27 lines
1001 B
YAML
27 lines
1001 B
YAML
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicy
|
|
metadata:
|
|
name: security-admission
|
|
spec:
|
|
failurePolicy: Fail
|
|
matchConstraints:
|
|
resourceRules:
|
|
- apiVersions: ["v1"]
|
|
apiGroups: [""]
|
|
operations: ["CREATE","UPDATE"]
|
|
resources: ["pods"]
|
|
validations:
|
|
- expression: "object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true) && (!has(object.spec.initContainers) || object.spec.initContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true))"
|
|
message: "Privileged regular and init containers are not allowed"
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicyBinding
|
|
metadata:
|
|
name: security-admission-binding
|
|
spec:
|
|
policyName: security-admission
|
|
validationActions: [Deny]
|
|
matchResources:
|
|
namespaceSelector:
|
|
matchLabels:
|
|
cks-training: admission |