feat(tyr): write gatekeeper container security policy

project/roadmap.md

@@ -14,8 +14,12 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 2: Network Hardening & Perimeter Defense
 - [x] Establish GCP VPC Service Controls (VPC-SC) perimeter.
 - [x] Configure Private Service Connect (PSC) for all Google APIs.
+- [x] Deploy Cloud Armor WAF policy.
 - [x] Enforce IAP-only SSH and restrict Cloud Run ingress.
 
+## Phase 3: Runtime Enforcers & Workload Security
+- [x] Draft Gatekeeper container security policy.
+
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.
 - [x] Implement `build_and_deploy_service` MCP tool.

tyr/memory_bank/completed.md

@@ -27,3 +27,7 @@
 - **Task 2.4: Harden Ingress**
   - Status: **Complete**
   - Notes: Replaced default SSH rule with IAP-only rule and set Cloud Run ingress to internal.
+
+- **Task 3.1: Draft Gatekeeper Policy**
+  - Status: **Complete**
+  - Notes: Wrote `container_security.yaml` with policies to disallow root and require resource limits.

tyr/policy/container_security.yaml

@@ -0,0 +1,70 @@
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8sdisallowroot
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sDisallowRoot
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8sdisallowroot
+
+        violation[{"msg": msg}] {
+          input.review.object.spec.securityContext.runAsNonRoot == false
+          msg := "Containers must not run as root. Set spec.securityContext.runAsNonRoot to true."
+        }
+
+        violation[{"msg": msg}] {
+          some c in input.review.object.spec.containers
+          c.securityContext.runAsNonRoot == false
+          msg := sprintf("Container %v must not run as root. Set securityContext.runAsNonRoot to true.", [c.name])
+        }
+---
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sDisallowRoot
+metadata:
+  name: disallow-root-containers
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+---
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8srequiredlimits
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sRequiredLimits
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8srequiredlimits
+
+        violation[{"msg": msg}] {
+          some c in input.review.object.spec.containers
+          not c.resources.limits.cpu
+          msg := sprintf("Container %v must have a CPU limit.", [c.name])
+        }
+
+        violation[{"msg": msg}] {
+          some c in input.review.object.spec.containers
+          not c.resources.limits.memory
+          msg := sprintf("Container %v must have a memory limit.", [c.name])
+        }
+---
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sRequiredLimits
+metadata:
+  name: require-resource-limits
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]