Platform security polcies

[j-zimnowoda]

WHY

Platform apps also need to validated to ensure security posture and control the applications during the upgrades

Acceptance criteria

GIVENplatform apps (offline mode) WHENI run otomi validate-polices then THEN I can perform static validation of all the manifests rendered by otomi

GIVENplatform apps on running k8s cluster WHENI enable Kyverno THEN I can see if platform apps conform with that platform security policy baseline

Functional requirements:

• [ ] prevent run as root user and group
• [ ] drop all capabilities
• [ ] enforce semver tags (no latest)
• [ ] prevent privilege escalation
• [ ] enforce readOnlyRootFilesystem
• [ ] ensure runAsNonRoot
• [ ] enforce privileged: false
• [ ] prevent hostPath
• [ ] prevent hostNetwork

Non-functional requirements:

• [ ] policy exceptions are defined as app artefacts
• [ ] use kyverno CLI instead of konstraint for policy validation

Definition of done

• [ ] Relevant PRs are merged
• [ ] Tested by peer
• [ ] Updated documentation reviewed by peer
• [ ] Short demo video recorded and stored on google drive (if applicable)