mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-09 09:26:54 +00:00
Code Activity
kyverno/examples/best_practices
History
Shuting Zhao bc087d7918 Merge branch 'master' of https://github.com/nirmata/kyverno into best_practice_policies 
# Conflicts:
#	examples/best_practices/validate_default_namespace.yaml
2019-09-06 17:04:44 -07:00
..
resources start best practice policies 2019-09-04 11:08:25 -07:00
policy_mutate_pod_disable_automountingapicred.yaml add policies 2019-09-06 10:03:24 -07:00
policy_validate_image_latest_ifnotpresent_deny.yaml add policies 2019-09-06 10:03:24 -07:00
policy_validate_image_pullpolicy_notalways_deny.yaml add policies 2019-09-06 10:03:24 -07:00
policy_validate_image_tag.yaml add policies 2019-09-06 10:03:24 -07:00
policy_validate_image_tag_latest_deny.yaml add policies 2019-09-06 10:03:24 -07:00
policy_validate_image_tag_notspecified_deny.yaml add policies 2019-09-06 10:03:24 -07:00
policy_validate_pod_probes.yaml add policies 2019-09-06 10:03:24 -07:00
policy_validate_pod_resources.yaml add policies 2019-09-06 10:03:24 -07:00
README.md start best practice policies 2019-09-04 11:08:25 -07:00
resource_default_namespace.yaml add policies 2019-09-06 10:03:24 -07:00
resource_mutate_pod_disable_automountingapicred.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_latest_ifnotpresent_deny.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_latest_ifnotpresent_pass.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_pullpolicy_notalways_deny.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_pullpolicy_notalways_pass.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_tag_latest_deny.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_tag_latest_pass.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_tag_notspecified_deny.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_image_tag_notspecified_pass.yaml add policies 2019-09-06 10:03:24 -07:00
resource_validate_pod_resources.yaml add policies 2019-09-06 10:03:24 -07:00
validate_container_security_context.yaml rename policy to cluster policy 2019-09-04 11:29:46 -07:00
validate_default_namespace.yaml add policies 2019-09-06 10:03:24 -07:00
validate_host_network_port.yaml rename policy to cluster policy 2019-09-04 11:29:46 -07:00
validate_host_path.yaml update examples/best_practices/validate_host_path.yaml 2019-09-06 17:02:47 -07:00
validate_image_registries.yaml rename policy to cluster policy 2019-09-04 11:29:46 -07:00
validate_image_tag.yaml rename policy to cluster policy 2019-09-04 11:29:46 -07:00
validate_pod_probes.yaml rename policy to cluster policy 2019-09-04 11:29:46 -07:00
validate_pod_resources.yaml rename policy to cluster policy 2019-09-04 11:29:46 -07:00

README.md

Best Practice Policies

This folder contains recommended policies

Best practice Policy
Run as non-root user
Disallow privileged and privilege escalation
Disallow use of host networking and ports
Disallow use of host filesystem
Disallow hostPOD and hostIPC
Require read only root filesystem
Disallow node ports
Allow trusted registries
Require resource requests and limits container_resources.yaml
Require pod liveness and readiness probes
Require an image tag
Disallow latest tag and pull IfNotPresent
Require a namespace (disallow default)
Disallow use of kube-system namespace
Prevent mounting of service account secret
Require a default network policy
Require namespace quotas and limit ranges