completed lesson 31

lab/lesson-31-answer.yaml

@@ -0,0 +1,27 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: security-admission
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiVersions: ["v1"]
+      apiGroups: [""]
+      operations: ["CREATE","UPDATE"]
+      resources: ["pods"]
+  validations:
+    - expression: "object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true) && (!has(object.spec.initContainers) || object.spec.initContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true))"
+      message: "Privileged regular and init containers are not allowed"
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata: 
+  name: security-admission-binding
+spec:
+  policyName: security-admission
+  validationActions: [Deny]
+  matchResources:
+    namespaceSelector:
+      matchLabels:
+        cks-training: admission