apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: kyverno-bestpractices
  namespace: kyverno-policies
placementRef:
  apiGroup: apps.open-cluster-management.io
  kind: PlacementRule
  name: kyverno
subjects:
- apiGroup: policy.open-cluster-management.io
  kind: PolicySet
  name: kyverno-best-practices
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: kyverno-security
  namespace: kyverno-policies
placementRef:
  apiGroup: apps.open-cluster-management.io
  kind: PlacementRule
  name: kyverno
subjects:
- apiGroup: policy.open-cluster-management.io
  kind: PolicySet
  name: kyverno-security
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: application-field-validation
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-application-field-validation
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: application-field-validation
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: application-field-validation
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: application-prevent-default-project
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-application-prevent-default-project
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: application-prevent-default-project
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: application-prevent-default-project
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: check-deprecated-apis
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-check-deprecated-apis
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: check-deprecated-apis
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: check-deprecated-apis
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: check-openshift-deprecated-apis
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-check-openshift-deprecated-apis
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: check-openshift-deprecated-apis
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: check-openshift-deprecated-apis
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: disallow-jenkins-pipeline-strategy
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-disallow-jenkins-pipeline-strategy
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: disallow-jenkins-pipeline-strategy
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: disallow-jenkins-pipeline-strategy
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: disallow-latest-tag
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-disallow-latest-tag
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: disallow-latest-tag
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: disallow-latest-tag
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: disallow-scc-anyuid
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-disallow-security-context-constraint-anyuid
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: disallow-security-context-constraint-anyuid
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: disallow-security-context-constraint-anyuid
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: policy-require-pod-probes
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-require-pod-probes
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: require-pod-probes
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: require-pod-probes
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: require-requests-limits
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-require-requests-limits
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: require-requests-limits
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: require-requests-limits
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: setup
    policy.open-cluster-management.io/controls: setup
    policy.open-cluster-management.io/disable-templates: "true"
    policy.open-cluster-management.io/standards: generic
  name: require-tls-routes
  namespace: kyverno-policies
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: inform-kyverno-check-routes
      spec:
        namespaceSelector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: ClusterPolicyReport
            results:
            - policy: check-routes
              result: fail
        - complianceType: mustnothave
          objectDefinition:
            apiVersion: wgpolicyk8s.io/v1alpha2
            kind: PolicyReport
            results:
            - policy: check-routes
              result: fail
        remediationAction: inform
        severity: medium
---
apiVersion: policy.open-cluster-management.io/v1beta1
kind: PolicySet
metadata:
  name: kyverno-best-practices
  namespace: kyverno-policies
spec:
  description: Kyverno Best Practices
  policies:
  - application-field-validation
  - application-prevent-default-project
  - check-deprecated-apis
  - check-openshift-deprecated-apis
  - disallow-jenkins-pipeline-strategy
  - disallow-latest-tag
  - policy-require-pod-probes
  - require-requests-limits
---
apiVersion: policy.open-cluster-management.io/v1beta1
kind: PolicySet
metadata:
  name: kyverno-security
  namespace: kyverno-policies
spec:
  description: Kyverno Security
  policies:
  - disallow-scc-anyuid
  - require-tls-routes