Chris Christiansen
9fcb9c354a
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
71 lines
1.8 KiB
YAML
71 lines
1.8 KiB
YAML
apiVersion: templates.gatekeeper.sh/v1
|
|
kind: ConstraintTemplate
|
|
metadata:
|
|
name: k8sdisallowroot
|
|
spec:
|
|
crd:
|
|
spec:
|
|
names:
|
|
kind: K8sDisallowRoot
|
|
targets:
|
|
- target: admission.k8s.gatekeeper.sh
|
|
rego: |
|
|
package k8sdisallowroot
|
|
|
|
violation[{"msg": msg}] {
|
|
input.review.object.spec.securityContext.runAsNonRoot == false
|
|
msg := "Containers must not run as root. Set spec.securityContext.runAsNonRoot to true."
|
|
}
|
|
|
|
violation[{"msg": msg}] {
|
|
some c in input.review.object.spec.containers
|
|
c.securityContext.runAsNonRoot == false
|
|
msg := sprintf("Container %v must not run as root. Set securityContext.runAsNonRoot to true.", [c.name])
|
|
}
|
|
---
|
|
apiVersion: constraints.gatekeeper.sh/v1beta1
|
|
kind: K8sDisallowRoot
|
|
metadata:
|
|
name: disallow-root-containers
|
|
spec:
|
|
match:
|
|
kinds:
|
|
- apiGroups: [""]
|
|
kinds: ["Pod"]
|
|
---
|
|
apiVersion: templates.gatekeeper.sh/v1
|
|
kind: ConstraintTemplate
|
|
metadata:
|
|
name: k8srequiredlimits
|
|
spec:
|
|
crd:
|
|
spec:
|
|
names:
|
|
kind: K8sRequiredLimits
|
|
targets:
|
|
- target: admission.k8s.gatekeeper.sh
|
|
rego: |
|
|
package k8srequiredlimits
|
|
|
|
violation[{"msg": msg}] {
|
|
some c in input.review.object.spec.containers
|
|
not c.resources.limits.cpu
|
|
msg := sprintf("Container %v must have a CPU limit.", [c.name])
|
|
}
|
|
|
|
violation[{"msg": msg}] {
|
|
some c in input.review.object.spec.containers
|
|
not c.resources.limits.memory
|
|
msg := sprintf("Container %v must have a memory limit.", [c.name])
|
|
}
|
|
---
|
|
apiVersion: constraints.gatekeeper.sh/v1beta1
|
|
kind: K8sRequiredLimits
|
|
metadata:
|
|
name: require-resource-limits
|
|
spec:
|
|
match:
|
|
kinds:
|
|
- apiGroups: [""]
|
|
kinds: ["Pod"]
|