Skip to content

Commit ed66920

Browse files
pratik705pratik705
committed
feat: refactor and add default kyverno policies
1 parent bbb0f66 commit ed66920

24 files changed

+1118
-193
lines changed

‎applications/base/services/kyverno/default-ruleset/README.md‎ renamed to ‎applications/base/services/kyverno/README.md‎

File renamed without changes.

‎applications/base/services/kyverno/default-ruleset/disallow-capabilities-strict.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
# Source: kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml
3+
apiVersion: kyverno.io/v1
4+
kind: ClusterPolicy
5+
metadata:
6+
name: disallow-capabilities-strict
7+
annotations:
8+
policies.kyverno.io/title: Disallow Capabilities (Strict)
9+
policies.kyverno.io/category: Pod Security Standards (Restricted)
10+
policies.kyverno.io/severity: "high"
11+
policies.kyverno.io/minversion: 1.6.0
12+
kyverno.io/kyverno-version: v1.15.2
13+
kyverno.io/kubernetes-version: ">=1.25.0-0"
14+
policies.kyverno.io/subject: Pod
15+
policies.kyverno.io/description: >-
16+
Adding capabilities other than `NET_BIND_SERVICE` is disallowed. In addition,
17+
all containers must explicitly drop `ALL` capabilities.
18+
19+
labels:
20+
app.kubernetes.io/component: kyverno
21+
app.kubernetes.io/instance: kyverno-policies
22+
app.kubernetes.io/managed-by: Helm
23+
app.kubernetes.io/name: kyverno-policies
24+
app.kubernetes.io/part-of: kyverno-policies
25+
app.kubernetes.io/version: "3.5.2"
26+
helm.sh/chart: kyverno-policies-3.5.2
27+
spec:
28+
background: true
29+
failurePolicy: Ignore
30+
rules:
31+
- name: require-drop-all
32+
match:
33+
any:
34+
- resources:
35+
kinds:
36+
- Pod
37+
preconditions:
38+
all:
39+
- key: "{{ request.operation || 'BACKGROUND' }}"
40+
operator: NotEquals
41+
value: DELETE
42+
validate:
43+
failureAction: Audit
44+
allowExistingViolations: true
45+
message: >-
46+
Containers must drop `ALL` capabilities.
47+
foreach:
48+
- list: request.object.spec.[ephemeralContainers, initContainers, containers][]
49+
deny:
50+
conditions:
51+
all:
52+
- key: ALL
53+
operator: AnyNotIn
54+
value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
55+
- name: adding-capabilities-strict
56+
match:
57+
any:
58+
- resources:
59+
kinds:
60+
- Pod
61+
preconditions:
62+
all:
63+
- key: "{{ request.operation || 'BACKGROUND' }}"
64+
operator: NotEquals
65+
value: DELETE
66+
validate:
67+
failureAction: Audit
68+
allowExistingViolations: true
69+
message: >-
70+
Any capabilities added other than NET_BIND_SERVICE are disallowed.
71+
foreach:
72+
- list: request.object.spec.[ephemeralContainers, initContainers, containers][]
73+
deny:
74+
conditions:
75+
all:
76+
- key: "{{ element.securityContext.capabilities.add[] || `[]` }}"
77+
operator: AnyNotIn
78+
value:
79+
- NET_BIND_SERVICE
80+
- ""

‎applications/base/services/kyverno/default-ruleset/disallow-capabilities.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
# Source: kyverno-policies/templates/baseline/disallow-capabilities.yaml
3+
apiVersion: kyverno.io/v1
4+
kind: ClusterPolicy
5+
metadata:
6+
name: disallow-capabilities
7+
annotations:
8+
policies.kyverno.io/title: Disallow Capabilities
9+
policies.kyverno.io/category: Pod Security Standards (Baseline)
10+
policies.kyverno.io/severity: medium
11+
kyverno.io/kyverno-version: v1.16.0
12+
policies.kyverno.io/minversion: 1.6.0
13+
kyverno.io/kubernetes-version: ">=1.25.0-0"
14+
policies.kyverno.io/subject: Pod
15+
policies.kyverno.io/description: >-
16+
Adding capabilities beyond those listed in the policy must be disallowed.
17+
18+
labels:
19+
app.kubernetes.io/component: kyverno
20+
app.kubernetes.io/instance: kyverno-policies
21+
app.kubernetes.io/managed-by: Helm
22+
app.kubernetes.io/name: kyverno-policies
23+
app.kubernetes.io/part-of: kyverno-policies
24+
app.kubernetes.io/version: "3.6.0"
25+
helm.sh/chart: kyverno-policies-3.6.0
26+
spec:
27+
background: true
28+
failurePolicy: Ignore
29+
rules:
30+
- name: adding-capabilities
31+
match:
32+
any:
33+
- resources:
34+
kinds:
35+
- Pod
36+
preconditions:
37+
all:
38+
- key: "{{ request.operation || 'BACKGROUND' }}"
39+
operator: NotEquals
40+
value: DELETE
41+
validate:
42+
failureAction: Audit
43+
allowExistingViolations: true
44+
message: >-
45+
Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER,
46+
FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT)
47+
are disallowed.
48+
deny:
49+
conditions:
50+
all:
51+
- key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].securityContext.capabilities.add[] }}"
52+
operator: AnyNotIn
53+
value:
54+
- AUDIT_WRITE
55+
- CHOWN
56+
- DAC_OVERRIDE
57+
- FOWNER
58+
- FSETID
59+
- KILL
60+
- MKNOD
61+
- NET_BIND_SERVICE
62+
- SETFCAP
63+
- SETGID
64+
- SETPCAP
65+
- SETUID
66+
- SYS_CHROOT

‎applications/base/services/kyverno/default-ruleset/disallow-host-namespaces.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
# Source: kyverno-policies/templates/baseline/disallow-host-namespaces.yaml
3+
apiVersion: kyverno.io/v1
4+
kind: ClusterPolicy
5+
metadata:
6+
name: disallow-host-namespaces
7+
annotations:
8+
policies.kyverno.io/title: Disallow Host Namespaces
9+
policies.kyverno.io/category: Pod Security Standards (Baseline)
10+
policies.kyverno.io/severity: medium
11+
kyverno.io/kyverno-version: v1.16.0
12+
kyverno.io/kubernetes-version: ">=1.25.0-0"
13+
policies.kyverno.io/subject: Pod
14+
policies.kyverno.io/description: >-
15+
Host namespaces (Process ID namespace, Inter-Process Communication namespace, and
16+
network namespace) allow access to shared information and can be used to elevate
17+
privileges. Pods should not be allowed access to host namespaces. This policy ensures
18+
fields which make use of these host namespaces are unset or set to `false`.
19+
20+
labels:
21+
app.kubernetes.io/component: kyverno
22+
app.kubernetes.io/instance: kyverno-policies
23+
app.kubernetes.io/managed-by: Helm
24+
app.kubernetes.io/name: kyverno-policies
25+
app.kubernetes.io/part-of: kyverno-policies
26+
app.kubernetes.io/version: "3.6.0"
27+
helm.sh/chart: kyverno-policies-3.6.0
28+
spec:
29+
background: true
30+
failurePolicy: Ignore
31+
rules:
32+
- name: host-namespaces
33+
match:
34+
any:
35+
- resources:
36+
kinds:
37+
- Pod
38+
validate:
39+
failureAction: Audit
40+
allowExistingViolations: true
41+
message: >-
42+
Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
43+
spec.hostIPC, and spec.hostPID must be unset or set to `false`.
44+
pattern:
45+
spec:
46+
=(hostPID): "false"
47+
=(hostIPC): "false"
48+
=(hostNetwork): "false"

‎applications/base/services/kyverno/default-ruleset/disallow-host-path.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
# Source: kyverno-policies/templates/baseline/disallow-host-path.yaml
3+
apiVersion: kyverno.io/v1
4+
kind: ClusterPolicy
5+
metadata:
6+
name: disallow-host-path
7+
annotations:
8+
policies.kyverno.io/title: Disallow hostPath
9+
policies.kyverno.io/category: Pod Security Standards (Baseline)
10+
policies.kyverno.io/severity: medium
11+
policies.kyverno.io/subject: Pod,Volume
12+
kyverno.io/kyverno-version: v1.16.0
13+
kyverno.io/kubernetes-version: ">=1.25.0-0"
14+
policies.kyverno.io/description: >-
15+
HostPath volumes let Pods use host directories and volumes in containers.
16+
Using host resources can be used to access shared data or escalate privileges
17+
and should not be allowed. This policy ensures no hostPath volumes are in use.
18+
19+
labels:
20+
app.kubernetes.io/component: kyverno
21+
app.kubernetes.io/instance: kyverno-policies
22+
app.kubernetes.io/managed-by: Helm
23+
app.kubernetes.io/name: kyverno-policies
24+
app.kubernetes.io/part-of: kyverno-policies
25+
app.kubernetes.io/version: "3.6.0"
26+
helm.sh/chart: kyverno-policies-3.6.0
27+
spec:
28+
background: true
29+
failurePolicy: Ignore
30+
rules:
31+
- name: host-path
32+
match:
33+
any:
34+
- resources:
35+
kinds:
36+
- Pod
37+
validate:
38+
failureAction: Audit
39+
allowExistingViolations: true
40+
message: >-
41+
HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
42+
pattern:
43+
spec:
44+
=(volumes):
45+
- X(hostPath): "null"

‎applications/base/services/kyverno/default-ruleset/disallow-host-ports.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
# Source: kyverno-policies/templates/baseline/disallow-host-ports.yaml
3+
apiVersion: kyverno.io/v1
4+
kind: ClusterPolicy
5+
metadata:
6+
name: disallow-host-ports
7+
annotations:
8+
policies.kyverno.io/title: Disallow hostPorts
9+
policies.kyverno.io/category: Pod Security Standards (Baseline)
10+
policies.kyverno.io/severity: medium
11+
policies.kyverno.io/subject: Pod
12+
kyverno.io/kyverno-version: v1.16.0
13+
kyverno.io/kubernetes-version: ">=1.25.0-0"
14+
policies.kyverno.io/description: >-
15+
Access to host ports allows potential snooping of network traffic and should not be
16+
allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
17+
field is unset or set to `0`.
18+
19+
labels:
20+
app.kubernetes.io/component: kyverno
21+
app.kubernetes.io/instance: kyverno-policies
22+
app.kubernetes.io/managed-by: Helm
23+
app.kubernetes.io/name: kyverno-policies
24+
app.kubernetes.io/part-of: kyverno-policies
25+
app.kubernetes.io/version: "3.6.0"
26+
helm.sh/chart: kyverno-policies-3.6.0
27+
spec:
28+
background: true
29+
failurePolicy: Ignore
30+
rules:
31+
- name: host-ports-none
32+
match:
33+
any:
34+
- resources:
35+
kinds:
36+
- Pod
37+
validate:
38+
failureAction: Audit
39+
allowExistingViolations: true
40+
message: >-
41+
Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
42+
, spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
43+
must either be unset or set to `0`.
44+
pattern:
45+
spec:
46+
=(ephemeralContainers):
47+
- =(ports):
48+
- =(hostPort): 0
49+
=(initContainers):
50+
- =(ports):
51+
- =(hostPort): 0
52+
containers:
53+
- =(ports):
54+
- =(hostPort): 0

‎applications/base/services/kyverno/default-ruleset/disallow-host-process.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
# Source: kyverno-policies/templates/baseline/disallow-host-process.yaml
3+
apiVersion: kyverno.io/v1
4+
kind: ClusterPolicy
5+
metadata:
6+
name: disallow-host-process
7+
annotations:
8+
policies.kyverno.io/title: Disallow hostProcess
9+
policies.kyverno.io/category: Pod Security Standards (Baseline)
10+
policies.kyverno.io/severity: medium
11+
policies.kyverno.io/subject: Pod
12+
kyverno.io/kyverno-version: v1.16.0
13+
kyverno.io/kubernetes-version: ">=1.25.0-0"
14+
policies.kyverno.io/description: >-
15+
Windows pods offer the ability to run HostProcess containers which enables privileged
16+
access to the Windows node. Privileged access to the host is disallowed in the baseline
17+
policy. HostProcess pods are an alpha feature as of Kubernetes v1.22. This policy ensures
18+
the `hostProcess` field, if present, is set to `false`.
19+
20+
labels:
21+
app.kubernetes.io/component: kyverno
22+
app.kubernetes.io/instance: kyverno-policies
23+
app.kubernetes.io/managed-by: Helm
24+
app.kubernetes.io/name: kyverno-policies
25+
app.kubernetes.io/part-of: kyverno-policies
26+
app.kubernetes.io/version: "3.6.0"
27+
helm.sh/chart: kyverno-policies-3.6.0
28+
spec:
29+
background: true
30+
failurePolicy: Ignore
31+
rules:
32+
- name: host-process-containers
33+
match:
34+
any:
35+
- resources:
36+
kinds:
37+
- Pod
38+
validate:
39+
failureAction: Audit
40+
allowExistingViolations: true
41+
message: >-
42+
HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess,
43+
spec.containers[*].securityContext.windowsOptions.hostProcess, spec.initContainers[*].securityContext.windowsOptions.hostProcess,
44+
and spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must either be undefined
45+
or set to `false`.
46+
pattern:
47+
spec:
48+
=(ephemeralContainers):
49+
- =(securityContext):
50+
=(windowsOptions):
51+
=(hostProcess): "false"
52+
=(initContainers):
53+
- =(securityContext):
54+
=(windowsOptions):
55+
=(hostProcess): "false"
56+
containers:
57+
- =(securityContext):
58+
=(windowsOptions):
59+
=(hostProcess): "false"

0 commit comments

Comments
 (0)