2025-02-11 19:05:22 +02:00
|
|
|
apiVersion: policies.kyverno.io/v1alpha1
|
2025-02-11 00:30:12 +02:00
|
|
|
kind: ValidatingPolicy
|
|
|
|
|
metadata:
|
|
|
|
|
name: disallow-privilege-escalation
|
|
|
|
|
annotations:
|
|
|
|
|
pod-policies.kyverno.io/autogen-controllers: deployments,cronjobs
|
|
|
|
|
spec:
|
|
|
|
|
matchConstraints:
|
|
|
|
|
resourceRules:
|
|
|
|
|
- apiGroups: [""]
|
|
|
|
|
apiVersions: [v1]
|
|
|
|
|
operations: [CREATE, UPDATE]
|
|
|
|
|
resources: ["pods"]
|
|
|
|
|
matchConditions:
|
|
|
|
|
- name: "check-prod-label"
|
|
|
|
|
expression: >-
|
|
|
|
|
has(object.metadata.labels) && has(object.metadata.labels.prod) && object.metadata.labels.prod == 'true'
|
|
|
|
|
validations:
|
|
|
|
|
- expression: >-
|
|
|
|
|
object.spec.containers.all(container, has(container.securityContext) &&
|
|
|
|
|
has(container.securityContext.allowPrivilegeEscalation) &&
|
|
|
|
|
container.securityContext.allowPrivilegeEscalation == false)
|
|
|
|
|
message: >-
|
|
|
|
|
Privilege escalation is disallowed. The field
|
|
|
|
|
spec.containers[*].securityContext.allowPrivilegeEscalation must be set to `false`.
|
