33 lines
2.1 KiB
Markdown
33 lines
2.1 KiB
Markdown
# Kyverno policy baseline
|
|
|
|
These policies are `ClusterPolicy` resources. The workload hardening policies
|
|
select only namespaces labeled `security-baseline/open: "true"`. The separate
|
|
`disallow-default-namespace` policy specifically protects the Kubernetes
|
|
`default` namespace. This keeps the portfolio demo enforceable without
|
|
blocking Kyverno, Falco, ArgoCD, or other platform components.
|
|
|
|
All six policies use `validationFailureAction: Enforce`, so a matching resource is
|
|
rejected at admission time. The policies use `background: false` because the
|
|
goal is to demonstrate admission enforcement, not retroactively evaluate
|
|
existing objects.
|
|
|
|
| Policy | CIS alignment | Enforcement |
|
|
| --- | --- | --- |
|
|
| `disallow-privileged` | 5.2.2 | Rejects privileged containers and init containers. |
|
|
| `require-non-root` | 5.2.7 | Requires `runAsNonRoot: true` on containers and init containers. |
|
|
| `require-resource-limits` | 5.7.3 supplemental | Requires CPU and memory limits. This is a supplemental control, not a one-to-one CIS test. |
|
|
| `restrict-image-registries` | 5.5.1 supplemental | Allows only approved registries. Full image provenance requires signing and verification as well. |
|
|
| `disallow-default-namespace` | Supplemental | Blocks common application resources from being created in `default`, which makes namespace ownership explicit. |
|
|
| `disallow-host-network` | 5.2.3 and 5.2.5 | Rejects host PID, host network, and host IPC access. |
|
|
|
|
The default-namespace policy intentionally excludes ConfigMaps and Secrets.
|
|
Those objects are supporting data, not application entrypoints, and blocking
|
|
them alone would not prevent a workload from being installed. Keeping them out
|
|
also avoids adding broad read permissions for Secret data to Kyverno's reports
|
|
controller. Applications should create these objects in the same explicitly
|
|
named namespace as the workloads that consume them.
|
|
|
|
The CIS benchmark includes manual checks and platform-specific exceptions.
|
|
The mapping above describes the control objective each policy supports, not a
|
|
claim that one Kyverno rule implements the entire benchmark control.
|