165 lines
4.8 KiB
YAML
165 lines
4.8 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: homelab-pod-hardening-audit
|
|
annotations:
|
|
policies.kyverno.io/title: Homelab Pod Hardening Audit
|
|
policies.kyverno.io/category: Pod Security
|
|
policies.kyverno.io/severity: medium
|
|
policies.kyverno.io/subject: Pod
|
|
policies.kyverno.io/description: >-
|
|
Audit pod settings that commonly increase compromise blast radius. These
|
|
rules intentionally start in Audit mode so enforcement can be promoted one
|
|
rule at a time after observing current workloads.
|
|
spec:
|
|
validationFailureAction: Audit
|
|
background: true
|
|
rules:
|
|
- name: disallow-privileged-containers
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
namespaces:
|
|
- kube-system
|
|
- tigera-operator
|
|
- calico-system
|
|
- metallb-system
|
|
- openebs
|
|
- kyverno
|
|
validate:
|
|
message: "Privileged containers should be avoided unless explicitly justified."
|
|
pattern:
|
|
spec:
|
|
=(ephemeralContainers):
|
|
- =(securityContext):
|
|
=(privileged): "false"
|
|
=(initContainers):
|
|
- =(securityContext):
|
|
=(privileged): "false"
|
|
containers:
|
|
- =(securityContext):
|
|
=(privileged): "false"
|
|
- name: disallow-privilege-escalation
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
namespaces:
|
|
- kube-system
|
|
- tigera-operator
|
|
- calico-system
|
|
- metallb-system
|
|
- openebs
|
|
- kyverno
|
|
validate:
|
|
message: "Containers should set allowPrivilegeEscalation=false."
|
|
pattern:
|
|
spec:
|
|
=(ephemeralContainers):
|
|
- securityContext:
|
|
allowPrivilegeEscalation: "false"
|
|
=(initContainers):
|
|
- securityContext:
|
|
allowPrivilegeEscalation: "false"
|
|
containers:
|
|
- securityContext:
|
|
allowPrivilegeEscalation: "false"
|
|
- name: disallow-hostpath-volumes
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
namespaces:
|
|
- kube-system
|
|
- tigera-operator
|
|
- calico-system
|
|
- metallb-system
|
|
- openebs
|
|
- kyverno
|
|
validate:
|
|
message: "hostPath volumes should be avoided outside platform components."
|
|
pattern:
|
|
spec:
|
|
=(volumes):
|
|
- X(hostPath): "null"
|
|
- name: require-resource-requests-and-limits
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
namespaces:
|
|
- kube-system
|
|
- tigera-operator
|
|
- calico-system
|
|
- metallb-system
|
|
- openebs
|
|
- kyverno
|
|
validate:
|
|
message: "Containers should define CPU/memory requests and memory limits."
|
|
pattern:
|
|
spec:
|
|
containers:
|
|
- resources:
|
|
requests:
|
|
cpu: "?*"
|
|
memory: "?*"
|
|
limits:
|
|
memory: "?*"
|
|
---
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: homelab-image-tag-audit
|
|
annotations:
|
|
policies.kyverno.io/title: Homelab Image Tag Audit
|
|
policies.kyverno.io/category: Software Supply Chain Security
|
|
policies.kyverno.io/severity: medium
|
|
policies.kyverno.io/subject: Pod
|
|
policies.kyverno.io/description: >-
|
|
Audit mutable image references. Enforcement should wait until learning
|
|
workloads and third-party apps have explicit version pins or exceptions.
|
|
spec:
|
|
validationFailureAction: Audit
|
|
background: true
|
|
rules:
|
|
- name: disallow-latest-tag
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
validate:
|
|
message: "Use explicit image versions instead of the mutable latest tag."
|
|
foreach:
|
|
- list: "request.object.spec.containers"
|
|
deny:
|
|
conditions:
|
|
any:
|
|
- key: "{{ element.image }}"
|
|
operator: Equals
|
|
value: "*:latest"
|
|
- list: "request.object.spec.initContainers || `[]`"
|
|
deny:
|
|
conditions:
|
|
any:
|
|
- key: "{{ element.image }}"
|
|
operator: Equals
|
|
value: "*:latest"
|