kyverno/samples

Sample Policies

Sample policies are designed to be applied to your Kubernetes clusters with minimal changes. To apply these policies to your cluster, install Kyverno and import the policies as follows:

Install Kyverno

kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml

(installation docs)

Apply Kyverno Policies

To start applying policies to your cluster, first clone the repo:

git clone https://github.com/nirmata/kyverno.git
cd kyverno

Import best_practices from here:

kubectl create -f samples/best_practices

Import addition policies from here:

kubectl create -f samples/more/

The policies are mostly validation rules in audit mode i.e. your existing workloads will not be impacted, but will be audited for policy complaince.

Best Practice Policies

These policies are highly recommended.

1. Run as non-root user
2. Disable privileged containers and disallow privilege escalation
3. Disallow new capabilities
4. Require Read-only root filesystem
5. Disallow use of bind mounts (hostPath volumes)
6. Disallow hostNetwork and hostPort
7. Disallow hostPID and hostIPC
8. Disallow unknown image registries
9. Disallow latest image tag
10. Disallow use of default namespace
11. Require namespace limits and quotas
12. Require pod resource requests and limits
13. Require pod livenessProbe and readinessProbe
14. Default deny all ingress traffic

Additional Policies

The policies provide additional best practices and are worthy of close consideration. These policies may require workload specific changes.

15. Limit use of NodePort services
16. Limit automount of Service Account credentials
17. Configure Linux Capabilities
18. Limit Kernel parameter access