sensitive files extended to non vanilla k8s distros

[entlein]

Moved to the internal node-agent tracker and closed here. Sensitive-file rule coverage for non-vanilla k8s distros is tracked privately going forward.

[ConstanzeTU]

PR is up: k8sstormcenter/rulelibrary#3 (against main).

What it covers

The sensitive-file rules only knew vanilla kubeadm + EKS paths, so cluster credentials on other distros were never matched — a profile learned on one distro under-covers on another.

R0010 (sensitive file access) now covers, beyond /etc/shadow:

distro	paths
kubeadm	/etc/kubernetes/{admin,kubelet,controller-manager,scheduler}.conf, pki/
OpenShift	/etc/kubernetes/kubeconfig, static-pod-resources/, /var/lib/kubelet/kubeconfig
RKE2	/etc/rancher/rke2/, /var/lib/rancher/rke2/server/
k3s	/etc/rancher/k3s/, /var/lib/rancher/k3s/server/
k0s	/etc/k0s/, /var/lib/k0s/pki/
MicroK8s	/var/snap/microk8s/current/{credentials,certs}/
all	/var/lib/kubelet/pki/

R1010 / R1012 (sym/hardlink over sensitive file) get the same target list — otherwise the same credentials could be swapped via a link.

R0006 (SA token) adds GKE bound tokens and the AKS Azure workload-identity token.

profileDataRequired is extended in step with each expression so the projection actually collects what the rules test.

Two findings worth recording

1. AKS tokens could never be whitelisted. /var/run/secrets/azure/tokens/azure-identity-token does not end in /token, so R0006's was_path_opened_with_suffix(.., "/token") suppression never matched it. Fixed by adding an exact was_path_opened arm.
2. Only prefix/exact matchers need distro variants. Suffix/contains matchers are inherently portable — /token already covered RKE2/k3s node tokens on every distro. The class that genuinely needed work is kubeconfig/PKI, which has no portable fragment.

Superseded

An earlier attempt (rulelibrary#2) was written against migrate/cp-cel-rules using cp. verbs. That base was never merged into main, so #3 rebuilds the change on main with ap. verbs. #2 can be closed.

[ConstanzeTU]

Moved to the internal tracker; closing here.