91 lines
2.0 KiB
YAML
91 lines
2.0 KiB
YAML
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: PolicyGenerator
|
|
metadata:
|
|
name: kyverno-bestpractices
|
|
placementBindingDefaults:
|
|
name: kyverno-bestpractices
|
|
policyDefaults:
|
|
policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"}
|
|
categories:
|
|
- CM Configuration Management
|
|
controls:
|
|
- CM-2 Baseline Configuration
|
|
namespace: kyverno-policies
|
|
remediationAction: enforce
|
|
severity: medium
|
|
policySets:
|
|
- kyverno-best-practices
|
|
standards:
|
|
- generic
|
|
generatePlacementWhenInSet: false
|
|
policies:
|
|
- name: policy-require-pod-probes
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/validate-probes-policy.yaml
|
|
- name: require-requests-limits
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/require-requests-limits-policy.yaml
|
|
- name: application-field-validation
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/application-field-validation.yaml
|
|
- name: application-prevent-default-project
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/application-prevent-default-project.yaml
|
|
- name: check-deprecated-apis
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/check-deprecated-apis.yaml
|
|
- name: check-openshift-deprecated-apis
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/check-openshift-deprecated-apis.yaml
|
|
- name: disallow-jenkins-pipeline-strategy
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/disallow-jenkins-pipeline-strategy.yaml
|
|
- name: disallow-latest-tag
|
|
categories:
|
|
- setup
|
|
controls:
|
|
- setup
|
|
disabled: false
|
|
manifests:
|
|
- path: policies/disallow-latest-tag.yaml
|
|
policySets:
|
|
- description: Kyverno Best Practices
|
|
name: kyverno-best-practices
|
|
placement:
|
|
placementRuleName: kyverno
|