476 lines
14 KiB
YAML
476 lines
14 KiB
YAML
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: PlacementBinding
|
|
metadata:
|
|
name: kyverno-bestpractices
|
|
namespace: kyverno-policies
|
|
placementRef:
|
|
apiGroup: apps.open-cluster-management.io
|
|
kind: PlacementRule
|
|
name: kyverno
|
|
subjects:
|
|
- apiGroup: policy.open-cluster-management.io
|
|
kind: PolicySet
|
|
name: kyverno-best-practices
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: PlacementBinding
|
|
metadata:
|
|
name: kyverno-security
|
|
namespace: kyverno-policies
|
|
placementRef:
|
|
apiGroup: apps.open-cluster-management.io
|
|
kind: PlacementRule
|
|
name: kyverno
|
|
subjects:
|
|
- apiGroup: policy.open-cluster-management.io
|
|
kind: PolicySet
|
|
name: kyverno-security
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: application-field-validation
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-application-field-validation
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: application-field-validation
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: application-field-validation
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: application-prevent-default-project
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-application-prevent-default-project
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: application-prevent-default-project
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: application-prevent-default-project
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: check-deprecated-apis
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-check-deprecated-apis
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: check-deprecated-apis
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: check-deprecated-apis
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: check-openshift-deprecated-apis
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-check-openshift-deprecated-apis
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: check-openshift-deprecated-apis
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: check-openshift-deprecated-apis
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: disallow-jenkins-pipeline-strategy
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-disallow-jenkins-pipeline-strategy
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: disallow-jenkins-pipeline-strategy
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: disallow-jenkins-pipeline-strategy
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: disallow-latest-tag
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-disallow-latest-tag
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: disallow-latest-tag
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: disallow-latest-tag
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: disallow-scc-anyuid
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-disallow-security-context-constraint-anyuid
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: disallow-security-context-constraint-anyuid
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: disallow-security-context-constraint-anyuid
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: policy-require-pod-probes
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-require-pod-probes
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: require-pod-probes
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: require-pod-probes
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: require-requests-limits
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-require-requests-limits
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: require-requests-limits
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: require-requests-limits
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
policy.open-cluster-management.io/categories: setup
|
|
policy.open-cluster-management.io/controls: setup
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
policy.open-cluster-management.io/standards: generic
|
|
name: require-tls-routes
|
|
namespace: kyverno-policies
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: inform-kyverno-check-routes
|
|
spec:
|
|
namespaceSelector:
|
|
exclude:
|
|
- kube-*
|
|
include:
|
|
- '*'
|
|
object-templates:
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: ClusterPolicyReport
|
|
results:
|
|
- policy: check-routes
|
|
result: fail
|
|
- complianceType: mustnothave
|
|
objectDefinition:
|
|
apiVersion: wgpolicyk8s.io/v1alpha2
|
|
kind: PolicyReport
|
|
results:
|
|
- policy: check-routes
|
|
result: fail
|
|
remediationAction: inform
|
|
severity: medium
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1beta1
|
|
kind: PolicySet
|
|
metadata:
|
|
name: kyverno-best-practices
|
|
namespace: kyverno-policies
|
|
spec:
|
|
description: Kyverno Best Practices
|
|
policies:
|
|
- application-field-validation
|
|
- application-prevent-default-project
|
|
- check-deprecated-apis
|
|
- check-openshift-deprecated-apis
|
|
- disallow-jenkins-pipeline-strategy
|
|
- disallow-latest-tag
|
|
- policy-require-pod-probes
|
|
- require-requests-limits
|
|
---
|
|
apiVersion: policy.open-cluster-management.io/v1beta1
|
|
kind: PolicySet
|
|
metadata:
|
|
name: kyverno-security
|
|
namespace: kyverno-policies
|
|
spec:
|
|
description: Kyverno Security
|
|
policies:
|
|
- disallow-scc-anyuid
|
|
- require-tls-routes
|