From d8bbf122f9ddee2f9efb8a92fb793987648611cf Mon Sep 17 00:00:00 2001 From: rock Date: Wed, 4 Nov 2026 05:29:48 +0800 Subject: [PATCH] chore(kyverno): remove the never-deployed policy engine Both ArgoCD Applications reported broken: 'kyverno' Unknown and 'kyverno-policies' OutOfSync/Missing. Neither the namespace nor a single kyverno pod ever existed, so no policy was enforced and nothing is lost. Kyverno is future work. Removing the two Applications and the bootstrap directory keeps the root app from reporting two permanent failures. --- k8s/bootstrap/kyverno/kustomization.yaml | 6 - k8s/bootstrap/kyverno/kyverno-values.yaml | 42 ----- k8s/bootstrap/kyverno/policies.yaml | 204 ---------------------- 3 files changed, 252 deletions(-) delete mode 100644 k8s/bootstrap/kyverno/kustomization.yaml delete mode 100644 k8s/bootstrap/kyverno/kyverno-values.yaml delete mode 100644 k8s/bootstrap/kyverno/policies.yaml diff --git a/k8s/bootstrap/kyverno/kustomization.yaml b/k8s/bootstrap/kyverno/kustomization.yaml deleted file mode 100644 index 9fd36ff..0000000 --- a/k8s/bootstrap/kyverno/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: kyverno - -resources: - - policies.yaml diff --git a/k8s/bootstrap/kyverno/kyverno-values.yaml b/k8s/bootstrap/kyverno/kyverno-values.yaml deleted file mode 100644 index ac402d3..0000000 --- a/k8s/bootstrap/kyverno/kyverno-values.yaml +++ /dev/null @@ -1,42 +0,0 @@ -# Kyverno: Policy engine for Kubernetes image scanning, Pod security, and admission control -# Scan all images, enforce baseline Pod Security Standard, prevent privilege escalation - -replicaCount: 1 - -image: - registry: ghcr.io - repository: kyverno/kyverno - tag: "v1.14.0" - -config: - # Webhook timeout for policy evaluation. Increase if scanning takes longer. - webhookTimeoutSeconds: 30 - # Failure policy: fail-open (audit/log) vs fail-closed (reject on error) - failurePolicy: fail - # Resource limits for webhook - webhookAnnotations: - rules: "allow" - -# Pod security via Kyverno instead of Pod Security Policies (deprecated) -# Enforces baseline restrictions cluster-wide, with exceptions for privileged namespaces -podSecurityContext: - runAsNonRoot: true - runAsUser: 1000 - -rbac: - create: true - -resources: - requests: - memory: "256Mi" - cpu: "100m" - limits: - memory: "512Mi" - cpu: "500m" - -# Webhook configuration -webhook: - timeoutSeconds: 30 - # Failure policy: "Fail" (reject on error) or "Ignore" (audit-only) - # Set to "Ignore" for initial testing, then change to "Fail" - failurePolicy: ignore diff --git a/k8s/bootstrap/kyverno/policies.yaml b/k8s/bootstrap/kyverno/policies.yaml deleted file mode 100644 index 215d6b4..0000000 --- a/k8s/bootstrap/kyverno/policies.yaml +++ /dev/null @@ -1,204 +0,0 @@ -# Kyverno ClusterPolicies: Image scanning, Pod security, and admission control ---- -# Policy 1: Require non-root containers -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: require-non-root - namespace: kyverno -spec: - validationFailureAction: audit # audit first, then change to enforce - rules: - - name: check-runAsNonRoot - match: - any: - - resources: - kinds: - - Pod - selector: - matchLabels: - pod-security.kubernetes.io/enforce: "!privileged" - validate: - message: "Container must not run as root" - pattern: - spec: - containers: - - securityContext: - runAsNonRoot: true ---- -# Policy 2: Drop all Linux capabilities, add only required ones -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: require-dropped-caps - namespace: kyverno -spec: - validationFailureAction: audit - rules: - - name: drop-all-capabilities - match: - any: - - resources: - kinds: - - Pod - selector: - matchLabels: - pod-security.kubernetes.io/enforce: "!privileged" - validate: - message: "All Linux capabilities must be dropped" - pattern: - spec: - containers: - - securityContext: - capabilities: - drop: - - ALL ---- -# Policy 3: Require image tags (no 'latest') -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: disallow-latest-tag - namespace: kyverno -spec: - validationFailureAction: audit # Change to enforce after testing - rules: - - name: disallow-latest - match: - any: - - resources: - kinds: - - Pod - - Deployment - - StatefulSet - - DaemonSet - - Job - validate: - message: "Image tag 'latest' is not allowed. Use explicit version tags." - pattern: - spec: - =(template): - spec: - containers: - - image: "!*:latest" - =(initContainers): - - image: "!*:latest" ---- -# Policy 4: Restrict images to trusted registries -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: restrict-registries - namespace: kyverno -spec: - validationFailureAction: audit - rules: - - name: trusted-registries - match: - any: - - resources: - kinds: - - Pod - - Deployment - - StatefulSet - - DaemonSet - - Job - selector: - matchLabels: - pod-security.kubernetes.io/enforce: "!privileged" - validate: - message: "Images must come from trusted registries: docker.io, ghcr.io, quay.io, k8s.gcr.io, registry.k8s.io, or internal forgejo registry" - pattern: - spec: - =(template): - spec: - containers: - - image: "docker.io/* | ghcr.io/* | quay.io/* | k8s.gcr.io/* | registry.k8s.io/* | forgejo.riotpiao.com/* | *" ---- -# Policy 5: Require read-only root filesystem (audit only, exceptions for apps that need writes) -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: require-readonly-filesystem - namespace: kyverno -spec: - validationFailureAction: audit - rules: - - name: check-readOnlyRootFilesystem - match: - any: - - resources: - kinds: - - Pod - selector: - matchLabels: - pod-security.kubernetes.io/enforce: "!privileged" - validate: - message: "Root filesystem should be read-only for defense-in-depth" - pattern: - spec: - containers: - - securityContext: - readOnlyRootFilesystem: true ---- -# Policy 6: Require resource requests and limits (prevent resource starvation) -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: require-resource-limits - namespace: kyverno -spec: - validationFailureAction: audit - rules: - - name: check-resources - match: - any: - - resources: - kinds: - - Pod - - Deployment - - StatefulSet - - DaemonSet - excludeResources: - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: "kyverno|kube-system|kube-node-lease" - validate: - message: "CPU and memory requests and limits are required" - pattern: - spec: - =(template): - spec: - containers: - - resources: - requests: - memory: "?*" - cpu: "?*" - limits: - memory: "?*" - cpu: "?*" ---- -# Policy 7: Require securityContext on all containers -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: require-security-context - namespace: kyverno -spec: - validationFailureAction: audit - rules: - - name: check-securityContext - match: - any: - - resources: - kinds: - - Pod - selector: - matchLabels: - pod-security.kubernetes.io/enforce: "!privileged" - validate: - message: "securityContext must be defined" - pattern: - spec: - containers: - - securityContext: {}