mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-20 00:20:44 -08:00
57 lines
2.2 KiB
Markdown
57 lines
2.2 KiB
Markdown
# Kubernetes Kyverno
|
|
|
|
**The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
|
|
|
|
## Definition 
|
|
|
|
Kyverno is an open-source, policy management framework for Kubernetes that enables organizations to define, enforce, and audit policies across their entire Kubernetes infrastructure. It provides a scalable, extensible, and highly customizable solution for managing the security, compliance, and governance of Kubernetes clusters.
|
|
|
|
## Use cases
|
|
|
|
Kyverno can be used in a variety of use cases, including:
|
|
|
|
1. **Network Policy Enforcement**: Kyverno can be used to enforce network policies, such as allowing or blocking traffic between pods or services.
|
|
2. **Secret Management**: Kyverno can be used to enforce secret management policies, such as requiring secrets to be stored in a specific format or location.
|
|
3. **Access Control**: Kyverno can be used to enforce access control policies, such as requiring users to have specific roles or permissions to access certain resources.
|
|
|
|
## **Example: ClusterPolicy and Policy**
|
|
|
|
Let's say we have a Kubernetes cluster with multiple namespaces, and we want to enforce a policy that requires all pods in the `default` namespace to have a specific label.
|
|
|
|
**ClusterPolicy**
|
|
|
|
A ClusterPolicy is a high-level policy that defines the overall policy intent. In this case, our ClusterPolicy might look like this:
|
|
|
|
```yaml
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: require-label
|
|
spec:
|
|
rules:
|
|
- validate:
|
|
message: "Pods in the default namespace must have the label 'app: myapp'"
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaceSelector:
|
|
matchLabels:
|
|
namespace: default
|
|
- any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaceSelector:
|
|
matchLabels:
|
|
namespace: default
|
|
validationFailureAction: enforce
|
|
```
|
|
|
|
When a pod is created in the `default` namespace without the label `app: myapp`, Kyverno will block the request and return an error message indicating that the pod does not meet the policy requirements.
|
|
|
|
## References
|
|
|
|
* [https://kyverno.io/](https://kyverno.io/)
|