policies

This repository contains all of our common Kyverno policies.

add-egress-proxy

Injects the egress proxy vars in environments which request it by a special annotation

set-application-compare-options

Mutate Argo CD application resources to take into account mutating webhooks when doing the server side diff https://argo-cd.readthedocs.io/en/stable/user-guide/diff-strategies/#mutation-webhooks

validating-no-capabilities

Check for pods to drop capabilities and report if this is not the case

validating-non-root

Check for pods to run without root context and report if this is not the case

validating-ingress-domain-postfix

Restricts Ingress hosts to a fixed, cluster-specific domain postfix so that tenants cannot claim (and hijack traffic for) each other's domains.

enforce-es-refresh-interval

Sets the refreshInterval of ExternalSecrets that are created or updated to at least 1h, to limit the request load on Vault. The original value is kept in the annotation flow.rws.nl/original-refresh-interval. An unset interval and a zero interval (0, 0s, 0m, ...: sync once) are left alone.

The policy only acts at admission.