
 
 ### NIST 800-190: Container Countermeasures
 
@@ -615,6 +660,7 @@ Evaluate container runtime configurations against NIST SP 800-190 countermeasure
 | **CM-13:** Drop all capabilities | `capabilities.drop: ["ALL"]` |
 | **CM-14:** Set resource limits | CPU and memory limits set on all containers |
 | **CM-15:** Use seccomp profiles | `seccompProfile.type: RuntimeDefault` or custom |
+| **CM-16:** Apply controls to debug containers | Same non-root, read-only root filesystem, capabilities, and seccomp controls on `ephemeralContainers` |
 
 **Resource limits check:**
 
@@ -677,8 +723,45 @@ spec:
         requests:
           memory: "128Mi"
           cpu: "250m"
+  initContainers:
+    - name: migrate
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 1000
+        capabilities:
+          drop: ["ALL"]
+        seccompProfile:
+          type: RuntimeDefault
+  ephemeralContainers:
+    - name: debug
+      image: registry.example.com/debug-tools@sha256:...
+      targetContainerName: app
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 1000
+        capabilities:
+          drop: ["ALL"]
+        seccompProfile:
+          type: RuntimeDefault
 ```
 
+**Runtime debug-container evidence checklist:**
+
+| Evidence | What to verify |
+|----------|----------------|
+| RBAC | Only approved break-glass groups can `create` or `update` `pods/ephemeralcontainers` in production namespaces |
+| Admission | Kyverno/Gatekeeper/PSA policies apply to the `pods/ephemeralcontainers` subresource, not only pod create/update |
+| Audit | Audit policy records user, namespace, target pod, debug image, and requested security context for ephemeral-container changes |
+| Image policy | Debug images are pinned by digest, scanned, and pulled from trusted registries |
+| Scope | Production namespaces either disallow debug containers or require explicit incident/break-glass approval |
+
+If these runtime controls are unavailable, report the debug-container path as
+**Not Evaluable** instead of silently passing the workload.
+
 **Fields that must NOT be present for Restricted compliance:**
 
 - `privileged: true`