UNCLASSIFIED - NO CUI

Skip to content
Snippets Groups Projects
Commit 6ccf7a66 authored by Ryan Garcia's avatar Ryan Garcia :dizzy:
Browse files

Merge branch 'enforce-no-root-user' into 'master'

set require-non-root-user to enforce

Closes #1277

See merge request !3453
parents e2657de4 f3b635b1
No related branches found
No related tags found
1 merge request!3453set require-non-root-user to enforce
Pipeline #2466264 passed
...@@ -309,15 +309,34 @@ policies: ...@@ -309,15 +309,34 @@ policies:
{{- end }} {{- end }}
require-non-root-user: require-non-root-user:
validationFailureAction: audit validationFailureAction: Enforce
{{ if .Values.istio.enabled }} {{ if .Values.istio.enabled }}
parameters: parameters:
excludeContainers: excludeContainers:
- istio-init - istio-init
{{- end }} {{- end }}
{{- if or $deployNodeAgent .Values.twistlock.enabled .Values.fluentbit.enabled .Values.promtail.enabled }}
exclude: exclude:
any: any:
- resources:
namespaces:
- kube-system
{{- if or $deployNodeAgent .Values.twistlock.enabled .Values.fluentbit.enabled .Values.promtail.enabled .Values.kiali.enabled .Values.neuvector.enabled}}
{{- if .Values.kiali.enabled }}
# Kiali needs exception for operator to deploy Kiali server
- resources:
namespaces:
- kiali
names:
- kiali-*
{{- end }}
{{- if .Values.neuvector.enabled }}
# Neuvector needs privileged access for realtime scanning of files from the node / access to the container runtime
- resources:
namespaces:
- neuvector
names:
- neuvector*
{{- end }}
{{- if $deployNodeAgent }} {{- if $deployNodeAgent }}
# Velero. The node agent backup tool requires root user access to the host's runtime pod directory which is # Velero. The node agent backup tool requires root user access to the host's runtime pod directory which is
# mounted inside velero/node agent pods. # mounted inside velero/node agent pods.
......
...@@ -621,6 +621,21 @@ kyvernoPolicies: ...@@ -621,6 +621,21 @@ kyvernoPolicies:
- gitlab - gitlab
names: names:
- gitlab-minio-* - gitlab-minio-*
- resources:
namespaces:
- metallb-system
names:
- speaker-*
- resources:
namespaces:
- argocd
names:
- guestbook*
- resources:
namespaces:
- velero
names:
- velero-backup-restore-test*
disallow-namespaces: disallow-namespaces:
parameters: parameters:
disallow: disallow:
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment