---
# Source: kyverno-policies/templates/baseline/disallow-capabilities.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-capabilities
  annotations:
    policies.kyverno.io/title: Disallow Capabilities
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    kyverno.io/kyverno-version: v1.19.0
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Adding capabilities beyond those listed in the policy must be disallowed.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.containers) || object.spec.containers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.capabilities) ||
          !has(c.securityContext.capabilities.add) ||
          c.securityContext.capabilities.add.all(cap, cap in ['AUDIT_WRITE', 'CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'FSETID', 'KILL', 'MKNOD', 'NET_BIND_SERVICE', 'SETFCAP', 'SETGID', 'SETPCAP', 'SETUID', 'SYS_CHROOT']))) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.capabilities) ||
          !has(c.securityContext.capabilities.add) ||
          c.securityContext.capabilities.add.all(cap, cap in ['AUDIT_WRITE', 'CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'FSETID', 'KILL', 'MKNOD', 'NET_BIND_SERVICE', 'SETFCAP', 'SETGID', 'SETPCAP', 'SETUID', 'SYS_CHROOT']))) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.capabilities) ||
          !has(c.securityContext.capabilities.add) ||
          c.securityContext.capabilities.add.all(cap, cap in ['AUDIT_WRITE', 'CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'FSETID', 'KILL', 'MKNOD', 'NET_BIND_SERVICE', 'SETFCAP', 'SETGID', 'SETPCAP', 'SETUID', 'SYS_CHROOT'])))
      message: >-
        Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER,
        FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT)
        are disallowed.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/disallow-host-namespaces.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-host-namespaces
  annotations:
    policies.kyverno.io/title: Disallow Host Namespaces
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Host namespaces (Process ID namespace, Inter-Process Communication namespace, and
      network namespace) allow access to shared information and can be used to elevate
      privileges. Pods should not be allowed access to host namespaces. This policy ensures
      fields which make use of these host namespaces are unset or set to `false`.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.hostPID) || object.spec.hostPID == false) &&
        (!has(object.spec.hostIPC) || object.spec.hostIPC == false) &&
        (!has(object.spec.hostNetwork) || object.spec.hostNetwork == false)
      message: >-
        Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
        spec.hostIPC, and spec.hostPID must be unset or set to `false`.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/disallow-host-path.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-host-path
  annotations:
    policies.kyverno.io/title: Disallow hostPath
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod,Volume
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      HostPath volumes let Pods use host directories and volumes in containers.
      Using host resources can be used to access shared data or escalate privileges
      and should not be allowed. This policy ensures no hostPath volumes are in use.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        !has(object.spec.volumes) || object.spec.volumes.all(v, !has(v.hostPath))
      message: >-
        HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/disallow-host-ports.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-host-ports
  annotations:
    policies.kyverno.io/title: Disallow hostPorts
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      Access to host ports allows potential snooping of network traffic and should not be
      allowed, or at minimum restricted to a known list. This policy ensures the `hostPort`
      field is unset or set to `0`.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.containers) || object.spec.containers.all(c,
          !has(c.ports) || c.ports.all(p, !has(p.hostPort) || p.hostPort == 0))) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c,
          !has(c.ports) || c.ports.all(p, !has(p.hostPort) || p.hostPort == 0))) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c,
          !has(c.ports) || c.ports.all(p, !has(p.hostPort) || p.hostPort == 0)))
      message: >-
        Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
        , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
        must either be unset or set to `0`.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/disallow-host-process.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-host-process
  annotations:
    policies.kyverno.io/title: Disallow HostProcess
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      HostProcess containers can access the host and should not be allowed. This policy ensures
      the `hostProcess` field is unset or set to `false`.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.securityContext) ||
         !has(object.spec.securityContext.windowsOptions) ||
         !has(object.spec.securityContext.windowsOptions.hostProcess) ||
         object.spec.securityContext.windowsOptions.hostProcess == false) &&
        (!has(object.spec.containers) || object.spec.containers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.windowsOptions) ||
          !has(c.securityContext.windowsOptions.hostProcess) ||
          c.securityContext.windowsOptions.hostProcess == false)) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.windowsOptions) ||
          !has(c.securityContext.windowsOptions.hostProcess) ||
          c.securityContext.windowsOptions.hostProcess == false)) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.windowsOptions) ||
          !has(c.securityContext.windowsOptions.hostProcess) ||
          c.securityContext.windowsOptions.hostProcess == false))
      message: >-
        HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess,
        spec.containers[*].securityContext.windowsOptions.hostProcess,
        spec.initContainers[*].securityContext.windowsOptions.hostProcess, and
        spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must be unset or set to `false`.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/disallow-privileged-containers.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-privileged-containers
  annotations:
    policies.kyverno.io/title: Disallow Privileged Containers
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      Privileged mode disables most security mechanisms and must not be allowed. This policy
      ensures Pods do not call for privileged mode.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.containers) || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false)) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false)) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false))
      message: >-
        Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged
        and spec.initContainers[*].securityContext.privileged must be unset or set to `false`.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/disallow-proc-mount.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-proc-mount
  annotations:
    policies.kyverno.io/title: Disallow /proc Mount Type
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      The default /proc masks are set up to reduce attack surface and should be required.
      This policy ensures the `procMount` field is unset or set to `Default`.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.containers) || object.spec.containers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.procMount) ||
          c.securityContext.procMount == 'Default')) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.procMount) ||
          c.securityContext.procMount == 'Default')) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.procMount) ||
          c.securityContext.procMount == 'Default'))
      message: >-
        The default /proc masks are set up to reduce attack surface. The fields
        spec.containers[*].securityContext.procMount,
        spec.initContainers[*].securityContext.procMount, and
        spec.ephemeralContainers[*].securityContext.procMount must be unset or set to `Default`.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/disallow-selinux.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: disallow-selinux
  annotations:
    policies.kyverno.io/title: Disallow SELinux
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      Setting custom SELinux options may be used to bypass discretionary access control and
      should not be allowed. This policy ensures SELinux options are restricted.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.securityContext) ||
         !has(object.spec.securityContext.seLinuxOptions) ||
         (!has(object.spec.securityContext.seLinuxOptions.type) || object.spec.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&
         (!has(object.spec.securityContext.seLinuxOptions.user) || object.spec.securityContext.seLinuxOptions.user == '') &&
         (!has(object.spec.securityContext.seLinuxOptions.role) || object.spec.securityContext.seLinuxOptions.role == '')) &&
        (!has(object.spec.containers) || object.spec.containers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.seLinuxOptions) ||
          (!has(c.securityContext.seLinuxOptions.type) || c.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&
          (!has(c.securityContext.seLinuxOptions.user) || c.securityContext.seLinuxOptions.user == '') &&
          (!has(c.securityContext.seLinuxOptions.role) || c.securityContext.seLinuxOptions.role == ''))) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.seLinuxOptions) ||
          (!has(c.securityContext.seLinuxOptions.type) || c.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&
          (!has(c.securityContext.seLinuxOptions.user) || c.securityContext.seLinuxOptions.user == '') &&
          (!has(c.securityContext.seLinuxOptions.role) || c.securityContext.seLinuxOptions.role == ''))) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.seLinuxOptions) ||
          (!has(c.securityContext.seLinuxOptions.type) || c.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&
          (!has(c.securityContext.seLinuxOptions.user) || c.securityContext.seLinuxOptions.user == '') &&
          (!has(c.securityContext.seLinuxOptions.role) || c.securityContext.seLinuxOptions.role == '')))
      message: >-
        Setting custom SELinux options is disallowed. The fields
        spec.securityContext.seLinuxOptions, spec.containers[*].securityContext.seLinuxOptions,
        spec.initContainers[*].securityContext.seLinuxOptions, and
        spec.ephemeralContainers[*].securityContext.seLinuxOptions must be unset or restricted.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/restrict-apparmor-profiles.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: restrict-apparmor-profiles
  annotations:
    policies.kyverno.io/title: Restrict AppArmor Profiles
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      AppArmor profiles should be restricted to allowed values. This policy ensures
      AppArmor profiles are unset or set to allowed values.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.metadata) ||
         !has(object.metadata.annotations) ||
         object.metadata.annotations.filter(k, k.startsWith('container.apparmor.security.beta.kubernetes.io/')).all(k,
           object.metadata.annotations[k] in ['', 'runtime/default', 'localhost/*'])) &&
        (!has(object.spec.securityContext) ||
         !has(object.spec.securityContext.appArmorProfile) ||
         !has(object.spec.securityContext.appArmorProfile.type) ||
         object.spec.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost']) &&
        (!has(object.spec.containers) || object.spec.containers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.appArmorProfile) ||
          !has(c.securityContext.appArmorProfile.type) ||
          c.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost'])) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.appArmorProfile) ||
          !has(c.securityContext.appArmorProfile.type) ||
          c.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost'])) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.appArmorProfile) ||
          !has(c.securityContext.appArmorProfile.type) ||
          c.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost']))
      message: >-
        AppArmor profiles must be restricted. The fields
        metadata.annotations['container.apparmor.security.beta.kubernetes.io/*'],
        spec.securityContext.appArmorProfile.type,
        spec.containers[*].securityContext.appArmorProfile.type,
        spec.initContainers[*].securityContext.appArmorProfile.type, and
        spec.ephemeralContainers[*].securityContext.appArmorProfile.type must be unset or set to allowed values.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/restrict-seccomp.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: restrict-seccomp
  annotations:
    policies.kyverno.io/title: Restrict Seccomp
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      The seccomp profile must not be explicitly set to Unconfined. This policy,
      requiring Kubernetes v1.19 or later, ensures that seccomp is unset or
      set to `RuntimeDefault` or `Localhost`.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        (!has(object.spec.securityContext) ||
         !has(object.spec.securityContext.seccompProfile) ||
         !has(object.spec.securityContext.seccompProfile.type) ||
         object.spec.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost']) &&
        (!has(object.spec.containers) || object.spec.containers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.seccompProfile) ||
          !has(c.securityContext.seccompProfile.type) ||
          c.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost'])) &&
        (!has(object.spec.initContainers) || object.spec.initContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.seccompProfile) ||
          !has(c.securityContext.seccompProfile.type) ||
          c.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost'])) &&
        (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c,
          !has(c.securityContext) ||
          !has(c.securityContext.seccompProfile) ||
          !has(c.securityContext.seccompProfile.type) ||
          c.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost']))
      message: >-
        Use of custom Seccomp profiles is disallowed. The fields
        spec.securityContext.seccompProfile.type,
        spec.containers[*].securityContext.seccompProfile.type,
        spec.initContainers[*].securityContext.seccompProfile.type, and
        spec.ephemeralContainers[*].securityContext.seccompProfile.type
        must be unset or set to `RuntimeDefault` or `Localhost`.

  validationActions:
    - Audit
---
# Source: kyverno-policies/templates/baseline/restrict-sysctls.cel.yaml
apiVersion: policies.kyverno.io/v1beta1
kind: ValidatingPolicy
metadata:
  name: restrict-sysctls
  annotations:
    policies.kyverno.io/title: Restrict Sysctls
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: "medium"
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: v1.19.0
    kyverno.io/kubernetes-version: ">=1.25.0-0"
    policies.kyverno.io/description: >-
      Sysctls can disable security mechanisms or affect all containers on a host and should be
      restricted. This policy ensures only safe sysctls are allowed.

  labels:
    app.kubernetes.io/component: kyverno
    app.kubernetes.io/instance: kyverno-policies
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kyverno-policies
    app.kubernetes.io/part-of: kyverno-policies
    app.kubernetes.io/version: "3.9.0"
    helm.sh/chart: kyverno-policies-3.9.0
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
    - expression: >-
        !has(object.spec.securityContext) ||
        !has(object.spec.securityContext.sysctls) ||
        object.spec.securityContext.sysctls.all(s, s.name in ['kernel.shm_rmid_forced', 'net.ipv4.ip_local_port_range', 'net.ipv4.tcp_syncookies', 'net.ipv4.ping_group_range', 'net.ipv4.ip_unprivileged_port_start', 'net.ipv4.ip_local_reserved_ports', 'net.ipv4.tcp_keepalive_time', 'net.ipv4.tcp_fin_timeout', 'net.ipv4.tcp_keepalive_intvl', 'net.ipv4.tcp_keepalive_probes'])
      message: >-
        Sysctls must be restricted to safe values. The field spec.securityContext.sysctls[*].name
        must be one of the allowed safe sysctls.

  validationActions:
    - Audit