Skip to content

Latest commit

 

History

History
70 lines (50 loc) · 2.57 KB

README.md

File metadata and controls

70 lines (50 loc) · 2.57 KB
Raw

Sample Policies

Sample policies are designed to be applied to your Kubernetes clusters with minimal changes.

The policies are mostly validation rules in audit mode i.e. your existing workloads will not be impacted, but will be audited for policy complaince.

Best Practice Policies

These policies are highly recommended.

  1. Disallow root user
  2. Disallow privileged containers
  3. Disallow new capabilities
  4. Disallow kernel parameter changes
  5. Disallow use of bind mounts (hostPath volumes)
  6. Disallow docker socket bind mount
  7. Disallow hostNetwork and hostPort
  8. Disallow hostPID and hostIPC
  9. Disallow use of default namespace
  10. Disallow latest image tag
  11. Disallow Helm Tiller
  12. Require read-only root filesystem
  13. Require pod resource requests and limits
  14. Require pod livenessProbe and readinessProbe
  15. Add default network policy
  16. Add namespace quotas
  17. Add safe-to-evict for pods with emptyDir and hostPath volumes

Additional Policies

These policies provide additional best practices and are worthy of close consideration. These policies may require specific changes for your workloads and environments.

  1. Restrict image registries
  2. Restrict NodePort services
  3. Restrict auto-mount of service account credentials
  4. Restrict ingress classes
  5. Restrict User Group

Applying the sample policies

To apply these policies to your cluster, install Kyverno and import the policies as follows:

Install Kyverno

kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml

(installation docs)

Apply Kyverno Policies

To start applying policies to your cluster, first clone the repo:

git clone https://github.com/nirmata/kyverno.git
cd kyverno

Import best_practices from here:

kubectl create -f samples/best_practices

Import addition policies from here:

kubectl create -f samples/more/