diff --git a/charts/test-krish-globalps/Chart.yaml b/charts/test-krish-globalps/Chart.yaml index a3f1d219..1938df88 100644 --- a/charts/test-krish-globalps/Chart.yaml +++ b/charts/test-krish-globalps/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: test-krish description: Pod Security Standards (baseline) policy set type: application -version: 0.4.5 +version: 0.4.6 appVersion: 0.1.0 keywords: - kubernetes diff --git a/charts/test-krish-globalps/pols/disallow-selinux.yaml b/charts/test-krish-globalps/pols/disallow-selinux.yaml deleted file mode 100644 index cb9fd456..00000000 --- a/charts/test-krish-globalps/pols/disallow-selinux.yaml +++ /dev/null @@ -1,79 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: disallow-selinux - annotations: - policies.kyverno.io/title: Disallow SELinux - policies.kyverno.io/category: Pod Security Standards (Baseline) - policies.kyverno.io/severity: medium - policies.kyverno.io/subject: Pod - kyverno.io/kubernetes-version: "1.22-1.23" - policies.nirmata.io/remediation-docs: "https://docs.nirmata.io/policysets/podsecurity/baseline/disallow-selinux/" - policies.kyverno.io/description: >- - SELinux options can be used to escalate privileges and should not be allowed. This policy - ensures that the `seLinuxOptions` field is undefined. -spec: - validationFailureAction: Audit - background: true - rules: - - name: selinux-type - match: - any: - - resources: - kinds: - - Pod - validate: - message: >- - Setting the SELinux type is restricted. - pattern: - spec: - =(securityContext): - =(seLinuxOptions): - =(type): "container_t | container_init_t | container_kvm_t" - =(ephemeralContainers): - - =(securityContext): - =(seLinuxOptions): - =(type): "container_t | container_init_t | container_kvm_t" - =(initContainers): - - =(securityContext): - =(seLinuxOptions): - =(type): "container_t | container_init_t | container_kvm_t" - containers: - - =(securityContext): - =(seLinuxOptions): - =(type): "container_t | container_init_t | container_kvm_t" - - name: selinux-user-role - match: - any: - - resources: - kinds: - - Pod - validate: - message: >- - Setting the SELinux user or role is forbidden. The fields - spec.securityContext.seLinuxOptions.user, spec.securityContext.seLinuxOptions.role, - spec.containers[*].securityContext.seLinuxOptions.user, spec.containers[*].securityContext.seLinuxOptions.role, - spec.initContainers[*].securityContext.seLinuxOptions.user, spec.initContainers[*].securityContext.seLinuxOptions.role, - spec.ephemeralContainers[*].securityContext.seLinuxOptions.user, and spec.ephemeralContainers[*].securityContext.seLinuxOptions.role - must be unset. - pattern: - spec: - =(securityContext): - =(seLinuxOptions): - X(user): "null" - X(role): "null" - =(ephemeralContainers): - - =(securityContext): - =(seLinuxOptions): - X(user): "null" - X(role): "null" - =(initContainers): - - =(securityContext): - =(seLinuxOptions): - X(user): "null" - X(role): "null" - containers: - - =(securityContext): - =(seLinuxOptions): - X(user): "null" - X(role): "null"