init

05-variables/03-templates/kyverno-policies/templates/disallow-privileged.yaml

@@ -0,0 +1,42 @@
+{{- if .Values.disallowPrivileged.enabled }}
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-privileged-containers
+  annotations:
+    policies.kyverno.io/title: "Запрет привилегированных контейнеров"
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/severity: critical
+    policies.kyverno.io/version: {{ .Chart.Version }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+spec:
+  validationFailureAction: {{ .Values.disallowPrivileged.failureAction | default .Values.global.failureAction }}
+  background: true
+  rules:
+  - name: privileged-containers
+    match:
+      resources:
+        kinds:
+        - Pod
+    exclude:
+      resources:
+        namespaces:
+        {{- range .Values.global.excludedNamespaces }}
+        - {{ . }}
+        {{- end }}
+    validate:
+      message: >-
+        Контейнер '{{ "{{" }} element.name {{ "}}" }}' имеет privileged: true.
+        Привилегированные контейнеры запрещены политикой безопасности.
+      foreach:
+      - list: >-
+          request.object.spec.containers[] |
+          merge(request.object.spec.initContainers[] || `[]`, @) |
+          merge(request.object.spec.ephemeralContainers[] || `[]`, @)
+        deny:
+          conditions:
+            any:
+            - key: "{{ "{{" }} element.securityContext.privileged {{ "}}" }}"
+              operator: Equals
+              value: true
+{{- end }}