swaphb/kubernetes-security-baseline-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

block application resources in default namespace
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Failing after 3m11s
Details

Browse Source
This commit is contained in:
swaphb
2026-08-10 18:01:00 -04:00
parent 1c1e9dc394
commit e389331a07
4 changed files with 50 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policies/README.md
+7 -6
View File
@@ -1,11 +1,12 @@
# Kyverno policy baseline
These policies are `ClusterPolicy` resources, but they intentionally select
only namespaces labeled `security-baseline/open: "true"`. That keeps the
portfolio demo enforceable without blocking Kyverno, Falco, ArgoCD, or other
platform components. Expand the label scope deliberately for a real cluster.
These policies are `ClusterPolicy` resources. The workload hardening policies
select only namespaces labeled `security-baseline/open: "true"`. The separate
`disallow-default-namespace` policy specifically protects the Kubernetes
`default` namespace. This keeps the portfolio demo enforceable without
blocking Kyverno, Falco, ArgoCD, or other platform components.
All five policies use `validationFailureAction: Enforce`, so a matching Pod is
All six policies use `validationFailureAction: Enforce`, so a matching resource is
rejected at admission time. The policies use `background: false` because the
goal is to demonstrate admission enforcement, not retroactively evaluate
existing objects.
@@ -16,9 +17,9 @@ existing objects.
| `require-non-root` | 5.2.7 | Requires `runAsNonRoot: true` on containers and init containers. |
| `require-resource-limits` | 5.7.3 supplemental | Requires CPU and memory limits. This is a supplemental control, not a one-to-one CIS test. |
| `restrict-image-registries` | 5.5.1 supplemental | Allows only approved registries. Full image provenance requires signing and verification as well. |
| `disallow-default-namespace` | Supplemental | Blocks common application resources from being created in `default`, which makes namespace ownership explicit. |
| `disallow-host-network` | 5.2.3 and 5.2.5 | Rejects host PID, host network, and host IPC access. |
The CIS benchmark includes manual checks and platform-specific exceptions.
The mapping above describes the control objective each policy supports, not a
claim that one Kyverno rule implements the entire benchmark control.