 rock
|
2038253d48
|
feat(security): add Kyverno for image scanning and Pod security policies
- Install Kyverno policy engine for admission control
- Add ClusterPolicies:
* Disallow 'latest' tags (require explicit versions)
* Restrict to trusted registries (docker.io, ghcr.io, quay.io, etc.)
* Require non-root containers
* Drop all Linux capabilities by default
* Require securityContext on all containers
* Require read-only root filesystem (audit only)
* Require resource requests/limits (prevent starvation)
- All policies in audit mode initially (failurePolicy: ignore)
- Ready to graduate to enforce after testing
- Fixes: missing image scanning from security audit
|
2026-08-31 11:43:04 -07:00 |
|