kyverno policies: cosign signature verify + baseline security

apps/policies.yaml

@@ -0,0 +1,16 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: policies
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://ns31240276.ip-51-195-4.eu/devops/gitops.git
+    targetRevision: main
+    path: manifests/policies
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kyverno
+  syncPolicy:
+    automated: { prune: true, selfHeal: true }

manifests/policies/baseline-security.yaml

@@ -0,0 +1,75 @@
+# Baseline container security. Kyverno ke restricted profile ka chhota version -
+# wahi cheezein jo hamari apni images already follow karti hain.
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: baseline-security
+spec:
+  background: true
+  rules:
+    - name: no-privileged
+      match:
+        any:
+          - resources:
+              kinds: [Pod]
+              namespaces: ["demo-app", "hello-api"]
+      validate:
+        failureAction: Enforce
+        message: "privileged container allow nahi hai"
+        pattern:
+          spec:
+            =(securityContext):
+              =(privileged): "false"
+            containers:
+              - =(securityContext):
+                  =(privileged): "false"
+                  =(allowPrivilegeEscalation): "false"
+
+    - name: must-run-as-nonroot
+      match:
+        any:
+          - resources:
+              kinds: [Pod]
+              namespaces: ["demo-app", "hello-api"]
+      validate:
+        failureAction: Enforce
+        message: "container root se nahi chalna chahiye - runAsNonRoot true karo"
+        anyPattern:
+          - spec:
+              securityContext:
+                runAsNonRoot: "true"
+          - spec:
+              containers:
+                - securityContext:
+                    runAsNonRoot: "true"
+
+    - name: no-latest-tag
+      match:
+        any:
+          - resources:
+              kinds: [Pod]
+              namespaces: ["demo-app", "hello-api"]
+      validate:
+        failureAction: Enforce
+        message: "':latest' mat use karo - immutable tag chahiye warna rollback ka matlab hi nahi"
+        pattern:
+          spec:
+            containers:
+              - image: "!*:latest"
+
+    - name: require-resource-limits
+      match:
+        any:
+          - resources:
+              kinds: [Pod]
+              namespaces: ["demo-app", "hello-api"]
+      validate:
+        failureAction: Enforce
+        message: "CPU/memory limits zaroori hain - ek pod poora node nahi kha sakta"
+        pattern:
+          spec:
+            containers:
+              - resources:
+                  limits:
+                    memory: "?*"
+                    cpu: "?*"

manifests/policies/verify-image-signature.yaml

@@ -0,0 +1,43 @@
+# Cluster khud signature check karta hai. Pipeline bhi karti hai, par wo bypass
+# ho sakti hai - ye nahi. Bina cosign signature wali image pod ban hi nahi sakti.
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: verify-image-signature
+  annotations:
+    policies.kyverno.io/description: >-
+      Private registry se aane wali har image cosign se signed honi chahiye.
+spec:
+  background: false
+  webhookConfiguration:
+    failurePolicy: Fail
+  rules:
+    - name: check-cosign-signature
+      match:
+        any:
+          - resources:
+              kinds: [Pod]
+              namespaces: ["demo-app", "hello-api"]
+      verifyImages:
+        - imageReferences:
+            - "ns31240276.ip-51-195-4.eu:5000/*"
+          failureAction: Enforce
+          # digest par rewrite nahi karte - warna ArgoCD ko drift lagta hai
+          # aur selfHeal se khaamakhaan ladai hoti hai.
+          mutateDigest: false
+          verifyDigest: false
+          required: true
+          attestors:
+            - count: 1
+              entries:
+                - keys:
+                    publicKeys: |-
+                      -----BEGIN PUBLIC KEY-----
+                      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEO+rCXEKByVGTiB+2zDA4gr495oib
+                      zNMItTZ+s4xYETg4ZoTOJTCxo83uAPDrD8xesWp1ttWYUbR6xcq2g7kagw==
+                      -----END PUBLIC KEY-----
+                    # tlog upload band hai (private registry), verify bhi offline
+                    ctlog:
+                      ignoreSCT: true
+                    rekor:
+                      ignoreTlog: true