add Kyverno and Falco security test workloads

2026-08-14 22:08:52 -04:00
parent 2bd22db276
commit 2506b61ae0
11 changed files with 204 additions and 2 deletions
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: compliant-workload
+  namespace: security-baseline
+  labels:
+    app.kubernetes.io/name: compliant-workload
+    security-baseline/test: admission-pass
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sh", "-c", "echo compliant-workload-ready; sleep 3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: [ALL]
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          cpu: 100m
+          memory: 64Mi