Kyverno policy baseline
These policies are ClusterPolicy resources. The workload hardening policies
select only namespaces labeled security-baseline/open: "true". The separate
disallow-default-namespace policy specifically protects the Kubernetes
default namespace. This keeps the portfolio demo enforceable without
blocking Kyverno, Falco, ArgoCD, or other platform components.
All six policies use validationFailureAction: Enforce, so a matching resource is
rejected at admission time. The policies use background: false because the
goal is to demonstrate admission enforcement, not retroactively evaluate
existing objects.
| Policy | CIS alignment | Enforcement |
|---|---|---|
disallow-privileged |
5.2.2 | Rejects privileged containers and init containers. |
require-non-root |
5.2.7 | Requires runAsNonRoot: true on containers and init containers. |
require-resource-limits |
5.7.3 supplemental | Requires CPU and memory limits. This is a supplemental control, not a one-to-one CIS test. |
restrict-image-registries |
5.5.1 supplemental | Allows only approved registries. Full image provenance requires signing and verification as well. |
disallow-default-namespace |
Supplemental | Blocks common application resources from being created in default, which makes namespace ownership explicit. |
disallow-host-network |
5.2.3 and 5.2.5 | Rejects host PID, host network, and host IPC access. |
The CIS benchmark includes manual checks and platform-specific exceptions. The mapping above describes the control objective each policy supports, not a claim that one Kyverno rule implements the entire benchmark control.