block application resources in default namespace

2026-08-10 18:01:00 -04:00
parent 1c1e9dc394
commit e389331a07
4 changed files with 50 additions and 7 deletions
@@ -0,0 +1,41 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-default-namespace
+  annotations:
+    policies.kyverno.io/title: Disallow application workloads in default
+    policies.kyverno.io/category: Namespace hygiene
+    policies.kyverno.io/severity: medium
+    # Supplemental namespace-isolation control. This is not a one-to-one CIS control.
+    policies.kyverno.io/cis-control: "supplemental"
+spec:
+  validationFailureAction: Enforce
+  background: false
+  failurePolicy: Fail
+  rules:
+    - name: application-resources-not-in-default
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+                - Deployment
+                - StatefulSet
+                - DaemonSet
+                - Job
+                - CronJob
+                - ReplicaSet
+                - ReplicationController
+                - Service
+                - Ingress
+              namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: default
+      validate:
+        message: Application resources must be deployed into an explicitly named namespace.
+        deny:
+          conditions:
+            any:
+              - key: "{{ request.namespace }}"
+                operator: Equals
+                value: default
@@ -7,3 +7,4 @@ resources:
  - require-resource-limits.yaml
  - restrict-image-registries.yaml
  - disallow-host-network.yaml
+  - disallow-default-namespace.yaml