Skip to content

v0.3.0 — Policy & Runtime Security

Choose a tag to compare

View all tags
@fadyy2k fadyy2k released this 20 Sep 12:48
· 9 commits to main since this release
v0.3.0
65a625b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Engineering intent

Move enforcement inside the Kubernetes trust boundary so security remains active after CI finishes.

Architecture delta

  • restricted Pod Security Admission for the demo namespace
  • default-deny NetworkPolicy with explicit DNS/application traffic
  • Kyverno ValidatingPolicy requiring project-owned images by digest
  • Kyverno ImageValidatingPolicy verifying the Cosign keyless signing identity
  • Trivy Operator for recurring vulnerability, SBOM, configuration, RBAC, infrastructure and compliance reports
  • Falco runtime detection with modern eBPF configuration
  • dedicated policy/runtime-security CI
  • positive and negative Kyverno tests, including registry signature verification

Evidence

Policy behavior and chart rendering are exercised by the repository's Policy and Runtime Security CI. See Engineering Evidence.

Evidence boundary

The release proved policy definitions and signature verification in CI. It did not claim in-cluster Trivy/Falco reports from a provisioned EKS cluster.

Assets 2
Loading