Research Shows How Misconfigured Kubernetes Policies Can Allow Unapproved Container Images

Feb 3, 2025 · Original article ↗

Summary

Aqua researchers found that prefix-based OPA Gatekeeper and Kyverno policies can be bypassed when repository constraints omit trailing slashes, potentially allowing unapproved container images. They describe a revised Gatekeeper policy and scanning recommendations.

Key points

The k8sallowedrepos Gatekeeper policy uses prefix matching, so a constraint without a trailing slash can match attacker-controlled subdomains or similarly prefixed repositories.
Examples include bypassing an allowed registry with a domain such as my-ecr.azurecr.io.attacker.com, or using a similarly named Docker Hub namespace.
Aqua reports similar misconfiguration risks in Kyverno policies that append wildcards to approved repository values.
Aqua worked with the Gatekeeper security team on k8sallowedreposv2, which supports exact image names and glob-like syntax and is available in the gatekeeper-library.
Recommended steps include correctly scoping repository values, avoiding overly permissive matching, and scanning constraints for risky configurations.
Aqua says Trivy was enhanced to detect missing trailing slashes and other risky patterns in these constraints.

Article Details

Attack Vectors: Misconfigured OPA Gatekeeper k8sallowedrepos constraints without trailing slashes allow prefix matches to accept attacker-controlled image references, including subdomains such as my-ecr.azurecr.io.attacker.com/malicious and similarly prefixed Docker Hub namespaces.
Misconfigured Kyverno policies that append a wildcard to approved repository values can allow unauthorized image references such as myregistry.com.attacker.com.
Defensive Notes: Terminate allowed domain and repository namespace values with a trailing slash where appropriate, such as my-company-ecr.azurecr.io/ or docker.io/openpolicyagent/.
Avoid overly permissive prefix, suffix, or wildcard matching for domains, repositories, and namespaces.
Adopt the k8sallowedreposv2 policy, which supports exact image names and glob-like syntax.
Use Aqua Trivy to scan for insecure k8sallowedrepos constraint configurations, including missing trailing slashes.
Validate constraint values and scope namespaces explicitly.