rock
2038253d48
- Install Kyverno policy engine for admission control - Add ClusterPolicies: * Disallow 'latest' tags (require explicit versions) * Restrict to trusted registries (docker.io, ghcr.io, quay.io, etc.) * Require non-root containers * Drop all Linux capabilities by default * Require securityContext on all containers * Require read-only root filesystem (audit only) * Require resource requests/limits (prevent starvation) - All policies in audit mode initially (failurePolicy: ignore) - Ready to graduate to enforce after testing - Fixes: missing image scanning from security audit
43 lines
1.1 KiB
YAML
43 lines
1.1 KiB
YAML
# Kyverno: Policy engine for Kubernetes image scanning, Pod security, and admission control
|
|
# Scan all images, enforce baseline Pod Security Standard, prevent privilege escalation
|
|
|
|
replicaCount: 1
|
|
|
|
image:
|
|
registry: ghcr.io
|
|
repository: kyverno/kyverno
|
|
tag: "v1.14.0"
|
|
|
|
config:
|
|
# Webhook timeout for policy evaluation. Increase if scanning takes longer.
|
|
webhookTimeoutSeconds: 30
|
|
# Failure policy: fail-open (audit/log) vs fail-closed (reject on error)
|
|
failurePolicy: fail
|
|
# Resource limits for webhook
|
|
webhookAnnotations:
|
|
rules: "allow"
|
|
|
|
# Pod security via Kyverno instead of Pod Security Policies (deprecated)
|
|
# Enforces baseline restrictions cluster-wide, with exceptions for privileged namespaces
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
|
|
rbac:
|
|
create: true
|
|
|
|
resources:
|
|
requests:
|
|
memory: "256Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
|
|
# Webhook configuration
|
|
webhook:
|
|
timeoutSeconds: 30
|
|
# Failure policy: "Fail" (reject on error) or "Ignore" (audit-only)
|
|
# Set to "Ignore" for initial testing, then change to "Fail"
|
|
failurePolicy: ignore
|