homelab/k8s/bootstrap/kyverno/kustomization.yaml at 2038253d4881e88113e66c293ab01d716df486d1 - homelab - Gitea: Git with a cup of tea

rock/homelab

Files

T

rock 2038253d48 feat(security): add Kyverno for image scanning and Pod security policies

- Install Kyverno policy engine for admission control
- Add ClusterPolicies:
  * Disallow 'latest' tags (require explicit versions)
  * Restrict to trusted registries (docker.io, ghcr.io, quay.io, etc.)
  * Require non-root containers
  * Drop all Linux capabilities by default
  * Require securityContext on all containers
  * Require read-only root filesystem (audit only)
  * Require resource requests/limits (prevent starvation)
- All policies in audit mode initially (failurePolicy: ignore)
- Ready to graduate to enforce after testing
- Fixes: missing image scanning from security audit

2026-08-31 11:43:04 -07:00

7 lines

113 B

YAML

Raw Blame History

 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kyverno
 resources:
   - policies.yaml