Add Kyverno admission policies and CIS mappings

2026-08-10 17:34:45 -04:00
parent fc786ec63c
commit ff033f2fcb
10 changed files with 253 additions and 12 deletions
@@ -0,0 +1,49 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-resource-limits
+  annotations:
+    policies.kyverno.io/title: Require CPU and memory limits
+    policies.kyverno.io/category: Resource governance
+    policies.kyverno.io/severity: medium
+    # Supplemental hardening aligned with CIS 5.7.3 workload controls. The
+    # CIS benchmark does not define a one-to-one resource-limit test.
+    policies.kyverno.io/cis-control: "5.7.3 supplemental"
+spec:
+  validationFailureAction: Enforce
+  background: false
+  failurePolicy: Fail
+  rules:
+    - name: containers-have-resource-limits
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              namespaceSelector:
+                matchLabels:
+                  security-baseline/open: "true"
+      validate:
+        message: Every container must define CPU and memory limits.
+        foreach:
+          - list: request.object.spec.containers[]
+            deny:
+              conditions:
+                any:
+                  - key: "{{ element.resources.limits.cpu || '' }}"
+                    operator: Equals
+                    value: ""
+                  - key: "{{ element.resources.limits.memory || '' }}"
+                    operator: Equals
+                    value: ""
+          - list: request.object.spec.initContainers[]
+            deny:
+              conditions:
+                any:
+                  - key: "{{ element.resources.limits.cpu || '' }}"
+                    operator: Equals
+                    value: ""
+                  - key: "{{ element.resources.limits.memory || '' }}"
+                    operator: Equals
+                    value: ""
+