feat(security): add Kyverno for image scanning and Pod security policies

- Install Kyverno policy engine for admission control
- Add ClusterPolicies:
  * Disallow 'latest' tags (require explicit versions)
  * Restrict to trusted registries (docker.io, ghcr.io, quay.io, etc.)
  * Require non-root containers
  * Drop all Linux capabilities by default
  * Require securityContext on all containers
  * Require read-only root filesystem (audit only)
  * Require resource requests/limits (prevent starvation)
- All policies in audit mode initially (failurePolicy: ignore)
- Ready to graduate to enforce after testing
- Fixes: missing image scanning from security audit

This commit is contained in:

rock

2026-08-31 11:43:04 -07:00

parent c4a302c3d1

commit 2038253d48

4 changed files with 303 additions and 0 deletions

									
										k8s/bootstrap/kyverno/kustomization.yaml
									
		+6
		
												View File
												
				@@ -0,0 +1,6 @@

				apiVersion: kustomize.config.k8s.io/v1beta1

				kind: Kustomization

				namespace: kyverno

				resources:

				  - policies.yaml