kyverno/samples

Sample Policies

Sample policies are designed to be applied to your Kubernetes clusters with minimal changes.

The policies are mostly validation rules in audit mode (i.e. your existing workloads will not be impacted, but will be audited for policy compliance). It is recommended that all policies be tested and observed in a non-production environment before setting enforce mode.

Best Practice Policies

These policies are highly recommended.

1. Disallow root user
2. Disallow privileged containers
3. Disallow new capabilities
4. Disallow kernel parameter changes
5. Disallow use of bind mounts (hostPath volumes)
6. Disallow docker socket bind mount
7. Disallow hostNetwork and hostPort
8. Disallow hostPID and hostIPC
9. Disallow use of default namespace
10. Disallow latest image tag
11. Disallow Helm Tiller
12. Require read-only root filesystem
13. Require pod resource requests and limits
14. Require pod livenessProbe and readinessProbe
15. Add default network policy
16. Add namespace quotas
17. Add safe-to-evict for pods with emptyDir and hostPath volumes

Additional Policies

These policies provide additional best practices and are worthy of close consideration. These policies may require specific changes for your workloads and environments.

1. Restrict image registries
2. Restrict NodePort services
3. Restrict LoadBalancer services
4. Restrict auto-mount of service account credentials
5. Restrict ingress classes
6. Restrict User Group
7. Require pods are labeled
8. Require pods have certain labels
9. Require Deployments have multiple replicas
10. Spread Pods across topology
11. Create Pod Anti-Affinity
12. Ensure Pod livenessProbe and readinessProbe are different
13. Disallow mounting Secrets as environment variables
14. Add default labels
15. Require all Pods drop all capabilities

Miscellaneous Policies

Policies in this group are either highly-specific, involve third-party CRDs, or may be variations on standard Best Practice or Additional policies.

1. Require imagePullPolicy of Always for images not using latest tags
2. Require images using latest tag not use imagePullPolicy of Always

Applying the sample policies

To apply these policies to your cluster, install Kyverno and import the policies as follows:

Install Kyverno

kubectl create -f https://raw.githubusercontent.com/kyverno/kyverno/main/definitions/release/install.yaml

(installation docs)

Apply Kyverno Policies

To start applying policies to your cluster, first clone the repo:

git clone https://github.com/kyverno/kyverno.git
cd kyverno

Import best practices from here:

kubectl create -f samples/best_practices

Import additional policies from here:

kubectl create -f samples/more/