fix: refactor and tune kyverno for HA

Author: pratik705

applications/base/services/kyverno/default-ruleset/disallow-host-path.yaml

@@ -15,8 +15,8 @@ metadata:
       HostPath volumes let Pods use host directories and volumes in containers.
       Using host resources can be used to access shared data or escalate privileges
       and should not be allowed. This policy ensures no hostPath volumes are in use.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -31,9 +31,9 @@ spec:
     - name: host-path
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true

applications/base/services/kyverno/default-ruleset/disallow-host-ports.yaml

@@ -15,8 +15,8 @@ metadata:
       Access to host ports allows potential snooping of network traffic and should not be
       allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
       field is unset or set to `0`.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -31,9 +31,9 @@ spec:
     - name: host-ports-none
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true

applications/base/services/kyverno/default-ruleset/disallow-host-process.yaml

@@ -16,8 +16,8 @@ metadata:
       access to the Windows node. Privileged access to the host is disallowed in the baseline
       policy. HostProcess pods are an alpha feature as of Kubernetes v1.22. This policy ensures
       the `hostProcess` field, if present, is set to `false`.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -32,9 +32,9 @@ spec:
     - name: host-process-containers
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true

applications/base/services/kyverno/default-ruleset/disallow-privileged-containers.yaml

@@ -14,8 +14,8 @@ metadata:
     policies.kyverno.io/description: >-
       Privileged mode disables most security mechanisms and must not be allowed. This policy
       ensures Pods do not call for privileged mode.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -30,9 +30,9 @@ spec:
     - name: privileged-containers
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true

applications/base/services/kyverno/default-ruleset/disallow-proc-mount.yaml

@@ -16,8 +16,8 @@ metadata:
       ensures nothing but the default procMount can be specified. Note that in order for users
       to deviate from the `Default` procMount requires setting a feature gate at the API
       server.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -32,9 +32,9 @@ spec:
     - name: check-proc-mount
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true

applications/base/services/kyverno/default-ruleset/disallow-selinux.yaml

@@ -14,8 +14,8 @@ metadata:
     policies.kyverno.io/description: >-
       SELinux options can be used to escalate privileges and should not be allowed. This policy
       ensures that the `seLinuxOptions` field is undefined.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -30,9 +30,9 @@ spec:
     - name: selinux-type
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true
@@ -61,9 +61,9 @@ spec:
     - name: selinux-user-role
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true

applications/base/services/kyverno/default-ruleset/kustomization.yaml

@@ -14,7 +14,6 @@ resources:
   - "disallow-selinux.yaml"
   - "require-run-as-non-root-user.yaml"
   - "require-run-as-nonroot.yaml"
-  - "require-run-as-nonroot.yaml"
   - "restrict-apparmor-profiles.yaml"
   - "restrict-seccomp-strict.yaml"
   - "restrict-seccomp.yaml"

applications/base/services/kyverno/default-ruleset/restrict-apparmor-profiles.yaml

@@ -17,8 +17,8 @@ metadata:
       The default policy should prevent overriding or disabling the policy, or restrict
       overrides to an allowed set of profiles. This policy ensures Pods do not
       specify any other AppArmor profiles than `runtime/default` or `localhost/*`.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -33,9 +33,9 @@ spec:
     - name: app-armor
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true

applications/base/services/kyverno/default-ruleset/restrict-seccomp.yaml

@@ -15,8 +15,8 @@ metadata:
       The seccomp profile must not be explicitly set to Unconfined. This policy,
       requiring Kubernetes v1.19 or later, ensures that seccomp is unset or
       set to `RuntimeDefault` or `Localhost`.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -31,9 +31,9 @@ spec:
     - name: check-seccomp
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true
@@ -50,14 +50,14 @@ spec:
               =(seccompProfile):
                 =(type): "RuntimeDefault | Localhost"
             =(ephemeralContainers):
-            - =(securityContext):
-                =(seccompProfile):
-                  =(type): "RuntimeDefault | Localhost"
+              - =(securityContext):
+                  =(seccompProfile):
+                    =(type): "RuntimeDefault | Localhost"
             =(initContainers):
-            - =(securityContext):
-                =(seccompProfile):
-                  =(type): "RuntimeDefault | Localhost"
+              - =(securityContext):
+                  =(seccompProfile):
+                    =(type): "RuntimeDefault | Localhost"
             containers:
-            - =(securityContext):
-                =(seccompProfile):
-                  =(type): "RuntimeDefault | Localhost"
+              - =(securityContext):
+                  =(seccompProfile):
+                    =(type): "RuntimeDefault | Localhost"

applications/base/services/kyverno/default-ruleset/restrict-sysctls.yaml

@@ -18,8 +18,8 @@ metadata:
       Pod, and it is isolated from other Pods or processes on the same Node.
       This policy ensures that only those "safe" subsets can be specified in
       a Pod.
-    
-  labels: 
+
+  labels:
     app.kubernetes.io/component: kyverno
     app.kubernetes.io/instance: kyverno-policies
     app.kubernetes.io/managed-by: Helm
@@ -34,9 +34,9 @@ spec:
     - name: check-sysctls
       match:
         any:
-        - resources:
-            kinds:
-              - Pod
+          - resources:
+              kinds:
+                - Pod
       validate:
         failureAction: Audit
         allowExistingViolations: true