Kyverno policy baseline
These policies are ClusterPolicy resources, but they intentionally select
only namespaces labeled security-baseline/open: "true". That keeps the
portfolio demo enforceable without blocking Kyverno, Falco, ArgoCD, or other
platform components. Expand the label scope deliberately for a real cluster.
All five policies use validationFailureAction: Enforce, so a matching Pod is
rejected at admission time. The policies use background: false because the
goal is to demonstrate admission enforcement, not retroactively evaluate
existing objects.
| Policy | CIS alignment | Enforcement |
|---|---|---|
disallow-privileged |
5.2.2 | Rejects privileged containers and init containers. |
require-non-root |
5.2.7 | Requires runAsNonRoot: true on containers and init containers. |
require-resource-limits |
5.7.3 supplemental | Requires CPU and memory limits. This is a supplemental control, not a one-to-one CIS test. |
restrict-image-registries |
5.5.1 supplemental | Allows only approved registries. Full image provenance requires signing and verification as well. |
disallow-host-network |
5.2.3 and 5.2.5 | Rejects host PID, host network, and host IPC access. |
The CIS benchmark includes manual checks and platform-specific exceptions. The mapping above describes the control objective each policy supports, not a claim that one Kyverno rule implements the entire benchmark control.