--- # Source: kyverno-policies/templates/baseline/disallow-capabilities.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-capabilities annotations: policies.kyverno.io/title: Disallow Capabilities policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" kyverno.io/kyverno-version: v1.18.0 policies.kyverno.io/minversion: 1.6.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/subject: Pod policies.kyverno.io/description: >- Adding capabilities beyond those listed in the policy must be disallowed. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: adding-capabilities match: any: - resources: kinds: - Pod preconditions: all: - key: "{{ request.operation || 'BACKGROUND' }}" operator: NotEquals value: DELETE validate: failureAction: Audit allowExistingViolations: true message: >- Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER, FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT) are disallowed. deny: conditions: all: - key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].securityContext.capabilities.add[] }}" operator: AnyNotIn value: - AUDIT_WRITE - CHOWN - DAC_OVERRIDE - FOWNER - FSETID - KILL - MKNOD - NET_BIND_SERVICE - SETFCAP - SETGID - SETPCAP - SETUID - SYS_CHROOT --- # Source: kyverno-policies/templates/baseline/disallow-host-namespaces.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-host-namespaces annotations: policies.kyverno.io/title: Disallow Host Namespaces policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/subject: Pod policies.kyverno.io/description: >- Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access to shared information and can be used to elevate privileges. Pods should not be allowed access to host namespaces. This policy ensures fields which make use of these host namespaces are unset or set to `false`. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: host-namespaces match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must be unset or set to `false`. pattern: spec: =(hostPID): "false" =(hostIPC): "false" =(hostNetwork): "false" --- # Source: kyverno-policies/templates/baseline/disallow-host-path.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-host-path annotations: policies.kyverno.io/title: Disallow hostPath policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod,Volume kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- HostPath volumes let Pods use host directories and volumes in containers. Using host resources can be used to access shared data or escalate privileges and should not be allowed. This policy ensures no hostPath volumes are in use. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: host-path match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset. pattern: spec: =(volumes): - X(hostPath): "null" --- # Source: kyverno-policies/templates/baseline/disallow-host-ports.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-host-ports annotations: policies.kyverno.io/title: Disallow hostPorts policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum restricted to a known list. This policy ensures the `hostPort` field is unset or set to `0`. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: host-ports-none match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort must either be unset or set to `0`. pattern: spec: =(ephemeralContainers): - =(ports): - =(hostPort): 0 =(initContainers): - =(ports): - =(hostPort): 0 containers: - =(ports): - =(hostPort): 0 --- # Source: kyverno-policies/templates/baseline/disallow-host-process.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-host-process annotations: policies.kyverno.io/title: Disallow hostProcess policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node. Privileged access to the host is disallowed in the baseline policy. HostProcess pods are an alpha feature as of Kubernetes v1.22. This policy ensures the `hostProcess` field, if present, is set to `false`. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: host-process-containers match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess, spec.containers[*].securityContext.windowsOptions.hostProcess, spec.initContainers[*].securityContext.windowsOptions.hostProcess, and spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must either be undefined or set to `false`. pattern: spec: =(ephemeralContainers): - =(securityContext): =(windowsOptions): =(hostProcess): "false" =(initContainers): - =(securityContext): =(windowsOptions): =(hostProcess): "false" containers: - =(securityContext): =(windowsOptions): =(hostProcess): "false" --- # Source: kyverno-policies/templates/baseline/disallow-privileged-containers.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-privileged-containers annotations: policies.kyverno.io/title: Disallow Privileged Containers policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- Privileged mode disables most security mechanisms and must not be allowed. This policy ensures Pods do not call for privileged mode. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: privileged-containers match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged and spec.initContainers[*].securityContext.privileged must be unset or set to `false`. pattern: spec: =(ephemeralContainers): - =(securityContext): =(privileged): "false" =(initContainers): - =(securityContext): =(privileged): "false" containers: - =(securityContext): =(privileged): "false" --- # Source: kyverno-policies/templates/baseline/disallow-proc-mount.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-proc-mount annotations: policies.kyverno.io/title: Disallow procMount policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- The default /proc masks are set up to reduce attack surface and should be required. This policy ensures nothing but the default procMount can be specified. Note that in order for users to deviate from the `Default` procMount requires setting a feature gate at the API server. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: check-proc-mount match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Changing the proc mount from the default is not allowed. The fields spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount, and spec.ephemeralContainers[*].securityContext.procMount must be unset or set to `Default`. pattern: spec: =(ephemeralContainers): - =(securityContext): =(procMount): "Default" =(initContainers): - =(securityContext): =(procMount): "Default" containers: - =(securityContext): =(procMount): "Default" --- # Source: kyverno-policies/templates/baseline/disallow-selinux.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-selinux annotations: policies.kyverno.io/title: Disallow SELinux policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- SELinux options can be used to escalate privileges and should not be allowed. This policy ensures that the `seLinuxOptions` field is undefined. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: selinux-type match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Setting the SELinux type is restricted. The fields spec.securityContext.seLinuxOptions.type, spec.containers[*].securityContext.seLinuxOptions.type, , spec.initContainers[*].securityContext.seLinuxOptions, and spec.ephemeralContainers[*].securityContext.seLinuxOptions.type must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t). pattern: spec: =(securityContext): =(seLinuxOptions): =(type): "container_t | container_init_t | container_kvm_t" =(ephemeralContainers): - =(securityContext): =(seLinuxOptions): =(type): "container_t | container_init_t | container_kvm_t" =(initContainers): - =(securityContext): =(seLinuxOptions): =(type): "container_t | container_init_t | container_kvm_t" containers: - =(securityContext): =(seLinuxOptions): =(type): "container_t | container_init_t | container_kvm_t" - name: selinux-user-role match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Setting the SELinux user or role is forbidden. The fields spec.securityContext.seLinuxOptions.user, spec.securityContext.seLinuxOptions.role, spec.containers[*].securityContext.seLinuxOptions.user, spec.containers[*].securityContext.seLinuxOptions.role, spec.initContainers[*].securityContext.seLinuxOptions.user, spec.initContainers[*].securityContext.seLinuxOptions.role, spec.ephemeralContainers[*].securityContext.seLinuxOptions.user, and spec.ephemeralContainers[*].securityContext.seLinuxOptions.role must be unset. pattern: spec: =(securityContext): =(seLinuxOptions): X(user): "null" X(role): "null" =(ephemeralContainers): - =(securityContext): =(seLinuxOptions): X(user): "null" X(role): "null" =(initContainers): - =(securityContext): =(seLinuxOptions): X(user): "null" X(role): "null" containers: - =(securityContext): =(seLinuxOptions): X(user): "null" X(role): "null" --- # Source: kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: restrict-apparmor-profiles annotations: policies.kyverno.io/title: Restrict AppArmor policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod, Annotation policies.kyverno.io/minversion: 1.3.0 kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- On supported hosts, the 'runtime/default' AppArmor profile is applied by default. The default policy should prevent overriding or disabling the policy, or restrict overrides to an allowed set of profiles. This policy ensures Pods do not specify any other AppArmor profiles than `runtime/default` or `localhost/*`. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: app-armor match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Specifying other AppArmor profiles is disallowed. The annotation `container.apparmor.security.beta.kubernetes.io` if defined must not be set to anything other than `runtime/default` or `localhost/*`. pattern: =(metadata): =(annotations): =(container.apparmor.security.beta.kubernetes.io/*): "runtime/default | localhost/*" --- # Source: kyverno-policies/templates/baseline/restrict-seccomp.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: restrict-seccomp annotations: policies.kyverno.io/title: Restrict Seccomp policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- The seccomp profile must not be explicitly set to Unconfined. This policy, requiring Kubernetes v1.19 or later, ensures that seccomp is unset or set to `RuntimeDefault` or `Localhost`. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: check-seccomp match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Use of custom Seccomp profiles is disallowed. The fields spec.securityContext.seccompProfile.type, spec.containers[*].securityContext.seccompProfile.type, spec.initContainers[*].securityContext.seccompProfile.type, and spec.ephemeralContainers[*].securityContext.seccompProfile.type must be unset or set to `RuntimeDefault` or `Localhost`. pattern: spec: =(securityContext): =(seccompProfile): =(type): "RuntimeDefault | Localhost" =(ephemeralContainers): - =(securityContext): =(seccompProfile): =(type): "RuntimeDefault | Localhost" =(initContainers): - =(securityContext): =(seccompProfile): =(type): "RuntimeDefault | Localhost" containers: - =(securityContext): =(seccompProfile): =(type): "RuntimeDefault | Localhost" --- # Source: kyverno-policies/templates/baseline/restrict-sysctls.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: restrict-sysctls annotations: policies.kyverno.io/title: Restrict sysctls policies.kyverno.io/category: Pod Security Standards (Baseline) policies.kyverno.io/severity: "medium" policies.kyverno.io/subject: Pod kyverno.io/kyverno-version: v1.18.0 kyverno.io/kubernetes-version: ">=1.25.0-0" policies.kyverno.io/description: >- Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. This policy ensures that only those "safe" subsets can be specified in a Pod. labels: app.kubernetes.io/component: kyverno app.kubernetes.io/instance: kyverno-policies app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-policies app.kubernetes.io/part-of: kyverno-policies app.kubernetes.io/version: "3.8.0" helm.sh/chart: kyverno-policies-3.8.0 spec: background: true failurePolicy: Fail validationFailureAction: Audit rules: - name: check-sysctls match: any: - resources: kinds: - Pod validate: failureAction: Audit allowExistingViolations: true message: >- Setting additional sysctls above the allowed type is disallowed. The field spec.securityContext.sysctls must be unset or not use any other names than kernel.shm_rmid_forced, net.ipv4.ip_local_port_range, net.ipv4.ip_unprivileged_port_start, net.ipv4.tcp_syncookies and net.ipv4.ping_group_range. pattern: spec: =(securityContext): =(sysctls): - =(name): "kernel.shm_rmid_forced | net.ipv4.ip_local_port_range | net.ipv4.ip_unprivileged_port_start | net.ipv4.tcp_syncookies | net.ipv4.ping_group_range"