Loading...
Generate a Kyverno ClusterPolicy from common guardrails — disallow :latest, require limits/probes/non-root, restrict registries, require labels.
Roll out as Audit, watch PolicyReports, then flip to Enforce.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: platform-guardrails
spec:
validationFailureAction: Audit # start in Audit, then flip to Enforce
background: true
rules:
- name: disallow-latest
match:
any:
- resources:
kinds: [Pod]
exclude:
any:
- resources:
namespaces: [kube-system, kyverno]
validate:
message: "Using a mutable ':latest' tag is not allowed — pin a version."
pattern:
spec:
containers:
- image: "!*:latest"
- name: require-limits
match:
any:
- resources:
kinds: [Pod]
exclude:
any:
- resources:
namespaces: [kube-system, kyverno]
validate:
message: "CPU and memory limits are required."
pattern:
spec:
containers:
- resources:
limits:
memory: "?*"
cpu: "?*"
- name: require-runasnonroot
match:
any:
- resources:
kinds: [Pod]
exclude:
any:
- resources:
namespaces: [kube-system, kyverno]
validate:
message: "Containers must run as non-root."
pattern:
spec:
securityContext:
runAsNonRoot: true
Test with kyverno apply in CI before applying. Learn the model in the Kyverno tutorial.