mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-10 18:06:55 +00:00
26 lines
933 B
YAML
26 lines
933 B
YAML
|
apiVersion: kyverno.io/v2alpha1
|
||
|
|
kind: ValidatingPolicy
|
||
|
|
metadata:
|
||
|
|
name: disallow-privilege-escalation
|
||
|
|
annotations:
|
||
|
|
pod-policies.kyverno.io/autogen-controllers: none
|
||
|
|
spec:
|
||
|
|
matchConstraints:
|
||
|
|
resourceRules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
apiVersions: [v1]
|
||
|
|
operations: [CREATE, UPDATE]
|
||
|
|
resources: ["pods"]
|
||
|
|
matchConditions:
|
||
|
|
- name: "check-prod-label"
|
||
|
|
expression: >-
|
||
|
|
has(object.metadata.labels) && has(object.metadata.labels.prod) && object.metadata.labels.prod == 'true'
|
||
|
|
validations:
|
||
|
|
- expression: >-
|
||
|
|
object.spec.containers.all(container, has(container.securityContext) &&
|
||
|
|
has(container.securityContext.allowPrivilegeEscalation) &&
|
||
|
|
container.securityContext.allowPrivilegeEscalation == false)
|
||
|
|
message: >-
|
||
|
|
Privilege escalation is disallowed. The field
|
||
|
|
spec.containers[*].securityContext.allowPrivilegeEscalation must be set to `false`.
|