Add Kyverno admission policies and CIS mappings

2026-08-10 17:34:45 -04:00
parent fc786ec63c
commit ff033f2fcb
10 changed files with 253 additions and 12 deletions
@@ -0,0 +1,24 @@
+# Kyverno policy baseline
+
+These policies are `ClusterPolicy` resources, but they intentionally select
+only namespaces labeled `security-baseline/open: "true"`. That keeps the
+portfolio demo enforceable without blocking Kyverno, Falco, ArgoCD, or other
+platform components. Expand the label scope deliberately for a real cluster.
+
+All five policies use `validationFailureAction: Enforce`, so a matching Pod is
+rejected at admission time. The policies use `background: false` because the
+goal is to demonstrate admission enforcement, not retroactively evaluate
+existing objects.
+
+| Policy | CIS alignment | Enforcement |
+| --- | --- | --- |
+| `disallow-privileged` | 5.2.2 | Rejects privileged containers and init containers. |
+| `require-non-root` | 5.2.7 | Requires `runAsNonRoot: true` on containers and init containers. |
+| `require-resource-limits` | 5.7.3 supplemental | Requires CPU and memory limits. This is a supplemental control, not a one-to-one CIS test. |
+| `restrict-image-registries` | 5.5.1 supplemental | Allows only approved registries. Full image provenance requires signing and verification as well. |
+| `disallow-host-network` | 5.2.3 and 5.2.5 | Rejects host PID, host network, and host IPC access. |
+
+The CIS benchmark includes manual checks and platform-specific exceptions.
+The mapping above describes the control objective each policy supports, not a
+claim that one Kyverno rule implements the entire benchmark control.
+