mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
.. | ||
best_practices | ||
more | ||
AssignLinuxCapabilities.md | ||
CheckUserGroup.md | ||
ConfigureKernelParmeters.md | ||
DefaultDenyAllIngress.md | ||
DisablePrivilegedContainers.md | ||
DisallowAutomountSACredentials.md | ||
DisallowDefaultNamespace.md | ||
DisallowHostFS.md | ||
DisallowHostNetworkPort.md | ||
DisallowHostPIDIPC.md | ||
DisallowLatestTag.md | ||
DisallowNewCapabilities.md | ||
DisallowUnknownRegistries.md | ||
LimitNodePort.md | ||
README.md | ||
RequireNSLimitsQuotas.md | ||
RequirePodProbes.md | ||
RequirePodRequestsLimits.md | ||
RequireReadOnlyFS.md | ||
RunAsNonRootUser.md |
Sample Policies
Sample policies are designed to be applied to your Kubernetes clusters with minimal changes. To apply these policies to your cluster, install Kyverno and import the policies as follows:
Install Kyverno
kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml
Apply Kyverno Policies
kubectl create -f https://github.com/nirmata/kyverno/raw/master/samples/best_practices/
kubectl create -f https://github.com/nirmata/kyverno/raw/master/samples/more/
The policies are mostly validation rules in audit
mode i.e. your existing workloads will not be impacted, but will be audited for policy complaince.
Best Practice Policies
These policies are highly recommended.
- Run as non-root user
- Disable privileged containers and disallow privilege escalation
- Require Read-only root filesystem
- Disallow use of host filesystem
- Disallow
hostNetwork
andhostPort
- Disallow
hostPID
andhostIPC
- Disallow unknown image registries
- Disallow latest image tag
- Disallow use of default namespace
- Require namespace limits and quotas
- Require pod resource requests and limits
- Require pod
livenessProbe
andreadinessProbe
- Default deny all ingress traffic
Additional Policies
The policies provide additional best practices and are worthy of close consideration. These policies may require workload specific changes.