Common policies

Abstract

FLOW deploys and maintains a set of common Kyverno policies.

They are located in their own repository and are deployed as part of the FLOW platform.

Policies

Currently we deploy the following policies:

Policy	Type	What you need to do
Allow Pod egress	Mutating	Annotate your Deployment or StatefulSet with flow.rws.nl/egress: proxied
Rewrite Docker Hub registry	Mutating	Nothing — it applies automatically
Run as non-root	Reporting	Set runAsNonRoot: true on your pods
Drop capabilities	Reporting	Drop all Linux capabilities in your containers
Image signing	Reporting	Sign water management images with a cosign key
Tenant Ingress domain postfix	Reporting	Ensure your Ingress hosts end with the cluster’s fixed domain postfix

Allow Pod egress

Adds egress proxy environment variables to all pods of a Deployment or StatefulSet when that Deployment or StatefulSet is annotated with flow.rws.nl/egress: proxied.

Rewrite Docker Hub registry

By default there is no restriction on the source of container images running inside the Kubernetes cluster. To help with Docker Hub rate limits and to increase security posture it is preferred to source images from our Harbor image registry.

This Kyverno policy targets any Pod created in the cluster and will automatically rewrite images being pulled directly from Docker Hub to use the dockerhub proxy project in Harbor.

There is no user intervention or configuration required for this policy to apply.

Validate running as user root is disabled in containers

A reporting policy that will indicate that the container that is being deployed or is running, is running using root credentials (UID 0). This will not be supported with the default Openshift security policies in place. Reporting on the current CNAP platform gives development teams and technical application engineers the opportunity to address this issues now instead of later.

To fix this message, your pods needs something like:

podSecurityContext:
  runAsNonRoot: true

Please check the documentation of the chart how to achieve this via value overrides or modify your the chart to implement this.

Validate capabilities usage is disabled in containers

A reporting policy that will indicate that the container that is being deployed or is running, enables the use of linux capabilities. More often than not these capabilities are not really required and just need to be configured to false. The usage of most capabilities is not supported with the default Openshift security policies in place. Reporting on the current CNAP platform gives development teams and technical application engineers the opportunity to address this issues now instead of later.

To fix this message, your deployments need something like:

containerSecurityContext:
  capabilities:
    drop:
      - ALL

Please check the documentation of the chart how to achieve this via value overrides or modify your the chart to implement this.

Validate image signing

A reporting policy that will give a warning when a container image is not signed using a cosign key.

Tenant Ingress domain postfix

A reporting policy that requires every Ingress host (including TLS hosts) to end with that cluster’s fixed domain postfix, e.g. .example-cluster.example.com. This prevents a tenant from creating an Ingress with a host that another tenant is already using.

To fix this message, make sure your Ingress host (and any tls.hosts) end with the postfix configured for your cluster.