ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/require-drop-all-capabilities.yaml

@@ -0,0 +1,59 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-drop-all-capabilities
+  annotations:
+    policies.kyverno.io/title: Require capabilities.drop ALL
+    policies.kyverno.io/category: Pod Security
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/description: >-
+      Require every container to drop ALL capabilities (add back only what is
+      needed).
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+    - name: require-capabilities-drop-all
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-system
+                - kube-public
+                - kube-node-lease
+                - flux-system
+                - flux-canary
+                - kyverno
+                - cert-manager
+                - cilium-secrets
+                - olm
+                - operators
+                - longhorn
+                - openebs
+                - intel-system
+                - nfd
+      validate:
+        message: >-
+          Containers must set securityContext.capabilities.drop to include ALL.
+        pattern:
+          spec:
+            =(initContainers):
+              - securityContext:
+                  capabilities:
+                    drop:
+                      - ALL
+            =(ephemeralContainers):
+              - securityContext:
+                  capabilities:
+                    drop:
+                      - ALL
+            containers:
+              - securityContext:
+                  capabilities:
+                    drop:
+                      - ALL