rage.fail

azure-aks-workload-pulls-image

explicit azure emits ContainsResourceReference

match (record)

{ "field": "spec.template.spec.containers[].image", "resource_type": "k8s/Deployment|k8s/DaemonSet|k8s/StatefulSet|k8s/Job|k8s/Pod" }

emit

source type	`KubernetesWorkload`
target type	`ContainerRegistry`
source	`<KubernetesWorkload>`
target	`<ContainerRegistry (ACR) that hosts the image>`

Narrative

{workload.name} pulls its container image from {registry.name} (tag/digest: {image_ref}).

Raw rule rules/explicit/azure-aks.yaml

id: azure-aks-workload-pulls-image
emits: ContainsResourceReference
applies_to:
- azure
match_record:
  resource_type: k8s/Deployment|k8s/DaemonSet|k8s/StatefulSet|k8s/Job|k8s/Pod
  field: spec.template.spec.containers[].image
emit:
  source_type: KubernetesWorkload
  target_type: ContainerRegistry
  source: <KubernetesWorkload>
  target: <ContainerRegistry (ACR) that hosts the image>
  reference_kind: runs_image
  api_source: kubectl get <kind> -n <namespace> <name> -o yaml
  evidence_field: spec.template.spec.containers[].image
  note: "Tag/digest pinning is recorded as a property on this edge:\n  MUTABLE (moving tag like :latest,\
    \ imagePullPolicy Always, no @sha256 digest pin)\n  => container-chains image-push-poisons-consumers\
    \ fires ACTIVE for overwritten tag.\n  DIGEST-PINNED (@sha256:...) => the fan-out to this workload\
    \ is BLOCKED for any\n  tag overwrite; an attacker must overwrite the exact digest (registry must\
    \ not\n  enforce content-addressable immutability)."
  narrative: '{workload.name} pulls its container image from {registry.name} (tag/digest: {image_ref}).'