apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: homelab-pod-hardening-audit
  annotations:
    policies.kyverno.io/title: Homelab Pod Hardening Audit
    policies.kyverno.io/category: Pod Security
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Audit pod settings that commonly increase compromise blast radius. These
      rules intentionally start in Audit mode so enforcement can be promoted one
      rule at a time after observing current workloads.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: disallow-privileged-containers
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - tigera-operator
                - calico-system
                - metallb-system
                - openebs
                - kyverno
      validate:
        message: "Privileged containers should be avoided unless explicitly justified."
        pattern:
          spec:
            =(ephemeralContainers):
              - =(securityContext):
                  =(privileged): "false"
            =(initContainers):
              - =(securityContext):
                  =(privileged): "false"
            containers:
              - =(securityContext):
                  =(privileged): "false"
    - name: disallow-privilege-escalation
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - tigera-operator
                - calico-system
                - metallb-system
                - openebs
                - kyverno
      validate:
        message: "Containers should set allowPrivilegeEscalation=false."
        pattern:
          spec:
            =(ephemeralContainers):
              - securityContext:
                  allowPrivilegeEscalation: "false"
            =(initContainers):
              - securityContext:
                  allowPrivilegeEscalation: "false"
            containers:
              - securityContext:
                  allowPrivilegeEscalation: "false"
    - name: disallow-hostpath-volumes
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - tigera-operator
                - calico-system
                - metallb-system
                - openebs
                - kyverno
      validate:
        message: "hostPath volumes should be avoided outside platform components."
        pattern:
          spec:
            =(volumes):
              - X(hostPath): "null"
    - name: require-resource-requests-and-limits
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - tigera-operator
                - calico-system
                - metallb-system
                - openebs
                - kyverno
      validate:
        message: "Containers should define CPU/memory requests and memory limits."
        pattern:
          spec:
            containers:
              - resources:
                  requests:
                    cpu: "?*"
                    memory: "?*"
                  limits:
                    memory: "?*"
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: homelab-image-tag-audit
  annotations:
    policies.kyverno.io/title: Homelab Image Tag Audit
    policies.kyverno.io/category: Software Supply Chain Security
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Audit mutable image references. Enforcement should wait until learning
      workloads and third-party apps have explicit version pins or exceptions.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: disallow-latest-tag
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Use explicit image versions instead of the mutable latest tag."
        foreach:
          - list: "request.object.spec.containers"
            deny:
              conditions:
                any:
                  - key: "{{ element.image }}"
                    operator: Equals
                    value: "*:latest"
          - list: "request.object.spec.initContainers || `[]`"
            deny:
              conditions:
                any:
                  - key: "{{ element.image }}"
                    operator: Equals
                    value: "*:latest"