Kyverno

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-nodeport-cel
  annotations:
    policies.kyverno.io/title: Disallow NodePort in CEL expressions
    policies.kyverno.io/category: Best Practices in CEL
spec:
  validationFailureAction: Enforce (1)
  background: true (2)
  rules:
    - name: validate-nodeport (3)
      match: (4)
        any: (5)
          - resources:
              kinds: (6)
                - Service
              operations: (7)
                - CREATE
                - UPDATE
      validate: (8)
        cel:
          expressions: (9)
            - expression: "has(object.spec.type) ? (object.spec.type != 'NodePort') : true" (10)
              message: "Services of type NodePort are not allowed."

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resources
  annotations:
    policies.kyverno.io/title: Require CPU and memory requests/limits
    policies.kyverno.io/category: Best Practices
spec:
  validationFailureAction: Enforce (1)
  background: true (2)
  rules:
    - name: require-resources-containers (3)
      match: (4)
        any: (5)
          - resources:
              kinds: (6)
                - Pod
      validate: (7)
        message: "Each container must set cpu and memory requests and limits." (8)
        pattern: (9)
          spec:
            containers:
              - resources:
                  requests:
                    cpu: "?*" (10)
                    memory: "?*" (11)
                  limits:
                    cpu: "?*" (12)
                    memory: "?*" (13)
            initContainers:
              - resources:
                  limits:
                    cpu: '?*' (14)
                    memory: '?*' (15)
                  requests:
                    cpu: '?*' (16)
                    memory: '?*' (17)

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
  annotations:
    policies.kyverno.io/title: Restrict image registries
    policies.kyverno.io/category: Supply Chain Security
spec:
  validationFailureAction: Enforce (1)
  background: true (2)
  rules:
    - name: allowed-registries (3)
      match: (4)
        any: (5)
          - resources:
              kinds: (6)
                - Pod
      validate:
        message: "Images must be pulled only from hub.nova-platform.io/registry." (7)
        foreach: (8)
          - list: "request.object.spec.containers" (9)
            preconditions: (10)
              all:
                - key: "{{ element.image }}"
                  operator: NotEquals
                  value: ""
            deny: (11)
              conditions: (12)
                any:
                  - key: "{{ element.image }}"
                    operator: NotEquals
                    value: "hub.nova-platform.io/registry/*"
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
  annotations:
    policies.kyverno.io/title: Disallow latest tag
    policies.kyverno.io/category: Supply Chain Security
spec:
  validationFailureAction: Enforce (1)
  background: true (2)
  rules:
    - name: no-latest-tag (3)
      match: (4)
        any: (5)
          - resources:
              kinds: (6)
                - Pod
      validate:
        message: "Using tag 'latest' or no tag is not allowed. Use a specific version." (7)
        foreach: (8)
          - list: "request.object.spec.containers" (9)
            deny: (10)
              conditions: (11)
                any:
                  - key: "{{ element.image }}"
                    operator: Equals
                    value: "*:latest"
                  - key: "{{ element.image }}"
                    operator: NotEquals
                    value: "*:*"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-run-as-non-root
  annotations:
    policies.kyverno.io/title: Require runAsNonRoot
    policies.kyverno.io/category: Pod Security Standards
spec:
  validationFailureAction: Enforce (1)
  background: true (2)
  rules:
    - name: check-runasnonroot (3)
      match: (4)
        any: (5)
          - resources:
              kinds: (6)
                - Pod
      validate:
        message: >- (7)
          Running as root is not allowed. Either the field spec.securityContext.runAsNonRoot
          must be set to `true`, or all containers must set securityContext.runAsNonRoot to `true`.
        anyPattern: (8)
          - spec:
              securityContext:
                runAsNonRoot: true (9)
              =(ephemeralContainers):
                - =(securityContext):
                    =(runAsNonRoot): true (10)
              =(initContainers):
                - =(securityContext):
                    =(runAsNonRoot): true (11)
              containers:
                - =(securityContext):
                    =(runAsNonRoot): true (12)
          - spec:
              =(ephemeralContainers):
                - securityContext:
                    runAsNonRoot: true (13)
              =(initContainers):
                - securityContext:
                    runAsNonRoot: true (14)
              containers:
                - securityContext:
                    runAsNonRoot: true (15)