76 lines
2.1 KiB
YAML
76 lines
2.1 KiB
YAML
# Baseline container security. Kyverno ke restricted profile ka chhota version -
|
|
# wahi cheezein jo hamari apni images already follow karti hain.
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: baseline-security
|
|
spec:
|
|
background: true
|
|
rules:
|
|
- name: no-privileged
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds: [Pod]
|
|
namespaces: ["demo-app", "hello-api"]
|
|
validate:
|
|
failureAction: Enforce
|
|
message: "privileged container allow nahi hai"
|
|
pattern:
|
|
spec:
|
|
=(securityContext):
|
|
=(privileged): "false"
|
|
containers:
|
|
- =(securityContext):
|
|
=(privileged): "false"
|
|
=(allowPrivilegeEscalation): "false"
|
|
|
|
- name: must-run-as-nonroot
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds: [Pod]
|
|
namespaces: ["demo-app", "hello-api"]
|
|
validate:
|
|
failureAction: Enforce
|
|
message: "container root se nahi chalna chahiye - runAsNonRoot true karo"
|
|
anyPattern:
|
|
- spec:
|
|
securityContext:
|
|
runAsNonRoot: "true"
|
|
- spec:
|
|
containers:
|
|
- securityContext:
|
|
runAsNonRoot: "true"
|
|
|
|
- name: no-latest-tag
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds: [Pod]
|
|
namespaces: ["demo-app", "hello-api"]
|
|
validate:
|
|
failureAction: Enforce
|
|
message: "':latest' mat use karo - immutable tag chahiye warna rollback ka matlab hi nahi"
|
|
pattern:
|
|
spec:
|
|
containers:
|
|
- image: "!*:latest"
|
|
|
|
- name: require-resource-limits
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds: [Pod]
|
|
namespaces: ["demo-app", "hello-api"]
|
|
validate:
|
|
failureAction: Enforce
|
|
message: "CPU/memory limits zaroori hain - ek pod poora node nahi kha sakta"
|
|
pattern:
|
|
spec:
|
|
containers:
|
|
- resources:
|
|
limits:
|
|
memory: "?*"
|
|
cpu: "?*"
|