kyverno/samples/README.md

Sample Policies

Sample policies are designed to be applied to your Kubernetes clusters with minimal changes. To apply these policies to your cluster, install Kyverno and import the policies as follows:

Install Kyverno

kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml

(installation docs)

Apply Kyverno Policies

To start applying policies to your cluster, first clone the repo:

git clone https://github.com/nirmata/kyverno.git
cd kyverno

Import best_practices from here:

kubectl create -f samples/best_practices

Import addition policies from here:

kubectl create -f samples/more/

The policies are mostly validation rules in audit mode i.e. your existing workloads will not be impacted, but will be audited for policy complaince.

Best Practice Policies

These policies are highly recommended.

1. Run as non-root user
2. Disable privileged containers and disallow privilege escalation
3. Require Read-only root filesystem
4. Disallow use of host filesystem
5. Disallow hostNetwork and hostPort
6. Disallow hostPID and hostIPC
7. Disallow unknown image registries
8. Disallow latest image tag
9. Disallow use of default namespace
10. Require namespace limits and quotas
11. Require pod resource requests and limits
12. Require pod livenessProbe and readinessProbe
13. Default deny all ingress traffic

Additional Policies

The policies provide additional best practices and are worthy of close consideration. These policies may require workload specific changes.

14. Limit use of NodePort services
15. Limit automount of Service Account credentials
16. Configure Linux Capabilities
17. Limit Kernel parameter access