# Baseline container security. Kyverno ke restricted profile ka chhota version -
# wahi cheezein jo hamari apni images already follow karti hain.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: baseline-security
spec:
  background: true
  rules:
    - name: no-privileged
      match:
        any:
          - resources:
              kinds: [Pod]
              namespaces: ["demo-app", "hello-api"]
      validate:
        failureAction: Enforce
        message: "privileged container allow nahi hai"
        pattern:
          spec:
            =(securityContext):
              =(privileged): "false"
            containers:
              - =(securityContext):
                  =(privileged): "false"
                  =(allowPrivilegeEscalation): "false"

    - name: must-run-as-nonroot
      match:
        any:
          - resources:
              kinds: [Pod]
              namespaces: ["demo-app", "hello-api"]
      validate:
        failureAction: Enforce
        message: "container root se nahi chalna chahiye - runAsNonRoot true karo"
        anyPattern:
          - spec:
              securityContext:
                runAsNonRoot: "true"
          - spec:
              containers:
                - securityContext:
                    runAsNonRoot: "true"

    - name: no-latest-tag
      match:
        any:
          - resources:
              kinds: [Pod]
              namespaces: ["demo-app", "hello-api"]
      validate:
        failureAction: Enforce
        message: "':latest' mat use karo - immutable tag chahiye warna rollback ka matlab hi nahi"
        pattern:
          spec:
            containers:
              - image: "!*:latest"

    - name: require-resource-limits
      match:
        any:
          - resources:
              kinds: [Pod]
              namespaces: ["demo-app", "hello-api"]
      validate:
        failureAction: Enforce
        message: "CPU/memory limits zaroori hain - ek pod poora node nahi kha sakta"
        pattern:
          spec:
            containers:
              - resources:
                  limits:
                    memory: "?*"
                    cpu: "?*"