kubernetes-security-baseline-lab/policies/README.md

Kyverno policy baseline

These policies are ClusterPolicy resources. The workload hardening policies select only namespaces labeled security-baseline/open: "true". The separate disallow-default-namespace policy specifically protects the Kubernetes default namespace. This keeps the portfolio demo enforceable without blocking Kyverno, Falco, ArgoCD, or other platform components.

All six policies use validationFailureAction: Enforce, so a matching resource is rejected at admission time. The policies use background: false because the goal is to demonstrate admission enforcement, not retroactively evaluate existing objects.

Policy	CIS alignment	Enforcement
disallow-privileged	5.2.2	Rejects privileged containers and init containers.
require-non-root	5.2.7	Requires runAsNonRoot: true on containers and init containers.
require-resource-limits	5.7.3 supplemental	Requires CPU and memory limits. This is a supplemental control, not a one-to-one CIS test.
restrict-image-registries	5.5.1 supplemental	Allows only approved registries. Full image provenance requires signing and verification as well.
disallow-default-namespace	Supplemental	Blocks common application resources from being created in default, which makes namespace ownership explicit.
disallow-host-network	5.2.3 and 5.2.5	Rejects host PID, host network, and host IPC access.

The default-namespace policy intentionally excludes ConfigMaps and Secrets. Those objects are supporting data, not application entrypoints, and blocking them alone would not prevent a workload from being installed. Keeping them out also avoids adding broad read permissions for Secret data to Kyverno's reports controller. Applications should create these objects in the same explicitly named namespace as the workloads that consume them.

The CIS benchmark includes manual checks and platform-specific exceptions. The mapping above describes the control objective each policy supports, not a claim that one Kyverno rule implements the entire benchmark control.