apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged-containers
  annotations:
    policies.kyverno.io/title: Disallow Privileged Containers
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: 1.6.0
    kyverno.io/kubernetes-version: "1.22-1.23"
    policies.kyverno.io/description: >-
      Privileged mode disables most security mechanisms and must not be allowed. This policy
      ensures Pods do not call for privileged mode.      
spec:
  validationFailureAction: audit
  background: true
  rules:
    - name: privileged-containers
      match:
        any:
        - resources:
            kinds:
              - Pod
      validate:
        message: >-
          Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged
          and spec.initContainers[*].securityContext.privileged must be unset or set to `false`.          
        pattern:
          spec:
            =(ephemeralContainers):
              - =(securityContext):
                  =(privileged): "false"
            =(initContainers):
              - =(securityContext):
                  =(privileged): "false"
            containers:
              - =(securityContext):
                  =(privileged): "false"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-securitycontext
  annotations:
    policies.kyverno.io/title: Add Default securityContext
    policies.kyverno.io/category: Sample
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      A Pod securityContext entry defines fields such as the user and group which should be used to run the Pod.
      Sometimes choosing default values for users rather than blocking is a better alternative to not impede
      such Pod definitions. This policy will mutate a Pod to set default securityContext    
spec:
  background: false
  rules:
  - name: add-default-securitycontext-containers
    match:
      any:
      - resources:
          kinds:
          - Pod
    preconditions:
      all:
      - key: "{{request.operation}}"
        operator: In
        value:
          - CREATE
          - UPDATE
    mutate:
      foreach:
      - list: "request.object.spec.containers"
        patchStrategicMerge:
          spec:
            securityContext:
              runAsUser: 10001
              runAsGroup: 10001
              fsGroup: 10001
              seccompProfile:
                type: RuntimeDefault
            containers:
            - name: "{{ element.name }}"
              securityContext:
                runAsUser: 10001
                runAsGroup: 10001
                capabilities:
                  drop:
                    - ALL
                runAsNonRoot: true
                allowPrivilegeEscalation: false
								privileged: false
                seccompProfile:
                  type: RuntimeDefault
  - name: add-default-securitycontext-initContainers
    match:
      any:
      - resources:
          kinds:
          - Pod
    preconditions:
      all:
      - key: "{{request.operation}}"
        operator: In
        value:
          - CREATE
          - UPDATE
      - key: "{{ request.object.spec.initContainers[] || '' | length(@) }}"
        operator: GreaterThanOrEquals
        value: 1
    mutate:
      foreach:
      - list: "request.object.spec.initContainers"
        patchStrategicMerge:
          spec:
            securityContext:
              runAsUser: 10001
              fsGroup: 10001
              seccompProfile:
                type: RuntimeDefault
            initContainers:
            - name: "{{ element.name }}"
              securityContext:
                runAsUser: 10001
                runAsGroup: 10001
                capabilities:
                  drop:
                    - ALL
                runAsNonRoot: true
                allowPrivilegeEscalation: false
								privileged: false
                seccompProfile:
                  type: RuntimeDefault

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: clone-cert
  annotations:
    policies.kyverno.io/title: Clone Certificate's secret
    policies.kyverno.io/category: Cert-Manager
    policies.kyverno.io/subject: Certificate, Namespace
    policies.kyverno.io/description: >-
      Clone certificate's secret to every namespace
spec:
  background: true
  rules:
  - name: clone-cert
    match:
      any:
      - resources:
          kinds:
          - Namespace
    exclude:
      any:
      - resources:
          namespaces:
          - "kube-system"
          - "kube-public"
          - "default"
    generate:
      synchronize: true
      apiVersion: v1
      kind: Secret
      name: base-cert
      namespace: "{{request.object.metadata.name}}"
      clone:
        namespace: cert-manager
        name: base-cert

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-certificates-volume
  annotations:
    policies.kyverno.io/title: Add Certificates as a Volume
    policies.kyverno.io/category: Sample
    policies.kyverno.io/subject: Pod,Volume
    kyverno.io/kyverno-version: 1.5.2
    kyverno.io/kubernetes-version: "1.21"
    policies.kyverno.io/minversion: 1.5.0
    pod-policies.kyverno.io/autogen-controllers: DaemonSet,Deployment,Job,StatefulSet
    policies.kyverno.io/description: >-
      In some cases you would need to trust custom CA certificates for all the containers of a Pod.
      It makes sense to be in a Secret so that you can automount them by only setting an annotation.
      This policy adds a volume to all containers in a Pod containing the certificate if the annotation
      called `inject-certs` with value `enabled` is found.      
spec:
  background: true
  rules:
  - name: add-ssl-certs
    match:
      any:
      - resources:
          kinds:
          - Pod
    exclude:
      any:
      - resources:
          namespaces:
          - "kube-system"
          - "kube-public"
          - "default"
    preconditions:
      all:
      - key: "{{request.operation}}"
        operator: In
        value:
          - CREATE
          - UPDATE
    mutate:
      foreach:
      - list: "request.object.spec.containers" 
        patchStrategicMerge:
          spec:
            containers:
            - name: "{{ element.name }}"
              volumeMounts:
              - name: ssl-certs
                mountPath: /etc/ssl/certs
            volumes:
            - name: ssl-certs
              secret:
                secretName: base-cert