Policies on Kyverno

Add AppArmor Annotations

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psp-migration/add-apparmor/add-apparmor.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-apparmor-annotations
 5 annotations:
 6 policies.kyverno.io/title: Add AppArmor Annotations
 7 policies.kyverno.io/category: PSP Migration
 8 policies.kyverno.io/subject: Pod,Annotation
 9 kyverno.io/kyverno-version: 1.10.0
10 kyverno.io/kubernetes-version: "1.24"
11 pod-policies.kyverno.io/autogen-controllers: none
12 policies.kyverno.io/description: >-
13 In the earlier Pod Security Policy controller, it was possible to define
14 a setting which would enable AppArmor for all the containers within a Pod so
15 they may be assigned the desired profile. Assigning an AppArmor profile, accomplished
16 via an annotation, is useful in that it allows secure defaults to be defined and may
17 also result in passing other validation rules such as those in the Pod Security Standards.
18 This policy mutates Pods to add an annotation for every container to enabled AppArmor
19 at the runtime/default level.
20spec:
21 rules:
22 - name: apparmor-runtime-default
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 preconditions:
29 all:
30 - key: "{{request.operation || 'BACKGROUND'}}"
31 operator: AnyIn
32 value:
33 - CREATE
34 - UPDATE
35 mutate:
36 foreach:
37 - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
38 patchStrategicMerge:
39 metadata:
40 annotations:
41 container.apparmor.security.beta.kubernetes.io/{{element.name}}: runtime/default

Add Capabilities

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psp-migration/add-capabilities/add-capabilities.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-capabilities
 5 annotations:
 6 policies.kyverno.io/title: Add Capabilities
 7 policies.kyverno.io/category: PSP Migration
 8 policies.kyverno.io/subject: Pod
 9 kyverno.io/kyverno-version: 1.10.0
10 kyverno.io/kubernetes-version: "1.24"
11 pod-policies.kyverno.io/autogen-controllers: none
12 policies.kyverno.io/description: >-
13 In the earlier Pod Security Policy controller, it was possible to configure a policy
14 to add capabilities to containers within a Pod. This made it easier to assign some basic defaults
15 rather than blocking Pods or to simply provide capabilities for certain workloads if not specified.
16 This policy mutates Pods to add the capabilities SETFCAP and SETUID so long as they are not listed
17 as dropped capabilities first.
18spec:
19 rules:
20 - name: add-setfcap-setuid
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 preconditions:
27 all:
28 - key: "{{request.operation || 'BACKGROUND'}}"
29 operator: AnyIn
30 value:
31 - CREATE
32 - UPDATE
33 mutate:
34 foreach:
35 - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
36 preconditions:
37 all:
38 - key: SETFCAP
39 operator: AnyNotIn
40 value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
41 patchesJson6902: |-
42 - path: /spec/containers/{{elementIndex}}/securityContext/capabilities/add/-
43 op: add
44 value: SETFCAP
45 - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
46 preconditions:
47 all:
48 - key: SETUID
49 operator: AnyNotIn
50 value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
51 patchesJson6902: |-
52 - path: /spec/containers/{{elementIndex}}/securityContext/capabilities/add/-
53 op: add
54 value: SETUID

Add CAST AI Removal Disabled

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/castai/add-castai-removal-disabled/add-castai-removal-disabled.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-castai-removal-disabled
 5 annotations:
 6 policies.kyverno.io/title: Add CAST AI Removal Disabled
 7 policies.kyverno.io/category: CAST AI
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: "Job, CronJob"
10 kyverno.io/kyverno-version: "1.9"
11 kyverno.io/kubernetes-version: "1.25"
12 policies.kyverno.io/description: >- 
13 CAST AI will not downscale a node that includes a pod with the 
14 autoscaling.cast.ai/removal-disabled="true" label on it, this protects
15 sensitive workloads from being evicted and can be attributed to any pod to
16 protect against unwanted downscaling. This policy will mutate jobs and 
17 cronjobs to add the removal-disabled label to protect against eviction. 
18spec:
19 rules:
20 - name: do-not-evict-jobs
21 match:
22 any:
23 - resources:
24 kinds:
25 - Job
26 mutate:
27 patchStrategicMerge:
28 spec:
29 template:
30 metadata:
31 labels:
32 autoscaling.cast.ai/removal-disabled: "true"
33 - name: do-not-evict-cronjobs
34 match:
35 any:
36 - resources:
37 kinds:
38 - CronJob
39 mutate:
40 patchStrategicMerge:
41 spec:
42 jobTemplate:
43 spec:
44 template:
45 metadata:
46 labels:
47 autoscaling.cast.ai/removal-disabled: "true"

Add Certificates as a Volume

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-certificates-volume/add-certificates-volume.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-certificates-volume
 5 annotations:
 6 policies.kyverno.io/title: Add Certificates as a Volume
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Pod,Volume
 9 kyverno.io/kyverno-version: 1.6.0
10 kyverno.io/kubernetes-version: "1.21"
11 policies.kyverno.io/minversion: 1.5.0
12 pod-policies.kyverno.io/autogen-controllers: DaemonSet,Deployment,Job,StatefulSet
13 policies.kyverno.io/description: >-
14 In some cases you would need to trust custom CA certificates for all the containers of a Pod.
15 It makes sense to be in a ConfigMap so that you can automount them by only setting an annotation.
16 This policy adds a volume to all containers in a Pod containing the certificate if the annotation
17 called `inject-certs` with value `enabled` is found.
18spec:
19 background: false
20 rules:
21 - name: add-ssl-certs
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 preconditions:
28 all:
29 - key: '{{request.object.metadata.annotations."inject-certs" || ""}}'
30 operator: Equals
31 value: enabled
32 - key: "{{request.operation || 'BACKGROUND'}}"
33 operator: AnyIn
34 value:
35 - CREATE
36 - UPDATE
37 mutate:
38 foreach:
39 - list: "request.object.spec.containers"
40 patchStrategicMerge:
41 spec:
42 containers:
43 - name: "{{ element.name }}"
44 volumeMounts:
45 - name: etc-ssl-certs
46 mountPath: /etc/ssl/certs
47 volumes:
48 - name: etc-ssl-certs
49 configMap:
50 name: ca-pemstore

Add Default Resources

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-default-resources/add-default-resources.yaml

 1apiVersion : kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-default-resources
 5 annotations:
 6 policies.kyverno.io/title: Add Default Resources
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.10.0-alpha.2
10 policies.kyverno.io/minversion: 1.7.0
11 kyverno.io/kubernetes-version: "1.26"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Pods which don't specify at least resource requests are assigned a QoS class
15 of BestEffort which can hog resources for other Pods on Nodes. At a minimum,
16 all Pods should specify resource requests in order to be labeled as the QoS
17 class Burstable. This sample mutates any container in a Pod which doesn't
18 specify memory or cpu requests to apply some sane defaults.
19spec:
20 background: false
21 rules:
22 - name: add-default-requests
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 preconditions:
29 any:
30 - key: "{{request.operation || 'BACKGROUND'}}"
31 operator: AnyIn
32 value:
33 - CREATE
34 - UPDATE
35 mutate:
36 foreach:
37 - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
38 patchStrategicMerge:
39 spec:
40 containers:
41 - (name): "{{element.name}}"
42 resources:
43 requests:
44 +(memory): "100Mi"
45 +(cpu): "100m"

Add Default securityContext

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-default-securitycontext/add-default-securitycontext.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-default-securitycontext
 5 annotations:
 6 policies.kyverno.io/title: Add Default securityContext
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Pod
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 A Pod securityContext entry defines fields such as the user and group which should be used to run the Pod.
12 Sometimes choosing default values for users rather than blocking is a better alternative to not impede
13 such Pod definitions. This policy will mutate a Pod to set `runAsNonRoot`, `runAsUser`, `runAsGroup`, and 
14 `fsGroup` fields within the Pod securityContext if they are not already set.
15spec:
16 rules:
17 - name: add-default-securitycontext
18 match:
19 any:
20 - resources:
21 kinds:
22 - Pod
23 mutate:
24 patchStrategicMerge:
25 spec:
26 securityContext:
27 +(runAsNonRoot): true
28 +(runAsUser): 1000
29 +(runAsGroup): 3000
30 +(fsGroup): 2000

Add emptyDir sizeLimit

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-emptydir-sizelimit/add-emptydir-sizelimit.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-emptydir-sizelimit
 5 annotations:
 6 pod-policies.kyverno.io/autogen-controllers: none
 7 policies.kyverno.io/title: Add emptyDir sizeLimit
 8 policies.kyverno.io/category: Other
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kyverno-version: 1.7.3,1.8.0-rc2
12 kyverno.io/kubernetes-version: "1.24"
13 policies.kyverno.io/description: >-
14 When a Pod requests an emptyDir, by default it does not have a size limit which
15 may allow it to consume excess or all of the space in the medium backing the volume.
16 This can quickly overrun a Node and may result in a denial of service for other
17 workloads. This policy adds a sizeLimit field to all Pods mounting emptyDir
18 volumes, if not present, and sets it to 100Mi.
19spec: 
20 rules: 
21 - name: mutate-emptydir
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 mutate:
28 foreach:
29 - list: "request.object.spec.volumes[]"
30 preconditions:
31 all:
32 - key: "{{element.keys(@)}}"
33 operator: AnyIn
34 value: emptyDir
35 - key: "{{element.emptyDir.sizeLimit || ''}}"
36 operator: Equals
37 value: ''
38 patchesJson6902: |-
39 - path: "/spec/volumes/{{elementIndex}}/emptyDir/sizeLimit"
40 op: add
41 value: 100Mi

Add Environment Variables from ConfigMap

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-env-vars-from-cm/add-env-vars-from-cm.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-env-vars-from-cm
 5 annotations:
 6 policies.kyverno.io/title: Add Environment Variables from ConfigMap
 7 policies.kyverno.io/minversion: 1.6.0
 8 policies.kyverno.io/subject: Pod
 9 policies.kyverno.io/category: Other
10 policies.kyverno.io/description: >-
11 Instead of defining a common set of environment variables multiple
12 times either in manifests or separate policies, Pods can reference
13 entire collections stored in a ConfigMap. This policy mutates all
14 initContainers (if present) and containers in a Pod with environment
15 variables defined in a ConfigMap named `nsenvvars` that must exist
16 in the destination Namespace. 
17spec:
18 rules:
19 - name: add-env-vars-from-cm
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 mutate:
26 patchStrategicMerge:
27 spec:
28 initContainers:
29 - (name): "*"
30 envFrom:
31 - configMapRef:
32 name: nsenvvars
33 containers:
34 - (name): "*"
35 envFrom:
36 - configMapRef:
37 name: nsenvvars

Add Image as Environment Variable

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-image-as-env-var/add-image-as-env-var.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-image-as-env-var
 5 annotations:
 6 pod-policies.kyverno.io/autogen-controllers: none
 7 policies.kyverno.io/title: Add Image as Environment Variable
 8 policies.kyverno.io/category: Other
 9 policies.kyverno.io/severity: medium
10 kyverno.io/kyverno-version: 1.10.0-alpha.2
11 kyverno.io/kubernetes-version: "1.26"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 The Kubernetes downward API only has the ability to express so many
15 options as environment variables. The image consumed in a Pod is commonly
16 needed to make the application aware of some logic it must take. This policy
17 takes the value of the `image` field and adds it as an environment variable
18 to Pods.
19spec:
20 rules:
21 - name: pod-containers-inject-image
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 mutate:
28 foreach:
29 - list: request.object.spec.containers[]
30 patchesJson6902: |-
31 - op: add
32 path: /spec/containers/{{elementIndex}}/env/-
33 value:
34 name: K8S_IMAGE
35 value: "{{ element.image }}"

Add imagePullSecrets

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-imagepullsecrets/add-imagepullsecrets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-imagepullsecrets
 5 annotations:
 6 policies.kyverno.io/title: Add imagePullSecrets
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Pod
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 Images coming from certain registries require authentication in order to pull them,
12 and the kubelet uses this information in the form of an imagePullSecret to pull
13 those images on behalf of your Pod. This policy searches for images coming from a
14 registry called `corp.reg.com` and, if found, will mutate the Pod to add an
15 imagePullSecret called `my-secret`.
16spec:
17 rules:
18 - name: add-imagepullsecret
19 match:
20 any:
21 - resources:
22 kinds:
23 - Pod
24 mutate:
25 patchStrategicMerge:
26 spec:
27 containers:
28 - <(image): "corp.reg.com/*"
29 imagePullSecrets:
30 - name: my-secret

Add imagePullSecrets for Containers and InitContainers

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-imagepullsecrets-for-containers-and-initcontainers/add-imagepullsecrets-for-containers-and-initcontainers.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-imagepullsecrets-for-containers-and-initcontainers
 5 annotations:
 6 policies.kyverno.io/title: Add imagePullSecrets for Containers and InitContainers
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Pod
 9 policies.kyverno.io/minversion: 1.6.0
10 kyverno.io/kyverno-version: 1.6.2
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/description: >-
13 Images coming from certain registries require authentication in order to pull them,
14 and the kubelet uses this information in the form of an imagePullSecret to pull
15 those images on behalf of your Pod. This policy searches for images coming from a
16 registry called `corp.reg.com` referenced by either one of the containers or one 
17 of the init containers and, if found, will mutate the Pod to add an
18 imagePullSecret called `my-secret`.
19spec:
20 rules:
21 - name: add-imagepullsecret
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 preconditions:
28 any:
29 - key: "corp.reg.com"
30 operator: AnyIn
31 value: "{{ images.initContainers.*.registry || `[]` }}"
32 - key: "corp.reg.com" 
33 operator: AnyIn
34 value: "{{ images.containers.*.registry }}"
35 mutate:
36 patchStrategicMerge:
37 spec:
38 imagePullSecrets:
39 - name: my-secret

Add Istio Ambient Mode

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/istio/add-ambient-mode-namespace/add-ambient-mode-namespace.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-ambient-mode-namespace
 5 annotations:
 6 policies.kyverno.io/title: Add Istio Ambient Mode
 7 policies.kyverno.io/category: Istio
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.8.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 In order for Istio to include namespaces in ambient mode, the label `istio.io/dataplane-mode` 
15 must be set to `ambient`. As an alternative to rejecting Namespace definitions which don't already 
16 contain this label, it can be added automatically. This policy adds the label `istio.io/dataplane-mode`
17 set to `ambient` for all new Namespaces.
18spec:
19 rules:
20 - name: add-ambient-mode-enabled
21 match:
22 any:
23 - resources:
24 kinds:
25 - Namespace
26 exclude:
27 any:
28 - resources:
29 names:
30 - kube-system
31 - istio-system 
32 mutate:
33 patchStrategicMerge:
34 metadata:
35 labels:
36 istio.io/dataplane-mode: ambient

Add Istio Sidecar Injection

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/istio/add-sidecar-injection-namespace/add-sidecar-injection-namespace.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-sidecar-injection-namespace
 5 annotations:
 6 policies.kyverno.io/title: Add Istio Sidecar Injection
 7 policies.kyverno.io/category: Istio
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.8.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 In order for Istio to inject sidecars to workloads deployed into Namespaces, the label
15 `istio-injection` must be set to `enabled`. As an alternative to rejecting Namespace definitions
16 which don't already contain this label, it can be added automatically. This policy adds the label
17 `istio-inject` set to `enabled` for all new Namespaces.
18spec:
19 rules:
20 - name: add-istio-injection-enabled
21 match:
22 any:
23 - resources:
24 kinds:
25 - Namespace
26 mutate:
27 patchStrategicMerge:
28 metadata:
29 labels:
30 istio-injection: enabled

Add Karpenter Do Not Evict

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/karpenter/add-karpenter-donot-evict/add-karpenter-donot-evict.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-karpenter-donot-evict
 5 annotations:
 6 policies.kyverno.io/title: Add Karpenter Do Not Evict
 7 policies.kyverno.io/category: Karpenter, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.7.1
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >- 
14 If a Pod exists with the annotation `karpenter.sh/do-not-evict: true` on a Node,
15 and a request is made to delete the Node, Karpenter will not drain any Pods from
16 that Node or otherwise try to delete the Node. This is useful for Pods that should
17 run uninterrupted to completion. This policy mutates Jobs and CronJobs
18 so that Pods spawned by them will contain the `karpenter.sh/do-not-evict: true` annotation.
19spec:
20 rules:
21 - name: do-not-evict-jobs
22 match:
23 any:
24 - resources:
25 kinds:
26 - Job
27 mutate:
28 patchStrategicMerge:
29 spec:
30 template:
31 metadata:
32 annotations:
33 karpenter.sh/do-not-evict: "true"
34 - name: do-not-evict-cronjobs
35 match:
36 any:
37 - resources:
38 kinds:
39 - CronJob
40 mutate:
41 patchStrategicMerge:
42 spec:
43 jobTemplate:
44 spec:
45 template:
46 metadata:
47 annotations:
48 karpenter.sh/do-not-evict: "true"

Add Karpenter nodeSelector

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/karpenter/add-karpenter-nodeselector/add-karpenter-nodeselector.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-karpenter-nodeselector
 5 annotations:
 6 policies.kyverno.io/title: Add Karpenter nodeSelector
 7 policies.kyverno.io/category: Karpenter, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.7.1
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >- 
14 Selecting the correct Node(s) provisioned by Karpenter is a way to specify
15 the appropriate resource landing zone for a workload. This policy injects a
16 nodeSelector map into the Pod based on the Namespace type where it is deployed.
17spec:
18 rules:
19 - name: add-medium
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 namespaceSelector:
26 matchLabels:
27 type: medium 
28 mutate:
29 patchStrategicMerge:
30 spec:
31 nodeSelector:
32 kubernetes.io/arch: amd64
33 karpenter.sh/capacity-type: spot
34 - name: add-large
35 match:
36 any:
37 - resources:
38 kinds:
39 - Pod
40 namespaceSelector:
41 matchLabels:
42 type: large
43 mutate:
44 patchStrategicMerge:
45 spec:
46 nodeSelector:
47 kubernetes.io/arch: amd64
48 karpenter.sh/capacity-type: on-demand

Add Labels

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-labels/add-labels.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-labels
 5 annotations:
 6 policies.kyverno.io/title: Add Labels
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/severity: medium
10 policies.kyverno.io/subject: Label
11 policies.kyverno.io/description: >-
12 Labels are used as an important source of metadata describing objects in various ways
13 or triggering other functionality. Labels are also a very basic concept and should be
14 used throughout Kubernetes. This policy performs a simple mutation which adds a label
15 `foo=bar` to Pods, Services, ConfigMaps, and Secrets.
16spec:
17 rules:
18 - name: add-labels
19 match:
20 any:
21 - resources:
22 kinds:
23 - Pod
24 - Service
25 - ConfigMap
26 - Secret
27 mutate:
28 patchStrategicMerge:
29 metadata:
30 labels:
31 foo: bar

Add Linkerd Mesh Injection

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/linkerd/add-linkerd-mesh-injection/add-linkerd-mesh-injection.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-linkerd-mesh-injection
 5 annotations:
 6 policies.kyverno.io/title: Add Linkerd Mesh Injection
 7 policies.kyverno.io/category: Linkerd
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Namespace, Annotation
10 policies.kyverno.io/description: >-
11 Sidecar proxy injection in Linkerd may be handled at the Namespace level by
12 setting the annotation `linkerd.io/inject` to `enabled`. In addition, a second
13 annotation may be applied which controls the Pod startup behavior. This policy
14 sets the annotations, if not present, `linkerd.io/inject` and `config.linkerd.io/proxy-await`
15 to `enabled` on all new Namespaces.
16spec:
17 rules:
18 - name: add-mesh-annotations
19 match:
20 any:
21 - resources:
22 kinds:
23 - Namespace
24 mutate:
25 patchStrategicMerge:
26 metadata:
27 annotations:
28 +(linkerd.io/inject): enabled
29 +(config.linkerd.io/proxy-await): enabled

Add Linkerd Policy Annotation

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/linkerd/add-linkerd-policy-annotation/add-linkerd-policy-annotation.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-linkerd-policy-annotation
 5 annotations:
 6 policies.kyverno.io/title: Add Linkerd Policy Annotation
 7 policies.kyverno.io/category: Linkerd
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Namespace,Annotation
10 policies.kyverno.io/description: >-
11 Linkerd will, by default, allow all incoming traffic to Pods in the mesh
12 including that from outside the cluster network. In many cases, this default
13 needs to be changed to deny all traffic so it may be selectively
14 opened using Linkerd policy objects. This policy sets the annotation
15 `config.linkerd.io/default-inbound-policy` to `deny`, if not present, for new Namespaces.
16 It can be customized with exclusions to more tightly control its application.
17spec:
18 rules:
19 - name: deny-inbound-namespace
20 match:
21 any:
22 - resources:
23 kinds:
24 - Namespace
25 mutate:
26 patchStrategicMerge:
27 metadata:
28 annotations:
29 +(config.linkerd.io/default-inbound-policy): deny

Add ndots

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-ndots/add-ndots.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-ndots
 5 annotations:
 6 policies.kyverno.io/title: Add ndots
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Pod
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 The ndots value controls where DNS lookups are first performed in a cluster
12 and needs to be set to a lower value than the default of 5 in some cases.
13 This policy mutates all Pods to add the ndots option with a value of 1.
14spec:
15 rules:
16 - name: add-ndots
17 match:
18 any:
19 - resources:
20 kinds:
21 - Pod
22 mutate:
23 patchStrategicMerge:
24 spec:
25 dnsConfig:
26 options:
27 - name: ndots
28 value: "1"

Add Network Policy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/add-network-policy/add-network-policy.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-networkpolicy
 5 annotations:
 6 policies.kyverno.io/title: Add Network Policy
 7 policies.kyverno.io/category: Multi-Tenancy, EKS Best Practices
 8 policies.kyverno.io/subject: NetworkPolicy
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 By default, Kubernetes allows communications across all Pods within a cluster.
12 The NetworkPolicy resource and a CNI plug-in that supports NetworkPolicy must be used to restrict
13 communications. A default NetworkPolicy should be configured for each Namespace to
14 default deny all ingress and egress traffic to the Pods in the Namespace. Application
15 teams can then configure additional NetworkPolicy resources to allow desired traffic
16 to application Pods from select sources. This policy will create a new NetworkPolicy resource
17 named `default-deny` which will deny all traffic anytime a new Namespace is created.
18spec:
19 rules:
20 - name: default-deny
21 match:
22 any:
23 - resources:
24 kinds:
25 - Namespace
26 generate:
27 apiVersion: networking.k8s.io/v1
28 kind: NetworkPolicy
29 name: default-deny
30 namespace: "{{request.object.metadata.name}}"
31 synchronize: true
32 data:
33 spec:
34 # select all pods in the namespace
35 podSelector: {}
36 # deny all traffic
37 policyTypes:
38 - Ingress
39 - Egress

Add Network Policy for DNS

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/add-networkpolicy-dns/add-networkpolicy-dns.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-networkpolicy-dns
 5 annotations:
 6 policies.kyverno.io/title: Add Network Policy for DNS
 7 policies.kyverno.io/category: Multi-Tenancy, EKS Best Practices
 8 policies.kyverno.io/subject: NetworkPolicy
 9 kyverno.io/kyverno-version: 1.6.2
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/description: >-
13 By default, Kubernetes allows communication across all Pods within a cluster. The NetworkPolicy
14 resource and a CNI plug-in that supports NetworkPolicy must be used to restrict communication.
15 A default NetworkPolicy should be configured for each Namespace to deny all egress traffic
16 from the Pods while still allowing DNS resolution. Application teams can then configure additional
17 NetworkPolicy resources to allow desired traffic to application Pods from select sources. This
18 policy will create a new NetworkPolicy resource named `allow-dns` when a new Namespace is created, 
19 which will deny all egress traffic while still allowing DNS queries to the kube-system Namespace.
20spec:
21 rules:
22 - name: add-netpol-dns
23 match:
24 any:
25 - resources: 
26 kinds:
27 - Namespace
28 generate:
29 apiVersion: networking.k8s.io/v1
30 kind: NetworkPolicy
31 name: allow-dns
32 namespace: "{{request.object.metadata.name}}"
33 synchronize: false
34 data:
35 spec:
36 podSelector:
37 matchLabels: {}
38 policyTypes:
39 - Egress
40 egress:
41 - to:
42 - namespaceSelector:
43 matchLabels:
44 name: kube-system
45 ports:
46 - protocol: UDP
47 port: 53

Add Node Affinity

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-node-affinity/add-node-affinity.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-node-affinity
 5 annotations:
 6 policies.kyverno.io/title: Add Node Affinity
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Deployment
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.21"
12 policies.kyverno.io/description: >-
13 Node affinity, similar to node selection, is a way to specify which node(s) on which Pods will be scheduled
14 but based on more complex conditions. This policy will add node affinity to a Deployment and if one already
15 exists an expression will be added to it.
16spec:
17 background: false
18 rules:
19 - name: add-node-affinity-deployment
20 match:
21 any:
22 - resources:
23 kinds:
24 - Deployment
25 mutate:
26 patchesJson6902: |-
27 - path: "/spec/template/spec/affinity/nodeAffinity/requiredDuringSchedulingIgnoredDuringExecution/nodeSelectorTerms/-1/matchExpressions/-1"
28 op: add
29 value:
30 key: zone_weight
31 operator: Lt
32 values:
33 - "400"

Add nodeSelector

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-nodeSelector/add-nodeSelector.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-nodeselector
 5 annotations:
 6 policies.kyverno.io/title: Add nodeSelector
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Pod
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 The nodeSelector field uses labels to select the node on which a Pod can be scheduled.
12 This can be useful when Pods have specific needs that only certain nodes in a cluster can provide.
13 This policy adds the nodeSelector field to a Pod spec and configures it with labels `foo` and `color`.
14spec:
15 rules:
16 - name: add-nodeselector
17 match:
18 any:
19 - resources:
20 kinds:
21 - Pod
22 # Adds the `nodeSelector` field to any Pod with two labels.
23 mutate:
24 patchStrategicMerge:
25 spec:
26 nodeSelector:
27 foo: bar
28 color: orange

Add Pod Anti-Affinity

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/create-pod-antiaffinity/create-pod-antiaffinity.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: insert-pod-antiaffinity
 5 annotations:
 6 policies.kyverno.io/title: Add Pod Anti-Affinity
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Deployment, Pod
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 Applications may involve multiple replicas of the same Pod for availability as well as scale
12 purposes, yet Kubernetes does not by default provide a solution for availability. This policy
13 sets a Pod anti-affinity configuration on Deployments which contain an `app` label if it is
14 not already present.
15spec:
16 rules:
17 - name: insert-pod-antiaffinity
18 match:
19 any:
20 - resources:
21 kinds:
22 - Deployment
23 preconditions:
24 # This precondition selects Pods with the label `app` defined
25 all:
26 - key: "{{request.object.spec.template.metadata.labels.app || ''}}"
27 operator: NotEquals
28 value: ""
29 # Mutates the Deployment resource to add fields.
30 mutate:
31 patchStrategicMerge:
32 spec:
33 template:
34 spec:
35 # Add the `affinity`if not already specified.
36 +(affinity):
37 +(podAntiAffinity):
38 +(preferredDuringSchedulingIgnoredDuringExecution):
39 - weight: 1
40 podAffinityTerm:
41 topologyKey: "kubernetes.io/hostname"
42 labelSelector:
43 matchExpressions:
44 - key: app
45 operator: In
46 values:
47 - "{{request.object.spec.template.metadata.labels.app}}"

Add Pod Disruption Budget

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/create-default-pdb/create-default-pdb.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: create-default-pdb
 5 annotations:
 6 policies.kyverno.io/title: Add Pod Disruption Budget
 7 policies.kyverno.io/category: Sample
 8 kyverno.io/kyverno-version: 1.6.2
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/subject: Deployment
11 policies.kyverno.io/description: >-
12 A PodDisruptionBudget limits the number of Pods of a replicated application that
13 are down simultaneously from voluntary disruptions. For example, a quorum-based
14 application would like to ensure that the number of replicas running is never brought
15 below the number needed for a quorum. As an application owner, you can create a PodDisruptionBudget (PDB)
16 for each application. This policy will create a PDB resource whenever a new Deployment is created.
17spec:
18 rules:
19 - name: create-default-pdb
20 match:
21 any:
22 - resources:
23 kinds:
24 - Deployment
25 generate:
26 apiVersion: policy/v1
27 kind: PodDisruptionBudget
28 name: "{{request.object.metadata.name}}-default-pdb"
29 namespace: "{{request.object.metadata.namespace}}"
30 data:
31 spec:
32 minAvailable: 1
33 selector: "{{request.object.spec.selector}}"

Add Pod priorityClassName

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-pod-priorityclassname/add-pod-priorityclassname.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-pod-priorityclassname
 5 annotations:
 6 policies.kyverno.io/title: Add Pod priorityClassName
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 pod-policies.kyverno.io/autogen-controllers: none
11 kyverno.io/kyverno-version: 1.7.1
12 policies.kyverno.io/minversion: 1.6.0
13 kyverno.io/kubernetes-version: "1.23"
14 policies.kyverno.io/description: >- 
15 A Pod PriorityClass is used to provide a guarantee on the scheduling of a Pod relative to others.
16 This policy adds the priorityClassName of `non-production` to any Pod controller deployed
17 into a Namespace that does not have the label env=production.
18spec:
19 background: false
20 rules:
21 - name: add-priorityclass-controllers
22 match:
23 any:
24 - resources:
25 kinds:
26 - Deployment
27 - DaemonSet
28 - StatefulSet
29 - Job
30 namespaceSelector:
31 matchExpressions:
32 - key: env
33 operator: NotIn
34 values:
35 - production
36 mutate:
37 patchesJson6902: |-
38 - op: remove
39 path: '/spec/template/spec/priority'
40 - op: add
41 path: /spec/template/spec/priorityClassName
42 value: 'non-production'
43 - name: add-priorityclass-cronjobs
44 match:
45 any:
46 - resources:
47 kinds:
48 - CronJob
49 namespaceSelector:
50 matchExpressions:
51 - key: env
52 operator: NotIn
53 values:
54 - production
55 mutate:
56 patchesJson6902: |-
57 - op: remove
58 path: '/spec/jobTemplate/spec/template/spec/priority'
59 - op: add
60 path: /spec/jobTemplate/spec/template/spec/priorityClassName
61 value: 'non-production'

Add Pod Proxies

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-pod-proxies/add-pod-proxies.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-pod-proxies
 5 annotations:
 6 policies.kyverno.io/title: Add Pod Proxies
 7 policies.kyverno.io/subject: Pod
 8 policies.kyverno.io/category: Sample
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 In restricted environments, Pods may not be allowed to egress directly to all destinations
12 and some overrides to specific addresses may need to go through a corporate proxy.
13 This policy adds proxy information to Pods in the form of environment variables.
14 It will add the `env` array if not present. If any Pods have any of these
15 env vars, they will be overwritten with the value(s) in this policy.
16spec:
17 rules:
18 - name: add-pod-proxies
19 match:
20 any:
21 - resources:
22 kinds:
23 - Pod
24 mutate:
25 patchStrategicMerge:
26 spec:
27 containers:
28 - (name): "*"
29 env:
30 - name: HTTP_PROXY
31 value: http://proxy.corp.domain:8080
32 - name: HTTPS_PROXY
33 value: https://secureproxy.corp.domain:8080
34 - name: NO_PROXY
35 value: localhost,*.example.com

Add prefix to external secret

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/external-secret-operator/add-external-secret-prefix/add-external-secret-prefix.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-external-secret-prefix
 5 annotations:
 6 policies.kyverno.io/title: Add prefix to external secret
 7 policies.kyverno.io/category: ExternalSecretOperator
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: ExternalSecret
10 kyverno.io/kyverno-version: 1.7.1
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >- 
14 This Policy mutates secretRef key to add a prefix.
15 External Secret Operator proposes to use kyverno to force ExternalSecrets
16 to have namespace prefix so that kubernetes administrators do not need to
17 define permissions and users per namespace.
18 Doing this developers are abstracted by administrators naming convention and will not 
19 be able to access secrets from other namespaces.
20 In this example, in the JSON patch change "prefix-" to your preferred prefix. For example: {{ request.namespace }}
21spec:
22 rules:
23 - name: add-external-secret-prefix
24 match:
25 any:
26 - resources:
27 kinds:
28 - external-secrets.io/v1beta1/ExternalSecret
29 mutate:
30 foreach: 
31 - list: "request.object.spec.data"
32 patchesJson6902: |-
33 - path: /spec/data/{{elementIndex}}/remoteRef
34 op: add
35 value:
36 key: "prefix-{{element.remoteRef.key}}"
37 property: "{{element.remoteRef.property}}"
38 conversionStrategy: "{{element.remoteRef.conversionStrategy}}"
39 decodingStrategy: "{{element.remoteRef.decodingStrategy}}"

Add priority class for DaemonSets to help Karpenter.

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/karpenter/add-karpenter-daemonset-priority-class/add-karpenter-daemonset-priority-class.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-karpenter-daemonset-priority-class
 5 annotations:
 6 policies.kyverno.io/title: Add priority class for DaemonSets to help Karpenter.
 7 policies.kyverno.io/subject: DaemonSet
 8 policies.kyverno.io/category: Karpenter
 9 policies.kyverno.io/severity: medium
10 kyverno.io/kyverno-version: 1.9.3
11 kyverno.io/kubernetes-version: "1.26"
12 policies.kyverno.io/minversion: 1.6.0
13 policies.kyverno.io/description: >-
14 When a DaemonSet is added to a cluster every node will get a new pod. There may not be 
15 enough room for this on every node. Karpenter cannot provision extra nodes just for the 
16 DaemonSet because the new pods are not scheduled the way regular pods are. It would require
17 parallel scheduling logic that is not proper to Kubernetes. Therefore, eviction of regular 
18 pods should happen instead. This can be achieved with the priority class system-node-critical.
19spec:
20 rules:
21 - name: add-karpenter-daemonset-priority-class
22 match:
23 any:
24 - resources:
25 kinds:
26 - DaemonSet
27 mutate:
28 patchStrategicMerge:
29 spec:
30 template:
31 spec:
32 priorityClassName: system-node-critical

Add Privileged Label to Existing Namespaces

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psa/add-privileged-existing-namespaces/add-privileged-existing-namespaces.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-privileged-existing-namespaces
 5 annotations:
 6 policies.kyverno.io/title: Add Privileged Label to Existing Namespaces
 7 policies.kyverno.io/category: Pod Security Admission
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Namespace
10 kyverno.io/kyverno-version: 1.8.0
11 policies.kyverno.io/minversion: 1.7.0
12 kyverno.io/kubernetes-version: "1.24"
13 policies.kyverno.io/description: >-
14 When Pod Security Admission is configured with a cluster-wide AdmissionConfiguration file
15 which sets either baseline or restricted, for example in many PaaS CIS profiles, it may
16 be necessary to relax this to privileged on a per-Namespace basis so that more
17 granular control can be provided. This policy labels new and existing Namespaces, except
18 that of kube-system, with the `pod-security.kubernetes.io/enforce: privileged` label.
19spec:
20 mutateExistingOnPolicyUpdate: true
21 rules:
22 - name: label-privileged-namespaces
23 match:
24 any:
25 - resources:
26 kinds:
27 - Namespace
28 mutate:
29 targets:
30 - apiVersion: v1
31 kind: Namespace
32 patchStrategicMerge:
33 metadata:
34 <(name): "!kube-system"
35 labels:
36 pod-security.kubernetes.io/enforce: privileged

Add PSA Labels

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psa/add-psa-labels/add-psa-labels.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-psa-labels
 5 annotations:
 6 policies.kyverno.io/title: Add PSA Labels
 7 policies.kyverno.io/category: Pod Security Admission, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.7.1
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 Pod Security Admission (PSA) can be controlled via the assignment of labels
15 at the Namespace level which define the Pod Security Standard (PSS) profile
16 in use and the action to take. If not using a cluster-wide configuration
17 via an AdmissionConfiguration file, Namespaces must be explicitly labeled.
18 This policy assigns the labels `pod-security.kubernetes.io/enforce=baseline`
19 and `pod-security.kubernetes.io/warn=restricted` to all new Namespaces if
20 those labels are not included.
21spec:
22 rules:
23 - name: add-baseline-enforce-restricted-warn
24 match:
25 any:
26 - resources:
27 kinds:
28 - Namespace
29 mutate:
30 patchStrategicMerge:
31 metadata:
32 labels:
33 +(pod-security.kubernetes.io/enforce): baseline
34 +(pod-security.kubernetes.io/warn): restricted

Add PSA Namespace Reporting

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psa/add-psa-namespace-reporting/add-psa-namespace-reporting.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-psa-namespace-reporting
 5 annotations:
 6 policies.kyverno.io/title: Add PSA Namespace Reporting
 7 policies.kyverno.io/category: Pod Security Admission, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.7.1
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 This policy is valuable as it ensures that all namespaces within a Kubernetes 
15 cluster are labeled with Pod Security Admission (PSA) labels, which are crucial
16 for defining security levels and ensuring that pods within a namespace operate 
17 under the defined Pod Security Standard (PSS). By enforcing namespace labeling,
18 This policy audits namespaces to verify the presence of PSA labels. 
19 If a namespace is found without the required labels, it generates and maintain 
20 and ClusterPolicy Report in default namespace. 
21 This helps administrators identify namespaces that do not comply with the 
22 organization's security practices and take appropriate action to rectify the 
23 situation.
24spec:
25 validationFailureAction: Audit
26 background: true
27 rules:
28 - name: check-namespace-labels
29 match:
30 any:
31 - resources:
32 kinds:
33 - Namespace
34 validate:
35 message: This Namespace is missing a PSA label.
36 pattern:
37 metadata:
38 labels:
39 pod-security.kubernetes.io/*: "?*"

Add PSA Namespace Reporting in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psa-cel/add-psa-namespace-reporting/add-psa-namespace-reporting.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-psa-namespace-reporting
 5 annotations:
 6 policies.kyverno.io/title: Add PSA Namespace Reporting in CEL expressions
 7 policies.kyverno.io/category: Pod Security Admission, EKS Best Practices in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 This policy is valuable as it ensures that all namespaces within a Kubernetes 
15 cluster are labeled with Pod Security Admission (PSA) labels, which are crucial
16 for defining security levels and ensuring that pods within a namespace operate 
17 under the defined Pod Security Standard (PSS). By enforcing namespace labeling,
18 This policy audits namespaces to verify the presence of PSA labels. 
19 If a namespace is found without the required labels, it generates and maintain 
20 and ClusterPolicy Report in default namespace. 
21 This helps administrators identify namespaces that do not comply with the 
22 organization's security practices and take appropriate action to rectify the 
23 situation.
24spec:
25 validationFailureAction: Audit
26 background: true
27 rules:
28 - name: check-namespace-labels
29 match:
30 any:
31 - resources:
32 kinds:
33 - Namespace
34 operations:
35 - CREATE
36 - UPDATE
37 validate:
38 cel:
39 expressions:
40 - expression: "object.metadata.?labels.orValue([]).exists(label, label.startsWith('pod-security.kubernetes.io/') && object.metadata.labels[label] != '')"
41 message: This Namespace is missing a PSA label.

Add Quota

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/add-ns-quota/add-ns-quota.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-ns-quota
 5 annotations:
 6 policies.kyverno.io/title: Add Quota
 7 policies.kyverno.io/category: Multi-Tenancy, EKS Best Practices
 8 policies.kyverno.io/subject: ResourceQuota, LimitRange
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 To better control the number of resources that can be created in a given
12 Namespace and provide default resource consumption limits for Pods,
13 ResourceQuota and LimitRange resources are recommended.
14 This policy will generate ResourceQuota and LimitRange resources when
15 a new Namespace is created.
16spec:
17 rules:
18 - name: generate-resourcequota
19 match:
20 any:
21 - resources:
22 kinds:
23 - Namespace
24 generate:
25 apiVersion: v1
26 kind: ResourceQuota
27 name: default-resourcequota
28 synchronize: true
29 namespace: "{{request.object.metadata.name}}"
30 data:
31 spec:
32 hard:
33 requests.cpu: '4'
34 requests.memory: '16Gi'
35 limits.cpu: '4'
36 limits.memory: '16Gi'
37 - name: generate-limitrange
38 match:
39 any:
40 - resources:
41 kinds:
42 - Namespace
43 generate:
44 apiVersion: v1
45 kind: LimitRange
46 name: default-limitrange
47 synchronize: true
48 namespace: "{{request.object.metadata.name}}"
49 data:
50 spec:
51 limits:
52 - default:
53 cpu: 500m
54 memory: 1Gi
55 defaultRequest:
56 cpu: 200m
57 memory: 256Mi
58 type: Container

Add RoleBinding

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/add-rolebinding/add-rolebinding.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-rolebinding
 5 annotations:
 6 policies.kyverno.io/title: Add RoleBinding
 7 policies.kyverno.io/category: Multi-Tenancy
 8 policies.kyverno.io/subject: RoleBinding
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 Typically in multi-tenancy and other use cases, when a new Namespace is created,
12 users and other principals must be given some permissions to create and interact
13 with resources in the Namespace. Very commonly, Roles and RoleBindings are used to
14 grant permissions at the Namespace level. This policy generates a RoleBinding
15 called `<userName>-admin-binding` in the new Namespace which binds to the ClusterRole
16 `admin` as long as a `cluster-admin` did not create the Namespace. Additionally, an annotation
17 named `kyverno.io/user` is added to the RoleBinding recording the name of the user responsible
18 for the Namespace's creation.
19spec:
20 background: false
21 rules:
22 - name: generate-admin-binding
23 match:
24 any:
25 - resources:
26 kinds:
27 - Namespace
28 exclude:
29 any:
30 - clusterRoles:
31 - cluster-admin
32 generate:
33 synchronize: true
34 apiVersion: rbac.authorization.k8s.io/v1
35 kind: RoleBinding
36 name: "{{request.userInfo.username}}-admin-binding"
37 namespace: "{{request.object.metadata.name}}"
38 data:
39 metadata:
40 annotations:
41 kyverno.io/user: "{{request.userInfo.username}}"
42 roleRef:
43 apiGroup: rbac.authorization.k8s.io
44 kind: ClusterRole
45 name: admin
46 subjects:
47 - kind: User
48 name: "{{request.userInfo.username}}"

Add runtimeClassName

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psp-migration/add-runtimeClassName/add-runtimeClassName.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-runtimeclassname
 5 annotations:
 6 policies.kyverno.io/title: Add runtimeClassName
 7 policies.kyverno.io/category: PSP Migration
 8 policies.kyverno.io/subject: Pod
 9 kyverno.io/kyverno-version: 1.10.0
10 kyverno.io/kubernetes-version: "1.24"
11 pod-policies.kyverno.io/autogen-controllers: none
12 policies.kyverno.io/description: >-
13 In the earlier Pod Security Policy controller, it was possible to configure a policy to add
14 a Pod's runtimeClassName. This was beneficial in that various container runtimes could be
15 specified according to a policy. This Kyverno policies mutates Pods to add a runtimeClassName
16 of `prodclass`.
17spec:
18 rules:
19 - name: add-prodclass
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 preconditions:
26 all:
27 - key: "{{request.operation || 'BACKGROUND'}}"
28 operator: AnyIn
29 value:
30 - CREATE
31 - UPDATE
32 mutate:
33 patchStrategicMerge:
34 spec:
35 runtimeClassName: prodclass

Add Safe To Evict

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/add-safe-to-evict/add-safe-to-evict.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-safe-to-evict
 5 annotations:
 6 policies.kyverno.io/title: Add Safe To Evict
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/subject: Pod,Annotation
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 The Kubernetes cluster autoscaler does not evict pods that 
12 use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation 
13 cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods. 
14spec: 
15 rules: 
16 - name: annotate-empty-dir
17 match:
18 any:
19 - resources:
20 kinds:
21 - Pod
22 mutate:
23 patchStrategicMerge:
24 metadata:
25 annotations:
26 +(cluster-autoscaler.kubernetes.io/safe-to-evict): "true"
27 spec: 
28 volumes: 
29 - <(emptyDir): {}
30 - name: annotate-host-path
31 match:
32 any:
33 - resources:
34 kinds:
35 - Pod
36 mutate:
37 patchStrategicMerge:
38 metadata:
39 annotations:
40 +(cluster-autoscaler.kubernetes.io/safe-to-evict): "true"
41 spec: 
42 volumes: 
43 - hostPath:
44 <(path): "*"

Add scheduled Node's labels to a Pod

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-node-labels-pod/add-node-labels-pod.yaml

 1apiVersion: kyverno.io/v2beta1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-node-labels-pod
 5 annotations:
 6 pod-policies.kyverno.io/autogen-controllers: none
 7 policies.kyverno.io/title: Add scheduled Node's labels to a Pod
 8 policies.kyverno.io/category: Other
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.10.0
11 policies.kyverno.io/minversion: 1.10.0
12 kyverno.io/kubernetes-version: "1.26"
13 policies.kyverno.io/description: >-
14 Containers running in Pods may sometimes need access to node-specific information on 
15 which the Pod has been scheduled. A common use case is node topology labels to ensure 
16 pods are spread across failure zones in racks or in the cloud. The mutate-pod-binding
17 policy already does this for annotations, but it does not handle labels. A useful use
18 case is for passing metric label information to ServiceMonitors and then into Prometheus.
19 This policy watches for Pod binding events when the pod is scheduled and then 
20 asynchronously mutates the existing Pod to add the labels.
21 This policy requires the following changes to common default configurations:
22 - The kyverno resourceFilter should not filter Pod/binding resources.
23 - The kyverno backgroundController service account requires Update permission on pods. 
24 It is recommended to use https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles 
25spec:
26 rules:
27 - name: project-foo
28 match:
29 any:
30 - resources:
31 kinds:
32 - Pod/binding
33 context:
34 - name: node
35 variable:
36 jmesPath: request.object.target.name
37 default: ''
38 - name: foolabel
39 apiCall:
40 urlPath: "/api/v1/nodes/{{node}}"
41 jmesPath: "metadata.labels.foo || 'empty'"
42 mutate:
43 targets:
44 - apiVersion: v1
45 kind: Pod
46 name: "{{ request.object.metadata.name }}"
47 namespace: "{{ request.object.metadata.namespace }}"
48 patchStrategicMerge:
49 metadata:
50 labels: 
51 foo: "{{ foolabel }}"

Add Services

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kubevirt/add-services/add-services.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: k6t-add-services
 5 annotations:
 6 policies.kyverno.io/title: Add Services
 7 policies.kyverno.io/category: KubeVirt
 8 policies.kyverno.io/subject: VirtualMachineInstance
 9 policies.kyverno.io/description: >-
10 Add an SSH Service to every VirtualMachineInstance which is getting created.
11 This Service will use a ClusterIP, thus the admin has to ensure that the IP
12 space is large enough and ClusterIP type can be met.
13 kyverno.io/kyverno-version: "1.8.0-rc2"
14 kyverno.io/kubernetes-version: "1.24-1.25"
15spec:
16 background: false
17 rules:
18 - name: k6t-add-service-ssh
19 match:
20 any:
21 - resources:
22 kinds:
23 - VirtualMachineInstance
24 generate:
25 apiVersion: v1
26 kind: Service
27 name: "{{request.object.metadata.name}}"
28 namespace: "{{request.object.metadata.namespace}}"
29 synchronize: true
30 data:
31 metadata:
32 ownerReferences:
33 - apiVersion: kubevirt.io/v1
34 kind: VirtualMachineInstance
35 name: "{{request.object.metadata.name}}"
36 uid: "{{request.object.metadata.uid}}"
37 spec:
38 ports:
39 - protocol: TCP
40 port: 22
41 selector:
42 kubevirt.io/domain: "{{request.object.metadata.name}}"
43 type: ClusterIP

Add Tolerations

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-tolerations/add-tolerations.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-tolerations
 5 annotations:
 6 policies.kyverno.io/title: Add Tolerations
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.7.1
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >- 
14 Pod tolerations are used to schedule on Nodes which have
15 a matching taint. This policy adds the toleration `org.com/role=service:NoSchedule`
16 if existing tolerations do not contain the key `org.com/role`.
17spec:
18 rules:
19 - name: service-toleration
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 preconditions:
26 any:
27 - key: "org.com/role"
28 operator: AnyNotIn
29 value: "{{ request.object.spec.tolerations[].key || `[]` }}"
30 mutate:
31 patchesJson6902: |-
32 - op: add
33 path: "/spec/tolerations/-"
34 value:
35 key: org.com/role
36 operator: Equal
37 value: service
38 effect: NoSchedule

Add TTL to Jobs

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-ttl-jobs/add-ttl-jobs.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-ttl-jobs
 5 annotations:
 6 policies.kyverno.io/title: Add TTL to Jobs
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Job
10 kyverno.io/kyverno-version: 1.7.1
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >-
14 Jobs which are user created can often pile up and consume
15 excess space in the cluster. In Kubernetes 1.23, the TTL-after-finished controller
16 is stable and will automatically clean up these Jobs if the ttlSecondsAfterFinished
17 is specified. This policy adds the ttlSecondsAfterFinished field to an Job that does
18 not have an ownerReference set if not already specified.
19spec:
20 rules:
21 - name: add-ttlSecondsAfterFinished
22 match:
23 any:
24 - resources:
25 kinds:
26 - Job
27 preconditions:
28 any:
29 - key: "{{ request.object.metadata.ownerReferences || `[]` }}"
30 operator: Equals
31 value: []
32 mutate:
33 patchStrategicMerge:
34 spec:
35 +(ttlSecondsAfterFinished): 900

Add Volume to Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/add-volume-deployment/add-volume-deployment.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: add-volume
 5 annotations:
 6 policies.kyverno.io/title: Add Volume to Deployment
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Deployment, Volume
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/description: >-
11 Some Kubernetes applications like HashiCorp Vault must perform some modifications
12 to resources in order to invoke their specific functionality. Often times, that functionality
13 is controlled by the presence of a label or specific annotation. This policy, based on HashiCorp
14 Vault, adds a volume and volumeMount to a Deployment if there is an annotation called
15 "vault.k8s.corp.net/inject=enabled" present.
16spec:
17 rules:
18 - name: add-volume
19 match:
20 any:
21 - resources:
22 kinds:
23 - Deployment
24 preconditions:
25 any:
26 - key: "{{request.object.spec.template.metadata.annotations.\"vault.k8s.corp.net/inject\"}}"
27 operator: Equals
28 value: enabled
29 mutate:
30 patchesJson6902: |-
31 - op: add
32 path: /spec/template/spec/volumes/-
33 value:
34 name: vault-secret
35 emptyDir:
36 medium: Memory
37 - op: add
38 path: /spec/template/spec/containers/0/volumeMounts/-
39 value:
40 mountPath: /secret
41 name: vault-secret

Advanced Restrict Image Registries

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/advanced-restrict-image-registries/advanced-restrict-image-registries.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: advanced-restrict-image-registries
 5 annotations:
 6 policies.kyverno.io/title: Advanced Restrict Image Registries
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 In instances where a ClusterPolicy defines all the approved image registries
15 is insufficient, more granular control may be needed to set permitted registries,
16 especially in multi-tenant use cases where some registries may be based on
17 the Namespace. This policy shows an advanced version of the Restrict Image Registries
18 policy which gets a global approved registry from a ConfigMap and, based upon an
19 annotation at the Namespace level, gets the registry approved for that Namespace.
20spec:
21 validationFailureAction: Audit
22 background: false
23 rules:
24 - name: validate-corp-registries
25 match:
26 any:
27 - resources:
28 kinds:
29 - Pod
30 context:
31 # Get the value of the Namespace annotation called `corp.com/allowed-registries` and store. The value
32 # must end with a wildcard. Currently assumes there is only a single registry name in the value.
33 - name: nsregistries
34 apiCall:
35 urlPath: "/api/v1/namespaces/{{request.namespace}}"
36 jmesPath: "metadata.annotations.\"corp.com/allowed-registries\" || ''"
37 # Get the ConfigMap in the `default` Namespace called `clusterregistries` and store. The value of the key
38 # must end with a wildcard. Currently assumes there is only a single registry name in the value.
39 - name: clusterregistries
40 configMap:
41 name: clusterregistries
42 namespace: default
43 preconditions:
44 any:
45 - key: "{{request.operation || 'BACKGROUND'}}"
46 operator: AnyIn
47 value:
48 - CREATE
49 - UPDATE
50 validate:
51 message: This Pod names an image that is not from an approved registry.
52 foreach:
53 # Create a flattened array of all containers in the Pod.
54 - list: "request.object.spec.[initContainers, ephemeralContainers, containers][]"
55 deny:
56 conditions:
57 all:
58 # Loop over every image and deny the Pod if any image doesn't match either the allowed registry in the
59 # cluster ConfigMap or the annotation on the Namespace where the Pod is created.
60 - key: "{{element.image}}"
61 operator: NotEquals
62 value: "{{nsregistries}}"
63 - key: "{{element.image}}"
64 operator: NotEquals
65 value: "{{clusterregistries.data.registries}}"

Advanced Restrict Image Registries in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/advanced-restrict-image-registries/advanced-restrict-image-registries.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: advanced-restrict-image-registries
 5 annotations:
 6 policies.kyverno.io/title: Advanced Restrict Image Registries in CEL expressions
 7 policies.kyverno.io/category: Other in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 In instances where a ClusterPolicy defines all the approved image registries
15 is insufficient, more granular control may be needed to set permitted registries,
16 especially in multi-tenant use cases where some registries may be based on
17 the Namespace. This policy shows an advanced version of the Restrict Image Registries
18 policy which gets a global approved registry from a ConfigMap and, based upon an
19 annotation at the Namespace level, gets the registry approved for that Namespace.
20spec:
21 validationFailureAction: Audit
22 background: false
23 rules:
24 - name: validate-corp-registries
25 match:
26 any:
27 - resources:
28 kinds:
29 - Pod
30 operations:
31 - CREATE
32 - UPDATE
33 validate:
34 cel:
35 paramKind: 
36 apiVersion: v1
37 kind: ConfigMap
38 paramRef: 
39 name: clusterregistries
40 namespace: default
41 parameterNotFoundAction: Deny
42 variables:
43 - name: allContainers
44 expression: "object.spec.containers + object.spec.?initContainers.orValue([]) + object.spec.?ephemeralContainers.orValue([])"
45 - name: nsregistries
46 expression: >-
47 namespaceObject.metadata.?annotations[?'corp.com/allowed-registries'].orValue(' ')
48 - name: clusterregistries
49 expression: "params.data[?'registries'].orValue(' ')"
50 expressions:
51 - expression: "variables.allContainers.all(container, container.image.startsWith(variables.nsregistries) || container.image.startsWith(variables.clusterregistries))"
52 message: This Pod names an image that is not from an approved registry.

Advertise Node Extended Resources

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/advertise-node-extended-resources/advertise-node-extended-resources.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: advertise-node-extended-resources
 5 annotations:
 6 policies.kyverno.io/title: Advertise Node Extended Resources
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.9.0
10 policies.kyverno.io/minversion: 1.9.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Node
13 policies.kyverno.io/description: >-
14 Kubernetes Nodes, in addition to standard compute resources like
15 CPU and memory, may offer extended resources such as FPGAs and GPUs, both
16 of which can be defined per custom design. These extended resources are
17 advertised in the `status` object of a Node. This policy, functional only
18 starting in Kyverno 1.9, adds the extended resource `example.com/dongle` with
19 a value/capacity of `2` to Kubernetes Nodes.
20spec:
21 background: false
22 rules:
23 - name: advertise-dongle
24 match:
25 any:
26 - resources:
27 kinds:
28 - Node/status
29 mutate:
30 patchStrategicMerge:
31 status:
32 capacity:
33 example.com/dongle: 2

Allowed Annotations

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/allowed-annotations/allowed-annotations.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: allowed-annotations
 5 annotations:
 6 policies.kyverno.io/title: Allowed Annotations
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod, Annotation
13 policies.kyverno.io/description: >-
14 Rather than creating a deny list of annotations, it may be more useful
15 to invert that list and create an allow list which then denies any others.
16 This policy demonstrates how to allow two annotations with a specific key
17 name of fluxcd.io/ while denying others that do not meet the pattern.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: allowed-fluxcd-annotations
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 validate:
29 message: The only approved FluxCD annotations are `fluxcd.io/cow` and `fluxcd.io/dog`.
30 deny:
31 conditions:
32 all:
33 - key: "{{ request.object.metadata.annotations.keys(@)[?contains(@, 'fluxcd.io/')] }}"
34 operator: AnyNotIn
35 value:
36 - fluxcd.io/cow
37 - fluxcd.io/dog

Allowed Annotations in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/allowed-annotations/allowed-annotations.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: allowed-annotations
 5 annotations:
 6 policies.kyverno.io/title: Allowed Annotations in CEL expressions
 7 policies.kyverno.io/category: Other in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Pod, Annotation
13 policies.kyverno.io/description: >-
14 Rather than creating a deny list of annotations, it may be more useful
15 to invert that list and create an allow list which then denies any others.
16 This policy demonstrates how to allow two annotations with a specific key
17 name of fluxcd.io/ while denying others that do not meet the pattern.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: allowed-fluxcd-annotations
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: >-
35 object.metadata.?annotations.orValue([]).all(annotation, !annotation.contains('fluxcd.io/') || annotation in ['fluxcd.io/cow', 'fluxcd.io/dog'])
36 message: The only approved FluxCD annotations are `fluxcd.io/cow` and `fluxcd.io/dog`.
37

Allowed Base Images

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/allowed-base-images/allowed-base-images.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: allowed-base-images
 5 annotations:
 6 policies.kyverno.io/title: Allowed Base Images
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.7.0
10 policies.kyverno.io/minversion: 1.7.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Building images which specify a base as their origin is a good start
15 to improving supply chain security, but over time organizations
16 may want to build an allow list of specific base images which
17 are allowed to be used when constructing containers. This policy ensures
18 that a container's base, found in an OCI annotation, is in a cluster-wide
19 allow list.
20spec:
21 validationFailureAction: Audit
22 rules:
23 - name: allowed-base-images
24 match:
25 any:
26 - resources:
27 kinds:
28 - Pod
29 preconditions:
30 all:
31 - key: "{{request.operation || 'BACKGROUND'}}"
32 operator: NotEquals
33 value: DELETE
34 context:
35 - name: baseimages
36 configMap:
37 name: baseimages
38 namespace: platform
39 validate:
40 message: >-
41 This container image's base is not in the approved list or is not specified. Only pre-approved
42 base images may be used. Please contact the platform team for assistance.
43 foreach:
44 - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
45 context:
46 - name: imageData
47 imageRegistry: 
48 reference: "{{ element.image }}"
49 - name: basename
50 variable:
51 jmesPath: imageData.manifest.annotations."org.opencontainers.image.base.name"
52 default: ''
53 deny:
54 conditions:
55 all:
56 - key: "{{ basename }}"
57 operator: AnyNotIn
58 value: "{{ baseimages.data.allowedbaseimages }}"

Allowed Image Repositories

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/allowed-image-repos/allowed-image-repos.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: allowed-image-repos
 5 annotations:
 6 policies.kyverno.io/title: Allowed Image Repositories
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.9.0
10 kyverno.io/kubernetes-version: "1.24"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 In addition to restricting the image registry from which images are pulled, in some cases
14 and environments it may be required to also restrict which image repositories are used, 
15 for example in some restricted Namespaces. This policy ensures that the only allowed
16 image repositories present in a given Pod, across any container type, come from the
17 designated list.
18spec:
19 validationFailureAction: Audit
20 background: false
21 rules:
22 - name: good-repos
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 validate:
29 message: >-
30 All images in this Pod must come from an authorized repository.
31 deny:
32 conditions:
33 all:
34 - key: "{{ images.[containers, initContainers, ephemeralContainers][].*.name[] }}"
35 operator: AnyNotIn
36 value:
37 - myknownimage
38 - kyverno

Allowed Label Changes

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/allowed-label-changes/allowed-label-changes.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: allowed-label-changes
 5 annotations:
 6 pod-policies.kyverno.io/autogen-controllers: none
 7 policies.kyverno.io/title: Allowed Label Changes
 8 policies.kyverno.io/category: Other
 9 policies.kyverno.io/severity: medium
10 kyverno.io/kyverno-version: 1.6.0
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/subject: Pod,Label
14 policies.kyverno.io/description: >-
15 In some cases, operations teams need a type of limited access to
16 change resources during troubleshooting or outage mitigation.
17 This policy demonstrates how to prevent modification to labels
18 except one with the key `breakglass`. Changing, adding, or deleting
19 any other labels is denied.
20spec:
21 validationFailureAction: Enforce
22 background: false
23 rules:
24 - name: safe-label
25 match:
26 any:
27 - resources:
28 kinds:
29 - Pod
30 - Deployment
31 - StatefulSet
32 - DaemonSet
33 - Job
34 - CronJob
35 preconditions:
36 all:
37 - key: "{{ request.operation || 'BACKGROUND' }}"
38 operator: Equals
39 value: UPDATE
40 validate:
41 message: "The only label that may be removed or changed is `breakglass`."
42 deny:
43 conditions:
44 any:
45 - key: "{{ request.object.metadata.labels || `{}` | merge(@, {breakglass:null}) }}"
46 operator: NotEquals
47 value: "{{ request.oldObject.metadata.labels || `{}` | merge(@, {breakglass:null}) }}"

Allowed Pod Priorities

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/allowed-pod-priorities/allowed-pod-priorities.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: allowed-podpriorities
 5 annotations:
 6 policies.kyverno.io/title: Allowed Pod Priorities
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/description: >-
11 A Pod PriorityClass is used to provide a guarantee on the scheduling of a Pod relative to others.
12 In certain cases where not all users in a cluster are trusted, a malicious user could create Pods
13 at the highest possible priorities, causing other Pods to be evicted/not get scheduled. This policy
14 checks the defined `priorityClassName` in a Pod spec to a dictionary of allowable
15 PriorityClasses for the given Namespace stored in a ConfigMap. If the `priorityClassName` is not
16 among them, the Pod is blocked.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: validate-pod-priority
22 context:
23 - name: podprioritydict
24 configMap:
25 name: allowed-pod-priorities
26 namespace: default
27 match:
28 any:
29 - resources:
30 kinds:
31 - Pod
32 validate:
33 message: >-
34 The Pod PriorityClass {{ request.object.spec.priorityClassName }} is not in the list
35 of the following PriorityClasses allowed in this Namespace: {{ podprioritydict.data."{{request.namespace}}" }}.
36 deny:
37 conditions:
38 any:
39 - key: "{{ request.object.spec.priorityClassName || '' }}"
40 operator: AnyNotIn
41 value: '{{ podprioritydict.data."{{request.namespace}}" || "" }}'

Allowed Pod Priorities in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/allowed-pod-priorities/allowed-pod-priorities.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: allowed-podpriorities
 5 annotations:
 6 policies.kyverno.io/title: Allowed Pod Priorities in CEL expressions
 7 policies.kyverno.io/category: Sample in CEL 
 8 policies.kyverno.io/minversion: 1.11.0
 9 kyverno.io/kubernetes-version: "1.26-1.27"
10 policies.kyverno.io/subject: Pod
11 policies.kyverno.io/description: >-
12 A Pod PriorityClass is used to provide a guarantee on the scheduling of a Pod relative to others.
13 In certain cases where not all users in a cluster are trusted, a malicious user could create Pods
14 at the highest possible priorities, causing other Pods to be evicted/not get scheduled. This policy
15 checks the defined `priorityClassName` in a Pod spec to a dictionary of allowable
16 PriorityClasses for the given Namespace stored in a ConfigMap. If the `priorityClassName` is not
17 among them, the Pod is blocked.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: validate-pod-priority
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 paramKind:
34 apiVersion: v1
35 kind: ConfigMap
36 paramRef:
37 name: allowed-pod-priorities
38 namespace: default
39 parameterNotFoundAction: Deny
40 variables:
41 - name: namespaceName
42 expression: "namespaceObject.metadata.name"
43 - name: priorities
44 expression: "variables.namespaceName in params.data ? params.data[variables.namespaceName].split(', ') : []"
45 expressions:
46 - expression: "variables.priorities == [] || object.spec.priorityClassName in variables.priorities"
47 messageExpression: >-
48 'The Pod PriorityClass ' + object.spec.priorityClassName +
49 ' is not in the list of the following PriorityClasses allowed in this Namespace: ' +
50 params.data[variables.namespaceName]

Always Pull Images

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/always-pull-images/always-pull-images.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: always-pull-images
 5 annotations:
 6 policies.kyverno.io/title: Always Pull Images
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.6.0
11 policies.kyverno.io/description: >-
12 By default, images that have already been pulled can be accessed by other
13 Pods without re-pulling them if the name and tag are known. In multi-tenant scenarios,
14 this may be undesirable. This policy mutates all incoming Pods to set their
15 imagePullPolicy to Always. An alternative to the Kubernetes admission controller
16 AlwaysPullImages.
17spec:
18 rules:
19 - name: always-pull-images
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 mutate:
26 patchStrategicMerge:
27 spec:
28 containers:
29 - (name): "?*"
30 imagePullPolicy: Always

Annotate Base Images

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/annotate-base-images/annotate-base-images.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: annotate-base-images
 5 annotations:
 6 policies.kyverno.io/title: Annotate Base Images
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 pod-policies.kyverno.io/autogen-controllers: none
10 kyverno.io/kyverno-version: 1.7.0
11 policies.kyverno.io/minversion: 1.7.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/subject: Pod
14 policies.kyverno.io/description: >-
15 A base image used to construct a container image is not accessible
16 by any Kubernetes component and not a field in a Pod spec as it must
17 be fetched from a registry. Having this information available in the resource
18 referencing the containers helps to provide a clearer understanding of
19 its contents. This policy adds an annotation to a Pod or its controllers
20 with the base image used for each container if present in an OCI annotation.
21spec:
22 rules:
23 - name: mutate-base-image
24 match:
25 any:
26 - resources:
27 kinds:
28 - Pod
29 preconditions:
30 all:
31 - key: "{{request.operation || 'BACKGROUND'}}"
32 operator: NotEquals
33 value: DELETE
34 mutate:
35 foreach:
36 - list: "request.object.spec.containers"
37 context:
38 - name: imageData
39 imageRegistry: 
40 reference: "{{ element.image }}"
41 - name: basename
42 variable:
43 jmesPath: imageData.manifest.annotations."org.opencontainers.image.base.name"
44 default: ''
45 patchesJson6902: |-
46 - path: "/metadata/annotations/kyverno.io~1baseimages{{elementIndex}}"
47 op: add
48 value: "{{basename}}"

Application Field Validation

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/argo/application-field-validation/application-field-validation.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: application-field-validation
 5 annotations:
 6 policies.kyverno.io/title: Application Field Validation
 7 policies.kyverno.io/category: Argo
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Application
10 kyverno.io/kyverno-version: 1.6.0
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >-
14 This policy performs some best practices validation on Application fields.
15 Path or chart must be specified but never both. And destination.name or
16 destination.server must be specified but never both.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: source-path-chart
22 match:
23 any:
24 - resources:
25 kinds:
26 - Application
27 validate:
28 message: >-
29 `spec.source.path` OR `spec.source.chart` should be specified but never both.
30 anyPattern:
31 - spec:
32 source:
33 path: '?*'
34 X(chart):
35 - spec:
36 source:
37 X(path):
38 chart: '?*'
39 - name: destination-server-name
40 match:
41 any:
42 - resources:
43 kinds:
44 - Application
45 validate:
46 message: >-
47 `spec.destination.server` OR `spec.destination.name` should be specified but never both.
48 anyPattern:
49 - spec:
50 destination:
51 server: '?*'
52 X(name):
53 - spec:
54 destination:
55 X(server):
56 name: '?*'

Application Field Validation in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/argo-cel/application-field-validation/application-field-validation.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: application-field-validation
 5 annotations:
 6 policies.kyverno.io/title: Application Field Validation in CEL expressions
 7 policies.kyverno.io/category: Argo in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Application
10 kyverno.io/kyverno-version: 1.11.0
11 policies.kyverno.io/minversion: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 This policy performs some best practices validation on Application fields.
15 Path or chart must be specified but never both. And destination.name or
16 destination.server must be specified but never both.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: source-path-chart
22 match:
23 any:
24 - resources:
25 kinds:
26 - Application
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel:
32 expressions:
33 - expression: >-
34 has(object.spec.source) &&
35 (
36 (has(object.spec.source.path) && !has(object.spec.source.chart)) ||
37 (!has(object.spec.source.path) && has(object.spec.source.chart))
38 )
39 message: >-
40 `spec.source.path` OR `spec.source.chart` should be specified but never both.
41 - name: destination-server-name
42 match:
43 any:
44 - resources:
45 kinds:
46 - Application
47 operations:
48 - CREATE
49 - UPDATE
50 validate:
51 cel:
52 expressions:
53 - expression: >-
54 has(object.spec.destination) &&
55 (
56 (has(object.spec.destination.server) && !has(object.spec.destination.name)) ||
57 (!has(object.spec.destination.server) && has(object.spec.destination.name))
58 )
59 message: >-
60 `spec.destination.server` OR `spec.destination.name` should be specified but never both.

Apply PSS Restricted Profile

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/apply-pss-restricted-profile/apply-pss-restricted-profile.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: apply-pss-restricted-profile
 5 annotations:
 6 policies.kyverno.io/title: Apply PSS Restricted Profile
 7 policies.kyverno.io/category: Other, PSP Migration
 8 kyverno.io/kyverno-version: 1.6.2
 9 kyverno.io/kubernetes-version: "1.23"
10 policies.kyverno.io/subject: Pod
11 policies.kyverno.io/description: >-
12 Pod Security Standards define the fields and their options which
13 are allowable for Pods to achieve certain security best practices. While
14 these are typically validation policies, workloads will either be accepted or
15 rejected based upon what has already been defined. It is also possible to mutate
16 incoming Pods to achieve the desired PSS level rather than reject. This policy
17 sets all the fields necessary to pass the PSS Restricted profile. Note that it does
18 not attempt to remove non-compliant volumes and volumeMounts. Additional policies
19 may be employed for this purpose.
20spec:
21 rules:
22 - name: add-pss-fields
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 mutate:
29 patchStrategicMerge:
30 spec:
31 securityContext:
32 seccompProfile:
33 type: RuntimeDefault
34 runAsNonRoot: true
35 runAsUser: 1000
36 runAsGroup: 3000
37 fsGroup: 2000
38 containers:
39 - (name): "?*"
40 securityContext:
41 privileged: false
42 capabilities:
43 drop: 
44 - ALL
45 allowPrivilegeEscalation: false

Argo Cluster Secret Generation From Rancher CAPI Secret

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/argo/argo-cluster-generation-from-rancher-capi/argo-cluster-generation-from-rancher-capi.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: argo-cluster-generation-from-rancher-capi
 5 annotations:
 6 policies.kyverno.io/title: Argo Cluster Secret Generation From Rancher CAPI Secret
 7 policies.kyverno.io/category: Argo
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Secret
 10 kyverno.io/kyverno-version: 1.7.1
 11 policies.kyverno.io/minversion: 1.7.0
 12 kyverno.io/kubernetes-version: "1.23"
 13 policies.kyverno.io/description: >-
 14 This policy generates and synchronizes Argo CD cluster secrets from Rancher 
 15 managed cluster.provisioning.cattle.io/v1 resources and their corresponding CAPI secrets.
 16 In this solution, Argo CD integrates with Rancher managed clusters via the central
 17 Rancher authentication proxy which shares the network endpoint of the Rancher API/GUI.
 18 The policy implements work-arounds for Argo CD issue https://github.com/argoproj/argo-cd/issues/9033
 19 "Cluster-API cluster auto-registration" and Rancher issue https://github.com/rancher/rancher/issues/38053
 20 "Fix type and labels Rancher v2 provisioner specifies when creating CAPI Cluster Secret".
 21spec:
 22 generateExisting: true
 23 rules:
 24 - name: source-rancher-non-local-cluster-and-capi-secret
 25 match:
 26 all:
 27 - resources:
 28 kinds:
 29 - provisioning.cattle.io/v1/Cluster
 30 exclude:
 31 any:
 32 - resources:
 33 namespaces:
 34 - fleet-local
 35 context:
 36 - name: clusterName
 37 variable:
 38 value: "{{request.object.metadata.name}}"
 39 jmesPath: 'to_string(@)'
 40 - name: clusterPrefixedName
 41 variable:
 42 value: "{{ join('-', ['cluster', clusterName]) }}"
 43 jmesPath: 'to_string(@)'
 44 - name: kubeconfigName
 45 variable:
 46 value: "{{ join('-', [clusterName, 'kubeconfig']) }}"
 47 jmesPath: 'to_string(@)'
 48 - name: extraLabels
 49 variable:
 50 value:
 51 argocd.argoproj.io/secret-type: cluster
 52 clusterId: "{{ clusterName }}"
 53 - name: metadataLabels
 54 variable:
 55 jmesPath: request.object.metadata.labels
 56 default: {}
 57 - name: metadataLabels
 58 variable:
 59 jmesPath: merge(metadataLabels, extraLabels)
 60 - name: kubeconfigData
 61 apiCall:
 62 urlPath: "/api/v1/namespaces/{{request.object.metadata.namespace}}/secrets/{{kubeconfigName}}"
 63 jmesPath: 'data | to_string(@)'
 64 - name: serverName
 65 variable:
 66 value: "{{ kubeconfigData | parse_yaml(@).value | base64_decode(@) | parse_yaml(@).clusters[0].cluster.server }}"
 67 jmesPath: 'to_string(@)'
 68 - name: bearerToken
 69 variable:
 70 value: "{{ kubeconfigData | parse_yaml(@).token | base64_decode(@) }}"
 71 jmesPath: 'to_string(@)'
 72 - name: caData
 73 variable:
 74 value: "{{ kubeconfigData | parse_yaml(@).value | base64_decode(@) | parse_yaml(@).clusters[0].cluster.\"certificate-authority-data\" }}"
 75 jmesPath: 'to_string(@)'
 76 - name: dataConfig
 77 variable:
 78 value: |
 79 {
 80 "bearerToken": "{{ bearerToken }}",
 81 "tlsClientConfig": {
 82 "insecure": false,
 83 "caData": "{{ caData }}"
 84 }
 85 }
 86 jmesPath: 'to_string(@)'
 87 generate:
 88 synchronize: true
 89 apiVersion: v1
 90 kind: Secret
 91 name: "{{ clusterPrefixedName }}"
 92 namespace: argocd
 93 data:
 94 metadata:
 95 labels:
 96 "{{ metadataLabels }}"
 97 type: Opaque
 98 data:
 99 name: "{{ clusterPrefixedName | base64_encode(@) }}"
100 server: "{{ serverName | base64_encode(@) }}"
101 config: "{{ dataConfig | base64_encode(@) }}"

Audit Event on Delete

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/audit-event-on-delete/audit-event-on-delete.yaml

 1apiVersion: kyverno.io/v2beta1
 2kind: ClusterPolicy
 3metadata:
 4 name: audit-event-on-delete
 5 annotations:
 6 policies.kyverno.io/title: Audit Event on Delete
 7 policies.kyverno.io/category: Other
 8 kyverno.io/kyverno-version: 1.10.0
 9 policies.kyverno.io/minversion: 1.10.0
10 kyverno.io/kubernetes-version: "1.26"
11 policies.kyverno.io/subject: Secret
12 policies.kyverno.io/description: >-
13 Kubernetes Events are limited in that the circumstances under which they are created
14 cannot be changed and with what they are associated is fixed. It may be advantageous
15 in many cases to augment these out-of-the-box Events with custom Events which can be
16 custom designed to your needs. This policy generates an Event when a Secret has been
17 deleted. It lists the userInfo of the actor performing the deletion.
18spec:
19 background: false
20 rules:
21 - name: generate-event-on-delete
22 match:
23 any:
24 - resources:
25 kinds:
26 - Secret
27 operations:
28 - DELETE
29 generate:
30 apiVersion: v1
31 kind: Event
32 name: "delete.{{ random('[a-z0-9]{12}') }}"
33 namespace: "{{request.object.metadata.namespace}}"
34 synchronize: false
35 data:
36 firstTimestamp: "{{ time_now_utc() }}"
37 involvedObject:
38 apiVersion: v1
39 kind: Secret
40 name: "{{ request.name }}"
41 namespace: "{{ request.namespace }}"
42 uid: "{{request.oldObject.metadata.uid}}"
43 lastTimestamp: "{{ time_now_utc() }}"
44 message: The {{ request.name }} Secret was deleted by {{ request.userInfo | to_string(@) }}.
45 reason: Delete
46 source:
47 component: kyverno
48 type: Warning

Audit Event on Pod Exec

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/audit-event-on-exec/audit-event-on-exec.yaml

 1apiVersion: kyverno.io/v2beta1
 2kind: ClusterPolicy
 3metadata:
 4 name: audit-event-on-exec
 5 annotations:
 6 policies.kyverno.io/title: Audit Event on Pod Exec
 7 policies.kyverno.io/category: Other
 8 kyverno.io/kyverno-version: 1.10.0
 9 policies.kyverno.io/minversion: 1.10.0
10 kyverno.io/kubernetes-version: "1.26"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Kubernetes Events are limited in that the circumstances under which they are created
14 cannot be changed and with what they are associated is fixed. It may be advantageous
15 in many cases to augment these out-of-the-box Events with custom Events which can be
16 custom designed to your needs. This policy generates an Event on a Pod when an exec
17 has been made to it. It lists the userInfo of the actor performing the exec along
18 with the command used in the exec.
19spec:
20 background: false
21 rules:
22 - name: generate-event-on-exec
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod/exec
28 context:
29 - name: parentPodUID
30 apiCall:
31 urlPath: "/api/v1/namespaces/{{request.namespace}}/pods/{{request.name}}"
32 jmesPath: "metadata.uid"
33 generate:
34 apiVersion: v1
35 kind: Event
36 name: "exec.{{ random('[a-z0-9]{6}') }}"
37 namespace: "{{request.namespace}}"
38 synchronize: false
39 data:
40 firstTimestamp: "{{ time_now_utc() }}"
41 involvedObject:
42 apiVersion: v1
43 kind: Pod
44 name: "{{ request.name }}"
45 namespace: "{{ request.namespace }}"
46 uid: "{{ parentPodUID }}"
47 lastTimestamp: "{{ time_now_utc() }}"
48 message: An exec was performed by {{ request.userInfo | to_string(@) }} running commands {{ request.object.command }}
49 reason: Exec
50 source:
51 component: kyverno
52 type: Warning

Backup All Volumes

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/velero/backup-all-volumes/backup-all-volumes.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: backup-all-volumes
 5 annotations:
 6 policies.kyverno.io/title: Backup All Volumes
 7 policies.kyverno.io/category: Velero
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod, Annotation
10 kyverno.io/kyverno-version: 1.9.2
11 kyverno.io/kubernetes-version: "1.25"
12 policies.kyverno.io/description: >-
13 In order for Velero to backup volumes in a Pod using an opt-in approach, it
14 requires an annotation on the Pod called `backup.velero.io/backup-volumes` with the
15 value being a comma-separated list of the volumes mounted to that Pod. This policy
16 automatically annotates Pods (and Pod controllers) which refer to a PVC so that
17 all volumes are listed in the aforementioned annotation if a Namespace with the label
18 `velero-backup-pvc=true`.
19spec:
20 rules:
21 - name: backup-velero-pv
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 namespaceSelector:
28 matchLabels:
29 velero-backup-pvc: "true"
30 preconditions:
31 all:
32 - key: "{{ request.object.spec.volumes[?contains(keys(@), 'persistentVolumeClaim')] | length(@) }}"
33 operator: GreaterThanOrEquals
34 value: 1
35 - key: "{{request.operation}}"
36 operator: Equals
37 value: CREATE
38 context:
39 - name: volumes
40 variable:
41 jmesPath: join(',',request.object.spec.volumes[?persistentVolumeClaim].name)
42 mutate:
43 patchStrategicMerge:
44 metadata:
45 annotations:
46 backup.velero.io/backup-volumes: "{{ volumes }}"

Baseline Pod Security Standards

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/subrule/podsecurity-subrule-baseline/podsecurity-subrule-baseline.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: podsecurity-subrule-baseline
 5 annotations:
 6 policies.kyverno.io/title: Baseline Pod Security Standards
 7 policies.kyverno.io/category: Pod Security, EKS Best Practices
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.8.0
10 policies.kyverno.io/minversion: 1.8.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 The baseline profile of the Pod Security Standards is a collection of the
15 most basic and important steps that can be taken to secure Pods. Beginning
16 with Kyverno 1.8, an entire profile may be assigned to the cluster through a
17 single rule. This policy configures the baseline profile through the latest
18 version of the Pod Security Standards cluster wide.
19spec:
20 background: true
21 validationFailureAction: Audit
22 rules:
23 - name: baseline
24 match:
25 any:
26 - resources:
27 kinds:
28 - Pod
29 validate:
30 podSecurity:
31 level: baseline
32 version: latest

Block cluster-admin from modifying any object in a Namespace

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-cluster-admin-from-ns/block-cluster-admin-from-ns.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-cluster-admin-from-ns
 5 annotations:
 6 policies.kyverno.io/title: Block cluster-admin from modifying any object in a Namespace
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/subject: Namespace, ClusterRole, User 
 9 policies.kyverno.io/minversion: 1.9.0
10 policies.kyverno.io/description: >-
11 In some cases, it may be desirable to block operations of certain privileged users
12 (i.e. cluster-admins) in a specific namespace. In this policy, Kyverno will look for all user operations
13 (CREATE, UPDATE, DELETE), on every object kind, in the testnamespace namespace, and for the
14 ClusterRole cluster-admin. The user testuser is also mentioned so it won't include all the cluster-admins in
15 the cluster, but will be flexible enough to apply only for a sub-group of the cluster-admins in the cluster.
16spec:
17 validationFailureAction: Enforce
18 background: false
19 rules:
20 - name: block-cluster-admin-from-ns
21 match:
22 any:
23 - resources:
24 kinds:
25 - "*"
26 namespaces:
27 - testnamespace
28 clusterRoles:
29 - cluster-admin
30 subjects:
31 - kind: User
32 name: testuser
33 validate:
34 message: "The cluster-admin 'testuser' user cannot touch testnamespace Namespace."
35 deny:
36 conditions:
37 any:
38 - key: "{{request.operation || 'BACKGROUND'}}"
39 operator: AnyIn
40 value:
41 - CREATE
42 - UPDATE
43 - DELETE

Block Ephemeral Containers

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-ephemeral-containers/block-ephemeral-containers.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-ephemeral-containers
 5 annotations:
 6 policies.kyverno.io/title: Block Ephemeral Containers
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Ephemeral containers, enabled by default in Kubernetes 1.23, allow users to use the
15 `kubectl debug` functionality and attach a temporary container to an existing Pod.
16 This may potentially be used to gain access to unauthorized information executing inside
17 one or more containers in that Pod. This policy blocks the use of ephemeral containers.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: block-ephemeral-containers
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 validate:
29 message: "Ephemeral (debug) containers are not permitted."
30 pattern:
31 spec:
32 X(ephemeralContainers): "null"

Block Ephemeral Containers in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/block-ephemeral-containers/block-ephemeral-containers.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-ephemeral-containers
 5 annotations:
 6 policies.kyverno.io/title: Block Ephemeral Containers in CEL expressions
 7 policies.kyverno.io/category: Other in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Ephemeral containers, enabled by default in Kubernetes 1.23, allow users to use the
15 `kubectl debug` functionality and attach a temporary container to an existing Pod.
16 This may potentially be used to gain access to unauthorized information executing inside
17 one or more containers in that Pod. This policy blocks the use of ephemeral containers.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: block-ephemeral-containers
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: "!has(object.spec.ephemeralContainers)"
35 message: "Ephemeral (debug) containers are not permitted."

Block Images with Volumes

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-images-with-volumes/block-images-with-volumes.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-images-with-volumes
 5 annotations:
 6 policies.kyverno.io/title: Block Images with Volumes
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 OCI images may optionally be built with VOLUME statements which, if run
15 in read-only mode, would still result in write access to the specified location.
16 This may be unexpected and undesirable. This policy checks the contents of every
17 container image and inspects them for such VOLUME statements, then blocks if found.
18spec:
19 validationFailureAction: Audit
20 rules:
21 - name: block-images-with-vols
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 preconditions:
28 all:
29 - key: "{{request.operation || 'BACKGROUND'}}"
30 operator: NotEquals
31 value: DELETE
32 validate:
33 message: "Images containing built-in volumes are prohibited."
34 foreach:
35 - list: "request.object.spec.containers"
36 context: 
37 - name: imageData
38 imageRegistry: 
39 reference: "{{ element.image }}"
40 deny:
41 conditions:
42 all:
43 - key: "{{ imageData.configData.config.Volumes || '' | length(@) }}"
44 operator: GreaterThan
45 value: 0

Block Large Images

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-large-images/block-large-images.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-large-images
 5 annotations:
 6 policies.kyverno.io/title: Block Large Images
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Pods which run containers of very large image size take longer to pull
15 and require more space to store. A user may either inadvertently or purposefully
16 name an image which is unusually large to disrupt operations. This policy
17 checks the size of every container image and blocks if it is over 2 Gibibytes.
18spec:
19 validationFailureAction: Audit
20 rules:
21 - name: block-over-twogi
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 preconditions:
28 all:
29 - key: "{{request.operation || 'BACKGROUND'}}"
30 operator: NotEquals
31 value: DELETE
32 validate:
33 message: "images with size greater than 2Gi not allowed" 
34 foreach:
35 - list: "request.object.spec.containers"
36 context: 
37 - name: imageSize
38 imageRegistry: 
39 reference: "{{ element.image }}"
40 # Note that we need to use `to_string` here to allow kyverno to treat it like a resource quantity of type memory
41 # the total size of an image as calculated by docker is the total sum of its layer sizes
42 jmesPath: "to_string(sum(manifest.layers[*].size))"
43 deny:
44 conditions:
45 all:
46 - key: "2Gi"
47 operator: LessThan
48 value: "{{imageSize}}"

Block Pod Exec by Namespace Label

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-pod-exec-by-namespace-label/block-pod-exec-by-namespace-label.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-exec-by-namespace-label
 5 annotations:
 6 policies.kyverno.io/title: Block Pod Exec by Namespace Label
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/description: >-
11 The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can
12 be useful for troubleshooting purposes, it could represent an attack vector and is discouraged.
13 This policy blocks Pod exec commands based upon a Namespace label `exec=false`.
14spec:
15 validationFailureAction: Enforce
16 background: false
17 rules:
18 - name: deny-exec-by-ns-label
19 match:
20 any:
21 - resources:
22 kinds:
23 - Pod/exec
24 context:
25 - name: nslabelexec
26 apiCall:
27 urlPath: "/api/v1/namespaces/{{request.namespace}}"
28 jmesPath: "metadata.labels.exec || ''"
29 preconditions:
30 all:
31 - key: "{{ request.operation || 'BACKGROUND' }}"
32 operator: Equals
33 value: CONNECT
34 validate:
35 message: Executing a command in a container is forbidden for Pods running in Namespaces protected with the label "exec=false".
36 deny:
37 conditions:
38 any:
39 - key: "{{ nslabelexec }}"
40 operator: Equals
41 value: "false"

Block Pod Exec by Namespace Name

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-pod-exec-by-namespace/block-pod-exec-by-namespace.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-exec-by-namespace-name
 5 annotations:
 6 policies.kyverno.io/title: Block Pod Exec by Namespace Name
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/description: >-
11 The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can
12 be useful for troubleshooting purposes, it could represent an attack vector and is discouraged.
13 This policy blocks Pod exec commands to Pods in a Namespace called `pci`.
14spec:
15 validationFailureAction: Enforce
16 background: false
17 rules:
18 - name: deny-exec-ns-pci
19 match:
20 any:
21 - resources:
22 kinds:
23 - Pod/exec
24 preconditions:
25 all:
26 - key: "{{ request.operation || 'BACKGROUND' }}"
27 operator: Equals
28 value: CONNECT
29 validate:
30 message: Pods in this namespace may not be exec'd into.
31 deny:
32 conditions:
33 any:
34 - key: "{{ request.namespace }}"
35 operator: Equals
36 value: pci

Block Pod Exec by Pod and Container

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-pod-exec-by-pod-and-container/block-pod-exec-by-pod-and-container.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-exec-by-pod-and-container
 5 annotations:
 6 policies.kyverno.io/title: Block Pod Exec by Pod and Container
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/description: >-
11 The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can
12 be useful for troubleshooting purposes, it could represent an attack vector and is discouraged.
13 This policy blocks Pod exec commands to containers named `nginx` in Pods starting
14 with name `myapp-maintenance`.
15spec:
16 validationFailureAction: Enforce
17 background: false
18 rules:
19 - name: deny-nginx-exec-in-myapp-maintenance
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod/exec
25 preconditions:
26 all:
27 - key: "{{ request.operation || 'BACKGROUND' }}"
28 operator: Equals
29 value: CONNECT
30 - key: "{{ request.name }}"
31 operator: Equals
32 value: myapp-maintenance*
33 validate:
34 message: Nginx containers inside myapp-maintanence Pods may not be exec'd into.
35 deny:
36 conditions:
37 all:
38 - key: "{{ request.object.container }}"
39 operator: Equals
40 value: nginx

Block Pod Exec by Pod Label

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-pod-exec-by-pod-label/block-pod-exec-by-pod-label.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-exec-by-pod-label
 5 annotations:
 6 policies.kyverno.io/title: Block Pod Exec by Pod Label
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/description: >-
11 The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can
12 be useful for troubleshooting purposes, it could represent an attack vector and is discouraged.
13 This policy blocks Pod exec commands to Pods having the label `exec=false`.
14spec:
15 validationFailureAction: Enforce
16 background: false
17 rules:
18 - name: deny-exec-by-label
19 match:
20 any:
21 - resources:
22 kinds:
23 - Pod/exec
24 context:
25 - name: podexeclabel
26 apiCall:
27 urlPath: "/api/v1/namespaces/{{request.namespace}}/pods/{{request.name}}"
28 jmesPath: "metadata.labels.exec || ''"
29 preconditions:
30 all:
31 - key: "{{ request.operation || 'BACKGROUND' }}"
32 operator: Equals
33 value: CONNECT
34 validate:
35 message: Exec'ing into Pods protected with the label `exec=false` is forbidden.
36 deny:
37 conditions:
38 all:
39 - key: "{{ podexeclabel }}"
40 operator: Equals
41 value: "false"

Block Pod Exec by Pod Name

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-pod-exec-by-pod-name/block-pod-exec-by-pod-name.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-exec-by-pod-name
 5 annotations:
 6 policies.kyverno.io/title: Block Pod Exec by Pod Name
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/description: >-
11 The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can
12 be useful for troubleshooting purposes, it could represent an attack vector and is discouraged.
13 This policy blocks Pod exec commands to Pods beginning with the name
14 `myapp-maintenance-`.
15spec:
16 validationFailureAction: Enforce
17 background: false
18 rules:
19 - name: deny-exec-myapp-maintenance
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod/exec
25 preconditions:
26 all:
27 - key: "{{ request.operation || 'BACKGROUND' }}"
28 operator: Equals
29 value: CONNECT
30 validate:
31 message: Exec'ing into Pods called "myapp-maintenance" is not allowed.
32 deny:
33 conditions:
34 all:
35 - key: "{{ request.name }}"
36 operator: Equals
37 value: myapp-maintenance-*

Block Stale Images

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-stale-images/block-stale-images.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-stale-images
 5 annotations:
 6 policies.kyverno.io/title: Block Stale Images
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Images that are old usually have some open security vulnerabilities which are not patched.
15 This policy checks the contents of every container image and inspects them for the create time.
16 If it finds any image which was built more than 6 months ago this policy blocks the deployment.
17spec:
18 validationFailureAction: Audit 
19 rules:
20 - name: block-stale-images
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 validate:
27 message: "Images built more than 6 months ago are prohibited."
28 foreach:
29 - list: "request.object.spec.containers"
30 context:
31 - name: imageData
32 imageRegistry:
33 reference: "{{ element.image }}"
34 deny:
35 conditions:
36 all:
37 - key: "{{ time_since('', '{{ imageData.configData.created }}', '') }}"
38 operator: GreaterThan
39 value: 4380h

Block Tekton TaskRun

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/tekton/block-tekton-task-runs/block-tekton-task-runs.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-tekton-task-runs
 5 annotations:
 6 policies.kyverno.io/title: Block Tekton TaskRun
 7 policies.kyverno.io/category: Tekton
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: TaskRun
10 kyverno.io/kyverno-version: 1.7.1
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >-
14 Restrict creation of TaskRun resources to the Tekton pipelines controller.
15spec:
16 validationFailureAction: Audit
17 background: false
18 rules:
19 - name: check-taskrun-user
20 match:
21 any:
22 - resources:
23 kinds:
24 - TaskRun
25 exclude:
26 any:
27 - subjects:
28 - kind: User 
29 name: "system:serviceaccount:tekton-pipelines:tekton-pipelines-controller"
30 preconditions:
31 all:
32 - key: "{{ request.operation || 'BACKGROUND' }}"
33 operator: AnyIn
34 value:
35 - CREATE
36 - UPDATE
37 validate:
38 message: Creating a TaskRun is not allowed.
39 deny: {}

Block Tekton TaskRun in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/tekton-cel/block-tekton-task-runs/block-tekton-task-runs.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-tekton-task-runs
 5 annotations:
 6 policies.kyverno.io/title: Block Tekton TaskRun in CEL expressions
 7 policies.kyverno.io/category: Tekton in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: TaskRun
10 kyverno.io/kyverno-version: 1.11.0
11 policies.kyverno.io/minversion: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 Restrict creation of TaskRun resources to the Tekton pipelines controller.
15spec:
16 validationFailureAction: Audit
17 background: false
18 rules:
19 - name: check-taskrun-user
20 match:
21 any:
22 - resources:
23 kinds:
24 - TaskRun
25 operations:
26 - CREATE
27 - UPDATE
28 exclude:
29 any:
30 - subjects:
31 - kind: User 
32 name: "system:serviceaccount:tekton-pipelines:tekton-pipelines-controller"
33 validate:
34 cel:
35 expressions:
36 - expression: "false"
37 message: Creating a TaskRun is not allowed.

Block Updates and Deletes

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/block-updates-deletes/block-updates-deletes.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-updates-deletes
 5 annotations:
 6 policies.kyverno.io/title: Block Updates and Deletes
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: RBAC
 9 policies.kyverno.io/description: >-
10 Kubernetes RBAC allows for controls on kinds of resources or those
11 with specific names. But it does not have the type of granularity often
12 required in more complex environments. This policy restricts updates and deletes to any
13 Service resource that contains the label `protected=true` unless by
14 a cluster-admin.
15spec:
16 validationFailureAction: Enforce
17 background: false
18 rules:
19 - name: block-updates-deletes
20 match:
21 any:
22 - resources:
23 kinds:
24 - Service
25 selector:
26 matchLabels:
27 protected: "true"
28 exclude:
29 any:
30 - clusterRoles:
31 - cluster-admin
32 validate:
33 message: "This resource is protected and changes are not allowed. Please seek a cluster-admin."
34 deny:
35 conditions:
36 any:
37 - key: "{{request.operation || 'BACKGROUND'}}"
38 operator: AnyIn
39 value:
40 - DELETE
41 - UPDATE

Block Velero Restore to Protected Namespace

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/velero/block-velero-restore/block-velero-restore.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-velero-restore
 5 annotations:
 6 policies.kyverno.io/title: Block Velero Restore to Protected Namespace
 7 policies.kyverno.io/category: Velero
 8 policies.kyverno.io/subject: Restore
 9 policies.kyverno.io/description: >-
10 Velero allows on backup and restore operations and is designed to be run with full cluster admin permissions.
11 It allows on cross namespace restore operations, which means you can restore backup of namespace A to namespace B.
12 This policy protect restore operation into system or any protected namespaces, listed in deny condition section. 
13 It checks the Restore CRD object and its namespaceMapping field. If destination match protected namespace
14 then operation fails and warning message is throw.
15spec:
16 validationFailureAction: Audit
17 background: false
18 rules:
19 - name: block-velero-restore-to-protected-namespace
20 match:
21 any:
22 - resources:
23 kinds:
24 - velero.io/v1/Restore
25 validate:
26 message: "Warning! Restore to protected namespace: {{request.object.spec.namespaceMapping | values(@)}} is not allowed!"
27 deny:
28 conditions:
29 any:
30 - key: "{{request.object.spec.namespaceMapping || `{}` | values(@)}}"
31 operator: AnyIn
32 value:
33 - kube-system
34 - kube-node-lease

Block Velero Restore to Protected Namespace in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/velero-cel/block-velero-restore/block-velero-restore.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: block-velero-restore
 5 annotations:
 6 policies.kyverno.io/title: Block Velero Restore to Protected Namespace in CEL expressions
 7 policies.kyverno.io/category: Velero in CEL 
 8 policies.kyverno.io/subject: Restore
 9 kyverno.io/kyverno-version: 1.11.0
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/description: >-
12 Velero allows on backup and restore operations and is designed to be run with full cluster admin permissions.
13 It allows on cross namespace restore operations, which means you can restore backup of namespace A to namespace B.
14 This policy protect restore operation into system or any protected namespaces, listed in deny condition section. 
15 It checks the Restore CRD object and its namespaceMapping field. If destination match protected namespace
16 then operation fails and warning message is throw.
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: block-velero-restore-to-protected-namespace
22 match:
23 any:
24 - resources:
25 kinds:
26 - velero.io/v1/Restore
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel:
32 variables:
33 - name: namespaceMappingValues
34 expression: "has(object.spec.namespaceMapping) ? object.spec.namespaceMapping.map(nsmap, object.spec.namespaceMapping[nsmap]) : []"
35 expressions:
36 - expression: "!variables.namespaceMappingValues.exists(val, val in ['kube-system', 'kube-node-lease'])"
37 messageExpression: "'Warning! Restore to protected namespace: ' + variables.namespaceMappingValues.join(', ') + ' is not allowed!'"

Certificate max duration 100 days

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/cert-manager/limit-duration/limit-duration.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: cert-manager-limit-duration
 5 annotations:
 6 policies.kyverno.io/title: Certificate max duration 100 days
 7 policies.kyverno.io/category: Cert-Manager
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/subject: Certificate
11 policies.kyverno.io/description: >-
12 Kubernetes managed non-letsencrypt certificates have to be renewed in every 100 days.
13spec:
14 validationFailureAction: Audit
15 background: false
16 rules:
17 - name: certificate-duration-max-100days 
18 match:
19 any:
20 - resources:
21 kinds:
22 - Certificate
23 preconditions:
24 all:
25 - key: "{{ contains(request.object.spec.issuerRef.name, 'letsencrypt') }}"
26 operator: Equals
27 value: False
28 - key: "{{ request.object.spec.duration }}"
29 operator: NotEquals
30 value: ""
31 validate:
32 message: "certificate duration must be < than 2400h (100 days)"
33 deny:
34 conditions:
35 all:
36 - key: "{{ max( [ to_number(regex_replace_all('h.*',request.object.spec.duration,'')), to_number('2400') ] ) }}"
37 operator: NotEquals
38 value: 2400

Change DNS Config and Policy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/dns-policy-and-dns-config/dns-policy-and-dns-config.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: change-dns-config-policy
 5 annotations:
 6 policies.kyverno.io/title: Change DNS Config and Policy
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.8.1
10 kyverno.io/kubernetes-version: "1.23"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 The Default DNS policy in Kubernetes gives the flexibility of service 
14 access; however, it costs some latency on a high scale, and it needs to 
15 be optimized. This policy helps us to optimize the performance of DNS 
16 queries by setting DNS Options, nodelocalDNS IP, and search Domains.
17 This policy can be applied for the clusters provisioned by kubeadm.
18spec:
19 rules:
20 - name: dns-policy
21 context:
22 - name: dictionary
23 configMap:
24 # kubelet-config cm would also works by using clusterDomain 
25 # instead of clusterName; but kubeadm-config sounds more reliable
26 # when considering kubelet-config is changed every cluster upgrade, etc.
27 name: kubeadm-config 
28 namespace: kube-system
29 match:
30 any:
31 - resources:
32 kinds:
33 - Pod
34 preconditions:
35 any:
36 - key: "{{ request.object.spec.dnsPolicy || '' }}"
37 operator: AnyIn
38 value: 
39 - ClusterFirst
40 - ClusterFirstWithHostNet
41 - None
42 mutate:
43 patchStrategicMerge:
44 spec:
45 dnsConfig:
46 nameservers:
47 # NodelocalDNS IP
48 - 169.254.25.10 
49 options:
50 - name: timeout
51 value: "1"
52 - name: ndots
53 value: "2"
54 - name: attempts
55 value: "1"
56 searches:
57 - svc.{{dictionary.data.ClusterConfiguration | parse_yaml(@).clusterName}}
58 - "{{ request.namespace }}.svc.{{ dictionary.data.ClusterConfiguration | parse_yaml(@).clusterName }}"
59 dnsPolicy: None

Check Data Protection By Label

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kasten/kasten-data-protection-by-label/kasten-data-protection-by-label.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: kasten-data-protection-by-label
 5 annotations:
 6 policies.kyverno.io/title: Check Data Protection By Label
 7 policies.kyverno.io/category: Veeam Kasten
 8 kyverno.io/kyverno-version: 1.12.1
 9 policies.kyverno.io/minversion: 1.6.2
10 kyverno.io/kubernetes-version: "1.24-1.30"
11 policies.kyverno.io/subject: Deployment, StatefulSet
12 policies.kyverno.io/description: >-
13 Check the 'dataprotection' label for production Deployments and StatefulSet workloads.
14 Use in combination with 'kasten-generate-example-backup-policy' policy to generate a Kasten policy for the workload namespace, if it doesn't already exist.
15spec:
16 validationFailureAction: Audit
17 rules:
18 - name: kasten-data-protection-by-label
19 match:
20 any: 
21 - resources:
22 kinds:
23 - Deployment
24 - StatefulSet
25 selector:
26 matchLabels:
27 purpose: production
28 validate:
29 message: >-
30 "Deployments and StatefulSets with 'purpose=production' label must specify a valid 'dataprotection' label:
31 
32 "dataprotection=kasten-example" - <Insert human readable settings for each option>
33 "dataprotection=none" - No local snapshots or backups
34 pattern:
35 metadata:
36 labels:
37 dataprotection: "kasten-example|none"

Check Data Protection By Label in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kasten-cel/k10-data-protection-by-label/k10-data-protection-by-label.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: k10-data-protection-by-label
 5 annotations:
 6 policies.kyverno.io/title: Check Data Protection By Label in CEL expressions
 7 policies.kyverno.io/category: Kasten K10 by Veeam in CEL 
 8 kyverno.io/kyverno-version: 1.11.0
 9 policies.kyverno.io/minversion: 1.11.0
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/subject: Deployment, StatefulSet
12 policies.kyverno.io/description: >-
13 Check the 'dataprotection' label that production Deployments and StatefulSet have a named K10 Policy.
14 Use in combination with 'generate' ClusterPolicy to 'generate' a specific K10 Policy by name.
15spec:
16 validationFailureAction: Audit
17 rules:
18 - name: k10-data-protection-by-label
19 match:
20 any: 
21 - resources:
22 kinds:
23 - Deployment
24 - StatefulSet
25 operations:
26 - CREATE
27 - UPDATE
28 selector:
29 matchLabels:
30 purpose: production
31 validate:
32 cel:
33 expressions:
34 - expression: "object.metadata.?labels.?dataprotection.orValue('').startsWith('k10-')"
35 message: "Deployments and StatefulSets that specify 'dataprotection' label must have a valid k10-?* name (use labels: dataprotection: k10-<policyname>)"

Check deprecated APIs

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/check-deprecated-apis/check-deprecated-apis.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-deprecated-apis
 5 annotations:
 6 policies.kyverno.io/title: Check deprecated APIs
 7 policies.kyverno.io/category: Best Practices
 8 policies.kyverno.io/subject: Kubernetes APIs
 9 kyverno.io/kyverno-version: 1.7.4
 10 policies.kyverno.io/minversion: 1.7.4
 11 kyverno.io/kubernetes-version: "1.23"
 12 policies.kyverno.io/description: >-
 13 Kubernetes APIs are sometimes deprecated and removed after a few releases.
 14 As a best practice, older API versions should be replaced with newer versions.
 15 This policy validates for APIs that are deprecated or scheduled for removal.
 16 Note that checking for some of these resources may require modifying the Kyverno
 17 ConfigMap to remove filters. In the validate-v1-22-removals rule, the Lease kind
 18 has been commented out due to a check for this kind having a performance penalty
 19 on Kubernetes clusters with many leases. Its enabling should be attended carefully
 20 and is not recommended on large clusters. PodSecurityPolicy is removed in v1.25
 21 so therefore the validate-v1-25-removals rule may not completely work on 1.25+.
 22 This policy requires Kyverno v1.7.4+ to function properly.
 23spec:
 24 validationFailureAction: Audit
 25 background: true
 26 rules:
 27 - name: validate-v1-25-removals
 28 match:
 29 any:
 30 - resources:
 31 # NOTE: PodSecurityPolicy is completely removed in 1.25.
 32 kinds:
 33 - batch/*/CronJob
 34 - discovery.k8s.io/*/EndpointSlice
 35 - events.k8s.io/*/Event
 36 - policy/*/PodDisruptionBudget
 37 - policy/*/PodSecurityPolicy
 38 - node.k8s.io/*/RuntimeClass
 39 preconditions:
 40 all:
 41 - key: "{{ request.operation || 'BACKGROUND' }}"
 42 operator: NotEquals
 43 value: DELETE
 44 - key: "{{request.object.apiVersion}}"
 45 operator: AnyIn
 46 value:
 47 - batch/v1beta1
 48 - discovery.k8s.io/v1beta1
 49 - events.k8s.io/v1beta1
 50 - policy/v1beta1
 51 - node.k8s.io/v1beta1
 52 validate:
 53 message: >-
 54 {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.25.
 55 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
 56 deny: {}
 57 - name: validate-v1-26-removals
 58 match:
 59 any:
 60 - resources:
 61 kinds:
 62 - flowcontrol.apiserver.k8s.io/*/FlowSchema
 63 - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
 64 - autoscaling/*/HorizontalPodAutoscaler
 65 preconditions:
 66 all:
 67 - key: "{{ request.operation || 'BACKGROUND' }}"
 68 operator: NotEquals
 69 value: DELETE
 70 - key: "{{request.object.apiVersion}}"
 71 operator: AnyIn
 72 value:
 73 - flowcontrol.apiserver.k8s.io/v1beta1
 74 - autoscaling/v2beta2
 75 validate:
 76 message: >-
 77 {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.26.
 78 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
 79 deny: {}
 80 - name: validate-v1-27-removals
 81 match:
 82 any:
 83 - resources:
 84 kinds:
 85 - storage.k8s.io/*/CSIStorageCapacity
 86 preconditions:
 87 all:
 88 - key: "{{ request.operation || 'BACKGROUND' }}"
 89 operator: NotEquals
 90 value: DELETE
 91 - key: "{{request.object.apiVersion}}"
 92 operator: AnyIn
 93 value:
 94 - storage.k8s.io/v1beta1
 95 validate:
 96 message: >-
 97 {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.27.
 98 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
 99 deny: {}
100 - name: validate-v1-29-removals
101 match:
102 any:
103 - resources:
104 kinds:
105 - flowcontrol.apiserver.k8s.io/*/FlowSchema
106 - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
107 preconditions:
108 all:
109 - key: "{{ request.operation || 'BACKGROUND' }}"
110 operator: NotEquals
111 value: DELETE
112 - key: "{{request.object.apiVersion}}"
113 operator: AnyIn
114 value:
115 - flowcontrol.apiserver.k8s.io/v1beta2
116 validate:
117 message: >-
118 {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.29.
119 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
120 deny: {}
121 - name: validate-v1-32-removals
122 match:
123 any:
124 - resources:
125 kinds:
126 - flowcontrol.apiserver.k8s.io/*/FlowSchema
127 - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
128 preconditions:
129 all:
130 - key: "{{ request.operation || 'BACKGROUND' }}"
131 operator: NotEquals
132 value: DELETE
133 - key: "{{request.object.apiVersion}}"
134 operator: AnyIn
135 value:
136 -  flowcontrol.apiserver.k8s.io/v1beta3
137 validate:
138 message: >-
139 {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.32.
140 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
141 deny: {}

Check deprecated APIs in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/check-deprecated-apis/check-deprecated-apis.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-deprecated-apis
 5 annotations:
 6 policies.kyverno.io/title: Check deprecated APIs in CEL expressions
 7 policies.kyverno.io/category: Best Practices in CEL 
 8 policies.kyverno.io/subject: Kubernetes APIs
 9 kyverno.io/kyverno-version: 1.12.1
 10 kyverno.io/kubernetes-version: "1.26-1.27"
 11 policies.kyverno.io/description: >-
 12 Kubernetes APIs are sometimes deprecated and removed after a few releases.
 13 As a best practice, older API versions should be replaced with newer versions.
 14 This policy validates for APIs that are deprecated or scheduled for removal.
 15 Note that checking for some of these resources may require modifying the Kyverno
 16 ConfigMap to remove filters. PodSecurityPolicy is removed in v1.25
 17 so therefore the validate-v1-25-removals rule may not completely work on 1.25+.
 18spec:
 19 validationFailureAction: Audit
 20 background: true
 21 rules:
 22 - name: validate-v1-25-removals
 23 match:
 24 any:
 25 - resources:
 26 # NOTE: PodSecurityPolicy is completely removed in 1.25.
 27 kinds:
 28 - batch/*/CronJob
 29 - discovery.k8s.io/*/EndpointSlice
 30 - events.k8s.io/*/Event
 31 - policy/*/PodDisruptionBudget
 32 - policy/*/PodSecurityPolicy
 33 - node.k8s.io/*/RuntimeClass
 34 celPreconditions:
 35 - name: "allowed-api-versions"
 36 expression: "object.apiVersion in ['batch/v1beta1', 'discovery.k8s.io/v1beta1', 'events.k8s.io/v1beta1', 'policy/v1beta1', 'node.k8s.io/v1beta1']"
 37 validate:
 38 cel:
 39 expressions:
 40 - expression: "false"
 41 messageExpression: >-
 42 object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.25.
 43 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
 44 - name: validate-v1-26-removals
 45 match:
 46 any:
 47 - resources:
 48 kinds:
 49 - flowcontrol.apiserver.k8s.io/*/FlowSchema
 50 - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
 51 - autoscaling/*/HorizontalPodAutoscaler
 52 celPreconditions:
 53 - name: "allowed-api-versions"
 54 expression: "object.apiVersion in ['flowcontrol.apiserver.k8s.io/v1beta1', 'autoscaling/v2beta2']"
 55 validate:
 56 cel:
 57 expressions:
 58 - expression: "false"
 59 messageExpression: >-
 60 object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.26.
 61 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
 62 - name: validate-v1-27-removals
 63 match:
 64 any:
 65 - resources:
 66 kinds:
 67 - storage.k8s.io/*/CSIStorageCapacity
 68 celPreconditions:
 69 - name: "allowed-api-versions"
 70 expression: "object.apiVersion in ['storage.k8s.io/v1beta1']"
 71 validate:
 72 cel:
 73 expressions:
 74 - expression: "false"
 75 messageExpression: >-
 76 object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.27.
 77 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
 78 - name: validate-v1-29-removals
 79 match:
 80 any:
 81 - resources:
 82 kinds:
 83 - flowcontrol.apiserver.k8s.io/*/FlowSchema
 84 - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
 85 celPreconditions:
 86 - name: "object.apiVersion"
 87 expression: "object.apiVersion in ['flowcontrol.apiserver.k8s.io/v1beta2']"
 88 validate:
 89 cel:
 90 expressions:
 91 - expression: "false"
 92 messageExpression: >-
 93 object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.29.
 94 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
 95 - name: validate-v1-32-removals
 96 match:
 97 any:
 98 - resources:
 99 kinds:
100 - flowcontrol.apiserver.k8s.io/*/FlowSchema
101 - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
102 celPreconditions:
103 - name: "object.apiVersion"
104 expression: "object.apiVersion in ['flowcontrol.apiserver.k8s.io/v1beta3']"
105 validate:
106 cel:
107 expressions:
108 - expression: "false"
109 messageExpression: >-
110 object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.32.
111 See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'

Check Environment Variables

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/check-env-vars/check-env-vars.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-env-vars
 5 annotations:
 6 policies.kyverno.io/severity: medium
 7 policies.kyverno.io/title: Check Environment Variables
 8 policies.kyverno.io/category: Other
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kubernetes-version: "1.24"
11 kyverno.io/kyverno-version: 1.8.2
12 policies.kyverno.io/description: >-
13 Environment variables control many aspects of a container's execution and are
14 often the source of many different configuration settings. Being able to ensure that
15 the value of a specific environment variable either is or is not set to a specific string
16 is useful to maintain such controls. This policy checks every container to ensure that if the
17 `DISABLE_OPA` environment variable is defined, it must not be set to a value of `"true"`.
18spec:
19 background: true
20 validationFailureAction: Audit
21 rules:
22 - name: check-disable-opa
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 validate:
29 message: "DISABLE_OPA must not be set to true."
30 pattern:
31 spec:
32 containers:
33 - name: "*"
34 =(env):
35 - (name): DISABLE_OPA
36 value: "!true"

Check Environment Variables in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/check-env-vars/check-env-vars.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-env-vars
 5 annotations:
 6 policies.kyverno.io/title: Check Environment Variables in CEL expressions
 7 policies.kyverno.io/severity: medium
 8 policies.kyverno.io/category: Other in CEL 
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 kyverno.io/kyverno-version: 1.11.0
12 policies.kyverno.io/description: >-
13 Environment variables control many aspects of a container's execution and are
14 often the source of many different configuration settings. Being able to ensure that
15 the value of a specific environment variable either is or is not set to a specific string
16 is useful to maintain such controls. This policy checks every container to ensure that if the
17 `DISABLE_OPA` environment variable is defined, it must not be set to a value of `"true"`.
18spec:
19 background: true
20 validationFailureAction: Audit
21 rules:
22 - name: check-disable-opa
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: >- 
35 !object.spec.containers.exists(container, 
36 container.?env.orValue([]).exists(e, e.name == 'DISABLE_OPA' && e.value == 'true'))
37 message: "DISABLE_OPA must not be set to true."

Check for matching VerticalPodAutoscaler (VPA)

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/check-vpa-configuration/check-vpa-configuration.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-vpa-configuration
 5 annotations:
 6 policies.kyverno.io/title: Check for matching VerticalPodAutoscaler (VPA)
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.4 
10 kyverno.io/kubernetes-version: "1.27" 
11 policies.kyverno.io/subject: Deployment, StatefulSet, ReplicaSet, DaemonSet, VerticalPodAutoscaler
12 policies.kyverno.io/description: >-
13 VerticalPodAutoscaler (VPA) is useful to automatically adjust the resources assigned to Pods. 
14 It requires defining a specific target resource by kind and name. There are no built-in 
15 validation checks by the VPA controller to ensure that the target resource is associated with it. 
16 This policy ensures that the matching kind has a matching VPA. 
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: check-vpa-configuration
22 match:
23 any:
24 - resources:
25 kinds:
26 - Deployment
27 - StatefulSet
28 - ReplicaSet
29 - DaemonSet
30 context:
31 - name: vpas
32 apiCall:
33 urlPath: "/apis/autoscaling.k8s.io/v1/namespaces/{{request.object.metadata.namespace}}/verticalpodautoscalers"
34 jmesPath: "items[?spec.targetRef.kind=='{{ request.object.kind }}'].spec.targetRef.name"
35 validate:
36 message: >-
37 Workload '{{request.object.kind}}/{{request.object.metadata.name}}' 
38 requires a matching VerticalPodAutoscaler (VPA) in the 
39 '{{request.object.metadata.namespace}}' namespace.
40 deny:
41 conditions:
42 all:
43 - key: "{{ request.object.metadata.name }}" 
44 operator: NotIn 
45 value: "{{ vpas }}"

Check Hourly RPO in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kasten-cel/k10-hourly-rpo/k10-hourly-rpo.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: k10-policy-hourly-rpo
 5 annotations:
 6 policies.kyverno.io/title: Check Hourly RPO in CEL expressions
 7 policies.kyverno.io/category: Kasten K10 by Veeam in CEL 
 8 kyverno.io/kyverno-version: 1.11.0
 9 policies.kyverno.io/minversion: 1.11.0
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/subject: Policy
12 policies.kyverno.io/description: >-
13 K10 Policy resources can be educated to adhere to common Recovery Point Objective (RPO) best practices. 
14 This policy is advising to use an RPO frequency that with hourly granularity if it has the appPriority: Mission Critical
15spec:
16 validationFailureAction: Audit 
17 rules:
18 - name: k10-policy-hourly-rpo
19 match:
20 any:
21 - resources:
22 kinds:
23 - config.kio.kasten.io/v1alpha1/Policy
24 operations:
25 - CREATE
26 - UPDATE
27 selector:
28 matchLabels:
29 appPriority: Mission-Critical
30 validate:
31 cel:
32 expressions:
33 - expression: "has(object.spec.frequency) && object.spec.frequency == '@hourly'"
34 message: "Mission Critical RPO frequency should use no shorter than @hourly frequency"

Check Image Base

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/require-base-image/require-base-image.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: require-base-image
 5 annotations:
 6 policies.kyverno.io/title: Check Image Base
 7 policies.kyverno.io/category: Other, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.7.0
10 policies.kyverno.io/minversion: 1.7.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Container images can be built from a variety of sources, including other preexisting
15 images. Ensuring images that are allowed to run are built from known, trusted
16 images where their provenance is guaranteed can be an important step in ensuring
17 overall cluster security. This policy ensures that any
18 container image specifies some base image in its metadata from four possible sources:
19 Docker BuildKit, OCI annotations (in manifest or config), or Buildpacks. Note that the
20 ability to detect the presence of a base image is not implicit and requires the author
21 to specify it using metadata or build directives of some sort (ex., Dockerfile FROM
22 statements do not automatically expose this information).
23spec:
24 validationFailureAction: Audit
25 rules:
26 - name: require-base-image
27 match:
28 any:
29 - resources:
30 kinds:
31 - Pod
32 preconditions:
33 all:
34 - key: "{{request.operation || 'BACKGROUND'}}"
35 operator: NotEquals
36 value: DELETE
37 validate:
38 message: "Images must specify a source/base image from which they are built."
39 foreach:
40 - list: "request.object.spec.containers"
41 context: 
42 - name: imageData
43 imageRegistry: 
44 reference: "{{ element.image }}"
45 - name: mobysource
46 variable:
47 jmesPath: imageData.configData."moby.buildkit.buildinfo.v1" | base64_decode(@).parse_json(@) | sources[?type == 'docker-image'].ref | length(@)
48 default: 0
49 - name: ocisourcelabels
50 variable:
51 jmesPath: imageData.configData.config.Labels | keys(@)
52 default: []
53 - name: ocisourceannotations
54 variable:
55 jmesPath: imageData.manifest.annotations."org.opencontainers.image.base.name"
56 default: ''
57 - name: buildpacks
58 variable:
59 jmesPath: parse_json(imageData.configData.config.Labels."io.buildpacks.lifecycle.metadata").runImage.reference || parse_json(imageData.configData.config.Labels."io.buildpacks.lifecycle.metadata").stack.runImage.image
60 default: ''
61 deny:
62 conditions:
63 all:
64 - key: "org.opencontainers.image.base.name"
65 operator: AnyNotIn
66 value: "{{ ocisourcelabels}}"
67 - key: "{{ ocisourceannotations}}"
68 operator: Equals
69 value: ''
70 - key: "{{ mobysource }}"
71 operator: Equals
72 value: 0
73 - key: "{{ buildpacks }}"
74 operator: Equals
75 value: ''

Check Kasten 3-2-1 Backup Policy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kasten/kasten-3-2-1-backup/kasten-3-2-1-backup.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: kasten-3-2-1-backup-policy
 5 annotations:
 6 policies.kyverno.io/title: Check Kasten 3-2-1 Backup Policy
 7 policies.kyverno.io/category: Veeam Kasten
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.12.1
10 policies.kyverno.io/minversion: 1.12.0
11 kyverno.io/kubernetes-version: "1.24-1.30"
12 policies.kyverno.io/subject: Policy
13 policies.kyverno.io/description: >-
14 The 3-2-1 rule of data protection recommends that you have at least 3 copies of data, on 2 different storage targets, with 1 being offsite. This approach ensures a health mix of redundancy options for data recovery of the application for localized & multi-region cloud failures or compromise. In Kubernetes, this translates to the original running resources, a local snapshot, and a copy of all application resources and volume data exported to an external repository.
15 This policy accomplishes 3-2-1 validation by ensuring each policy contains both 'action: backup' and 'action: export'.
16spec:
17 validationFailureAction: Audit 
18 rules:
19 - name: kasten-3-2-1-backup-policy
20 match:
21 any:
22 - resources:
23 kinds:
24 - config.kio.kasten.io/v1alpha1/Policy
25 exclude:
26 any:
27 - resources:
28 operations:
29 - DELETE
30 validate:
31 message: "The Kasten 3-2-1 policy requires both 'action: backup' and 'action: export' be defined in the Policy."
32 deny:
33 conditions:
34 all:
35 - key:
36 - backup
37 - export
38 operator: AnyNotIn
39 value: "{{ request.object.spec.actions[].action }}"

Check Kasten Location Profile is Immutable

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kasten/kasten-immutable-location-profile/kasten-immutable-location-profile.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: kasten-immutable-location-profile
 5 annotations:
 6 policies.kyverno.io/title: Check Kasten Location Profile is Immutable
 7 policies.kyverno.io/category: Veeam Kasten
 8 policies.kyverno.io/subject: config.kio.kasten.io/v1alpha1/Profile
 9 kyverno.io/kyverno-version: 1.12.1
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.25-1.30"
12 policies.kyverno.io/description: >-
13 Ensure Kasten Location Profiles have enabled immutability to prevent unintentional or malicious changes to backup data.
14spec:
15 validationFailureAction: Audit
16 rules:
17 - name: kasten-immutable-location-profile
18 match:
19 resources:
20 kinds:
21 - Profile
22 validate:
23 message: >-
24 All Kasten Location Profiles must have immutability enabled.
25 pattern:
26 spec:
27 (type): Location
28 locationSpec:
29 objectStore:
30 protectionPeriod: "*"

Check Kasten Policy RPO based on Namespace Label

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kasten/kasten-hourly-rpo/kasten-hourly-rpo.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: kasten-hourly-rpo
 5 annotations:
 6 policies.kyverno.io/title: Check Kasten Policy RPO based on Namespace Label
 7 policies.kyverno.io/category: Veeam Kasten
 8 kyverno.io/kyverno-version: 1.12.1
 9 policies.kyverno.io/minversion: 1.12.0
10 kyverno.io/kubernetes-version: "1.24-1.30"
11 policies.kyverno.io/subject: Policy
12 policies.kyverno.io/description: >-
13 Kasten Policy resources can be required to adhere to common Recovery Point Objective (RPO) best practices. 
14 This example policy validates that the Policy is set to run hourly if it explicitly protects any namespaces containing the `appPriority=critical` label. This policy can be adapted to enforce any Kasten Policy requirements based on a namespace label.
15spec:
16 validationFailureAction: Enforce 
17 rules:
18 - name: kasten-hourly-rpo
19 match:
20 any:
21 - resources:
22 kinds:
23 - config.kio.kasten.io/v1alpha1/Policy
24 context:
25 - name: namespacesWithPriorityLabel # Get list of namespaces with appPriority=critical label
26 apiCall:
27 urlPath: "/api/v1/namespaces?labelSelector=appPriority%3Dcritical"
28 jmesPath: "items[].metadata.name"
29 preconditions:
30 any:
31 - key: "{{ length(namespacesWithPriorityLabel) }}"
32 operator: GreaterThan
33 value: 0 # Only proceed if namespaces with appPriority=critical label exist
34 validate:
35 message: "Mission Critical RPO frequency should use no shorter than @hourly frequency"
36 foreach:
37 - list: "request.object.spec.selector.matchExpressions[0].values"
38 deny:
39 conditions:
40 all: # Deny admission if the policy is not hourly AND any namespaces listed in the Policy contain the appPriority=critical label
41 - key: "{{ element }}"
42 operator: AnyIn
43 value: "{{ namespacesWithPriorityLabel }}"
44 - key: "{{ request.object.spec.frequency }}"
45 operator: NotEquals
46 value: '@hourly'

Check Linkerd AuthorizationPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/linkerd/check-linkerd-authorizationpolicy/check-linkerd-authorizationpolicy.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-linkerd-authorizationpolicy
 5 annotations:
 6 policies.kyverno.io/title: Check Linkerd AuthorizationPolicy
 7 policies.kyverno.io/category: Linkerd
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: AuthorizationPolicy
10 kyverno.io/kyverno-version: "1.8.0"
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/description: >-
13 As of Linkerd 2.12, an AuthorizationPolicy is a resource used to selectively allow traffic
14 to either a Server or HTTPRoute resource. Creating AuthorizationPolicies is needed when
15 a Server exists in order to control what traffic is permitted within the mesh to the Pods
16 selected by the Server or HTTPRoute. This policy, requiring Linkerd 2.12+, checks incoming
17 AuthorizationPolicy resources to ensure that either a matching Server or HTTPRoute exists
18 first.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: check-server-exists
24 match:
25 any:
26 - resources:
27 kinds:
28 - AuthorizationPolicy
29 context:
30 - name: servers
31 apiCall:
32 urlPath: "/apis/policy.linkerd.io/v1beta1/namespaces/{{request.namespace}}/servers"
33 jmesPath: "items[].metadata.name || `[]`"
34 - name: httproutes
35 apiCall:
36 urlPath: "/apis/policy.linkerd.io/v1beta1/namespaces/{{request.namespace}}/httproutes"
37 jmesPath: "items[].metadata.name || `[]`"
38 validate:
39 message: "Server or HTTPRoute not found for this AuthorizationPolicy."
40 deny:
41 conditions:
42 all:
43 - key: "{{request.object.spec.targetRef.name}}"
44 operator: AnyNotIn
45 value: "{{servers}}"
46 - key: "{{request.object.spec.targetRef.name}}"
47 operator: AnyNotIn
48 value: "{{httproutes}}"

Check Long-Lived Secrets in ServiceAccounts

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/check-serviceaccount-secrets/check-serviceaccount-secrets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-serviceaccount-secrets
 5 annotations:
 6 policies.kyverno.io/title: Check Long-Lived Secrets in ServiceAccounts
 7 policies.kyverno.io/category: Security
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.1
10 kyverno.io/kubernetes-version: "1.27"
11 policies.kyverno.io/subject: Secret,ServiceAccount
12 policies.kyverno.io/description: >-
13 Before version 1.24, Kubernetes automatically generated Secret-based tokens 
14 for ServiceAccounts. To distinguish between automatically generated tokens 
15 and manually created ones, Kubernetes checks for a reference from the 
16 ServiceAccount's secrets field. If the Secret is referenced in the secrets 
17 field, it is considered an auto-generated legacy token. These legacy Tokens can
18 be of security concern and should be audited.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: deny-secrets
24 match:
25 any:
26 - resources:
27 kinds:
28 - ServiceAccount
29 validate:
30 message: "Long-lived API tokens are not allowed."
31 pattern:
32 X(secrets):

Check Long-Lived Secrets in ServiceAccounts in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/check-serviceaccount-secrets/check-serviceaccount-secrets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-serviceaccount-secrets
 5 annotations:
 6 policies.kyverno.io/title: Check Long-Lived Secrets in ServiceAccounts in CEL expressions
 7 policies.kyverno.io/category: Security in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/subject: Secret,ServiceAccount
12 policies.kyverno.io/description: >-
13 Before version 1.24, Kubernetes automatically generated Secret-based tokens 
14 for ServiceAccounts. To distinguish between automatically generated tokens 
15 and manually created ones, Kubernetes checks for a reference from the 
16 ServiceAccount's secrets field. If the Secret is referenced in the secrets 
17 field, it is considered an auto-generated legacy token. These legacy Tokens can
18 be of security concern and should be audited.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: deny-secrets
24 match:
25 any:
26 - resources:
27 kinds:
28 - ServiceAccount
29 operations:
30 - CREATE
31 - UPDATE
32 validate:
33 cel:
34 expressions:
35 - expression: "!has(object.secrets)"
36 message: "Long-lived API tokens are not allowed."

Check Node for CVE-2022-0185

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/check-node-for-cve-2022-0185/check-node-for-cve-2022-0185.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-kernel
 5 annotations:
 6 policies.kyverno.io/title: Check Node for CVE-2022-0185
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Node
13 policies.kyverno.io/description: >-
14 Linux CVE-2022-0185 can allow a container escape in Kubernetes if left unpatched.
15 The affected Linux kernel versions, at this time, are 5.10.84-1 and 5.15.5-2.
16 For more information, refer to https://security-tracker.debian.org/tracker/CVE-2022-0185.
17 This policy runs in background mode and flags an entry in the ClusterPolicyReport
18 if any Node is reporting one of the affected kernel versions.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: kernel-validate
24 match:
25 any:
26 - resources:
27 kinds:
28 - Node
29 validate:
30 message: "Kernel is vulnerable to CVE-2022-0185."
31 deny:
32 conditions:
33 any:
34 - key: "{{request.object.status.nodeInfo.kernelVersion}}"
35 operator: Equals
36 value: "5.10.84-1"
37 - key: "{{request.object.status.nodeInfo.kernelVersion}}"
38 operator: Equals
39 value: "5.15.5-2"

Check Node for CVE-2022-0185 in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/check-node-for-cve-2022-0185/check-node-for-cve-2022-0185.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-kernel
 5 annotations:
 6 policies.kyverno.io/title: Check Node for CVE-2022-0185 in CEL expressions
 7 policies.kyverno.io/category: Other in CEL 
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Node
13 policies.kyverno.io/description: >-
14 Linux CVE-2022-0185 can allow a container escape in Kubernetes if left unpatched.
15 The affected Linux kernel versions, at this time, are 5.10.84-1 and 5.15.5-2.
16 For more information, refer to https://security-tracker.debian.org/tracker/CVE-2022-0185.
17 This policy runs in background mode and flags an entry in the ClusterPolicyReport
18 if any Node is reporting one of the affected kernel versions.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: kernel-validate
24 match:
25 any:
26 - resources:
27 kinds:
28 - Node
29 operations:
30 - CREATE
31 - UPDATE
32 validate:
33 cel:
34 expressions:
35 - expression: "!(object.status.nodeInfo.kernelVersion in ['5.10.84-1', '5.15.5-2'])"
36 message: "Kernel is vulnerable to CVE-2022-0185."
37

Check NVIDIA GPUs

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/check-nvidia-gpu/check-nvidia-gpu.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-nvidia-gpus
 5 annotations:
 6 policies.kyverno.io/title: Check NVIDIA GPUs
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Containers which request use of an NVIDIA GPU often need to
15 be authored to consume them via a CUDA environment variable called
16 NVIDIA_VISIBLE_DEVICES. This policy checks the containers which
17 request a GPU to ensure they have been authored with this environment
18 variable.
19spec:
20 validationFailureAction: Audit
21 rules:
22 - name: check-nvidia-gpus
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 preconditions:
29 all:
30 - key: "{{request.operation || 'BACKGROUND'}}"
31 operator: NotEquals
32 value: DELETE
33 validate:
34 message: "Images which reserve NVIDIA GPUs must be built to use them."
35 foreach:
36 - list: "request.object.spec.containers"
37 context: 
38 - name: imageData
39 imageRegistry: 
40 reference: "{{ element.image }}"
41 deny:
42 conditions:
43 all:
44 # If a container image calls for an NVIDIA GPU in its resources.limits, it must also
45 # have been built with the CUDA environment variable `NVIDIA_VISIBLE_DEVICES`.
46 - key: "NVIDIA_VISIBLE_DEVICES=*?"
47 operator: AnyNotIn
48 value: "{{ imageData.configData.config.Env || '' }}"
49 - key: "{{ element.resources.limits.\"nvidia.com/gpu\" || '' }}"
50 operator: GreaterThan
51 value: 0

Check PodDisruptionBudget minAvailable

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/pdb-minavailable/pdb-minavailable.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: pdb-minavailable-check
 5 annotations:
 6 policies.kyverno.io/title: Check PodDisruptionBudget minAvailable
 7 policies.kyverno.io/category: Other
 8 kyverno.io/kyverno-version: 1.9.0
 9 kyverno.io/kubernetes-version: "1.24"
10 policies.kyverno.io/subject: PodDisruptionBudget, Deployment, StatefulSet
11 policies.kyverno.io/description: >-
12 When a Pod controller which can run multiple replicas is subject to an active PodDisruptionBudget,
13 if the replicas field has a value equal to the minAvailable value of the PodDisruptionBudget
14 it may prevent voluntary disruptions including Node drains which may impact routine maintenance
15 tasks and disrupt operations. This policy checks incoming Deployments and StatefulSets which have
16 a matching PodDisruptionBudget to ensure these two values do not match.
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: pdb-minavailable
22 match:
23 any:
24 - resources:
25 kinds:
26 - Deployment
27 - StatefulSet
28 preconditions:
29 all:
30 - key: "{{request.operation || 'BACKGROUND'}}"
31 operator: AnyIn
32 value:
33 - CREATE
34 - UPDATE
35 - key: "{{ request.object.spec.replicas || `1` }}"
36 operator: GreaterThan
37 value: 0
38 context:
39 - name: minavailable
40 apiCall:
41 urlPath: "/apis/policy/v1/namespaces/{{request.namespace}}/poddisruptionbudgets"
42 jmesPath: "items[?label_match(spec.selector.matchLabels, `{{request.object.spec.template.metadata.labels}}`)] | [0] | spec.minAvailable || `0`"
43 validate:
44 message: >-
45 The matching PodDisruptionBudget for this resource has its minAvailable value equal to the replica count
46 which is not permitted.
47 deny:
48 conditions:
49 any:
50 - key: "{{ request.object.spec.replicas }}"
51 operator: Equals
52 value: "{{ minavailable }}"

Check ServiceAccount

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/check-serviceaccount/check-serviceaccount.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-sa
 5 annotations:
 6 policies.kyverno.io/title: Check ServiceAccount
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/subject: Pod,ServiceAccount
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.21"
12 policies.kyverno.io/description: >-
13 ServiceAccounts with privileges to create Pods may be able to do so and name
14 a ServiceAccount other than the one used to create it. This policy checks the
15 Pod, if created by a ServiceAccount, and ensures the `serviceAccountName` field
16 matches the actual ServiceAccount.
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: check-sa
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 preconditions:
28 all:
29 - key: "{{serviceAccountName}}"
30 operator: Equals
31 value: "*?"
32 - key: "{{request.operation}}"
33 operator: Equals
34 value: CREATE
35 validate:
36 message: "The ServiceAccount used to create this Pod is confined to using the same account when running the Pod."
37 pattern:
38 spec:
39 serviceAccountName: "{{serviceAccountName}}"

Check SubjectAccessReview

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/check-subjectaccessreview/check-subjectaccessreview.yaml

 1apiVersion: kyverno.io/v2beta1
 2kind: ClusterPolicy
 3metadata:
 4 name: check-subjectaccessreview
 5 annotations:
 6 policies.kyverno.io/title: Check SubjectAccessReview
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/subject: SubjectAccessReview
 9 kyverno.io/kyverno-version: 1.10.0
10 policies.kyverno.io/minversion: 1.10.0
11 kyverno.io/kubernetes-version: "1.26"
12 policies.kyverno.io/description: >-
13 In some cases a validation check for one type of resource may need to
14 take into consideration the requesting user's permissions on a different type of resource.
15 Rather than parsing through all Roles and/or ClusterRoles to check if these permissions
16 are held, Kyverno can perform a SubjectAccessReview request to the Kubernetes API server
17 and have it figure out those permissions. This policy illustrates how to perform a POST
18 request to the API server to subject a SubjectAccessReview for a user creating/updating a
19 ConfigMap. It is intended to be used as a component in a more functional rule.
20spec:
21 validationFailureAction: Audit
22 background: false
23 rules:
24 - name: check-sar
25 match:
26 any:
27 - resources:
28 kinds:
29 - ConfigMap
30 context:
31 - name: subjectaccessreview
32 apiCall:
33 urlPath: /apis/authorization.k8s.io/v1/subjectaccessreviews
34 method: POST
35 data:
36 - key: kind
37 value: SubjectAccessReview
38 - key: apiVersion
39 value: authorization.k8s.io/v1
40 - key: spec
41 value:
42 resourceAttributes:
43 resource: "namespaces"
44 namespace: "{{ request.namespace }}"
45 verb: "delete"
46 group: ""
47 user: "{{ request.userInfo.username }}"
48 validate:
49 message: "User is not authorized."
50 deny:
51 conditions:
52 any:
53 - key: "{{ subjectaccessreview.status.allowed }}"
54 operator: NotEquals
55 value: true

Check supplementalGroups

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psp-migration/check-supplemental-groups/check-supplemental-groups.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: psp-check-supplemental-groups
 5 annotations:
 6 policies.kyverno.io/title: Check supplementalGroups
 7 policies.kyverno.io/category: PSP Migration
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Supplemental groups control which group IDs containers add and can coincide with
15 restricted groups on the host. Pod Security Policies (PSP) allowed a range of
16 these group IDs to be specified which were allowed. This policy ensures any Pod
17 may only specify supplementalGroup IDs between 100-200 or 500-600.
18spec:
19 background: false
20 validationFailureAction: Audit
21 rules:
22 - name: supplementalgroup-ranges
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 preconditions:
29 all:
30 - key: "{{ request.operation || 'BACKGROUND' }}"
31 operator: AnyIn
32 value:
33 - CREATE
34 - UPDATE
35 validate:
36 message: Any supplementalGroup ID must be within the range 100-200 or 500-600.
37 pattern:
38 spec:
39 =(securityContext):
40 =(supplementalGroups): 100-200 | 500-600

Check supplementalGroups in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psp-migration-cel/check-supplemental-groups/check-supplemental-groups.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: psp-check-supplemental-groups
 5 annotations:
 6 policies.kyverno.io/title: Check supplementalGroups in CEL expressions
 7 policies.kyverno.io/category: PSP Migration in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Supplemental groups control which group IDs containers add and can coincide with
15 restricted groups on the host. Pod Security Policies (PSP) allowed a range of
16 these group IDs to be specified which were allowed. This policy ensures any Pod
17 may only specify supplementalGroup IDs between 100-200 or 500-600.
18spec:
19 background: false
20 validationFailureAction: Audit
21 rules:
22 - name: supplementalgroup-ranges
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: >-
35 object.spec.?securityContext.?supplementalGroups.orValue([]).all(supplementalGroup, (supplementalGroup >= 100 && supplementalGroup <= 200) || (supplementalGroup >= 500 && supplementalGroup <= 600))
36 message: Any supplementalGroup ID must be within the range 100-200 or 500-600.

Check Tekton TaskRun Vulnerability Scan

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/tekton/verify-tekton-taskrun-vuln-scan/verify-tekton-taskrun-vuln-scan.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: verify-tekton-taskrun-vuln-scan
 5 annotations:
 6 policies.kyverno.io/title: Check Tekton TaskRun Vulnerability Scan
 7 policies.kyverno.io/category: Tekton
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: TaskRun
10 kyverno.io/kyverno-version: 1.7.2
11 policies.kyverno.io/minversion: 1.7.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >-
14 A signed bundle is required and a vulnerability scan made by Grype must
15 return no vulnerabilities greater than 8.0.
16spec:
17 validationFailureAction: Audit
18 webhookTimeoutSeconds: 30
19 rules:
20 - name: check-signature
21 match:
22 any:
23 - resources:
24 kinds:
25 - tekton.dev/v1beta1/TaskRun.status 
26 imageExtractors:
27 TaskRun:
28 - name: "taskrunstatus"
29 path: "/status/taskSpec/steps/*"
30 value: "image"
31 key: "name"
32 verifyImages:
33 - imageReferences:
34 - "*"
35 attestations:
36 - predicateType: https://grype.anchore.io/scan
37 attestors:
38 - entries:
39 - keys:
40 publicKeys: |-
41 -----BEGIN PUBLIC KEY-----
42 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEahmSvGFmxMJABilV1usgsw6ImcQ/
43 gDaxw57Sq+uNGHW8Q3zUSx46PuRqdTI+4qE3Ng2oFZgLMpFN/qMrP0MQQg==
44 -----END PUBLIC KEY----- 
45 conditions:
46 - any:
47 - key: "{{ matches[].vulnerability[].cvss[?metrics.impactScore > '8.0'][] | length(@) }}"
48 operator: Equals
49 value: 0
50 - key: "{{ source.target.userInput }}"
51 operator: Equals
52 value: "ghcr.io/tap8stry/git-init:v0.21.0@sha256:322e3502c1e6fba5f1869efb55cfd998a3679e073840d33eb0e3c482b5d5609b"

Cleanup Bare Pods

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/cleanup/cleanup-bare-pods/cleanup-bare-pods.yaml

 1apiVersion: kyverno.io/v2
 2kind: ClusterCleanupPolicy
 3metadata:
 4 name: clean-bare-pods
 5 annotations:
 6 policies.kyverno.io/title: Cleanup Bare Pods
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.11.1
11 policies.kyverno.io/minversion: 1.10.0
12 pod-policies.kyverno.io/autogen-controllers: none
13 kyverno.io/kubernetes-version: "1.27"
14 policies.kyverno.io/description: >-
15 A bare Pod is any Pod created directly and not owned by a controller such as a
16 Deployment or Job. Bare Pods are often create manually by users in an attempt to troubleshoot
17 an issue. If left in the cluster, they create clutter, increase cost, and can be a security
18 risk. Bare Pods can be cleaned up periodically through use of a policy. This policy finds
19 and removes all bare Pods across the cluster.
20spec:
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 conditions:
27 all:
28 - key: "{{ target.metadata.ownerReferences[] || `[]` }}"
29 operator: Equals
30 value: []
31 schedule: "*/5 * * * *"

Cleanup Empty ReplicaSets

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/cleanup/cleanup-empty-replicasets/cleanup-empty-replicasets.yaml

 1#The described logic currently deletes the ReplicaSets created 30 seconds ago. You can adjust this timeframe according to your specific requirements.
 2apiVersion: kyverno.io/v2
 3kind: ClusterCleanupPolicy
 4metadata:
 5 name: cleanup-empty-replicasets
 6 annotations:
 7 policies.kyverno.io/title: Cleanup Empty ReplicaSets
 8 policies.kyverno.io/category: Other
 9 policies.kyverno.io/severity: medium
10 policies.kyverno.io/subject: ReplicaSet
11 kyverno.io/kyverno-version: 1.11.1
12 policies.kyverno.io/minversion: 1.9.0
13 kyverno.io/kubernetes-version: "1.27"
14 policies.kyverno.io/description: >-
15 ReplicaSets serve as an intermediate controller for various Pod controllers like Deployments. When a new version of a Deployment is initiated, it generates a new ReplicaSet with the specified number of replicas and scales down the current one to zero. Consequently, numerous empty ReplicaSets may accumulate in the cluster, leading to clutter and potential false positives in policy reports if enabled. This cleanup policy is designed to remove empty ReplicaSets across the cluster within a specified timeframe, for instance, ReplicaSets created one day ago, ensuring the ability to rollback to previous ReplicaSets in case of deployment issues
16spec:
17 match:
18 any:
19 - resources:
20 kinds:
21 - ReplicaSet
22 exclude:
23 any:
24 - resources:
25 namespaces:
26 - kube-system
27 conditions:
28 all:
29 - key: "{{ target.spec.replicas }}"
30 operator: Equals
31 value: 0
32 - key: "{{ time_diff('{{target.metadata.creationTimestamp}}','{{ time_now_utc() }}') }}"
33 operator: GreaterThan
34 value: "0h0m30s"
35 schedule: "*/1 * * * *"

Collect Debug Information for Pods in CrashLoopBackOff

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/get-debug-information/get-debug-information.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: get-debug-data-policy
 5 annotations:
 6 policies.kyverno.io/title: Collect Debug Information for Pods in CrashLoopBackOff
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.11.5
11 kyverno.io/kubernetes-version: "1.27"
12 policies.kyverno.io/description: >-
13 This policy generates a job which gathers troubleshooting data (including logs, kubectl describe output and events from the namespace) from pods that are in CrashLoopBackOff and have 3 restarts. This data can further be used to automatically create a Jira issue using some kind of automation or another Kyverno policy. For more information on the image used in this policy in addition to the necessary RBAC resources required in order for this policy to operate, see the documentation at https://github.com/nirmata/SRE-Operational-Usecases/tree/main/get-troubleshooting-data/get-debug-data. 
14spec:
15 rules:
16 - name: get-debug-data-policy-rule
17 match:
18 any:
19 - resources:
20 kinds:
21 - v1/Pod.status
22 context:
23 - name: pdcount
24 apiCall:
25 urlPath: "/api/v1/namespaces/{{request.namespace}}/pods?labelSelector=requestpdname=pod-{{request.object.metadata.name}}"
26 jmesPath: "items | length(@)"
27 preconditions:
28 all:
29 - key: "{{ sum(request.object.status.containerStatuses[*].restartCount || `0`) }}"
30 operator: Equals
31 value: 3
32 - key: "{{ request.object.metadata.labels.deleteme || 'empty' }}"
33 operator: Equals
34 value: "empty"
35 - key: "{{ pdcount }}"
36 operator: Equals
37 value: 0
38 generate:
39 apiVersion: batch/v1
40 kind: Job
41 name: get-debug-data-{{request.object.metadata.name}}-{{ random('[0-9a-z]{8}') }}
42 namespace: "{{request.namespace}}"
43 synchronize: false
44 data:
45 metadata:
46 labels:
47 deleteme: allow
48 spec:
49 template:
50 metadata:
51 labels:
52 app: my-app
53 deleteme: allow
54 requestpdname: "pod-{{request.object.metadata.name}}"
55 spec:
56 restartPolicy: OnFailure
57 containers:
58 - name: my-container
59 image: sagarkundral/my-python-app:v52
60 ports:
61 - containerPort: 8080
62 volumeMounts:
63 - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
64 name: token
65 readOnly: true
66 args:
67 - "/app/get-debug-jira-v2.sh"
68 - "{{request.namespace}}"
69 - "{{request.object.metadata.name}}"
70 serviceAccount: default # This serviceaccount needs the necessary RBAC in order for the policy to operate. 
71 volumes:
72 - name: token
73 projected:
74 defaultMode: 420
75 sources:
76 - serviceAccountToken:
77 expirationSeconds: 3607
78 path: token
79 - configMap:
80 items:
81 - key: ca.crt
82 path: ca.crt
83 name: kube-root-ca.crt

Concatenate ConfigMaps

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/concatenate-configmaps/concatenate-configmaps.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: concatenate-configmaps
 5 annotations:
 6 policies.kyverno.io/title: Concatenate ConfigMaps
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: ConfigMap
10 kyverno.io/kyverno-version: 1.7.0
11 policies.kyverno.io/minversion: 1.7.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >-
14 In some cases, an update to an existing resource should have downstream effects
15 on a different resource in another Namespace. Rather than overwriting the target,
16 the current state of the source can be concatenated to the target.
17 This policy, triggered by an update to a source ConfigMap, concatenates
18 that value of a target ConfigMap in a different Namespace.
19spec:
20 mutateExistingOnPolicyUpdate: false
21 rules:
22 - name: concat-cm
23 match:
24 any:
25 - resources:
26 kinds:
27 - ConfigMap
28 names:
29 - cmone
30 namespaces:
31 - foo
32 mutate:
33 targets:
34 - apiVersion: v1
35 kind: ConfigMap
36 name: cmtwo
37 namespace: bar
38 patchStrategicMerge:
39 data:
40 keytwo: "{{ @ }} plus {{request.object.data.keyone}}"

Copy Namespace Labels

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/copy-namespace-labels/copy-namespace-labels.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: copy-namespace-labels
 5 annotations:
 6 policies.kyverno.io/title: Copy Namespace Labels
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Deployment, Label, Namespace
10 kyverno.io/kyverno-version: 1.11.1
11 kyverno.io/kubernetes-version: "1.27"
12 policies.kyverno.io/description: >-
13 It is common for Namespaced resources to need access to labels which have been assigned
14 to the Namespace in which they reside. This policy demonstrates two different ways of
15 assigning Namespace labels to a Deployment. The first method copies only the `owner` label
16 while the second copies all labels except for `kubernetes.io/metadata.name`.
17spec:
18 rules:
19 - name: owner-label-deployment-from-ns
20 match:
21 any:
22 - resources:
23 kinds:
24 - Deployment
25 operations:
26 - CREATE
27 context:
28 - name: owner
29 apiCall:
30 urlPath: "/api/v1/namespaces/{{ request.object.metadata.namespace }}"
31 jmesPath: metadata.labels.owner || 'empty'
32 mutate:
33 patchStrategicMerge:
34 metadata:
35 labels:
36 owner: "{{ owner }}"
37 - name: all-label-deployment-from-ns
38 match:
39 any:
40 - resources:
41 kinds:
42 - Deployment
43 operations:
44 - CREATE
45 context:
46 - name: alllabels
47 apiCall:
48 urlPath: "/api/v1/namespaces/{{ request.object.metadata.namespace }}"
49 jmesPath: metadata.labels | merge(@, {"kubernetes.io/metadata.name":null})
50 mutate:
51 patchStrategicMerge:
52 metadata:
53 labels:
54 "{{ alllabels }}"

Cordon and Drain Node

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/cordon-and-drain-node/cordon-and-drain-node.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: cordon-and-drain-node
 5 annotations:
 6 policies.kyverno.io/title: Cordon and Drain Node
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/subject: Node
 9 kyverno.io/kyverno-version: 1.10.1
10 policies.kyverno.io/minversion: 1.10.0
11 kyverno.io/kubernetes-version: "1.26"
12 policies.kyverno.io/description: >-
13 There are cases where either an operations or security incident may occur and Nodes
14 should be evacuated and placed in an unused state for further analysis. For example,
15 a Node is found to be running a vulnerable version of a CRI engine or kernel and to
16 minimize chances of a compromise may need to be decommissioned so another can be built.
17 This policy shows how to use Kyverno to both cordon and drain a given Node and uses a
18 hypothetical label being written to it called `testing=drain` to illustrate the point.
19 For production use, the match block should be modified to trigger on the appropriate
20 condition.
21spec:
22 rules:
23 - name: mutate-node
24 match:
25 any:
26 - resources:
27 kinds:
28 - Node
29 operations:
30 - UPDATE
31 selector:
32 matchLabels:
33 testing: drain
34 mutate:
35 targets:
36 - apiVersion: v1
37 kind: Node
38 name: "{{request.object.metadata.name}}"
39 patchStrategicMerge:
40 spec:
41 unschedulable: true
42 taints:
43 - effect: NoExecute
44 key: kyverno-evicted
45 timeAdded: "{{ time_now_utc() }}"

Create Istio Deny AuthorizationPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/istio/create-authorizationpolicy/create-authorizationpolicy.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: create-authorizationpolicy
 5 annotations:
 6 policies.kyverno.io/title: Create Istio Deny AuthorizationPolicy
 7 policies.kyverno.io/category: Istio
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.8.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: AuthorizationPolicy
13 policies.kyverno.io/description: >-
14 An AuthorizationPolicy enables access controls on workloads in the mesh. It supports per-Namespace controls
15 which can be a union of different behaviors. This policy creates a default deny AuthorizationPolicy
16 for all new Namespaces. Further AuthorizationPolicies should be created to more granularly allow
17 traffic as permitted. Use of this policy will likely require granting the Kyverno ServiceAccount
18 additional privileges required to generate AuthorizationPolicy resources.
19spec:
20 rules:
21 - name: generate-deny-authorizationpolicy
22 match:
23 any:
24 - resources:
25 kinds:
26 - Namespace
27 generate:
28 apiVersion: security.istio.io/v1beta1
29 kind: AuthorizationPolicy
30 name: default-deny
31 namespace: "{{request.object.metadata.name}}"
32 synchronize: true
33 data:
34 spec: {}

Deny Commands in Exec Probe

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/deny-commands-in-exec-probe/deny-commands-in-exec-probe.yaml

 1apiVersion: kyverno.io/v2beta1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-commands-in-exec-probe
 5 annotations:
 6 policies.kyverno.io/title: Deny Commands in Exec Probe
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/subject: Pod
 9 kyverno.io/kyverno-version: 1.1.0
10 policies.kyverno.io/minversion: 1.9.0
11 kyverno.io/kubernetes-version: "1.26"
12 policies.kyverno.io/description: >-
13 Developers may feel compelled to use simple shell commands as a workaround to
14 creating "proper" liveness or readiness probes for a Pod. Such a practice can be discouraged
15 via detection of those commands. This policy prevents the use of certain commands
16 `jcmd`, `ps`, or `ls` if found in a Pod's liveness exec probe.
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: check-commands
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 preconditions:
28 all:
29 - key: "{{ length(request.object.spec.containers[].livenessProbe.exec.command[] || `[]`) }}"
30 operator: GreaterThan
31 value: 0
32 - key: "{{ request.operation }}"
33 operator: NotEquals
34 value: DELETE
35 validate:
36 message: Cannot use commands `jcmd`, `ps`, or `ls` in liveness probes.
37 deny:
38 conditions:
39 any:
40 - key:
41 - true
42 operator: AnyIn
43 value: "{{ request.object.spec.containers[].livenessProbe.exec.command[].regex_match('\\bjcmd\\b',@) }}"
44 - key:
45 - true
46 operator: AnyIn
47 value: "{{ request.object.spec.containers[].livenessProbe.exec.command[].regex_match('\\bps\\b',@) }}"
48 - key:
49 - true
50 operator: AnyIn
51 value: "{{ request.object.spec.containers[].livenessProbe.exec.command[].regex_match('\\bls\\b',@) }}"

Deny Commands in Exec Probe in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/deny-commands-in-exec-probe/deny-commands-in-exec-probe.yaml

 1apiVersion: kyverno.io/v2beta1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-commands-in-exec-probe
 5 annotations:
 6 policies.kyverno.io/title: Deny Commands in Exec Probe in CEL expressions
 7 policies.kyverno.io/category: Other in CEL
 8 policies.kyverno.io/subject: Pod
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Developers may feel compelled to use simple shell commands as a workaround to
14 creating "proper" liveness or readiness probes for a Pod. Such a practice can be discouraged
15 via detection of those commands. This policy prevents the use of certain commands
16 `jcmd`, `ps`, or `ls` if found in a Pod's liveness exec probe.
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: check-commands
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 operations:
28 - CREATE
29 - UPDATE
30 celPreconditions:
31 - name: "check-liveness-probes-commands-exist"
32 expression: >-
33 object.spec.containers.exists(container, size(container.?livenessProbe.?exec.?command.orValue([])) > 0)
34 validate:
35 cel:
36 expressions:
37 - expression: >-
38 object.spec.containers.all(container, 
39 !container.?livenessProbe.?exec.?command.orValue([]).exists(command, 
40 command.matches('\\bjcmd\\b') || command.matches('\\bps\\b') || command.matches('\\bls\\b')))
41 message: Cannot use commands `jcmd`, `ps`, or `ls` in liveness probes.

Deny Creation and Updating of Resources

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/resource-creation-updating-denied/resource-creation-updating-denied.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: resource-creation-updating-denied
 5 annotations:
 6 policies.kyverno.io/title: Deny Creation and Updating of Resources
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.1
10 policies.kyverno.io/minversion: 1.9.0
11 kyverno.io/kubernetes-version: "1.27"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 This policy denies the creation and updating of resources specifically for Deployment 
15 and Pod kinds during a specified time window. The policy is designed to enhance control 
16 over resource modifications during critical periods, ensuring stability and consistency 
17 within the Kubernetes environment.
18spec:
19 validationFailureAction: Audit
20 background: false
21 rules:
22 - name: deny-creation-updating-of-resources
23 match:
24 any:
25 - resources:
26 kinds:
27 - Deployment
28 preconditions:
29 all:
30 - key: '{{ time_now_utc().time_to_cron(@).split(@,'' '') | [1].to_number(@) }}'
31 operator: AnyIn
32 value: 8-10
33 validate:
34 message: Creating and updating resources is not allowed at this time.
35 deny:
36 conditions:
37 all:
38 - key: '{{request.operation}}'
39 operator: AnyIn
40 value:
41 - CREATE
42 - UPDATE

Deny Privileged Profile

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psa/deny-privileged-profile/deny-privileged-profile.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-privileged-profile
 5 annotations:
 6 policies.kyverno.io/title: Deny Privileged Profile
 7 policies.kyverno.io/category: Pod Security Admission
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.7.1
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 When Pod Security Admission (PSA) is enforced at the cluster level
15 via an AdmissionConfiguration file which defines a default level at
16 baseline or restricted, setting of a label at the `privileged` profile
17 will effectively cause unrestricted workloads in that Namespace, overriding
18 the cluster default. This may effectively represent a circumvention attempt
19 and should be closely controlled. This policy ensures that only those holding
20 the cluster-admin ClusterRole may create Namespaces which assign the label
21 `pod-security.kubernetes.io/enforce=privileged`.
22spec:
23 validationFailureAction: Audit
24 background: false
25 rules:
26 - name: check-privileged
27 match:
28 any:
29 - resources:
30 kinds:
31 - Namespace
32 selector:
33 matchLabels:
34 pod-security.kubernetes.io/enforce: privileged
35 exclude:
36 any:
37 - clusterRoles:
38 - cluster-admin
39 validate:
40 message: Only cluster-admins may create Namespaces that allow setting the privileged level.
41 deny: {}

Deny Privileged Profile in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/psa-cel/deny-privileged-profile/deny-privileged-profile.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-privileged-profile
 5 annotations:
 6 policies.kyverno.io/title: Deny Privileged Profile in CEL expressions
 7 policies.kyverno.io/category: Pod Security Admission in CEL expressions
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 When Pod Security Admission (PSA) is enforced at the cluster level
15 via an AdmissionConfiguration file which defines a default level at
16 baseline or restricted, setting of a label at the `privileged` profile
17 will effectively cause unrestricted workloads in that Namespace, overriding
18 the cluster default. This may effectively represent a circumvention attempt
19 and should be closely controlled. This policy ensures that only those holding
20 the cluster-admin ClusterRole may create Namespaces which assign the label
21 `pod-security.kubernetes.io/enforce=privileged`.
22spec:
23 validationFailureAction: Audit
24 background: false
25 rules:
26 - name: check-privileged
27 match:
28 any:
29 - resources:
30 kinds:
31 - Namespace
32 selector:
33 matchLabels:
34 pod-security.kubernetes.io/enforce: privileged
35 exclude:
36 any:
37 - clusterRoles:
38 - cluster-admin
39 validate:
40 cel:
41 expressions:
42 - expression: "false"
43 message: Only cluster-admins may create Namespaces that allow setting the privileged level.

Deny Secret Service Account Token Type

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/deny-secret-service-account-token-type/deny-secret-service-account-token-type.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-secret-service-account-token-type
 5 annotations:
 6 policies.kyverno.io/title: Deny Secret Service Account Token Type
 7 policies.kyverno.io/category: Security
 8 kyverno.io/kubernetes-version: "1.27"
 9 kyverno.io/kyverno-version: 1.11.1
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Secret, ServiceAccount
12 policies.kyverno.io/description: >-
13 Before version 1.24, Kubernetes automatically generated Secret-based tokens 
14 for ServiceAccounts. When creating a Secret, you can specify its type using the 
15 type field of the Secret resource . The type kubernetes.io/service-account-token
16 is used for legacy ServiceAccount tokens . These legacy Tokens can
17 be of security concern and should be audited.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: deny-secret-service-account-token-type
23 match:
24 any:
25 - resources:
26 kinds:
27 - Secret
28 validate:
29 message: "Secret ServiceAccount token type is not allowed."
30 pattern:
31 type: "!kubernetes.io/service-account-token"

Deny Secret Service Account Token Type in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/deny-secret-service-account-token-type/deny-secret-service-account-token-type.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: deny-secret-service-account-token-type
 5 annotations:
 6 policies.kyverno.io/title: Deny Secret Service Account Token Type in CEL expressions
 7 policies.kyverno.io/category: Security in CEL 
 8 kyverno.io/kubernetes-version: "1.26-1.27"
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Secret, ServiceAccount
12 policies.kyverno.io/description: >-
13 Before version 1.24, Kubernetes automatically generated Secret-based tokens 
14 for ServiceAccounts. When creating a Secret, you can specify its type using the 
15 type field of the Secret resource . The type kubernetes.io/service-account-token
16 is used for legacy ServiceAccount tokens . These legacy Tokens can
17 be of security concern and should be audited.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: deny-secret-service-account-token-type
23 match:
24 any:
25 - resources:
26 kinds:
27 - Secret
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: "object.type != 'kubernetes.io/service-account-token'"
35 message: "Secret ServiceAccount token type is not allowed."
36

Disable automountServiceAccountToken

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/disable-automountserviceaccounttoken/disable-automountserviceaccounttoken.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disable-automountserviceaccounttoken
 5 annotations:
 6 policies.kyverno.io/title: Disable automountServiceAccountToken
 7 policies.kyverno.io/category: Other, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: ServiceAccount
10 kyverno.io/kyverno-version: 1.6.0
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.21"
13 policies.kyverno.io/description: >-
14 A new ServiceAccount called `default` is created whenever a new Namespace is created.
15 Pods spawned in that Namespace, unless otherwise set, will be assigned this ServiceAccount.
16 This policy mutates any new `default` ServiceAccounts to disable auto-mounting of the token
17 into Pods obviating the need to do so individually.
18spec:
19 rules:
20 - name: disable-automountserviceaccounttoken
21 match:
22 any:
23 - resources:
24 kinds:
25 - ServiceAccount
26 names:
27 - default
28 mutate:
29 patchStrategicMerge:
30 automountServiceAccountToken: false

Disable Service Discovery

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/disable-service-discovery/disable-service-discovery.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disable-service-discovery
 5 annotations:
 6 policies.kyverno.io/title: Disable Service Discovery
 7 policies.kyverno.io/category: Other, EKS Best Practices
 8 policies.kyverno.io/subject: Pod
 9 kyverno.io/kyverno-version: 1.8.0-rc2
10 kyverno.io/kubernetes-version: "1.24"
11 policies.kyverno.io/minversion: 1.6.0
12 policies.kyverno.io/description: >-
13 Not all Pods require communicating with other Pods or resolving in-cluster Services.
14 For those, disabling service discovery can increase security as the Pods are limited
15 to what they can see. This policy mutates Pods to set dnsPolicy to `Default` and
16 enableServiceLinks to `false`.
17spec:
18 rules:
19 - name: example-configmap-lookup
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 mutate:
26 patchStrategicMerge:
27 spec:
28 dnsPolicy: Default
29 enableServiceLinks: false

Disallow all Secrets

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/disallow-all-secrets/disallow-all-secrets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: no-secrets
 5 annotations:
 6 policies.kyverno.io/title: Disallow all Secrets
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod, Secret
10 kyverno.io/kyverno-version: 1.6.0
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.21"
13 policies.kyverno.io/description: >-
14 Secrets often contain sensitive information which not all Pods need consume.
15 This policy disables the use of all Secrets in a Pod definition. In order to work effectively,
16 this Policy needs a separate Policy or rule to require `automountServiceAccountToken=false`
17 at the Pod level or ServiceAccount level since this would otherwise result in a Secret being mounted.
18spec:
19 validationFailureAction: Audit
20 rules:
21 - name: secrets-not-from-env
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 validate:
28 message: "No Secrets from env."
29 pattern:
30 spec:
31 =(ephemeralContainers):
32 - name: "*"
33 =(env):
34 - =(valueFrom):
35 X(secretKeyRef): "null"
36 =(initContainers):
37 - name: "*"
38 =(env):
39 - =(valueFrom):
40 X(secretKeyRef): "null"
41 containers:
42 - name: "*"
43 =(env):
44 - =(valueFrom):
45 X(secretKeyRef): "null"
46 - name: secrets-not-from-envfrom
47 match:
48 any:
49 - resources:
50 kinds:
51 - Pod
52 validate:
53 message: "No Secrets from envFrom."
54 pattern:
55 spec:
56 =(ephemeralContainers):
57 - name: "*"
58 =(envFrom):
59 - X(secretRef): "null"
60 =(initContainers):
61 - name: "*"
62 =(envFrom):
63 - X(secretRef): "null"
64 containers:
65 - name: "*"
66 =(envFrom):
67 - X(secretRef): "null"
68 - name: secrets-not-from-volumes
69 match:
70 any:
71 - resources:
72 kinds:
73 - Pod
74 validate:
75 message: "No Secrets from volumes."
76 pattern:
77 spec:
78 =(volumes):
79 - X(secret): "null"

Disallow all Secrets in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/disallow-all-secrets/disallow-all-secrets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: no-secrets
 5 annotations:
 6 policies.kyverno.io/title: Disallow all Secrets in CEL expressions
 7 policies.kyverno.io/category: Other in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod, Secret
10 kyverno.io/kyverno-version: 1.11.0
11 policies.kyverno.io/minversion: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 Secrets often contain sensitive information which not all Pods need consume.
15 This policy disables the use of all Secrets in a Pod definition. In order to work effectively,
16 this Policy needs a separate Policy or rule to require `automountServiceAccountToken=false`
17 at the Pod level or ServiceAccount level since this would otherwise result in a Secret being mounted.
18spec:
19 validationFailureAction: Audit
20 rules:
21 - name: secrets-not-from-env-envFrom-and-volumes
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel:
32 variables:
33 - name: allContainers
34 expression: >-
35 object.spec.containers + 
36 object.spec.?initContainers.orValue([]) + 
37 object.spec.?ephemeralContainers.orValue([])
38 expressions:
39 - expression: >-
40 variables.allContainers.all(container, 
41 container.?env.orValue([]).all(env, env.?valueFrom.?secretKeyRef.orValue(true)))
42 message: "No Secrets from env."
43
44 - expression: >-
45 variables.allContainers.all(container, 
46 container.?envFrom.orValue([]).all(envFrom, !has(envFrom.secretRef)))
47 message: "No Secrets from envFrom."
48
49 - expression: "object.spec.?volumes.orValue([]).all(volume, !has(volume.secret))"
50 message: "No Secrets from volumes."
51

Disallow binding to self-provisioner cluster role in OpenShift

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift/disallow-self-provisioner-binding/disallow-self-provisioner-binding.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-self-provisioner-binding
 5 annotations:
 6 policies.kyverno.io/title: Disallow binding to self-provisioner cluster role in OpenShift
 7 policies.kyverno.io/category: OpenShift
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.20"
12 policies.kyverno.io/subject: ClusterRoleBinding, RBAC
13 policies.kyverno.io/description: >-
14 This policy prevents binding to the self-provisioners role for strict control of OpenShift project creation.
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-self-provisioner-binding-no-subject
20 match:
21 any:
22 - resources:
23 kinds:
24 - ClusterRoleBinding
25 preconditions:
26 all:
27 - key: "{{request.object.metadata.name}}"
28 operator: Equals
29 value: self-provisioners
30 - key: "{{request.operation || 'BACKGROUND'}}"
31 operator: Equals
32 value: UPDATE
33 validate:
34 message: >-
35 Modifying the self-provisioners ClusterRoleBinding is not allowed.
36 deny: {}
37 - name: check-self-provisioner-binding-with-subject
38 match:
39 any:
40 - resources:
41 kinds:
42 - ClusterRoleBinding
43 preconditions:
44 all:
45 - key: "{{request.object.metadata.name || ''}}"
46 operator: NotEquals
47 value: self-provisioners
48 validate:
49 message: >-
50 Binding to the self-provisioners cluster role is not allowed.
51 deny:
52 conditions:
53 all:
54 - key: self-provisioner
55 operator: AnyIn
56 value: "{{request.object.roleRef.name}}"

Disallow Capabilities

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-capabilities/disallow-capabilities.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-capabilities
 5 annotations:
 6 policies.kyverno.io/title: Disallow Capabilities
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Adding capabilities beyond those listed in the policy must be disallowed.
15spec:
16 validationFailureAction: Audit
17 background: true
18 rules:
19 - name: adding-capabilities
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 preconditions:
26 all:
27 - key: "{{ request.operation || 'BACKGROUND' }}"
28 operator: NotEquals
29 value: DELETE
30 validate:
31 message: >-
32 Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER,
33 FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT)
34 are disallowed.
35 deny:
36 conditions:
37 all:
38 - key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].securityContext.capabilities.add[] }}"
39 operator: AnyNotIn
40 value:
41 - AUDIT_WRITE
42 - CHOWN
43 - DAC_OVERRIDE
44 - FOWNER
45 - FSETID
46 - KILL
47 - MKNOD
48 - NET_BIND_SERVICE
49 - SETFCAP
50 - SETGID
51 - SETPCAP
52 - SETUID
53 - SYS_CHROOT

Disallow Capabilities (Strict)

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/restricted/disallow-capabilities-strict/disallow-capabilities-strict.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-capabilities-strict
 5 annotations:
 6 policies.kyverno.io/title: Disallow Capabilities (Strict)
 7 policies.kyverno.io/category: Pod Security Standards (Restricted)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.6.0
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Adding capabilities other than `NET_BIND_SERVICE` is disallowed. In addition,
15 all containers must explicitly drop `ALL` capabilities.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: require-drop-all
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 preconditions:
27 all:
28 - key: "{{ request.operation || 'BACKGROUND' }}"
29 operator: NotEquals
30 value: DELETE
31 validate:
32 message: >-
33 Containers must drop `ALL` capabilities.
34 foreach:
35 - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
36 deny:
37 conditions:
38 all:
39 - key: ALL
40 operator: AnyNotIn
41 value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
42 - name: adding-capabilities-strict
43 match:
44 any:
45 - resources:
46 kinds:
47 - Pod
48 preconditions:
49 all:
50 - key: "{{ request.operation || 'BACKGROUND' }}"
51 operator: NotEquals
52 value: DELETE
53 validate:
54 message: >-
55 Any capabilities added other than NET_BIND_SERVICE are disallowed.
56 foreach:
57 - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
58 deny:
59 conditions:
60 all:
61 - key: "{{ element.securityContext.capabilities.add[] || `[]` }}"
62 operator: AnyNotIn
63 value:
64 - NET_BIND_SERVICE
65 - ''

Disallow Capabilities (Strict) in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/restricted/disallow-capabilities-strict/disallow-capabilities-strict.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-capabilities-strict
 5 annotations:
 6 policies.kyverno.io/title: Disallow Capabilities (Strict) in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Restricted) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.11.0
10 kyverno.io/kyverno-version: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Adding capabilities other than `NET_BIND_SERVICE` is disallowed. In addition,
15 all containers must explicitly drop `ALL` capabilities.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: require-drop-all
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 message: >-
31 Containers must drop `ALL` capabilities.
32 cel:
33 variables:
34 - name: allContainers
35 expression: >-
36 (has(object.spec.containers) ? object.spec.containers : []) +
37 (has(object.spec.initContainers) ? object.spec.initContainers : []) +
38 (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : [])
39 expressions:
40 - expression: >-
41 variables.allContainers.all(container,
42 has(container.securityContext) &&
43 has(container.securityContext.capabilities) &&
44 has(container.securityContext.capabilities.drop) &&
45 container.securityContext.capabilities.drop.exists_one(capability, capability == 'ALL')
46 )
47 - name: adding-capabilities-strict
48 match:
49 any:
50 - resources:
51 kinds:
52 - Pod
53 operations:
54 - CREATE
55 - UPDATE
56 validate:
57 cel:
58 variables:
59 - name: allContainers
60 expression: >-
61 (has(object.spec.containers) ? object.spec.containers : []) +
62 (has(object.spec.initContainers) ? object.spec.initContainers : []) +
63 (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : [])
64 expressions:
65 - expression: >-
66 variables.allContainers.all(container,
67 !has(container.securityContext) ||
68 !has(container.securityContext.capabilities) ||
69 !has(container.securityContext.capabilities.add) ||
70 (
71 size(container.securityContext.capabilities.add) == 1 &&
72 container.securityContext.capabilities.add[0] == 'NET_BIND_SERVICE'
73 )
74 )
75 message: >-
76 Any capabilities added other than NET_BIND_SERVICE are disallowed.

Disallow Capabilities (Strict) in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/restricted/disallow-capabilities-strict/disallow-capabilities-strict.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-capabilities-strict
 5 annotations:
 6 policies.kyverno.io/title: Disallow Capabilities (Strict) in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Restricted) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.14.0
10 kyverno.io/kyverno-version: 1.14.0
11 kyverno.io/kubernetes-version: "1.30+"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Adding capabilities other than `NET_BIND_SERVICE` is disallowed. In addition,
15 all containers must explicitly drop `ALL` capabilities.
16spec:
17 validationActions:
18 - Audit
19 evaluation:
20 background:
21 enabled: true
22 matchConstraints:
23 resourceRules:
24 - apiGroups: [""]
25 apiVersions: ["v1"]
26 operations: ["CREATE", "UPDATE"]
27 resources: ["pods"]
28 variables:
29 - name: allContainers
30 expression: >-
31 object.spec.containers + 
32 (object.spec.?initContainers.orValue([])) + 
33 (object.spec.?ephemeralContainers.orValue([]))
34
35 validations:
36 - expression: >-
37 variables.allContainers.all(container, 
38 container.?securityContext.?capabilities.?drop.orValue([]).exists_one(capability, capability == 'ALL'))
39 message: >-
40 Containers must drop `ALL` capabilities.
41
42 - expression: >-
43 variables.allContainers.all(container, 
44 container.?securityContext.?capabilities.?add.orValue([]).size() == 0 || 
45 (container.securityContext.capabilities.add.orValue([]).size() == 1 && 
46 container.securityContext.capabilities.add[0] == 'NET_BIND_SERVICE'))
47 message: >-
48 Any capabilities added other than NET_BIND_SERVICE are disallowed.

Disallow Capabilities in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-capabilities/disallow-capabilities.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-capabilities
 5 annotations:
 6 policies.kyverno.io/title: Disallow Capabilities in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.11.0
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Adding capabilities beyond those listed in the policy must be disallowed.
14spec:
15 validationFailureAction: Audit
16 background: true
17 rules:
18 - name: adding-capabilities
19 match:
20 any:
21 - resources:
22 kinds:
23 - Pod
24 operations:
25 - CREATE
26 - UPDATE
27 validate:
28 cel:
29 variables:
30 - name: allowedCapabilities
31 expression: "['AUDIT_WRITE','CHOWN','DAC_OVERRIDE','FOWNER','FSETID','KILL','MKNOD','NET_BIND_SERVICE','SETFCAP','SETGID','SETPCAP','SETUID','SYS_CHROOT']"
32 - name: allContainers
33 expression: "(object.spec.containers + (has(object.spec.initContainers) ? object.spec.initContainers : []) + (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : []))"
34 expressions:
35 - expression: >-
36 variables.allContainers.all(container, 
37 container.?securityContext.?capabilities.?add.orValue([]).all(capability, capability == '' ||
38 capability in variables.allowedCapabilities))
39 message: >-
40 Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER,
41 FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT)
42 are disallowed.

Disallow Capabilities in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-capabilities/disallow-capabilities.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-capabilities
 5 annotations:
 6 policies.kyverno.io/title: Disallow Capabilities in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.14.0
10 kyverno.io/kubernetes-version: "1.30+"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Adding capabilities beyond those listed in the policy must be disallowed.
14spec:
15 validationActions:
16 - Audit
17 evaluation:
18 background:
19 enabled: true
20 matchConstraints:
21 resourceRules:
22 - apiGroups: [""]
23 apiVersions: ["v1"]
24 operations: ["CREATE", "UPDATE"]
25 resources: ["pods"]
26 variables:
27 - name: allowedCapabilities
28 expression: >-
29 ['AUDIT_WRITE','CHOWN','DAC_OVERRIDE','FOWNER','FSETID','KILL','MKNOD','NET_BIND_SERVICE','SETFCAP','SETGID','SETPCAP','SETUID','SYS_CHROOT']
30 - name: allContainers
31 expression: >-
32 (object.spec.containers + 
33 object.spec.?initContainers.orValue([]) + 
34 object.spec.?ephemeralContainers.orValue([]))
35 validations:
36 - expression: >-
37 variables.allContainers.all(container, 
38 container.?securityContext.?capabilities.?add.orValue([]).all(capability, capability == '' ||
39 capability in variables.allowedCapabilities))
40 message: >-
41 Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER,
42 FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT)
43 are disallowed.

Disallow CRI socket mounts

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/disallow-cri-sock-mount/disallow-cri-sock-mount.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-container-sock-mounts
 5 annotations:
 6 policies.kyverno.io/title: Disallow CRI socket mounts
 7 policies.kyverno.io/category: Best Practices, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.6.0
11 policies.kyverno.io/description: >-
12 Container daemon socket bind mounts allows access to the container engine on the
13 node. This access can be used for privilege escalation and to manage containers
14 outside of Kubernetes, and hence should not be allowed. This policy validates that
15 the sockets used for CRI engines Docker, Containerd, and CRI-O are not used. In addition
16 to or replacement of this policy, preventing users from mounting the parent directories
17 (/var/run and /var) may be necessary to completely prevent socket bind mounts.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: validate-docker-sock-mount
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 validate:
29 message: "Use of the Docker Unix socket is not allowed."
30 pattern:
31 spec:
32 =(volumes):
33 - =(hostPath):
34 path: "!/var/run/docker.sock"
35 - name: validate-containerd-sock-mount
36 match:
37 any:
38 - resources:
39 kinds:
40 - Pod
41 validate:
42 message: "Use of the Containerd Unix socket is not allowed."
43 pattern:
44 spec:
45 =(volumes):
46 - =(hostPath):
47 path: "!/var/run/containerd/containerd.sock"
48 - name: validate-crio-sock-mount
49 match:
50 any:
51 - resources:
52 kinds:
53 - Pod
54 validate:
55 message: "Use of the CRI-O Unix socket is not allowed."
56 pattern:
57 spec:
58 =(volumes):
59 - =(hostPath):
60 path: "!/var/run/crio/crio.sock"
61 - name: validate-dockerd-sock-mount
62 match:
63 any:
64 - resources:
65 kinds:
66 - Pod
67 validate:
68 message: "Use of the Docker CRI socket is not allowed."
69 pattern:
70 spec:
71 =(volumes):
72 - =(hostPath):
73 path: "!/var/run/cri-dockerd.sock"

Disallow CRI socket mounts in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/disallow-cri-sock-mount/disallow-cri-sock-mount.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-container-sock-mounts
 5 annotations:
 6 policies.kyverno.io/title: Disallow CRI socket mounts in CEL expressions
 7 policies.kyverno.io/category: Best Practices, EKS Best Practices in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Container daemon socket bind mounts allows access to the container engine on the
14 node. This access can be used for privilege escalation and to manage containers
15 outside of Kubernetes, and hence should not be allowed. This policy validates that
16 the sockets used for CRI engines Docker, Containerd, and CRI-O are not used. In addition
17 to or replacement of this policy, preventing users from mounting the parent directories
18 (/var/run and /var) may be necessary to completely prevent socket bind mounts.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: validate-socket-mounts
24 match:
25 any:
26 - resources:
27 kinds:
28 - Pod
29 operations:
30 - CREATE
31 - UPDATE
32 validate:
33 cel:
34 variables:
35 - name: hasVolumes
36 expression: "!has(object.spec.volumes)"
37 - name: volumes
38 expression: "object.spec.volumes"
39 - name: volumesWithHostPath
40 expression: "variables.volumes.filter(volume, has(volume.hostPath))"
41 expressions:
42 - expression: >-
43 variables.hasVolumes || 
44 variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/docker.sock'))
45 message: "Use of the Docker Unix socket is not allowed."
46
47 - expression: >-
48 variables.hasVolumes || 
49 variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/containerd/containerd.sock'))
50 message: "Use of the Containerd Unix socket is not allowed."
51 
52 - expression: >-
53 variables.hasVolumes || 
54 variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/crio/crio.sock'))
55 message: "Use of the CRI-O Unix socket is not allowed."
56 
57 - expression: >-
58 variables.hasVolumes || 
59 variables.volumesWithHostPath.all(volume, !volume.hostPath.path.matches('/var/run/cri-dockerd.sock'))
60 message: "Use of the Docker CRI socket is not allowed."

Disallow Custom Snippets

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/nginx-ingress/disallow-ingress-nginx-custom-snippets/disallow-ingress-nginx-custom-snippets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-ingress-nginx-custom-snippets
 5 annotations:
 6 policies.kyverno.io/title: Disallow Custom Snippets
 7 policies.kyverno.io/category: Security, NGINX Ingress
 8 policies.kyverno.io/subject: ConfigMap, Ingress
 9 policies.kyverno.io/minversion: "1.6.0"
10 kyverno.io/kyverno-version: "1.6.0"
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/description: >-
13 Users that can create or update ingress objects can use the custom snippets 
14 feature to obtain all secrets in the cluster (CVE-2021-25742). This policy 
15 disables allow-snippet-annotations in the ingress-nginx configuration and 
16 blocks *-snippet annotations on an Ingress.
17 See: https://github.com/kubernetes/ingress-nginx/issues/7837
18spec:
19 validationFailureAction: Enforce
20 rules:
21 - name: check-config-map
22 match:
23 any:
24 - resources:
25 kinds:
26 - ConfigMap 
27 validate:
28 message: "ingress-nginx allow-snippet-annotations must be set to false"
29 pattern:
30 =(data):
31 =(allow-snippet-annotations) : "false"
32 - name: check-ingress-annotations
33 match:
34 any:
35 - resources:
36 kinds:
37 - networking.k8s.io/v1/Ingress 
38 validate:
39 message: "ingress-nginx custom snippets are not allowed"
40 pattern:
41 metadata:
42 =(annotations):
43 X(*-snippet): "?*"

Disallow Custom Snippets in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/nginx-ingress-cel/disallow-ingress-nginx-custom-snippets/disallow-ingress-nginx-custom-snippets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-ingress-nginx-custom-snippets
 5 annotations:
 6 policies.kyverno.io/title: Disallow Custom Snippets in CEL expressions
 7 policies.kyverno.io/category: Security, NGINX Ingress in CEL 
 8 policies.kyverno.io/subject: ConfigMap, Ingress
 9 policies.kyverno.io/minversion: "1.11.0"
10 kyverno.io/kyverno-version: "1.11.0"
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Users that can create or update ingress objects can use the custom snippets 
14 feature to obtain all secrets in the cluster (CVE-2021-25742). This policy 
15 disables allow-snippet-annotations in the ingress-nginx configuration and 
16 blocks *-snippet annotations on an Ingress.
17 See: https://github.com/kubernetes/ingress-nginx/issues/7837
18spec:
19 validationFailureAction: Enforce
20 rules:
21 - name: check-config-map
22 match:
23 any:
24 - resources:
25 kinds:
26 - ConfigMap
27 operations:
28 - CREATE
29 - UPDATE 
30 validate:
31 cel:
32 expressions:
33 - expression: "object.?data[?'allow-snippet-annotations'].orValue('false') == 'false'"
34 message: "ingress-nginx allow-snippet-annotations must be set to false"
35 - name: check-ingress-annotations
36 match:
37 any:
38 - resources:
39 kinds:
40 - networking.k8s.io/v1/Ingress 
41 operations:
42 - CREATE
43 - UPDATE 
44 validate:
45 cel:
46 expressions:
47 - expression: "!object.metadata.?annotations.orValue([]).exists(annotation, annotation.endsWith('-snippet'))"
48 message: "ingress-nginx custom snippets are not allowed"

Disallow Default Namespace

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/disallow-default-namespace/disallow-default-namespace.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-default-namespace
 5 annotations:
 6 pod-policies.kyverno.io/autogen-controllers: none
 7 policies.kyverno.io/title: Disallow Default Namespace
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/category: Multi-Tenancy
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Kubernetes Namespaces are an optional feature that provide a way to segment and
14 isolate cluster resources across multiple applications and users. As a best
15 practice, workloads should be isolated with Namespaces. Namespaces should be required
16 and the default (empty) Namespace should not be used. This policy validates that Pods
17 specify a Namespace name other than `default`. Rule auto-generation is disabled here
18 due to Pod controllers need to specify the `namespace` field under the top-level `metadata`
19 object and not at the Pod template level.
20spec:
21 validationFailureAction: Audit
22 background: true
23 rules:
24 - name: validate-namespace
25 match:
26 any:
27 - resources:
28 kinds:
29 - Pod
30 validate:
31 message: "Using 'default' namespace is not allowed."
32 pattern:
33 metadata:
34 namespace: "!default"
35 - name: validate-podcontroller-namespace
36 match:
37 any:
38 - resources:
39 kinds:
40 - DaemonSet
41 - Deployment
42 - Job
43 - StatefulSet
44 validate:
45 message: "Using 'default' namespace is not allowed for pod controllers."
46 pattern:
47 metadata:
48 namespace: "!default"

Disallow Default Namespace in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/disallow-default-namespace/disallow-default-namespace.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-default-namespace
 5 annotations:
 6 pod-policies.kyverno.io/autogen-controllers: none
 7 policies.kyverno.io/title: Disallow Default Namespace in CEL expressions
 8 policies.kyverno.io/minversion: 1.11.0
 9 policies.kyverno.io/category: Multi-Tenancy in CEL 
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/severity: medium
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Kubernetes Namespaces are an optional feature that provide a way to segment and
15 isolate cluster resources across multiple applications and users. As a best
16 practice, workloads should be isolated with Namespaces. Namespaces should be required
17 and the default (empty) Namespace should not be used. This policy validates that Pods
18 specify a Namespace name other than `default`. Rule auto-generation is disabled here
19 due to Pod controllers need to specify the `namespace` field under the top-level `metadata`
20 object and not at the Pod template level.
21spec:
22 validationFailureAction: Audit
23 background: true
24 rules:
25 - name: validate-namespace
26 match:
27 any:
28 - resources:
29 kinds:
30 - Pod
31 operations:
32 - CREATE
33 - UPDATE
34 validate:
35 cel:
36 expressions:
37 - expression: "namespaceObject.metadata.name != 'default'"
38 message: "Using 'default' namespace is not allowed."
39 - name: validate-podcontroller-namespace
40 match:
41 any:
42 - resources:
43 kinds:
44 - DaemonSet
45 - Deployment
46 - Job
47 - StatefulSet
48 operations:
49 - CREATE
50 - UPDATE
51 validate:
52 cel:
53 expressions:
54 - expression: "namespaceObject.metadata.name != 'default'"
55 message: "Using 'default' namespace is not allowed for pod controllers."

Disallow Default TLSOptions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/traefik/disallow-default-tlsoptions/disallow-default-tlsoptions.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-default-tlsoptions
 5 annotations:
 6 policies.kyverno.io/title: Disallow Default TLSOptions
 7 policies.kyverno.io/category: Traefik
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: TLSOption
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.21"
12 policies.kyverno.io/description: >-
13 The TLSOption CustomResource sets cluster-wide TLS configuration options for Traefik when 
14 none are specified in a TLS router. Since this can take effect for all Ingress resources,
15 creating the `default` TLSOption is a restricted operation. This policy ensures that
16 only a cluster-admin can create the `default` TLSOption resource.
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: disallow-default-tlsoptions
22 match:
23 any:
24 - resources:
25 names:
26 - default
27 kinds:
28 - TLSOption
29 exclude:
30 clusterRoles:
31 - cluster-admin
32 validate:
33 message: "Only cluster administrators are allowed to set default TLSOptions."
34 deny: {}

Disallow Default TLSOptions in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/traefik-cel/disallow-default-tlsoptions/disallow-default-tlsoptions.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-default-tlsoptions
 5 annotations:
 6 policies.kyverno.io/title: Disallow Default TLSOptions in CEL expressions
 7 policies.kyverno.io/category: Traefik in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: TLSOption
10 kyverno.io/kyverno-version: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 The TLSOption CustomResource sets cluster-wide TLS configuration options for Traefik when 
14 none are specified in a TLS router. Since this can take effect for all Ingress resources,
15 creating the `default` TLSOption is a restricted operation. This policy ensures that
16 only a cluster-admin can create the `default` TLSOption resource.
17spec:
18 validationFailureAction: Audit
19 background: false
20 rules:
21 - name: disallow-default-tlsoptions
22 match:
23 any:
24 - resources:
25 names:
26 - default
27 kinds:
28 - TLSOption
29 exclude:
30 clusterRoles:
31 - cluster-admin
32 validate:
33 cel:
34 expressions:
35 - expression: "false"
36 message: "Only cluster administrators are allowed to set default TLSOptions."

Disallow deprecated APIs

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift/disallow-deprecated-apis/disallow-deprecated-apis.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-deprecated-apis
 5 annotations:
 6 policies.kyverno.io/title: Disallow deprecated APIs
 7 policies.kyverno.io/category: OpenShift
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.20"
12 policies.kyverno.io/subject: ClusterRole,ClusterRoleBinding,Role,RoleBinding,RBAC
13 policies.kyverno.io/description: >-
14 OpenShift APIs are sometimes deprecated and removed after a few releases.
15 As a best practice, older API versions should be replaced with newer versions.
16 This policy validates for APIs that are deprecated or scheduled for removal.
17 Note that checking for some of these resources may require modifying the Kyverno
18 ConfigMap to remove filters. 
19spec:
20 validationFailureAction: Enforce
21 background: true
22 rules:
23 - name: check-deprecated-apis
24 match:
25 any:
26 - resources:
27 kinds:
28 - authorization.openshift.io/v1/ClusterRole
29 - authorization.openshift.io/v1/ClusterRoleBinding
30 - authorization.openshift.io/v1/Role
31 - authorization.openshift.io/v1/RoleBinding
32 validate:
33 message: >-
34 {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated.
35 deny: {}

Disallow deprecated APIs in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift-cel/disallow-deprecated-apis/disallow-deprecated-apis.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-deprecated-apis
 5 annotations:
 6 policies.kyverno.io/title: Disallow deprecated APIs in CEL expressions
 7 policies.kyverno.io/category: OpenShift in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: ClusterRole,ClusterRoleBinding,Role,RoleBinding,RBAC
13 policies.kyverno.io/description: >-
14 OpenShift APIs are sometimes deprecated and removed after a few releases.
15 As a best practice, older API versions should be replaced with newer versions.
16 This policy validates for APIs that are deprecated or scheduled for removal.
17 Note that checking for some of these resources may require modifying the Kyverno
18 ConfigMap to remove filters. 
19spec:
20 validationFailureAction: Enforce
21 background: true
22 rules:
23 - name: check-deprecated-apis
24 match:
25 any:
26 - resources:
27 kinds:
28 - authorization.openshift.io/v1/ClusterRole
29 - authorization.openshift.io/v1/ClusterRoleBinding
30 - authorization.openshift.io/v1/Role
31 - authorization.openshift.io/v1/RoleBinding
32 operations:
33 - CREATE
34 - UPDATE
35 validate:
36 cel:
37 expressions:
38 - expression: "false"
39 messageExpression: >-
40 object.apiVersion + '/' + object.kind + ' is deprecated.'

Disallow empty Ingress host

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/disallow-empty-ingress-host/disallow-empty-ingress-host.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-empty-ingress-host
 5 annotations:
 6 policies.kyverno.io/title: Disallow empty Ingress host
 7 policies.kyverno.io/category: Best Practices
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/severity: medium
10 policies.kyverno.io/subject: Ingress
11 policies.kyverno.io/description: >-
12 An ingress resource needs to define an actual host name
13 in order to be valid. This policy ensures that there is a
14 hostname for each rule defined.
15spec:
16 validationFailureAction: Audit
17 background: false
18 rules:
19 - name: disallow-empty-ingress-host
20 match:
21 any:
22 - resources:
23 kinds:
24 - Ingress
25 validate:
26 message: "The Ingress host name must be defined, not empty."
27 deny:
28 conditions:
29 all:
30 - key: "{{ request.object.spec.rules[].host || `[]` | length(@) }}"
31 operator: NotEquals
32 value: "{{ request.object.spec.rules[].http || `[]` | length(@) }}"

Disallow empty Ingress host in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/disallow-empty-ingress-host/disallow-empty-ingress-host.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-empty-ingress-host
 5 annotations:
 6 policies.kyverno.io/title: Disallow empty Ingress host in CEL expressions
 7 policies.kyverno.io/category: Best Practices in CEL 
 8 policies.kyverno.io/minversion: 1.11.0
 9 kyverno.io/kubernetes-version: "1.26-1.27"
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Ingress
12 policies.kyverno.io/description: >-
13 An ingress resource needs to define an actual host name
14 in order to be valid. This policy ensures that there is a
15 hostname for each rule defined.
16spec:
17 validationFailureAction: Audit
18 background: false
19 rules:
20 - name: disallow-empty-ingress-host
21 match:
22 any:
23 - resources:
24 kinds:
25 - Ingress
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 expressions:
32 - expression: >-
33 object.spec.?rules.orValue([]).all(rule, has(rule.host) && has(rule.http))
34 message: "The Ingress host name must be defined, not empty."
35

Disallow Helm Tiller

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/disallow-helm-tiller/disallow-helm-tiller.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-helm-tiller
 5 annotations:
 6 policies.kyverno.io/title: Disallow Helm Tiller
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/severity: medium
10 policies.kyverno.io/subject: Pod
11 policies.kyverno.io/description: >-
12 Tiller, found in Helm v2, has known security challenges. It requires administrative privileges and acts as a shared
13 resource accessible to any authenticated user. Tiller can lead to privilege escalation as
14 restricted users can impact other users. It is recommended to use Helm v3+ which does not contain
15 Tiller for these reasons. This policy validates that there is not an image
16 containing the name `tiller`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: validate-helm-tiller
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 validate:
28 message: "Helm Tiller is not allowed"
29 foreach:
30 - list: "request.object.spec.containers"
31 pattern:
32 image: "!*tiller*"
33 - list: "request.object.spec.initContainers"
34 pattern:
35 image: "!*tiller*"
36 - list: "request.object.spec.ephemeralContainers"
37 pattern:
38 image: "!*tiller*"

Disallow Helm Tiller in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/disallow-helm-tiller/disallow-helm-tiller.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-helm-tiller
 5 annotations:
 6 policies.kyverno.io/title: Disallow Helm Tiller in CEL expressions
 7 policies.kyverno.io/category: Sample in CEL 
 8 policies.kyverno.io/minversion: 1.11.0
 9 kyverno.io/kubernetes-version: "1.26-1.27"
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Tiller, found in Helm v2, has known security challenges. It requires administrative privileges and acts as a shared
14 resource accessible to any authenticated user. Tiller can lead to privilege escalation as
15 restricted users can impact other users. It is recommend to use Helm v3+ which does not contain
16 Tiller for these reasons. This policy validates that there is not an image
17 containing the name `tiller`.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: validate-helm-tiller
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: "object.spec.containers.all(container, !container.image.contains('tiller'))"
35 message: "Helm Tiller is not allowed"

Disallow Host Namespaces

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-host-namespaces/disallow-host-namespaces.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-namespaces
 5 annotations:
 6 policies.kyverno.io/title: Disallow Host Namespaces
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 kyverno.io/kubernetes-version: "1.22-1.23"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Host namespaces (Process ID namespace, Inter-Process Communication namespace, and
14 network namespace) allow access to shared information and can be used to elevate
15 privileges. Pods should not be allowed access to host namespaces. This policy ensures
16 fields which make use of these host namespaces are unset or set to `false`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: host-namespaces
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 validate:
28 message: >-
29 Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
30 spec.hostIPC, and spec.hostPID must be unset or set to `false`.
31 pattern:
32 spec:
33 =(hostPID): "false"
34 =(hostIPC): "false"
35 =(hostNetwork): "false"

Disallow Host Namespaces in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-host-namespaces/disallow-host-namespaces.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-namespaces
 5 annotations:
 6 policies.kyverno.io/title: Disallow Host Namespaces in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.11.0
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Host namespaces (Process ID namespace, Inter-Process Communication namespace, and
14 network namespace) allow access to shared information and can be used to elevate
15 privileges. Pods should not be allowed access to host namespaces. This policy ensures
16 fields which make use of these host namespaces are unset or set to `false`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: host-namespaces
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel:
32 expressions:
33 - expression: >-
34 ( object.spec.?hostNetwork.orValue(false) == false) &&
35 ( object.spec.?hostIPC.orValue(false) == false) &&
36 ( object.spec.?hostPID.orValue(false) == false)
37 message: >-
38 Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
39 spec.hostIPC, and spec.hostPID must be unset or set to `false`.

Disallow Host Namespaces in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-host-namespaces/disallow-host-namespaces.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-host-namespaces
 5 annotations:
 6 policies.kyverno.io/title: Disallow Host Namespaces in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.14.0
10 kyverno.io/kubernetes-version: "1.30+"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Host namespaces (Process ID namespace, Inter-Process Communication namespace, and
14 network namespace) allow access to shared information and can be used to elevate
15 privileges. Pods should not be allowed access to host namespaces. This policy ensures
16 fields which make use of these host namespaces are unset or set to `false`.
17spec:
18 validationActions:
19 - Audit
20 evaluation:
21 background:
22 enabled: true
23 matchConstraints:
24 resourceRules:
25 - apiGroups: [""]
26 apiVersions: ["v1"]
27 operations: ["CREATE", "UPDATE"]
28 resources: ["pods"]
29 variables:
30 - name: hostNetwork
31 expression: "object.spec.?hostNetwork.orValue(false)"
32 - name: hostIPC
33 expression: "object.spec.?hostIPC.orValue(false)"
34 - name: hostPID
35 expression: "object.spec.?hostPID.orValue(false)"
36 validations:
37 - expression: >-
38 !(variables.hostNetwork || variables.hostIPC || variables.hostPID)
39 message: >-
40 Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
41 spec.hostIPC, and spec.hostPID must be unset or set to `false`.

Disallow hostPath

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-host-path/disallow-host-path.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-path
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPath
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod,Volume
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/description: >-
13 HostPath volumes let Pods use host directories and volumes in containers.
14 Using host resources can be used to access shared data or escalate privileges
15 and should not be allowed. This policy ensures no hostPath volumes are in use.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: host-path
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 validate:
27 message: >-
28 HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
29 pattern:
30 spec:
31 =(volumes):
32 - X(hostPath): "null"

Disallow hostPath in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-host-path/disallow-host-path.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-path
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPath in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod,Volume
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 HostPath volumes let Pods use host directories and volumes in containers.
14 Using host resources can be used to access shared data or escalate privileges
15 and should not be allowed. This policy ensures no hostPath volumes are in use.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: host-path
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 expressions:
32 - expression: "object.spec.?volumes.orValue([]).all(volume, size(volume) == 0 || !has(volume.hostPath))"
33 message: "HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset"

Disallow hostPath in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-host-path/disallow-host-path.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-host-path
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPath in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod,Volume
10 policies.kyverno.io/minversion: 1.14.0
11 kyverno.io/kubernetes-version: "1.30+"
12 policies.kyverno.io/description: >-
13 HostPath volumes let Pods use host directories and volumes in containers.
14 Using host resources can be used to access shared data or escalate privileges
15 and should not be allowed. This policy ensures no hostPath volumes are in use.
16spec:
17 validationActions:
18 - Audit
19 evaluation:
20 background:
21 enabled: true
22 matchConstraints:
23 resourceRules:
24 - apiGroups: [""]
25 apiVersions: ["v1"]
26 operations: ["CREATE", "UPDATE"]
27 resources: ["pods"]
28 validations:
29 - expression: >-
30 object.spec.?volumes.orValue([]).all(volume, !has(volume.hostPath))
31 message: >-
32 HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset

Disallow hostPorts

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-host-ports/disallow-host-ports.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-ports
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPorts
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/description: >-
13 Access to host ports allows potential snooping of network traffic and should not be
14 allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
15 field is unset or set to `0`. 
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: host-ports-none
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 validate:
27 message: >-
28 Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
29 , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
30 must either be unset or set to `0`.
31 pattern:
32 spec:
33 =(ephemeralContainers):
34 - =(ports):
35 - =(hostPort): 0
36 =(initContainers):
37 - =(ports):
38 - =(hostPort): 0
39 containers:
40 - =(ports):
41 - =(hostPort): 0

Disallow hostPorts in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-host-ports/disallow-host-ports.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-ports
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPorts in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Access to host ports allows potential snooping of network traffic and should not be
14 allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
15 field is unset or set to `0`.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: host-ports-none
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 variables:
32 - name: allContainers
33 expression: >-
34 object.spec.containers + 
35 object.spec.?initContainers.orValue([]) + 
36 object.spec.?ephemeralContainers.orValue([])
37 expressions:
38 - expression: >-
39 variables.allContainers.all(container, 
40 container.?ports.orValue([]).all(port, port.?hostPort.orValue(0) == 0))
41 message: >-
42 Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort,
43 spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
44 must either be unset or set to `0`.

Disallow hostPorts in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-host-ports/disallow-host-ports.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-host-ports
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPorts in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.14.0
11 kyverno.io/kubernetes-version: "1.30+"
12 policies.kyverno.io/description: >-
13 Access to host ports allows potential snooping of network traffic and should not be
14 allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
15 field is unset or set to `0`. 
16spec:
17 validationActions:
18 - Audit
19 evaluation:
20 background:
21 enabled: true
22 matchConstraints:
23 resourceRules:
24 - apiGroups: [""]
25 apiVersions: ["v1"]
26 operations: ["CREATE", "UPDATE"]
27 resources: ["pods"]
28 variables:
29 - name: allContainers
30 expression: >-
31 object.spec.containers + 
32 object.spec.?initContainers.orValue([]) + 
33 object.spec.?ephemeralContainers.orValue([])
34 validations:
35 - expression: >- 
36 variables.allContainers.all(container, 
37 container.?ports.orValue([]).all(port, port.?hostPort.orValue(0) == 0))
38 message: >-
39 Use of host ports is disallowed. The field spec.containers[*].ports[*].hostPort
40 must either be unset or set to `0`.

Disallow hostPorts Range (Alternate)

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-host-ports-range/disallow-host-ports-range.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-ports-range
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPorts Range (Alternate)
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.6.0
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.22-1.23"
13 policies.kyverno.io/description: >-
14 Access to host ports allows potential snooping of network traffic and should not be
15 allowed by requiring host ports be undefined (recommended) or at minimum restricted to a known list.
16 This policy ensures the `hostPort` field, if defined, is set to either a port in the specified range
17 or to a value of zero. This policy is mutually exclusive of the disallow-host-ports policy.
18 Note that Kubernetes Pod Security Admission does not support the host port range rule.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: host-port-range
24 match:
25 any:
26 - resources:
27 kinds:
28 - Pod
29 preconditions:
30 all:
31 - key: "{{ request.operation }}"
32 operator: NotEquals
33 value: DELETE
34 validate:
35 message: >-
36 The only permitted hostPorts are in the range 5000-6000 or 0.
37 deny:
38 conditions:
39 all:
40 - key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].ports[].hostPort }}"
41 operator: AnyNotIn
42 value: 5000-6000
43 - key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].ports[].hostPort }}"
44 operator: AnyNotIn
45 value:
46 - 0

Disallow hostPorts Range (Alternate) in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-host-ports-range/disallow-host-ports-range.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-ports-range
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostPorts Range (Alternate) in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Access to host ports allows potential snooping of network traffic and should not be
14 allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
15 field is set to one in the designated list. Note that Kubernetes Pod Security Admission
16 does not support this rule.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: host-port-range
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel:
32 variables:
33 - name: allContainers
34 expression: >-
35 object.spec.containers + 
36 object.spec.?initContainers.orValue([]) + 
37 object.spec.?ephemeralContainers.orValue([])
38 expressions:
39 - expression: >- 
40 variables.allContainers.all(container, 
41 container.?ports.orValue([]).all(port,
42 size(port) == 0 ||
43 !has(port.hostPort) || (port.hostPort >= 5000 && port.hostPort <= 6000) )) 
44 message: >-
45 The only permitted hostPorts are in the range 5000-6000.

Disallow hostProcess

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-host-process/disallow-host-process.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-process
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostProcess
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/description: >-
13 Windows pods offer the ability to run HostProcess containers which enables privileged
14 access to the Windows node. Privileged access to the host is disallowed in the baseline
15 policy. HostProcess pods are an alpha feature as of Kubernetes v1.22. This policy ensures
16 the `hostProcess` field, if present, is set to `false`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: host-process-containers
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 validate:
28 message: >-
29 HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess,
30 spec.containers[*].securityContext.windowsOptions.hostProcess, spec.initContainers[*].securityContext.windowsOptions.hostProcess,
31 and spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must either be undefined
32 or set to `false`.
33 pattern:
34 spec:
35 =(ephemeralContainers):
36 - =(securityContext):
37 =(windowsOptions):
38 =(hostProcess): "false"
39 =(initContainers):
40 - =(securityContext):
41 =(windowsOptions):
42 =(hostProcess): "false"
43 containers:
44 - =(securityContext):
45 =(windowsOptions):
46 =(hostProcess): "false"

Disallow hostProcess in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-host-process/disallow-host-process.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-host-process
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostProcess in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Windows pods offer the ability to run HostProcess containers which enables privileged
14 access to the Windows node. Privileged access to the host is disallowed in the baseline
15 policy. HostProcess pods are an alpha feature as of Kubernetes v1.22. This policy ensures
16 the `hostProcess` field, if present, is set to `false`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: host-process-containers
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel:
32 variables:
33 - name: allContainers
34 expression: "(object.spec.containers + (has(object.spec.initContainers) ? object.spec.initContainers : []) + (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : []))"
35 expressions:
36 - expression: >-
37 variables.allContainers.all(container,
38 container.?securityContext.?windowsOptions.?hostProcess.orValue(false) == false)
39 message: >-
40 HostProcess containers are disallowed. The field spec.containers[*].securityContext.windowsOptions.hostProcess,
41 spec.initContainers[*].securityContext.windowsOptions.hostProcess, and
42 spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess
43 must either be undefined or set to `false`.

Disallow hostProcess in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-host-process/disallow-host-process.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-host-process
 5 annotations:
 6 policies.kyverno.io/title: Disallow hostProcess in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.14.0
11 kyverno.io/kubernetes-version: "1.30+"
12 policies.kyverno.io/description: >-
13 Windows pods offer the ability to run HostProcess containers which enables privileged
14 access to the Windows node. Privileged access to the host is disallowed in the baseline
15 policy. HostProcess pods are an alpha feature as of Kubernetes v1.22. This policy ensures
16 the `hostProcess` field, if present, is set to `false`.
17spec:
18 validationActions:
19 - Audit
20 evaluation:
21 background:
22 enabled: true
23 matchConstraints:
24 resourceRules:
25 - apiGroups: [""]
26 apiVersions: ["v1"]
27 operations: ["CREATE", "UPDATE"]
28 resources: ["pods"]
29 variables:
30 - name: allContainers
31 expression: >-
32 object.spec.containers + 
33 object.spec.?initContainers.orValue([]) + 
34 object.spec.?ephemeralContainers.orValue([])
35
36 validations:
37 - expression: >-
38 variables.allContainers.all(container,
39 container.?securityContext.?windowsOptions.?hostProcess.orValue(false) == false)
40 message: >-
41 HostProcess containers are disallowed. The field spec.containers[*].securityContext.windowsOptions.hostProcess,
42 spec.initContainers[*].securityContext.windowsOptions.hostProcess, and
43 spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess
44 must either be undefined or set to `false`.

Disallow Latest Tag

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/disallow-latest-tag/disallow-latest-tag.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-latest-tag
 5 annotations:
 6 policies.kyverno.io/title: Disallow Latest Tag
 7 policies.kyverno.io/category: Best Practices
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/severity: medium
10 policies.kyverno.io/subject: Pod
11 policies.kyverno.io/description: >-
12 The ':latest' tag is mutable and can lead to unexpected errors if the
13 image changes. A best practice is to use an immutable tag that maps to
14 a specific version of an application Pod. This policy validates that the image
15 specifies a tag and that it is not called `latest`.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: require-image-tag
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 validate:
27 message: "An image tag is required."
28 foreach:
29 - list: "request.object.spec.containers"
30 pattern:
31 image: "*:*"
32 - list: "request.object.spec.initContainers"
33 pattern:
34 image: "*:*"
35 - list: "request.object.spec.ephemeralContainers"
36 pattern:
37 image: "*:*"
38 - name: validate-image-tag
39 match:
40 any:
41 - resources:
42 kinds:
43 - Pod
44 validate:
45 message: "Using a mutable image tag e.g. 'latest' is not allowed."
46 foreach:
47 - list: "request.object.spec.containers"
48 pattern:
49 image: "!*:latest"
50 - list: "request.object.spec.initContainers"
51 pattern:
52 image: "!*:latest"
53 - list: "request.object.spec.ephemeralContainers"
54 pattern:
55 image: "!*:latest"

Disallow Latest Tag in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/disallow-latest-tag/disallow-latest-tag.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-latest-tag
 5 annotations:
 6 policies.kyverno.io/title: Disallow Latest Tag in CEL expressions
 7 policies.kyverno.io/category: Best Practices in CEL 
 8 policies.kyverno.io/minversion: 1.11.0
 9 kyverno.io/kubernetes-version: "1.26-1.27"
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 The ':latest' tag is mutable and can lead to unexpected errors if the
14 image changes. A best practice is to use an immutable tag that maps to
15 a specific version of an application Pod. This policy validates that the image
16 specifies a tag and that it is not called `latest`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: require-and-validate-image-tag
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel:
32 expressions:
33 - expression: "object.spec.containers.all(container, container.image.contains(':'))"
34 message: "An image tag is required."
35 - expression: "object.spec.containers.all(container, !container.image.endsWith(':latest'))"
36 message: "Using a mutable image tag e.g. 'latest' is not allowed."

Disallow Localhost ExternalName Services

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/disallow-localhost-services/disallow-localhost-services.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: no-localhost-service
 5 annotations:
 6 policies.kyverno.io/title: Disallow Localhost ExternalName Services
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Service
10 policies.kyverno.io/minversion: 1.6.0
11 policies.kyverno.io/description: >-
12 A Service of type ExternalName which points back to localhost can potentially be used to exploit
13 vulnerabilities in some Ingress controllers. This policy audits Services of type ExternalName
14 if the externalName field refers to localhost.
15spec:
16 validationFailureAction: Audit
17 background: true
18 rules:
19 - name: no-localhost-service
20 match:
21 any:
22 - resources:
23 kinds:
24 - Service
25 validate:
26 message: "Service of type ExternalName cannot point to localhost."
27 pattern:
28 spec:
29 (type): ExternalName
30 externalName: "!localhost"

Disallow Localhost ExternalName Services in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/disallow-localhost-services/disallow-localhost-services.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: no-localhost-service
 5 annotations:
 6 policies.kyverno.io/title: Disallow Localhost ExternalName Services in CEL expressions
 7 policies.kyverno.io/category: Sample in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Service
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 A Service of type ExternalName which points back to localhost can potentially be used to exploit
14 vulnerabilities in some Ingress controllers. This policy audits Services of type ExternalName
15 if the externalName field refers to localhost.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: no-localhost-service
21 match:
22 any:
23 - resources:
24 kinds:
25 - Service
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 expressions:
32 - expression: "object.spec.type != 'ExternalName' || object.spec.externalName != 'localhost'"
33 message: "Service of type ExternalName cannot point to localhost."
34

Disallow NodePort

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/restrict-node-port/restrict-node-port.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: restrict-nodeport
 5 annotations:
 6 policies.kyverno.io/title: Disallow NodePort
 7 policies.kyverno.io/category: Best Practices
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/severity: medium
10 policies.kyverno.io/subject: Service
11 policies.kyverno.io/description: >-
12 A Kubernetes Service of type NodePort uses a host port to receive traffic from
13 any source. A NetworkPolicy cannot be used to control traffic to host ports.
14 Although NodePort Services can be useful, their use must be limited to Services
15 with additional upstream security checks. This policy validates that any new Services
16 do not use the `NodePort` type.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: validate-nodeport
22 match:
23 any:
24 - resources:
25 kinds:
26 - Service
27 validate:
28 message: "Services of type NodePort are not allowed."
29 pattern:
30 spec:
31 =(type): "!NodePort"

Disallow NodePort in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/restrict-node-port/restrict-node-port.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: restrict-nodeport
 5 annotations:
 6 policies.kyverno.io/title: Disallow NodePort in CEL expressions
 7 policies.kyverno.io/category: Best Practices in CEL 
 8 policies.kyverno.io/minversion: 1.11.0
 9 kyverno.io/kubernetes-version: "1.26-1.27"
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Service
12 policies.kyverno.io/description: >-
13 A Kubernetes Service of type NodePort uses a host port to receive traffic from
14 any source. A NetworkPolicy cannot be used to control traffic to host ports.
15 Although NodePort Services can be useful, their use must be limited to Services
16 with additional upstream security checks. This policy validates that any new Services
17 do not use the `NodePort` type.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: validate-nodeport
23 match:
24 any:
25 - resources:
26 kinds:
27 - Service
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: "has(object.spec.type) ? (object.spec.type != 'NodePort') : true"
35 message: "Services of type NodePort are not allowed."

Disallow OpenShift Jenkins Pipeline Build Strategy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift/disallow-jenkins-pipeline-strategy/disallow-jenkins-pipeline-strategy.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-jenkins-pipeline-strategy
 5 annotations:
 6 policies.kyverno.io/title: Disallow OpenShift Jenkins Pipeline Build Strategy 
 7 policies.kyverno.io/category: OpenShift
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.20"
12 policies.kyverno.io/subject: BuildConfig
13 policies.kyverno.io/description: >-
14 The Jenkins Pipeline Build Strategy has been deprecated. This policy prevents its use. Use OpenShift Pipelines instead.
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-build-strategy
20 match:
21 any:
22 - resources:
23 kinds:
24 - v1/BuildConfig
25 - build.openshift.io/v1/BuildConfig
26 validate:
27 message: >-
28 Jenkins Pipeline Build Strategy has been deprecated and is not allowed
29 deny: 
30 conditions:
31 all:
32 - key: "{{ keys(request.object.spec.strategy) | contains(@, 'jenkinsPipelineStrategy') }}"
33 operator: Equals
34 value: true

Disallow OpenShift Jenkins Pipeline Build Strategy in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift-cel/disallow-jenkins-pipeline-strategy/disallow-jenkins-pipeline-strategy.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-jenkins-pipeline-strategy
 5 annotations:
 6 policies.kyverno.io/title: Disallow OpenShift Jenkins Pipeline Build Strategy in CEL expressions
 7 policies.kyverno.io/category: OpenShift in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: BuildConfig
13 policies.kyverno.io/description: >-
14 The Jenkins Pipeline Build Strategy has been deprecated. This policy prevents its use. Use OpenShift Pipelines instead.
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-build-strategy
20 match:
21 any:
22 - resources:
23 kinds:
24 - v1/BuildConfig
25 - build.openshift.io/v1/BuildConfig
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 expressions:
32 - expression: "!has(object.spec.strategy.jenkinsPipelineStrategy)"
33 message: >-
34 Jenkins Pipeline Build Strategy has been deprecated and is not allowed

Disallow Privilege Escalation

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/restricted/disallow-privilege-escalation/disallow-privilege-escalation.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-privilege-escalation
 5 annotations:
 6 policies.kyverno.io/title: Disallow Privilege Escalation
 7 policies.kyverno.io/category: Pod Security Standards (Restricted)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/description: >-
13 Privilege escalation, such as via set-user-ID or set-group-ID file mode, should not be allowed.
14 This policy ensures the `allowPrivilegeEscalation` field is set to `false`.
15spec:
16 validationFailureAction: Audit
17 background: true
18 rules:
19 - name: privilege-escalation
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 validate:
26 message: >-
27 Privilege escalation is disallowed. The fields
28 spec.containers[*].securityContext.allowPrivilegeEscalation,
29 spec.initContainers[*].securityContext.allowPrivilegeEscalation,
30 and spec.ephemeralContainers[*].securityContext.allowPrivilegeEscalation
31 must be set to `false`.
32 pattern:
33 spec:
34 =(ephemeralContainers):
35 - securityContext:
36 allowPrivilegeEscalation: "false"
37 =(initContainers):
38 - securityContext:
39 allowPrivilegeEscalation: "false"
40 containers:
41 - securityContext:
42 allowPrivilegeEscalation: "false"

Disallow Privilege Escalation in CEL

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/restricted/disallow-privilege-escalation/disallow-privilege-escalation.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-privilege-escalation
 5 annotations:
 6 policies.kyverno.io/title: Disallow Privilege Escalation in CEL
 7 policies.kyverno.io/category: Pod Security Standards (Restricted) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kyverno-version: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 Privilege escalation, such as via set-user-ID or set-group-ID file mode, should not be allowed.
15 This policy ensures the `allowPrivilegeEscalation` field is set to `false`.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: privilege-escalation
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 variables:
32 - name: allContainers
33 expression: >-
34 object.spec.containers + 
35 object.spec.?initContainers.orValue([]) + 
36 object.spec.?ephemeralContainers.orValue([])
37 expressions:
38 - expression: >- 
39 variables.allContainers.all(container, 
40 container.?securityContext.allowPrivilegeEscalation.orValue(true) == false)
41 message: >-
42 Privilege escalation is disallowed. 
43 All containers must set the securityContext.allowPrivilegeEscalation field to `false`.

Disallow Privilege Escalation in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/restricted/disallow-privilege-escalation/disallow-privilege-escalation.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-privilege-escalation
 5 annotations:
 6 policies.kyverno.io/title: Disallow Privilege Escalation in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Restricted) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.14.0
11 kyverno.io/kyverno-version: 1.14.0
12 kyverno.io/kubernetes-version: "1.30+"
13 policies.kyverno.io/description: >-
14 Privilege escalation, such as via set-user-ID or set-group-ID file mode, should not be allowed.
15 This policy ensures the `allowPrivilegeEscalation` field is set to `false`.
16spec:
17 validationActions:
18 - Audit
19 evaluation:
20 background:
21 enabled: true
22 matchConstraints:
23 resourceRules:
24 - apiGroups: [""]
25 apiVersions: ["v1"]
26 operations: ["CREATE", "UPDATE"]
27 resources: ["pods"]
28 variables:
29 - name: allContainers
30 expression: >-
31 object.spec.containers + 
32 object.spec.?initContainers.orValue([]) + 
33 object.spec.?ephemeralContainers.orValue([])
34 validations:
35 - expression: >- 
36 variables.allContainers.all(container, 
37 container.?securityContext.allowPrivilegeEscalation.orValue(true) == false)
38 message: >-
39 Privilege escalation is disallowed. 
40 All containers must set the securityContext.allowPrivilegeEscalation field to `false`.

Disallow Privileged Containers

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-privileged-containers/disallow-privileged-containers.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-privileged-containers
 5 annotations:
 6 policies.kyverno.io/title: Disallow Privileged Containers
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/description: >-
13 Privileged mode disables most security mechanisms and must not be allowed. This policy
14 ensures Pods do not call for privileged mode.
15spec:
16 validationFailureAction: Audit
17 background: true
18 rules:
19 - name: privileged-containers
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 validate:
26 message: >-
27 Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged,
28 spec.initContainers[*].securityContext.privileged, and spec.ephemeralContainers[*].securityContext.privileged must be unset or set to `false`.
29 pattern:
30 spec:
31 =(ephemeralContainers):
32 - =(securityContext):
33 =(privileged): "false"
34 =(initContainers):
35 - =(securityContext):
36 =(privileged): "false"
37 containers:
38 - =(securityContext):
39 =(privileged): "false"

Disallow Privileged Containers in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-privileged-containers/disallow-privileged-containers.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-privileged-containers
 5 annotations:
 6 policies.kyverno.io/title: Disallow Privileged Containers in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kyverno-version: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 Privileged mode disables most security mechanisms and must not be allowed. This policy
15 ensures Pods do not call for privileged mode.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: privileged-containers
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 variables:
32 - name: allContainers
33 expression: "(object.spec.containers + (has(object.spec.initContainers) ? object.spec.initContainers : []) + (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : []))"
34 expressions:
35 - expression: "variables.allContainers.all(container, container.?securityContext.?privileged.orValue(false) == false)"
36 message: "Privileged mode is disallowed. All containers must set the securityContext.privileged field to `false` or unset the field."

Disallow Privileged Containers in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-privileged-containers/disallow-privileged-containers.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-privileged-containers
 5 annotations:
 6 policies.kyverno.io/title: Disallow Privileged Containers in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.14.0
11 kyverno.io/kyverno-version: 1.14.0
12 kyverno.io/kubernetes-version: "1.30+"
13 policies.kyverno.io/description: >-
14 Privileged mode disables most security mechanisms and must not be allowed. This policy
15 ensures Pods do not call for privileged mode.
16spec:
17 validationActions:
18 - Audit
19 evaluation:
20 background:
21 enabled: true
22 matchConstraints:
23 resourceRules:
24 - apiGroups: [""]
25 apiVersions: ["v1"]
26 operations: ["CREATE", "UPDATE"]
27 resources: ["pods"]
28 variables:
29 - name: allContainers
30 expression: >-
31 object.spec.containers + 
32 object.spec.?initContainers.orValue([]) + 
33 object.spec.?ephemeralContainers.orValue([])
34 validations:
35 - expression: "variables.allContainers.all(container, container.?securityContext.?privileged.orValue(false) == false)"
36 message: "Privileged mode is disallowed. All containers must set the securityContext.privileged field to `false` or unset the field."

Disallow procMount

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-proc-mount/disallow-proc-mount.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-proc-mount
 5 annotations:
 6 policies.kyverno.io/title: Disallow procMount
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/description: >-
13 The default /proc masks are set up to reduce attack surface and should be required. This policy
14 ensures nothing but the default procMount can be specified. Note that in order for users
15 to deviate from the `Default` procMount requires setting a feature gate at the API
16 server.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: check-proc-mount
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 validate:
28 message: >-
29 Changing the proc mount from the default is not allowed. The fields
30 spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount,
31 and spec.ephemeralContainers[*].securityContext.procMount must be unset or
32 set to `Default`.
33 pattern:
34 spec:
35 =(ephemeralContainers):
36 - =(securityContext):
37 =(procMount): "Default"
38 =(initContainers):
39 - =(securityContext):
40 =(procMount): "Default"
41 containers:
42 - =(securityContext):
43 =(procMount): "Default"

Disallow procMount in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-proc-mount/disallow-proc-mount.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-proc-mount
 5 annotations:
 6 policies.kyverno.io/title: Disallow procMount in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kyverno-version: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 The default /proc masks are set up to reduce attack surface and should be required. This policy
15 ensures nothing but the default procMount can be specified. Note that in order for users
16 to deviate from the `Default` procMount requires setting a feature gate at the API
17 server.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: check-proc-mount
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 variables:
34 - name: allContainers
35 expression: "(object.spec.containers + (has(object.spec.initContainers) ? object.spec.initContainers : []) + (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : []))"
36 expressions:
37 - expression: "variables.allContainers.all(container, container.?securityContext.?procMount.orValue('Default') == 'Default')"
38 message: "Changing the proc mount from the default is not allowed."

Disallow procMount in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-proc-mount/disallow-proc-mount.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-proc-mount
 5 annotations:
 6 policies.kyverno.io/title: Disallow procMount in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.14.0
11 kyverno.io/kyverno-version: 1.14.0
12 kyverno.io/kubernetes-version: "1.30+"
13 policies.kyverno.io/description: >-
14 The default /proc masks are set up to reduce attack surface and should be required. This policy
15 ensures nothing but the default procMount can be specified. Note that in order for users
16 to deviate from the `Default` procMount requires setting a feature gate at the API
17 server.
18spec:
19 validationActions:
20 - Audit
21 evaluation:
22 background:
23 enabled: true
24 matchConstraints:
25 resourceRules:
26 - apiGroups: [""]
27 apiVersions: ["v1"]
28 operations: ["CREATE", "UPDATE"]
29 resources: ["pods"]
30 variables:
31 - name: allContainers
32 expression: >-
33 object.spec.containers + 
34 object.spec.?initContainers.orValue([]) + 
35 object.spec.?ephemeralContainers.orValue([])
36 validations:
37 - expression: "variables.allContainers.all(container, container.?securityContext.?procMount.orValue('Default') == 'Default')"
38 message: "Changing the proc mount from the default is not allowed."

Disallow Secrets from Env Vars

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/disallow-secrets-from-env-vars/disallow-secrets-from-env-vars.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: secrets-not-from-env-vars
 5 annotations:
 6 policies.kyverno.io/title: Disallow Secrets from Env Vars
 7 policies.kyverno.io/category: Sample, EKS Best Practices
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod, Secret
10 kyverno.io/kyverno-version: 1.6.0
11 policies.kyverno.io/description: >-
12 Secrets used as environment variables containing sensitive information may, if not carefully controlled, 
13 be printed in log output which could be visible to unauthorized people and captured in forwarding
14 applications. This policy disallows using Secrets as environment variables.
15spec:
16 validationFailureAction: Audit
17 background: true
18 rules:
19 - name: secrets-not-from-env-vars
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 validate:
26 message: "Secrets must be mounted as volumes, not as environment variables."
27 pattern:
28 spec:
29 containers:
30 - name: "*"
31 =(env):
32 - =(valueFrom):
33 X(secretKeyRef): "null"
34 - name: secrets-not-from-envfrom
35 match:
36 any:
37 - resources:
38 kinds:
39 - Pod
40 validate:
41 message: "Secrets must not come from envFrom statements."
42 pattern:
43 spec:
44 containers:
45 - name: "*"
46 =(envFrom):
47 - X(secretRef): "null"

Disallow Secrets from Env Vars in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/disallow-secrets-from-env-vars/disallow-secrets-from-env-vars.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: secrets-not-from-env-vars
 5 annotations:
 6 policies.kyverno.io/title: Disallow Secrets from Env Vars in CEL expressions
 7 policies.kyverno.io/category: Sample, EKS Best Practices in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod, Secret
10 kyverno.io/kyverno-version: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Secrets used as environment variables containing sensitive information may, if not carefully controlled, 
14 be printed in log output which could be visible to unauthorized people and captured in forwarding
15 applications. This policy disallows using Secrets as environment variables.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: secrets-not-from-env-vars
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 expressions:
32 - expression: "object.spec.containers.all(container, container.?env.orValue([]).all(env, env.?valueFrom.?secretKeyRef.orValue(true)))"
33 message: "Secrets must be mounted as volumes, not as environment variables."
34 - expression: "object.spec.containers.all(container, container.?envFrom.orValue([]).all(envFrom, !has(envFrom.secretRef)))"
35 message: "Secrets must not come from envFrom statements."
36

Disallow SELinux

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security/baseline/disallow-selinux/disallow-selinux.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-selinux
 5 annotations:
 6 policies.kyverno.io/title: Disallow SELinux
 7 policies.kyverno.io/category: Pod Security Standards (Baseline)
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 kyverno.io/kyverno-version: 1.6.0
11 kyverno.io/kubernetes-version: "1.22-1.23"
12 policies.kyverno.io/description: >-
13 SELinux options can be used to escalate privileges and should not be allowed. This policy
14 ensures that the `seLinuxOptions` field is undefined.
15spec:
16 validationFailureAction: Audit
17 background: true
18 rules:
19 - name: selinux-type
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 validate:
26 message: >-
27 Setting the SELinux type is restricted. The fields
28 spec.securityContext.seLinuxOptions.type, spec.containers[*].securityContext.seLinuxOptions.type,
29 , spec.initContainers[*].securityContext.seLinuxOptions, and spec.ephemeralContainers[*].securityContext.seLinuxOptions.type
30 must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
31 pattern:
32 spec:
33 =(securityContext):
34 =(seLinuxOptions):
35 =(type): "container_t | container_init_t | container_kvm_t"
36 =(ephemeralContainers):
37 - =(securityContext):
38 =(seLinuxOptions):
39 =(type): "container_t | container_init_t | container_kvm_t"
40 =(initContainers):
41 - =(securityContext):
42 =(seLinuxOptions):
43 =(type): "container_t | container_init_t | container_kvm_t"
44 containers:
45 - =(securityContext):
46 =(seLinuxOptions):
47 =(type): "container_t | container_init_t | container_kvm_t"
48 - name: selinux-user-role
49 match:
50 any:
51 - resources:
52 kinds:
53 - Pod
54 validate:
55 message: >-
56 Setting the SELinux user or role is forbidden. The fields
57 spec.securityContext.seLinuxOptions.user, spec.securityContext.seLinuxOptions.role,
58 spec.containers[*].securityContext.seLinuxOptions.user, spec.containers[*].securityContext.seLinuxOptions.role,
59 spec.initContainers[*].securityContext.seLinuxOptions.user, spec.initContainers[*].securityContext.seLinuxOptions.role,
60 spec.ephemeralContainers[*].securityContext.seLinuxOptions.user, and spec.ephemeralContainers[*].securityContext.seLinuxOptions.role
61 must be unset.
62 pattern:
63 spec:
64 =(securityContext):
65 =(seLinuxOptions):
66 X(user): "null"
67 X(role): "null"
68 =(ephemeralContainers):
69 - =(securityContext):
70 =(seLinuxOptions):
71 X(user): "null"
72 X(role): "null"
73 =(initContainers):
74 - =(securityContext):
75 =(seLinuxOptions):
76 X(user): "null"
77 X(role): "null"
78 containers:
79 - =(securityContext):
80 =(seLinuxOptions):
81 X(user): "null"
82 X(role): "null"

Disallow SELinux in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-cel/baseline/disallow-selinux/disallow-selinux.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-selinux
 5 annotations:
 6 policies.kyverno.io/title: Disallow SELinux in CEL expressions
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in CEL
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kyverno-version: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 SELinux options can be used to escalate privileges and should not be allowed. This policy
15 ensures that the `seLinuxOptions` field is undefined.
16spec:
17 validationFailureAction: Audit
18 background: true
19 rules:
20 - name: selinux-type
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 operations:
27 - CREATE
28 - UPDATE
29 validate:
30 cel:
31 variables:
32 - name: allContainerTypes
33 expression: "(object.spec.containers + (has(object.spec.initContainers) ? object.spec.initContainers : []) + (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : []))"
34 - name: seLinuxTypes
35 expression: "['container_t', 'container_init_t', 'container_kvm_t']"
36 expressions:
37 - expression: >-
38 (!has(object.spec.securityContext) ||
39 !has(object.spec.securityContext.seLinuxOptions) ||
40 !has(object.spec.securityContext.seLinuxOptions.type) ||
41 variables.seLinuxTypes.exists(type, type == object.spec.securityContext.seLinuxOptions.type)) &&
42 variables.allContainerTypes.all(container, 
43 !has(container.securityContext) ||
44 !has(container.securityContext.seLinuxOptions) ||
45 !has(container.securityContext.seLinuxOptions.type) ||
46 variables.seLinuxTypes.exists(type, type == container.securityContext.seLinuxOptions.type))
47 message: >-
48 Setting the SELinux type is restricted. The field securityContext.seLinuxOptions.type must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
49 - name: selinux-user-role
50 match:
51 any:
52 - resources:
53 kinds:
54 - Pod
55 operations:
56 - CREATE
57 - UPDATE
58 validate:
59 cel:
60 variables:
61 - name: allContainerTypes
62 expression: "(object.spec.containers + (has(object.spec.initContainers) ? object.spec.initContainers : []) + (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : []))"
63 expressions:
64 - expression: >-
65 (!has(object.spec.securityContext) ||
66 !has(object.spec.securityContext.seLinuxOptions) ||
67 (!has(object.spec.securityContext.seLinuxOptions.user) && !has(object.spec.securityContext.seLinuxOptions.role))) &&
68 variables.allContainerTypes.all(container,
69 !has(container.securityContext) ||
70 !has(container.securityContext.seLinuxOptions) ||
71 (!has(container.securityContext.seLinuxOptions.user) && !has(container.securityContext.seLinuxOptions.role)))
72 message: >-
73 Setting the SELinux user or role is forbidden. The fields seLinuxOptions.user and seLinuxOptions.role must be unset.
74

Disallow SELinux in ValidatingPolicy

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/pod-security-vpol/baseline/disallow-selinux/disallow-selinux.yaml

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4 name: disallow-selinux
 5 annotations:
 6 policies.kyverno.io/title: Disallow SELinux in ValidatingPolicy
 7 policies.kyverno.io/category: Pod Security Standards (Baseline) in ValidatingPolicy
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.14.0
11 kyverno.io/kyverno-version: 1.14.0
12 kyverno.io/kubernetes-version: "1.30+"
13 policies.kyverno.io/description: >-
14 SELinux options can be used to escalate privileges and should not be allowed. This policy
15 ensures that the `seLinuxOptions` field is undefined.
16spec:
17 validationActions:
18 - Audit
19 evaluation:
20 background:
21 enabled: true
22 matchConstraints:
23 resourceRules:
24 - apiGroups: [""]
25 apiVersions: ["v1"]
26 operations: ["CREATE", "UPDATE"]
27 resources: ["pods"]
28 variables:
29 - name: allContainerTypes
30 expression: >-
31 object.spec.containers + 
32 object.spec.?initContainers.orValue([]) + 
33 object.spec.?ephemeralContainers.orValue([])
34
35 - name: seLinuxTypes
36 expression: "['container_t', 'container_init_t', 'container_kvm_t']"
37
38 - name: hasValidSELinuxType
39 expression: >-
40 object.spec.?securityContext.?seLinuxOptions.?type.orValue('') == '' || 
41 variables.seLinuxTypes.exists(type, type == object.spec.securityContext.seLinuxOptions.type)
42
43 - name: hasValidSELinuxUserRole
44 expression: >-
45 object.spec.?securityContext.?seLinuxOptions.?user.orValue('') == '' &&
46 object.spec.?securityContext.?seLinuxOptions.?role.orValue('') == ''
47
48 validations:
49 - expression: >-
50 variables.hasValidSELinuxType &&
51 variables.allContainerTypes.all(container, 
52 container.?securityContext.?seLinuxOptions.?type.orValue('') == '' || 
53 variables.seLinuxTypes.exists(type, type == container.securityContext.seLinuxOptions.type))
54 message: >-
55 Setting the SELinux type is restricted. The field securityContext.seLinuxOptions.type 
56 must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
57
58 - expression: >-
59 variables.hasValidSELinuxUserRole &&
60 variables.allContainerTypes.all(container,
61 container.?securityContext.?seLinuxOptions.?user.orValue('') == '' &&
62 container.?securityContext.?seLinuxOptions.?role.orValue('') == '')
63 message: >-
64 Setting the SELinux user or role is forbidden. The fields seLinuxOptions.user and seLinuxOptions.role must be unset.

Disallow Service Type LoadBalancer

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/restrict-loadbalancer/restrict-loadbalancer.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: no-loadbalancer-service
 5 annotations:
 6 policies.kyverno.io/title: Disallow Service Type LoadBalancer
 7 policies.kyverno.io/category: Sample
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Service
10 policies.kyverno.io/minversion: 1.6.0
11 policies.kyverno.io/description: >-
12 Especially in cloud provider environments, a Service having type LoadBalancer will cause the
13 provider to respond by creating a load balancer somewhere in the customer account. This adds
14 cost and complexity to a deployment. Without restricting this ability, users may easily
15 overrun established budgets and security practices set by the organization. This policy restricts
16 use of the Service type LoadBalancer.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: no-LoadBalancer
22 match:
23 any:
24 - resources:
25 kinds:
26 - Service
27 validate:
28 message: "Service of type LoadBalancer is not allowed."
29 pattern:
30 spec:
31 type: "!LoadBalancer"

Disallow Service Type LoadBalancer in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/restrict-loadbalancer/restrict-loadbalancer.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: no-loadbalancer-service
 5 annotations:
 6 policies.kyverno.io/title: Disallow Service Type LoadBalancer in CEL expressions
 7 policies.kyverno.io/category: Sample in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Service
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/description: >-
13 Especially in cloud provider environments, a Service having type LoadBalancer will cause the
14 provider to respond by creating a load balancer somewhere in the customer account. This adds
15 cost and complexity to a deployment. Without restricting this ability, users may easily
16 overrun established budgets and security practices set by the organization. This policy restricts
17 use of the Service type LoadBalancer.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: no-LoadBalancer
23 match:
24 any:
25 - resources:
26 kinds:
27 - Service
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 expressions:
34 - expression: "object.spec.type != 'LoadBalancer'"
35 message: "Service of type LoadBalancer is not allowed."

Disallow use of the SecurityContextConstraint (SCC) anyuid

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift/disallow-security-context-constraint-anyuid/disallow-security-context-constraint-anyuid.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-security-context-constraint-anyuid
 5 annotations:
 6 policies.kyverno.io/title: Disallow use of the SecurityContextConstraint (SCC) anyuid
 7 policies.kyverno.io/category: Security
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.20"
12 policies.kyverno.io/subject: Role,ClusterRole,RBAC
13 policies.kyverno.io/description: >-
14 Disallow the use of the SecurityContextConstraint (SCC) anyuid which allows a pod to run with the UID as declared in the image instead of a random UID
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-security-context-constraint
20 match:
21 any:
22 - resources:
23 kinds:
24 - ClusterRole
25 - Role
26 validate:
27 message: >-
28 Use of the SecurityContextConstraint (SCC) anyuid is not allowed
29 foreach:
30 - list: request.object.rules[]
31 deny:
32 conditions:
33 all:
34 - key: anyuid
35 operator: AnyIn
36 value: "{{element.resourceNames[]}}"
37 - key: "{{ element.verbs[] | contains(@, 'use') || contains(@, '*') }}"
38 operator: Equals
39 value: true
40 - name: check-security-context-roleref
41 match:
42 any:
43 - resources:
44 kinds:
45 - ClusterRoleBinding
46 - RoleBinding
47 validate:
48 message: >-
49 Use of the SecurityContextConstraint (SCC) anyuid is not allowed
50 deny:
51 conditions:
52 all:
53 - key: system:openshift:scc:anyuid
54 operator: Equals
55 value: "{{request.object.roleRef.name}}"

Disallow use of the SecurityContextConstraint (SCC) anyuid in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift-cel/disallow-security-context-constraint-anyuid/disallow-security-context-constraint-anyuid.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: disallow-security-context-constraint-anyuid
 5 annotations:
 6 policies.kyverno.io/title: Disallow use of the SecurityContextConstraint (SCC) anyuid in CEL expressions
 7 policies.kyverno.io/category: Security in CEL 
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: Role,ClusterRole,RBAC
13 policies.kyverno.io/description: >-
14 Disallow the use of the SecurityContextConstraint (SCC) anyuid which allows a pod to run with the UID as declared in the image instead of a random UID
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-security-context-constraint
20 match:
21 any:
22 - resources:
23 kinds:
24 - ClusterRole
25 - Role
26 operations:
27 - CREATE
28 - UPDATE
29 validate: 
30 cel:
31 expressions:
32 - expression: "!object.?rules.orValue([]).exists(rule, 'anyuid' in rule.resourceNames && ('use' in rule.verbs || '*' in rule.verbs))"
33 message: >-
34 Use of the SecurityContextConstraint (SCC) anyuid is not allowed
35 - name: check-security-context-roleref
36 match:
37 any:
38 - resources:
39 kinds:
40 - ClusterRoleBinding
41 - RoleBinding
42 operations:
43 - CREATE
44 - UPDATE
45 validate:
46 cel:
47 expressions:
48 - expression: "object.roleRef.name != 'system:openshift:scc:anyuid'"
49 message: >-
50 Use of the SecurityContextConstraint (SCC) anyuid is not allowed

Docker Socket Requires Label

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other/docker-socket-requires-label/docker-socket-requires-label.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: docker-socket-check
 5 annotations:
 6 policies.kyverno.io/title: Docker Socket Requires Label
 7 policies.kyverno.io/category: Other
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.8.0
10 kyverno.io/kubernetes-version: "1.23"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Accessing a container engine's socket is for highly specialized use cases and should generally
14 be disabled. If access must be granted, it should be done on an explicit basis. This policy
15 requires that, for any Pod mounting the Docker socket, it must have the label `allow-docker` set
16 to `true`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: conditional-anchor-dockersock
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 validate:
28 message: "If a hostPath volume exists and is set to `/var/run/docker.sock`, the label `allow-docker` must equal `true`."
29 pattern:
30 metadata:
31 labels:
32 allow-docker: "true"
33 (spec):
34 (volumes):
35 - (hostPath):
36 path: "/var/run/docker.sock"

Docker Socket Requires Label in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/other-cel/docker-socket-requires-label/docker-socket-requires-label.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: docker-socket-check
 5 annotations:
 6 policies.kyverno.io/title: Docker Socket Requires Label in CEL expressions
 7 policies.kyverno.io/category: Other in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 kyverno.io/kubernetes-version: "1.26-1.27"
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Accessing a container engine's socket is for highly specialized use cases and should generally
14 be disabled. If access must be granted, it should be done on an explicit basis. This policy
15 requires that, for any Pod mounting the Docker socket, it must have the label `allow-docker` set
16 to `true`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: docker-socket-check
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 operations:
28 - CREATE
29 - UPDATE
30 validate:
31 cel: 
32 variables:
33 - name: hasDockerSocket
34 expression: "object.spec.?volumes.orValue([]).exists(volume, volume.?hostPath.?path.orValue('') == '/var/run/docker.sock')"
35 - name: isAllowDockerLabelTrue
36 expression: "object.metadata.?labels[?'allow-docker'].orValue('false') == 'true'"
37 expressions:
38 - expression: "!variables.hasDockerSocket || variables.isAllowDockerLabelTrue"
39 message: "If a hostPath volume exists and is set to `/var/run/docker.sock`, the label `allow-docker` must equal `true`."

Drop All Capabilities

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/require-drop-all/require-drop-all.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: drop-all-capabilities
 5 annotations:
 6 policies.kyverno.io/title: Drop All Capabilities
 7 policies.kyverno.io/category: Best Practices
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/minversion: 1.6.0
10 policies.kyverno.io/subject: Pod
11 policies.kyverno.io/description: >-
12 Capabilities permit privileged actions without giving full root access. All
13 capabilities should be dropped from a Pod, with only those required added back.
14 This policy ensures that all containers explicitly specify the `drop: ["ALL"]`
15 ability. Note that this policy also illustrates how to cover drop entries in any
16 case although this may not strictly conform to the Pod Security Standards.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: require-drop-all
22 match:
23 any:
24 - resources:
25 kinds:
26 - Pod
27 preconditions:
28 all:
29 - key: "{{ request.operation || 'BACKGROUND' }}"
30 operator: NotEquals
31 value: DELETE
32 validate:
33 message: >-
34 Containers must drop `ALL` capabilities.
35 foreach:
36 - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
37 deny:
38 conditions:
39 all:
40 - key: ALL
41 operator: AnyNotIn
42 value: "{{ element.securityContext.capabilities.drop[].to_upper(@) || `[]` }}"

Drop All Capabilities in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/require-drop-all/require-drop-all.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: drop-all-capabilities
 5 annotations:
 6 policies.kyverno.io/title: Drop All Capabilities in CEL expressions
 7 policies.kyverno.io/category: Best Practices in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kubernetes-version: "1.26-1.27"
10 policies.kyverno.io/minversion: 1.11.0
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Capabilities permit privileged actions without giving full root access. All
14 capabilities should be dropped from a Pod, with only those required added back.
15 This policy ensures that all containers explicitly specify the `drop: ["ALL"]`
16 ability. Note that this policy also illustrates how to cover drop entries in any
17 case although this may not strictly conform to the Pod Security Standards.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: require-drop-all
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 operations:
29 - CREATE
30 - UPDATE
31 validate:
32 cel:
33 variables:
34 - name: allContainers
35 expression: "object.spec.containers + object.spec.?initContainers.orValue([]) + object.spec.?ephemeralContainers.orValue([])"
36 expressions:
37 - expression: >-
38 variables.allContainers.all(container, 
39 container.?securityContext.?capabilities.?drop.orValue([]).exists(capability, capability.upperAscii() == 'ALL'))
40 message: "Containers must drop `ALL` capabilities."

Drop CAP_NET_RAW

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices/require-drop-cap-net-raw/require-drop-cap-net-raw.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: drop-cap-net-raw
 5 annotations:
 6 policies.kyverno.io/title: Drop CAP_NET_RAW
 7 policies.kyverno.io/category: Best Practices
 8 policies.kyverno.io/minversion: 1.6.0
 9 policies.kyverno.io/severity: medium
10 policies.kyverno.io/subject: Pod
11 policies.kyverno.io/description: >-
12 Capabilities permit privileged actions without giving full root access. The
13 CAP_NET_RAW capability, enabled by default, allows processes in a container to
14 forge packets and bind to any interface potentially leading to MitM attacks.
15 This policy ensures that all containers explicitly drop the CAP_NET_RAW
16 ability. Note that this policy also illustrates how to cover drop entries in any
17 case although this may not strictly conform to the Pod Security Standards.
18spec:
19 validationFailureAction: Audit
20 background: true
21 rules:
22 - name: require-drop-cap-net-raw
23 match:
24 any:
25 - resources:
26 kinds:
27 - Pod
28 preconditions:
29 all:
30 - key: "{{ request.operation || 'BACKGROUND' }}"
31 operator: NotEquals
32 value: DELETE
33 validate:
34 message: >-
35 Containers must drop the `CAP_NET_RAW` capability.
36 foreach:
37 - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
38 deny:
39 conditions:
40 all:
41 - key: CAP_NET_RAW
42 operator: AnyNotIn
43 value: "{{ element.securityContext.capabilities.drop[].to_upper(@) || `[]` }}"
44 - key: NET_RAW
45 operator: AnyNotIn
46 value: "{{ element.securityContext.capabilities.drop[].to_upper(@) || `[]` }}"

Drop CAP_NET_RAW in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/best-practices-cel/require-drop-cap-net-raw/require-drop-cap-net-raw.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: drop-cap-net-raw
 5 annotations:
 6 policies.kyverno.io/title: Drop CAP_NET_RAW in CEL expressions
 7 policies.kyverno.io/category: Best Practices in CEL 
 8 policies.kyverno.io/minversion: 1.11.0
 9 kyverno.io/kubernetes-version: "1.26-1.27"
10 policies.kyverno.io/severity: medium
11 policies.kyverno.io/subject: Pod
12 policies.kyverno.io/description: >-
13 Capabilities permit privileged actions without giving full root access. The
14 CAP_NET_RAW capability, enabled by default, allows processes in a container to
15 forge packets and bind to any interface potentially leading to MitM attacks.
16 This policy ensures that all containers explicitly drop the CAP_NET_RAW
17 ability. Note that this policy also illustrates how to cover drop entries in any
18 case although this may not strictly conform to the Pod Security Standards.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: require-drop-cap-net-raw
24 match:
25 any:
26 - resources:
27 kinds:
28 - Pod
29 operations:
30 - CREATE
31 - UPDATE
32 validate:
33 cel:
34 variables:
35 - name: mustDropCapabilities
36 expression: "['CAP_NET_RAW','NET_RAW']"
37 - name: allContainers
38 expression: "object.spec.containers + object.spec.?initContainers.orValue([]) + object.spec.?ephemeralContainers.orValue([])"
39 expressions:
40 - expression: >-
41 variables.allContainers.all(container, 
42 container.?securityContext.?capabilities.?drop.orValue([]).exists(capability, capability.upperAscii() in variables.mustDropCapabilities))
43 message: >-
44 Containers must drop the `CAP_NET_RAW` capability.

Enable Kubecost Continuous Rightsizing

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kubecost/enable-kubecost-continuous-rightsizing/enable-kubecost-continuous-rightsizing.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: enable-kubecost-continuous-rightsizing
 5 annotations:
 6 policies.kyverno.io/title: Enable Kubecost Continuous Rightsizing
 7 policies.kyverno.io/category: Kubecost
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Deployment, Annotation
10 kyverno.io/kyverno-version: 1.10.0
11 kyverno.io/kubernetes-version: "1.25"
12 policies.kyverno.io/description: >-
13 Kubecost is able to modify container resource requests and limits dynamically
14 based upon observed utilization patterns and recommendations. This provides an
15 easy way to automatically improve allocation of cluster resources by increasing
16 efficiency. This policy will annotate all Deployments which have the label
17 `env=test` with `request.autoscaling.kubecost.com/enabled="true"` if the annotation
18 is not already present. Other annotations may be added according to need and users
19 should see the documentation for a complete list.
20spec:
21 rules:
22 - name: enable-kubecost-autoscaling
23 match:
24 any:
25 - resources:
26 kinds:
27 - Deployment
28 selector:
29 matchLabels:
30 env: test
31 mutate:
32 patchStrategicMerge:
33 metadata:
34 annotations:
35 +(request.autoscaling.kubecost.com/enabled): "true"

Enforce AppProject with clusterResourceBlacklist

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/argo/appproject-clusterresourceblacklist/appproject-clusterresourceblacklist.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: appproject-clusterresourceblacklist
 5 annotations:
 6 policies.kyverno.io/title: Enforce AppProject with clusterResourceBlacklist
 7 policies.kyverno.io/category: Argo
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.6.2
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: AppProject
13 policies.kyverno.io/description: >-
14 An AppProject may optionally specify clusterResourceBlacklist which is a blacklisted
15 group of cluster resources. This is often a good practice to ensure AppProjects do
16 not allow more access than needed. This policy is a combination of two rules which
17 enforce that all AppProjects specify clusterResourceBlacklist and that their group
18 and kind have wildcards as values.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: has-wildcard
24 match:
25 any:
26 - resources:
27 kinds:
28 - AppProject
29 preconditions:
30 all:
31 - key: "{{ request.operation || 'BACKGROUND' }}"
32 operator: AnyIn
33 value: ["CREATE", "UPDATE"]
34 validate:
35 message: "Wildcards must be present in group and kind for clusterResourceBlacklist."
36 foreach:
37 - list: "request.object.spec.clusterResourceBlacklist"
38 deny:
39 conditions:
40 any:
41 - key: "{{ contains(element.group, '*') }}"
42 operator: Equals
43 value: false
44 - key: "{{ contains(element.kind, '*') }}"
45 operator: Equals
46 value: false
47 - name: validate-clusterresourceblacklist
48 match:
49 any:
50 - resources:
51 kinds:
52 - AppProject
53 preconditions:
54 all:
55 - key: "{{ request.operation || 'BACKGROUND' }}"
56 operator: AnyIn
57 value: ["CREATE", "UPDATE"]
58 validate:
59 message: "AppProject must specify clusterResourceBlacklist."
60 deny:
61 conditions:
62 any:
63 - key: clusterResourceBlacklist
64 operator: AnyNotIn
65 value: "{{ request.object.spec.keys(@) }}"

Enforce AppProject with clusterResourceBlacklist in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/argo-cel/appproject-clusterresourceblacklist/appproject-clusterresourceblacklist.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: appproject-clusterresourceblacklist
 5 annotations:
 6 policies.kyverno.io/title: Enforce AppProject with clusterResourceBlacklist in CEL expressions
 7 policies.kyverno.io/category: Argo in CEL 
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: AppProject
13 policies.kyverno.io/description: >-
14 An AppProject may optionally specify clusterResourceBlacklist which is a blacklisted
15 group of cluster resources. This is often a good practice to ensure AppProjects do
16 not allow more access than needed. This policy is a combination of two rules which
17 enforce that all AppProjects specify clusterResourceBlacklist and that their group
18 and kind have wildcards as values.
19spec:
20 validationFailureAction: Audit
21 background: true
22 rules:
23 - name: has-wildcard-and-validate-clusterresourceblacklist
24 match:
25 any:
26 - resources:
27 kinds:
28 - AppProject
29 operations:
30 - CREATE
31 - UPDATE
32 validate:
33 cel:
34 expressions:
35 - expression: "has(object.spec.clusterResourceBlacklist)"
36 message: "AppProject must specify clusterResourceBlacklist."
37 - expression: "object.spec.clusterResourceBlacklist.all(element, element.group.contains('*') && element.kind.contains('*'))"
38 message: "Wildcards must be present in group and kind for clusterResourceBlacklist."

Enforce Consul min TLS version

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/consul/enforce-min-tls-version/enforce-min-tls-version.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: enforce-min-tls-version
 5 annotations:
 6 policies.kyverno.io/title: Enforce Consul min TLS version 
 7 policies.kyverno.io/category: Consul
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Mesh
10 kyverno.io/kyverno-version: 1.8.0
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.24"
13 policies.kyverno.io/description: >-
14 This policy will check the TLS Min version to ensure that whenever the mesh is set, there is a minimum version of TLS set for all the service mesh proxies and this enforces that service mesh mTLS traffic uses TLS v1.2 or newer.
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-for-tls-version
20 match:
21 any:
22 - resources:
23 kinds:
24 - Mesh
25 validate:
26 message: The minimum version of TLS is TLS v1_2
27 pattern:
28 spec:
29 tls:
30 incoming:
31 tlsMinVersion: TLSv1_2

Enforce Consul min TLS version in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/consul-cel/enforce-min-tls-version/enforce-min-tls-version.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: enforce-min-tls-version
 5 annotations:
 6 policies.kyverno.io/title: Enforce Consul min TLS version in CEL expressions
 7 policies.kyverno.io/category: Consul in CEL 
 8 policies.kyverno.io/severity: medium
 9 policies.kyverno.io/subject: Mesh
10 kyverno.io/kyverno-version: 1.11.0
11 policies.kyverno.io/minversion: 1.11.0
12 kyverno.io/kubernetes-version: "1.26-1.27"
13 policies.kyverno.io/description: >-
14 This policy will check the TLS Min version to ensure that whenever the mesh is set, there is a minimum version of TLS set for all the service mesh proxies and this enforces that service mesh mTLS traffic uses TLS v1.2 or newer.
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-for-tls-version
20 match:
21 any:
22 - resources:
23 kinds:
24 - Mesh
25 operations:
26 - CREATE
27 - UPDATE
28 validate:
29 cel:
30 expressions:
31 - expression: >-
32 object.?spec.?tls.?incoming.?tlsMinVersion.orValue('') == 'TLSv1_2'
33 message: The minimum version of TLS is TLS v1_2

Enforce etcd encryption in OpenShift

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift/enforce-etcd-encryption/enforce-etcd-encryption.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: enforce-etcd-encryption
 5 annotations:
 6 policies.kyverno.io/title: Enforce etcd encryption in OpenShift
 7 policies.kyverno.io/category: OpenShift
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.20"
12 policies.kyverno.io/subject: APIServer
13 policies.kyverno.io/description: >-
14 Encryption at rest is a security best practice. This policy ensures encryption is enabled for etcd in OpenShift clusters.
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-etcd-encryption
20 match:
21 any:
22 - resources:
23 kinds:
24 - config.openshift.io/v1/APIServer
25 validate:
26 message: >-
27 Encryption should be enabled for etcd
28 deny: 
29 conditions:
30 all:
31 - key: "{{ keys(request.object.spec) | contains(@, 'encryption') }}"
32 operator: NotEquals
33 value: true

Enforce etcd encryption in OpenShift in CEL expressions

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/openshift-cel/enforce-etcd-encryption/enforce-etcd-encryption.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: enforce-etcd-encryption
 5 annotations:
 6 policies.kyverno.io/title: Enforce etcd encryption in OpenShift in CEL expressions
 7 policies.kyverno.io/category: OpenShift
 8 policies.kyverno.io/severity: high
 9 kyverno.io/kyverno-version: 1.11.0
10 policies.kyverno.io/minversion: 1.11.0
11 kyverno.io/kubernetes-version: "1.26-1.27"
12 policies.kyverno.io/subject: APIServer
13 policies.kyverno.io/description: >-
14 Encryption at rest is a security best practice. This policy ensures encryption is enabled for etcd in OpenShift clusters.
15spec:
16 validationFailureAction: Enforce
17 background: true
18 rules:
19 - name: check-etcd-encryption
20 match:
21 any:
22 - resources:
23 kinds:
24 - config.openshift.io/v1/APIServer
25 operations:
26 - CREATE
27 - UPDATE
28 validate:
29 cel:
30 expressions:
31 - expression: "has(object.spec.encryption)"
32 message: >-
33 Encryption should be enabled for etcd

Enforce instanceTypes

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/kubevirt/enforce-instancetype/enforce-instancetype.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: k6t-enforce-instancetype
 5 annotations:
 6 policies.kyverno.io/title: Enforce instanceTypes
 7 policies.kyverno.io/category: KubeVirt
 8 policies.kyverno.io/subject: VirtualMachine
 9 policies.kyverno.io/description: >-
10 Check VirtualMachines and validate that they are using an instance type and preference.
11 kyverno.io/kyverno-version: "1.8.0-rc2"
12 kyverno.io/kubernetes-version: "1.24-1.25"
13spec:
14 validationFailureAction: Enforce
15 rules:
16 - name: k6t-ensure-instance-type-and-preference
17 match:
18 any: 
19 - resources:
20 kinds:
21 - VirtualMachine
22 validate:
23 message: "VirtualMachines must use instance types and preferences"
24 pattern:
25 spec:
26 instancetype:
27 name: ?*
28 preference:
29 name: ?*

Enforce Istio Ambient Mode

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/istio/enforce-ambient-mode-namespace/enforce-ambient-mode-namespace.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: enforce-ambient-mode-namespace
 5 annotations:
 6 policies.kyverno.io/title: Enforce Istio Ambient Mode
 7 policies.kyverno.io/category: Istio
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.8.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 In order for Istio to include namespaces in ambient mode, the label
15 `istio.io/dataplane-mode` must be set to `ambient`. This policy ensures that all new Namespaces
16 set `istio.io/dataplane-mode` to `ambient`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: check-amblient-mode-enabled
22 match:
23 any:
24 - resources:
25 kinds:
26 - Namespace
27 validate:
28 message: "All new Namespaces must have Istio ambient mode enabled."
29 pattern:
30 metadata:
31 labels:
32 istio.io/dataplane-mode: ambient

Enforce Istio Sidecar Injection

Mon, 01 Jan 0001 00:00:00 +0000

Policy Definition

/istio/enforce-sidecar-injection-namespace/enforce-sidecar-injection-namespace.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4 name: enforce-sidecar-injection-namespace
 5 annotations:
 6 policies.kyverno.io/title: Enforce Istio Sidecar Injection
 7 policies.kyverno.io/category: Istio
 8 policies.kyverno.io/severity: medium
 9 kyverno.io/kyverno-version: 1.8.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 In order for Istio to inject sidecars to workloads deployed into Namespaces, the label
15 `istio-injection` must be set to `enabled`. This policy ensures that all new Namespaces
16 set `istio-inject` to `enabled`.
17spec:
18 validationFailureAction: Audit
19 background: true
20 rules:
21 - name: check-istio-injection-enabled
22 match:
23 any:
24 - resources:
25 kinds:
26 - Namespace
27 validate:
28 message: "All new Namespaces must have Istio sidecar injection enabled."
29 pattern:
30 metadata:
31 labels:
32 istio-injection: enabled