Add Kyverno pod hardening audits

apps/supply-chain-policy/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - kyverno-cosign-key-rbac.yaml
   - local-registry-image-policy.yaml
+  - pod-hardening-audit.yaml

apps/supply-chain-policy/pod-hardening-audit.yaml

@@ -0,0 +1,164 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: homelab-pod-hardening-audit
+  annotations:
+    policies.kyverno.io/title: Homelab Pod Hardening Audit
+    policies.kyverno.io/category: Pod Security
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Audit pod settings that commonly increase compromise blast radius. These
+      rules intentionally start in Audit mode so enforcement can be promoted one
+      rule at a time after observing current workloads.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: disallow-privileged-containers
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-system
+                - tigera-operator
+                - calico-system
+                - metallb-system
+                - openebs
+                - kyverno
+      validate:
+        message: "Privileged containers should be avoided unless explicitly justified."
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(securityContext):
+                  =(privileged): "false"
+            =(initContainers):
+              - =(securityContext):
+                  =(privileged): "false"
+            containers:
+              - =(securityContext):
+                  =(privileged): "false"
+    - name: disallow-privilege-escalation
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-system
+                - tigera-operator
+                - calico-system
+                - metallb-system
+                - openebs
+                - kyverno
+      validate:
+        message: "Containers should set allowPrivilegeEscalation=false."
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - securityContext:
+                  allowPrivilegeEscalation: "false"
+            =(initContainers):
+              - securityContext:
+                  allowPrivilegeEscalation: "false"
+            containers:
+              - securityContext:
+                  allowPrivilegeEscalation: "false"
+    - name: disallow-hostpath-volumes
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-system
+                - tigera-operator
+                - calico-system
+                - metallb-system
+                - openebs
+                - kyverno
+      validate:
+        message: "hostPath volumes should be avoided outside platform components."
+        pattern:
+          spec:
+            =(volumes):
+              - X(hostPath): "null"
+    - name: require-resource-requests-and-limits
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-system
+                - tigera-operator
+                - calico-system
+                - metallb-system
+                - openebs
+                - kyverno
+      validate:
+        message: "Containers should define CPU/memory requests and memory limits."
+        pattern:
+          spec:
+            containers:
+              - resources:
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
+                  limits:
+                    memory: "?*"
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: homelab-image-tag-audit
+  annotations:
+    policies.kyverno.io/title: Homelab Image Tag Audit
+    policies.kyverno.io/category: Software Supply Chain Security
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Audit mutable image references. Enforcement should wait until learning
+      workloads and third-party apps have explicit version pins or exceptions.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: disallow-latest-tag
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      validate:
+        message: "Use explicit image versions instead of the mutable latest tag."
+        foreach:
+          - list: "request.object.spec.containers"
+            deny:
+              conditions:
+                any:
+                  - key: "{{ element.image }}"
+                    operator: Equals
+                    value: "*:latest"
+          - list: "request.object.spec.initContainers || `[]`"
+            deny:
+              conditions:
+                any:
+                  - key: "{{ element.image }}"
+                    operator: Equals
+                    value: "*:latest"

docs/jeannie.1.md

@@ -167,6 +167,11 @@ user agents, auth failures, and HTTP errors.
 : Check the Tetragon runtime-detection DaemonSet and print the command for
 watching recent events.
 
+Kyverno hardening policies
+: `apps/supply-chain-policy` includes audit-mode checks for privileged pods,
+privilege escalation, hostPath use, resource requests/limits, and mutable image
+tags.
+
 `apps/security-lab`
 : GitOps-managed internal namespace for intentionally vulnerable practice
 targets. Use `kubectl port-forward`; do not expose it publicly.

security/README.md

@@ -71,3 +71,7 @@ practice. They use ClusterIP services only and should be accessed with
 
 Tetragon is installed by the platform stack as a runtime visibility tool. Use it
 to learn what container process execution looks like after a pod is compromised.
+
+Kyverno hardening policies live under `apps/supply-chain-policy`. The added pod
+hardening rules start in Audit mode so you can review violations before
+promoting any rule to Deny.