All Policies
Restrict Binding System Groups
Certain system groups exist in Kubernetes which grant permissions that are used for certain system-level functions yet typically never appropriate for other users. This policy prevents creating bindings to some of these groups including system:anonymous, system:unauthenticated, and system:masters.
Policy Definition
/other/restrict-binding-system-groups/restrict-binding-system-groups.yaml
1apiVersion: kyverno.io/v1
2kind: ClusterPolicy
3metadata:
4 name: restrict-binding-system-groups
5 annotations:
6 policies.kyverno.io/title: Restrict Binding System Groups
7 policies.kyverno.io/category: Security, EKS Best Practices
8 policies.kyverno.io/severity: medium
9 policies.kyverno.io/subject: RoleBinding, ClusterRoleBinding, RBAC
10 kyverno.io/kyverno-version: 1.8.0
11 policies.kyverno.io/minversion: 1.6.0
12 kyverno.io/kubernetes-version: "1.23"
13 policies.kyverno.io/description: >-
14 Certain system groups exist in Kubernetes which grant permissions that
15 are used for certain system-level functions yet typically never appropriate
16 for other users. This policy prevents creating bindings to some of these
17 groups including system:anonymous, system:unauthenticated, and system:masters.
18spec:
19 validationFailureAction: audit
20 background: true
21 rules:
22 - name: restrict-anonymous
23 match:
24 any:
25 - resources:
26 kinds:
27 - RoleBinding
28 - ClusterRoleBinding
29 validate:
30 message: "Binding to system:anonymous is not allowed."
31 pattern:
32 subjects:
33 - name: "!system:anonymous"
34 - name: restrict-unauthenticated
35 match:
36 any:
37 - resources:
38 kinds:
39 - RoleBinding
40 - ClusterRoleBinding
41 validate:
42 message: "Binding to system:unauthenticated is not allowed."
43 pattern:
44 subjects:
45 - name: "!system:unauthenticated"
46 - name: restrict-masters
47 match:
48 any:
49 - resources:
50 kinds:
51 - RoleBinding
52 - ClusterRoleBinding
53 validate:
54 message: "Binding to system:masters is not allowed."
55 pattern:
56 subjects:
57 - name: "!system:masters"
58