jakman85andClaude Opus 4.8
d9a80e5350
Prep only — nothing deployed; running cluster untouched. Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/ = 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring, monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base platform/apps and adds ./rollout, so only the no-secret tier reconciles; the secret-blocked components are simply not created until hand-offs arrive. The no-secret tier carries no SOPS content, so it needs no sops-age key. prod is untouched (still builds the monolith). Convergence path coded in (delete rollout/ + the two deletes) — R-ENV-02 divergence flagged for architect review. Component hardening via cluster-vars (prod keeps strict posture): - KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector excludes system+platform namespaces. - MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default); Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers. Cilium parity verified against the live CNI (no-op adopt). Validated: kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
76 lines
2.9 KiB
YAML
76 lines
2.9 KiB
YAML
# Serves: R-SEC-02 (least network reach / least privilege), supports R-NET-01.
|
|
# Spec: docs/07 "Identity/least privilege ... least network reach (R-SEC-02)";
|
|
# docs/03 default-deny.
|
|
#
|
|
# WHY: a pod on hostNetwork bypasses the CNI (Cilium) datapath and therefore
|
|
# ESCAPES the default-deny NetworkPolicy fabric -- it is the most direct way to
|
|
# defeat R-NET-01. hostPID/hostIPC and privileged containers likewise break
|
|
# workload isolation. Application workloads never legitimately need these
|
|
# (platform components that do -- e.g. Cilium, node-exporter -- live in platform
|
|
# namespaces that do NOT carry the app-namespace label, so they are out of scope).
|
|
#
|
|
# Matches Pods; Kyverno pod-controller autogen extends the same checks to
|
|
# Deployment/StatefulSet/DaemonSet/Job/CronJob pod templates automatically.
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: restrict-host-namespaces
|
|
annotations:
|
|
policies.kyverno.io/title: Restrict host namespaces and privilege in app namespaces
|
|
policies.kyverno.io/category: Least Privilege
|
|
policies.kyverno.io/severity: high
|
|
homelab.keithjackson.dev/requirements: R-SEC-02,R-NET-01
|
|
policies.kyverno.io/description: >-
|
|
Application-namespace pods must not use hostNetwork/hostPID/hostIPC (which
|
|
bypass default-deny) or run privileged containers.
|
|
spec:
|
|
validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
|
|
background: true
|
|
rules:
|
|
- name: disallow-host-namespaces
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaceSelector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/app-namespace: "true"
|
|
validate:
|
|
message: >-
|
|
Application workloads must not set hostNetwork/hostPID/hostIPC -- host
|
|
networking bypasses the default-deny NetworkPolicy fabric (R-SEC-02,
|
|
R-NET-01).
|
|
deny:
|
|
conditions:
|
|
any:
|
|
- key: "{{ request.object.spec.hostNetwork || `false` }}"
|
|
operator: Equals
|
|
value: true
|
|
- key: "{{ request.object.spec.hostPID || `false` }}"
|
|
operator: Equals
|
|
value: true
|
|
- key: "{{ request.object.spec.hostIPC || `false` }}"
|
|
operator: Equals
|
|
value: true
|
|
- name: disallow-privileged-containers
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaceSelector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/app-namespace: "true"
|
|
validate:
|
|
message: >-
|
|
Application containers must not run privileged (R-SEC-02).
|
|
foreach:
|
|
- list: "request.object.spec.containers"
|
|
deny:
|
|
conditions:
|
|
any:
|
|
- key: "{{ element.securityContext.privileged || `false` }}"
|
|
operator: Equals
|
|
value: true
|