1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
kyverno/samples
2019-11-07 19:28:48 -08:00
..
best_practices update test scenario and change rule to audit mode 2019-11-07 19:28:48 -08:00
more update the policy 2019-10-31 13:29:16 -07:00
AssignLinuxCapabilities.md reorganize samples 2019-10-23 14:45:27 -07:00
CheckUserGroup.md reorganize samples 2019-10-23 14:45:27 -07:00
ConfigureKernelParmeters.md reorganize samples 2019-10-23 14:45:27 -07:00
DefaultDenyAllIngress.md update descriptions... 2019-10-23 15:36:37 -07:00
DisablePrivilegedContainers.md update descriptions... 2019-10-23 15:36:37 -07:00
DisallowAutomountSACredentials.md reorganize samples 2019-10-23 14:45:27 -07:00
DisallowDefaultNamespace.md update descriptions... 2019-10-23 15:36:37 -07:00
DisallowDockerSockMount.md update README.md and markdown 2019-11-01 15:23:42 -07:00
DisallowHelmTiller.md add disallow Helm tiller 2019-11-03 18:19:06 -08:00
DisallowHostFS.md fix for https://github.com/nirmata/kyverno/issues/409 2019-10-30 12:51:07 -07:00
DisallowHostNetworkPort.md update message string 2019-11-01 15:21:23 -07:00
DisallowHostPIDIPC.md update policy YAML 2019-11-07 19:20:51 -08:00
DisallowLatestTag.md update descriptions... 2019-10-23 15:36:37 -07:00
DisallowNewCapabilities.md update markdown 2019-11-01 15:10:42 -07:00
DisallowUnknownRegistries.md - add policy and test for known ingress 2019-11-05 19:07:44 -08:00
KnownIngressClass.md - add policy and test for known ingress 2019-11-05 19:07:44 -08:00
LimitNodePort.md reorganize samples 2019-10-23 14:45:27 -07:00
MutateSafeToEvict.md add policy doc 2019-11-05 16:45:37 -08:00
README.md - add policy and test for known ingress 2019-11-05 19:07:44 -08:00
RequireNSLimitsQuotas.md update policy 2019-10-24 18:41:37 -05:00
RequirePodProbes.md update descriptions... 2019-10-23 15:36:37 -07:00
RequirePodRequestsLimits.md update descriptions... 2019-10-23 15:36:37 -07:00
RequireReadOnlyFS.md update descriptions... 2019-10-23 15:36:37 -07:00
RunAsNonRootUser.md update message string 2019-11-01 15:21:23 -07:00

Sample Policies

Sample policies are designed to be applied to your Kubernetes clusters with minimal changes. To apply these policies to your cluster, install Kyverno and import the policies as follows:

Install Kyverno

kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml

(installation docs)

Apply Kyverno Policies

To start applying policies to your cluster, first clone the repo:

git clone https://github.com/nirmata/kyverno.git
cd kyverno

Import best_practices from here:

kubectl create -f samples/best_practices

Import addition policies from here:

kubectl create -f samples/more/

The policies are mostly validation rules in audit mode i.e. your existing workloads will not be impacted, but will be audited for policy complaince.

Best Practice Policies

These policies are highly recommended.

  1. Run as non-root user
  2. Disable privileged containers and disallow privilege escalation
  3. Disallow new capabilities
  4. Require read-only root filesystem
  5. Disallow use of bind mounts (hostPath volumes)
  6. Disallow docker socket bind mount
  7. Disallow hostNetwork and hostPort
  8. Disallow hostPID and hostIPC
  9. Disallow unknown image registries
  10. Disallow latest image tag
  11. Disallow use of default namespace
  12. Require namespace limits and quotas
  13. Require pod resource requests and limits
  14. Require pod livenessProbe and readinessProbe
  15. Default deny all ingress traffic
  16. Disallow Helm Tiller
  17. Add safe-to-evict for pods with emptyDir and hostPath volumes

Additional Policies

The policies provide additional best practices and are worthy of close consideration. These policies may require workload specific changes.

  1. Limit use of NodePort services
  2. Limit automount of Service Account credentials
  3. Configure Linux Capabilities
  4. Limit Kernel parameter access
  5. Restrict ingress class