We’re so glad you’re here. You can expect all the best TNS content to arrive Monday through Friday to keep you on top of the news and at the top of your game.

Check your inbox for a confirmation email where you can adjust your preferences and even join additional groups.

Follow TNS on your favorite social media networks.

Become a TNS follower on LinkedIn.

Check out the latest featured and trending stories while you wait for your first TNS newsletter.

Figure reference: https://kyverno.io/docs/introduction/#how-kyverno-works

Figure reference: https://kyverno.io/docs/kyverno-policies/

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: ensure-readonly-hostpath
 annotations:
 policies.kyverno.io/title: Ensure Read Only hostPath
 policies.kyverno.io/category: Other
 policies.kyverno.io/severity: medium
 policies.kyverno.io/minversion: 1.6.0
 kyverno.io/kyverno-version: 1.6.2
 kyverno.io/kubernetes-version: "1.23"
 policies.kyverno.io/subject: Pod
 policies.kyverno.io/description: >-
 Pods which are allowed to mount hostPath volumes in read/write mode pose a security risk
 even if confined to a "safe" file system on the host and may escape those confines (see
 https://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts). The only true way
 to ensure safety is to enforce that all Pods mounting hostPath volumes do so in read only
 mode. This policy checks all containers for any hostPath volumes and ensures they are
 explicitly mounted in readOnly mode. 
spec:
 background: false
 validationFailureAction: Enforce
 rules:
 - name: ensure-hostpaths-readonly
 match:
 any:
 - resources:
 kinds:
 - Pod
 preconditions:
 all:
 - key: "{{ request.operation || 'BACKGROUND' }}"
 operator: AnyIn
 value:
 - CREATE
 - UPDATE
 validate:
 message: All hostPath volumes must be mounted as readOnly.
 foreach:
 - list: "request.object.spec.volumes[?hostPath][]"
 deny:
 conditions:
 any:
 - key: "{{ request.object.spec.[containers, initContainers, ephemeralContainers][].volumeMounts[?name == '{{element.name}}'][] | length(@) }}"
 operator: NotEquals
 value: "{{ request.object.spec.[containers, initContainers, ephemeralContainers][].volumeMounts[?name == '{{element.name}}' && readOnly] [] | length(@) }}"

apiVersion: v1
kind: Pod
metadata:
 name: nginx-without-readonly
spec:
 containers:
 - image: nginx:latest
 name: nginx
 volumeMounts:
 - mountPath: /data
 name: nginx-volume
 volumes:
 - name: nginx-volume
 hostPath:
 path: /data

---
apiVersion: v1
kind: Pod
metadata:
 name: nginx-with-readonly
spec:
 containers:
 - image: nginx:latest
 name: nginx
 volumeMounts:
 - mountPath: /data
 name: nginx-volume
 readOnly: true
 volumes:
 - name: nginx-volume
 hostPath:
 path: /data

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: resolve-image-to-digest
 annotations:
 policies.kyverno.io/title: Resolve Image to Digest
 policies.kyverno.io/category: Other
 policies.kyverno.io/severity: medium
 kyverno.io/kyverno-version: 1.6.0
 policies.kyverno.io/minversion: 1.6.0
 kyverno.io/kubernetes-version: "1.23"
 policies.kyverno.io/subject: Pod
 policies.kyverno.io/description: >-
 Image tags are mutable and the change of an image can result in the same tag.
 This policy resolves the image digest of each image in a container and replaces
 the image with the fully resolved reference which includes the digest rather than tag. 
spec:
 background: false
 rules:
 - name: resolve-to-digest
 match:
 any:
 - resources:
 kinds:
 - Pod
 preconditions:
 all:
 - key: "{{request.operation || 'BACKGROUND'}}"
 operator: NotEquals
 value: DELETE
 mutate:
 foreach:
 - list: "request.object.spec.containers"
 context:
 - name: resolvedRef
 imageRegistry:
 reference: "{{ element.image }}"
 jmesPath: "resolvedImage"
 patchStrategicMerge:
 spec:
 containers:
 - name: "{{ element.name }}" 
 image: "{{ resolvedRef }}"



kubectl apply -f resolve-image-to-digest.yaml
kubectl get clusterpolicies

apiVersion: v1
kind: Pod
metadata:
 name: nginx-app
spec:
 containers:
 - image: nginx:latest
 name: nginx

# values.yaml 
policies:
- name: ensure-readonly-hostpath
 resources:
 - name: good-pod-01
 values:
 request.operation: UPDATE



# kyverno-test.yaml
name: ensure-readonly-hostpath
policies:
 - ensure-readonly-hostpath.yaml
resources:
 - good-pod-01.yaml
 - bad-pod-01.yaml
variables: values.yaml
results:
 - policy: ensure-readonly-hostpath
 rule: ensure-hostpaths-readonly
 resource: bad-pod-01
 kind: Pod
 result: fail
 - policy: ensure-readonly-hostpath
 rule: ensure-hostpaths-readonly
 resource: good-pod-01
 kind: Pod
 result: pass

# values.yaml
policies:
 - name: resolve-image-to-digest
 rules:
 - name: resolve-to-digest
 values:
 resolvedRef: "busybox@sha256:141c253bc4c3fd0a201d32dc1f493bcf3fff003b6df416dea4f41046e0f37d47"
 resources:
 - name: busybox
 values:
 request.operation: UPDATE







# kyverno-test.yaml
name: resolve-image-to-digest
policies:
 - resolve-image-to-digest.yaml
resources:
 - pod.yaml
variables: values.yaml
results:
 - policy: resolve-image-to-digest
 rule: resolve-to-digest
 resource: busybox
 patchedResource: patchedResource.yaml
 kind: Pod
 result: pass





# patchedResource.yaml
apiVersion: v1
kind: Pod
metadata:
 name: busybox
spec:
 containers:
 - name: busybox
 image: busybox@sha256:141c253bc4c3fd0a201d32dc1f493bcf3fff003b6df416dea4f41046e0f37d47