mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-04-08 10:04:25 +00:00
Code Activity

try paragraph format

Browse source
This commit is contained in:
Jim Bugwadia 2019-10-09 14:30:31 -07:00
parent d1a8309243
commit 6a346df6f7
1 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
samples/README.md
View file

@ -1,9 +1,27 @@
# Best Practice Policies
| Best practice | Policy
|------------------------------------------------|-----------------------------------------------------------------------|
| Run as non-root user | [deny_runasrootuser.yaml](best_practices/deny_runasrootuser.yaml) |
Best practice policies are recommended policies that can be applied to yoru Kubernetes clusters with minimal changes. To import these policies install Kyverno and import the resources as follows:
**Install Kyverno**
````bash
kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml
````
**Import Policies**
````bash
kubectl create -f https://github.com/nirmata/kyverno/raw/master/samples/best_practices/
````
More information on each best-practice policy is provided below:
## Run as non-root user
**Description**: By default, processes in a container run as a root user (uid 0). To prevent compromising the host, a best practice is to specify a least privileged user ID when building the container image, and require that application containers run as non root users.
**Policy YAML**: [deny_runasrootuser.yaml](best_practices/deny_runasrootuser.yaml)
**Aditional Information**
* [Pod Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
# Additional Policies