mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
3cf9141f4d
* initial commit * background policy validation * correct message * skip non-background policy process for add/update * add Generate Request CR * generate Request Generator Initial * test generate request CR generation * initial commit gr generator * generate controller initial framework * add crd for generate request * gr cleanup controller initial commit * cleanup controller initial * generate mid-commit * generate rule processing * create PV on generate error * embed resource type * testing phase 1- generate resources with variable substitution * fix tests * comment broken test #586 * add printer column for state * return if existing resource for clone * set resync time to 2 mins & remove resource version check in update handler for gr * generate events for reporting * fix logs * initial commit * fix trailing quote in patch * remove comments * initial condition (equal & notequal) * initial support for conditions * initial support fo conditions in generate * support precondition checks * cleanup * re-evaluate GR on namespace update using dynamic informers * add status for generated resources * display loaded variable SA * support delete cleanup of generate request main resources * fix log * remove namespace from SA username * support multiple variables per statement for scalar values * fix fail variables * add check for userInfo * validation checks for conditions * update policy * refactor logs * code review * add openapispec for clusterpolicy preconditions * Update documentation * CR fixes * documentation * CR fixes * update variable * fix logs * update policy * pre-defined variables (serviceAccountName & serviceAccountNamespace) * update test |
||
|---|---|---|
| .. | ||
| best_practices | ||
| more | ||
| AddDefaultNetworkPolicy.md | ||
| AddNamespaceQuotas.md | ||
| AddSafeToEvict.md | ||
| CheckUserGroup.md | ||
| DisallowBindMounts.md | ||
| DisallowDefaultNamespace.md | ||
| DisallowDockerSockMount.md | ||
| DisallowHelmTiller.md | ||
| DisallowHostNetworkPort.md | ||
| DisallowHostPIDIPC.md | ||
| DisallowLatestTag.md | ||
| DisallowNewCapabilities.md | ||
| DisallowPrivilegedContainers.md | ||
| DisallowRootUser.md | ||
| DisallowSysctls.md | ||
| README.md | ||
| RequirePodProbes.md | ||
| RequirePodRequestsLimits.md | ||
| RequireReadOnlyRootFS.md | ||
| RestrictAutomountSAToken.md | ||
| RestrictImageRegistries.md | ||
| RestrictIngressClasses.md | ||
| RestrictNodePort.md | ||
Sample Policies
Sample policies are designed to be applied to your Kubernetes clusters with minimal changes.
The policies are mostly validation rules in audit mode i.e. your existing workloads will not be impacted, but will be audited for policy complaince.
Best Practice Policies
These policies are highly recommended.
- Disallow root user
- Disallow privileged containers
- Disallow new capabilities
- Disallow kernel parameter changes
- Disallow use of bind mounts (
hostPathvolumes) - Disallow docker socket bind mount
- Disallow
hostNetworkandhostPort - Disallow
hostPIDandhostIPC - Disallow use of default namespace
- Disallow latest image tag
- Disallow Helm Tiller
- Require read-only root filesystem
- Require pod resource requests and limits
- Require pod
livenessProbeandreadinessProbe - Add default network policy
- Add namespace quotas
- Add
safe-to-evictfor pods withemptyDirandhostPathvolumes
Additional Policies
These policies provide additional best practices and are worthy of close consideration. These policies may require specific changes for your workloads and environments.
- Restrict image registries
- Restrict
NodePortservices - Restrict auto-mount of service account credentials
- Restrict ingress classes
- Restrict User Group
Applying the sample policies
To apply these policies to your cluster, install Kyverno and import the policies as follows:
Install Kyverno
kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml
Apply Kyverno Policies
To start applying policies to your cluster, first clone the repo:
git clone https://github.com/nirmata/kyverno.git
cd kyverno
Import best_practices from here:
kubectl create -f samples/best_practices
Import addition policies from here:
kubectl create -f samples/more/