Project: Litmus (Observability and Analysis / Chaos Engineering)
File: kyverno-policies.md

blocks configurations that don't match a policy (enforce mode) or can generate policy violations (audit mode). It scans existing configurations and reports violations in the cluster. Litmus recommends using the provided policy configuration to enable the execution of all supported (out-of-the-box) experiments listed in the chaoshub. Having said that, this is recommendatory in nature and left to user discretion/choice depending upon experiments desired. The details listed here are expected to aid users of Kyverno. If you are using alternate means to enforce runtime security, such as native Kubernetes PSPs (pod security policies), refer this section: Litmus recommends using the following policies: : It restricts add capabilities except the `NETADMIN` and `SYSADMIN` for the pods that use runtime API : It validates following host namespaces for the pods that use runtime API. HostPID: It allows hostPID. It should be set to `true`. HostIPC: It restricts the host IPC. It should be set to `false`. HostNetwork: It restricts the hostNetwork. It should be set to `false`. : It restricts hostPath except the `socket-path` & `container-path` host paths for the pods that uses runtime API. It allows hostPaths for service-kill experiments. : It restricts privilege escalation except for the pods that use runtime API : It restricts privileged containers except for the pods that use runtime API : It allows users groups for all the experiment pods These Kyverno policies are based on the definitons. To apply all pod security policies (recommended) and , then run: ```bash kustomize build https://github.com/litmuschaos/chaos-charts/security/kyverno-policies | kubectl apply -f - ``` If setup contains restricted policies which don't allow execution of litmus experiments by default. For Example policy doesn't allow privileged escalation. It deny all the pods to use privileged escalation. To allow litmus pods to use the privileged escalation. Add the litmus serviceAcccount or ClusterRole/Role inside the exclude block as : ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: deny-privilege-escalation annotations: policies.kyverno.io/category: Pod Security Standards (Restricted) policies.kyverno.io/severity: medium policies.kyverno.io/subject: Pod policies.kyverno.io/description: >- Privilege escalation, such as via set-user-ID or set-group-ID file mode, should not be allowed. This policy ensures the `allowPrivilegeEscalation` fields are either undefined or set to `false`. spec: background: true validationFailureAction: enforce rules: name: deny-privilege-escalation match: resources: kinds: Pod exclude: clusterRoles: litmus-admin roles: litmus-roles subjects: kind: ServiceAccount name: pod-network-loss-sa validate: message: >- Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation, and spec.initContainers[*].securityContext.allowPrivilegeEscalation must be undefined or set to `false`. pattern: spec: =(initContainers): =(securityContext): =(allowPrivilegeEscalation): "false" containers: =(securityContext): =(allowPrivilegeEscalation): "false" ```