mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-09 09:26:54 +00:00
ae8264deae
# Conflicts: # examples/best_practices/policy_validate_container_disallow_priviledgedprivelegesecalation.yaml # examples/best_practices/policy_validate_container_security_context.yaml # examples/best_practices/validate_container_security_context.yaml |
||
|---|---|---|
| .. | ||
| resources | ||
| policy_mutate_pod_disable_automountingapicred.yaml | ||
| policy_validate_container_disallow_priviledgedprivelegesecalation.yaml | ||
| policy_validate_default_namespace.yaml | ||
| policy_validate_deny_runasrootuser.yaml | ||
| policy_validate_host_network_port.yaml | ||
| policy_validate_host_path.yaml | ||
| policy_validate_image_latest_ifnotpresent_deny.yaml | ||
| policy_validate_image_pullpolicy_notalways_deny.yaml | ||
| policy_validate_image_registries.yaml | ||
| policy_validate_image_tag.yaml | ||
| policy_validate_image_tag_latest_deny.yaml | ||
| policy_validate_image_tag_notspecified_deny.yaml | ||
| policy_validate_pod_probes.yaml | ||
| README.md | ||
Best Practice Policies
| Best practice | Policy |
|---|---|
| Run as non-root user | policy_validate_deny_runasrootuser.yaml |
| Disallow privileged and privilege escalation | policy_validate_container_disallow_priviledgedprivelegesecalation.yaml |
| Disallow use of host networking and ports | policy_validate_host_network_port.yaml |
| Disallow use of host filesystem | policy_validate_host_path.yaml |
| Disallow hostPOD and hostIPC | |
| Require read only root filesystem | |
| Disallow node ports | |
| Allow trusted registries | policy_validate_image_registries.yaml |
| Require resource requests and limits | policy_validate_pod_resources.yaml |
| Require pod liveness and readiness probes | policy_validate_pod_probes.yaml |
| Require an image tag | policy_validate_image_tag_notspecified_deny.yaml |
| Disallow latest tag and pull IfNotPresent | policy_validate_image_latest_ifnotpresent_deny.yaml |
| Require a namespace (disallow default) | |
| Disallow use of kube-system namespace | |
| Prevent mounting of service account secret | |
| Require a default network policy | |
| Require namespace quotas and limit ranges |