From 8964fda2fd55de150bab83faa9c4da86f52efb8c Mon Sep 17 00:00:00 2001 From: juvdiaz Date: Mon, 29 Jun 2026 15:05:23 -0600 Subject: [PATCH] Add Kyverno pod hardening audits --- apps/supply-chain-policy/kustomization.yaml | 1 + .../pod-hardening-audit.yaml | 164 ++++++++++++++++++ docs/jeannie.1.md | 5 + security/README.md | 4 + 4 files changed, 174 insertions(+) create mode 100644 apps/supply-chain-policy/pod-hardening-audit.yaml diff --git a/apps/supply-chain-policy/kustomization.yaml b/apps/supply-chain-policy/kustomization.yaml index b9fe210..68ecea2 100644 --- a/apps/supply-chain-policy/kustomization.yaml +++ b/apps/supply-chain-policy/kustomization.yaml @@ -3,3 +3,4 @@ kind: Kustomization resources: - kyverno-cosign-key-rbac.yaml - local-registry-image-policy.yaml + - pod-hardening-audit.yaml diff --git a/apps/supply-chain-policy/pod-hardening-audit.yaml b/apps/supply-chain-policy/pod-hardening-audit.yaml new file mode 100644 index 0000000..fd9a6e0 --- /dev/null +++ b/apps/supply-chain-policy/pod-hardening-audit.yaml @@ -0,0 +1,164 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: homelab-pod-hardening-audit + annotations: + policies.kyverno.io/title: Homelab Pod Hardening Audit + policies.kyverno.io/category: Pod Security + policies.kyverno.io/severity: medium + policies.kyverno.io/subject: Pod + policies.kyverno.io/description: >- + Audit pod settings that commonly increase compromise blast radius. These + rules intentionally start in Audit mode so enforcement can be promoted one + rule at a time after observing current workloads. +spec: + validationFailureAction: Audit + background: true + rules: + - name: disallow-privileged-containers + match: + any: + - resources: + kinds: + - Pod + exclude: + any: + - resources: + namespaces: + - kube-system + - tigera-operator + - calico-system + - metallb-system + - openebs + - kyverno + validate: + message: "Privileged containers should be avoided unless explicitly justified." + pattern: + spec: + =(ephemeralContainers): + - =(securityContext): + =(privileged): "false" + =(initContainers): + - =(securityContext): + =(privileged): "false" + containers: + - =(securityContext): + =(privileged): "false" + - name: disallow-privilege-escalation + match: + any: + - resources: + kinds: + - Pod + exclude: + any: + - resources: + namespaces: + - kube-system + - tigera-operator + - calico-system + - metallb-system + - openebs + - kyverno + validate: + message: "Containers should set allowPrivilegeEscalation=false." + pattern: + spec: + =(ephemeralContainers): + - securityContext: + allowPrivilegeEscalation: "false" + =(initContainers): + - securityContext: + allowPrivilegeEscalation: "false" + containers: + - securityContext: + allowPrivilegeEscalation: "false" + - name: disallow-hostpath-volumes + match: + any: + - resources: + kinds: + - Pod + exclude: + any: + - resources: + namespaces: + - kube-system + - tigera-operator + - calico-system + - metallb-system + - openebs + - kyverno + validate: + message: "hostPath volumes should be avoided outside platform components." + pattern: + spec: + =(volumes): + - X(hostPath): "null" + - name: require-resource-requests-and-limits + match: + any: + - resources: + kinds: + - Pod + exclude: + any: + - resources: + namespaces: + - kube-system + - tigera-operator + - calico-system + - metallb-system + - openebs + - kyverno + validate: + message: "Containers should define CPU/memory requests and memory limits." + pattern: + spec: + containers: + - resources: + requests: + cpu: "?*" + memory: "?*" + limits: + memory: "?*" +--- +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: homelab-image-tag-audit + annotations: + policies.kyverno.io/title: Homelab Image Tag Audit + policies.kyverno.io/category: Software Supply Chain Security + policies.kyverno.io/severity: medium + policies.kyverno.io/subject: Pod + policies.kyverno.io/description: >- + Audit mutable image references. Enforcement should wait until learning + workloads and third-party apps have explicit version pins or exceptions. +spec: + validationFailureAction: Audit + background: true + rules: + - name: disallow-latest-tag + match: + any: + - resources: + kinds: + - Pod + validate: + message: "Use explicit image versions instead of the mutable latest tag." + foreach: + - list: "request.object.spec.containers" + deny: + conditions: + any: + - key: "{{ element.image }}" + operator: Equals + value: "*:latest" + - list: "request.object.spec.initContainers || `[]`" + deny: + conditions: + any: + - key: "{{ element.image }}" + operator: Equals + value: "*:latest" diff --git a/docs/jeannie.1.md b/docs/jeannie.1.md index 9ad3e8b..aa0d7f2 100644 --- a/docs/jeannie.1.md +++ b/docs/jeannie.1.md @@ -167,6 +167,11 @@ user agents, auth failures, and HTTP errors. : Check the Tetragon runtime-detection DaemonSet and print the command for watching recent events. +Kyverno hardening policies +: `apps/supply-chain-policy` includes audit-mode checks for privileged pods, +privilege escalation, hostPath use, resource requests/limits, and mutable image +tags. + `apps/security-lab` : GitOps-managed internal namespace for intentionally vulnerable practice targets. Use `kubectl port-forward`; do not expose it publicly. diff --git a/security/README.md b/security/README.md index 886a0de..c748cda 100644 --- a/security/README.md +++ b/security/README.md @@ -71,3 +71,7 @@ practice. They use ClusterIP services only and should be accessed with Tetragon is installed by the platform stack as a runtime visibility tool. Use it to learn what container process execution looks like after a pod is compromised. + +Kyverno hardening policies live under `apps/supply-chain-policy`. The added pod +hardening rules start in Audit mode so you can review violations before +promoting any rule to Deny.