kyverno/samples/DisallowSysctls.md

Disallow changes to kernel parameters

The Sysctl interface allows modifications to kernel parameters at runtime. In a Kubernetes, pod these parameters can be specified under securityContext.sysctls. Kernel parameter modifications can be used for exploits and should be restricted.

Additional Information

• List of supported namespaced sysctl interfaces

Policy YAML

disallow_sysctls.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-sysctls
spec:
  validationFailureAction: audit
  rules:
  - name: validate-sysctls
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Changes to kernel parameters are not allowed"
      pattern:
        spec:
          securityContext:
            X(sysctls): null