add Kyverno and Falco security test workloads

test-workloads/README.md

@@ -0,0 +1,32 @@
+# Security test workloads
+
+The two manifests in the Kustomization are intentionally allowed through
+Kyverno. ArgoCD manages them so the baseline always has one admission-pass
+workload and one runtime-alert workload.
+
+The manifests under `blocked/` are negative tests. They are intentionally not
+included in the Kustomization because ArgoCD would continuously report them as
+failed syncs. Apply them manually and expect admission rejection:
+
+```bash
+kubectl apply --server-side --dry-run=server -f test-workloads/blocked/privileged-pod.yaml
+kubectl apply --server-side --dry-run=server -f test-workloads/blocked/root-container.yaml
+kubectl apply --server-side --dry-run=server -f test-workloads/blocked/host-network-pod.yaml
+kubectl apply --server-side --dry-run=server -f test-workloads/blocked/unapproved-registry-pod.yaml
+kubectl apply --server-side --dry-run=server -f test-workloads/blocked/default-namespace-pod.yaml
+```
+
+Expected policy coverage:
+
+| Manifest | Expected result | Policy or detector |
+| --- | --- | --- |
+| `blocked/privileged-pod.yaml` | Rejected | `disallow-privileged`, CIS 5.2.2 |
+| `blocked/root-container.yaml` | Rejected | `require-non-root`, CIS 5.2.7 |
+| `blocked/host-network-pod.yaml` | Rejected | `disallow-host-network`, CIS 5.2.3 and 5.2.5 |
+| `blocked/unapproved-registry-pod.yaml` | Rejected | `restrict-image-registries`, supplemental supply-chain control |
+| `blocked/default-namespace-pod.yaml` | Rejected | `disallow-default-namespace`, supplemental namespace control |
+| `compliant-workload.yaml` | Accepted | Admission baseline |
+| `suspicious-shell.yaml` | Accepted, then alerted | Falco shell detection |
+
+The suspicious workload is intentionally compliant at admission. Its shell
+process is the runtime event that Falco should report.

test-workloads/blocked/default-namespace-pod.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-default-namespace
+  namespace: default
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/host-network-pod.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-host-network
+  namespace: security-baseline
+spec:
+  hostNetwork: true
+  hostPID: true
+  hostIPC: true
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/privileged-pod.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-privileged
+  namespace: security-baseline
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        privileged: true
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/root-container.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-root
+  namespace: security-baseline
+spec:
+  restartPolicy: Never
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: false
+        runAsUser: 0
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/unapproved-registry-pod.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-unapproved-registry
+  namespace: security-baseline
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: registry.example.com/security-test:1.0
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/compliant-workload.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: compliant-workload
+  namespace: security-baseline
+  labels:
+    app.kubernetes.io/name: compliant-workload
+    security-baseline/test: admission-pass
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sh", "-c", "echo compliant-workload-ready; sleep 3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: [ALL]
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - phase-2-placeholder.yaml
-
+  - compliant-workload.yaml
+  - suspicious-shell.yaml

test-workloads/suspicious-shell.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: suspicious-shell
+  namespace: security-baseline
+  labels:
+    app.kubernetes.io/name: suspicious-shell
+    security-baseline/test: runtime-alert
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: shell-test
+      image: docker.io/library/busybox:1.36
+      command: ["sh", "-c", "echo suspicious-shell-started; sleep 3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: [ALL]
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          cpu: 100m
+          memory: 64Mi