Listing 1: Policy "restrict-privileged-containers"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: restrict-privileged-containers
annotations:
policies.kyverno.io/title:
Restrict Privileged Containers
policies.kyverno.io/category: Pod Security
Standards (Restricted)
policies.kyverno.io/description: >-
Privileged containers have unrestricted
access to the host, posing a security risk.
This policy denies pods that attempt to
run containers in privileged mode.
spec:
validationFailureAction: Enforce
background: true
rules:
- name: check-privileged
match:
any:
- resources:
kinds:
- Pod
validate:
message: "Privileged containers are not
allowed."
pattern:
spec:
containers:
- securityContext:
privileged: false


Listing 2: Policy zur Image-Verifikation

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: restrict-google-artifact-registry
annotations:
policies.kyverno.io/title: Restrict Images to
Google Artifact Registry
policies.kyverno.io/category: Security
policies.kyverno.io/description: >-
Ensures that container images come from the
Google Artifact Registry of a specific
project (my-project-id)
spec:
validationFailureAction: Enforce
background: true
rules:
- name: check-artifact-registry
match:
any:
- resources:
kinds:
- Pod
- Deployment
- StatefulSet
validate:
message: "Images must come from
europe-west3-docker.pkg.dev/my-project-id/*."
foreach:
- list: "request.object.spec.containers"
pattern:
image: "europe-west3-docker.pkg.dev/
my-project-id/*"


Listing 3: Prüfung auf Namespace-Labels

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: nodepool-selector
spec:
rules:
- name: nodepool-selector
match:
any:
- resources:
kinds:
- Pod
namespaceSelector:
matchLabels:
it-administrator.de/match: "true"
mutate:
patchStrategicMerge:
metadata:
labels:
+(team): kubernetes


Listing 4: Test-Manifest

apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
name: restrict-artifact-registry-test
policies:
- restrict-artifact-registry.yaml
resources:
- valid-pod.yaml
- invalid-pod.yaml
results:
- policy: restrict-google-artifact-registry
rule: check-artifact-registry
resource: valid-pod
kind: Pod
result: pass
- policy: restrict-google-artifact-registry
rule: check-artifact-registry
resource: invalid-pod
kind: Pod
result: fail