ghndrx/homelab-gitops
1
0
Fork 0
mirror of https://github.com/ghndrx/homelab-gitops.git synced 2026-02-10 06:44:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(kyverno): add policy engine with security baseline

Browse Source 
- Kyverno 3.3.4 via Helm (HA config: 3 admission, 2 background replicas)
- Validation policies:
  - disallow-privileged-containers (Enforce)
  - require-resource-limits (Enforce)
  - require-labels (Audit - standard k8s labels)
  - require-run-as-non-root (Audit)
  - disallow-latest-tag (Enforce - GitOps reproducibility)
- Mutating policy:
  - add-default-securitycontext (seccomp, drop caps, read-only fs)
- System namespaces excluded (kube-system, kyverno, istio-system)
- Auto-discovered by ArgoCD ApplicationSet

Reference: CIS Kubernetes Benchmark, Pod Security Standards
This commit is contained in:
Greg Hendrickson
2026-02-09 18:02:21 +00:00
parent 124a29a0a9
commit 3752fd0386
10 changed files with 445 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
infrastructure/kyverno/policies/kustomization.yaml Normal file
View File

@@ -0,0 +1,12 @@
# infrastructure/kyverno/policies/kustomization.yaml
# Security policies for cluster-wide enforcement
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- disallow-privileged.yaml
- require-resource-limits.yaml
- require-labels.yaml
- require-non-root.yaml
- disallow-latest-tag.yaml
- add-default-securitycontext.yaml