Skip to content

Commit 745f5cf

Browse files
OtowoSamuelOtowoSamuel
authored
Merge pull request #454 from godekina/feat/comprehensive-improvements
feat: issue
2 parents b50587c + a5a8593 commit 745f5cf

11 files changed

Lines changed: 2039 additions & 2 deletions

File tree

‎docs/governance.md‎

Lines changed: 475 additions & 0 deletions
Large diffs are not rendered by default.

‎policy/kyverno-policies.yaml‎

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
---
2+
# Kyverno ClusterPolicy Suite for Stellar-K8s
3+
# These policies enforce operational and security best practices for StellarNode resources
4+
# Install with: kubectl apply -f policy/kyverno-policies.yaml
5+
6+
---
7+
apiVersion: kyverno.io/v1
8+
kind: ClusterPolicy
9+
metadata:
10+
name: disallow-latest-tag
11+
namespace: kyverno
12+
spec:
13+
validationFailureAction: audit
14+
rules:
15+
- name: check-image-tag
16+
match:
17+
resources:
18+
kinds:
19+
- StellarNode
20+
validate:
21+
message: "Using 'latest' tag for container images is not allowed. Specify an explicit version tag."
22+
pattern:
23+
spec:
24+
version: "!latest"
25+
26+
---
27+
apiVersion: kyverno.io/v1
28+
kind: ClusterPolicy
29+
metadata:
30+
name: require-stellar-labels
31+
namespace: kyverno
32+
spec:
33+
validationFailureAction: audit
34+
rules:
35+
- name: check-required-labels
36+
match:
37+
resources:
38+
kinds:
39+
- StellarNode
40+
validate:
41+
message: "StellarNode resources must have required organizational labels: cost-center, owner, and environment"
42+
pattern:
43+
metadata:
44+
labels:
45+
cost-center: "?*"
46+
owner: "?*"
47+
environment: "?*"
48+
49+
---
50+
apiVersion: kyverno.io/v1
51+
kind: ClusterPolicy
52+
metadata:
53+
name: require-storage-for-validators
54+
namespace: kyverno
55+
spec:
56+
validationFailureAction: audit
57+
rules:
58+
- name: check-validator-storage
59+
match:
60+
resources:
61+
kinds:
62+
- StellarNode
63+
validate:
64+
message: "Validator nodes must not use ephemeral emptyDir storage. Configure persistent storage with a storageClass."
65+
pattern:
66+
spec:
67+
nodeType: "Validator"
68+
storage:
69+
storageClass: "?*"
70+
71+
---
72+
apiVersion: kyverno.io/v1
73+
kind: ClusterPolicy
74+
metadata:
75+
name: require-resource-limits
76+
namespace: kyverno
77+
spec:
78+
validationFailureAction: audit
79+
rules:
80+
- name: check-resource-limits
81+
match:
82+
resources:
83+
kinds:
84+
- StellarNode
85+
validate:
86+
message: "StellarNode resources must specify CPU and memory limits for predictable resource management"
87+
pattern:
88+
spec:
89+
resources:
90+
limits:
91+
cpu: "?*"
92+
memory: "?*"
93+
94+
---
95+
apiVersion: kyverno.io/v1
96+
kind: ClusterPolicy
97+
metadata:
98+
name: require-resource-requests
99+
namespace: kyverno
100+
spec:
101+
validationFailureAction: audit
102+
rules:
103+
- name: check-resource-requests
104+
match:
105+
resources:
106+
kinds:
107+
- StellarNode
108+
validate:
109+
message: "StellarNode resources must specify CPU and memory requests for proper scheduling"
110+
pattern:
111+
spec:
112+
resources:
113+
requests:
114+
cpu: "?*"
115+
memory: "?*"
116+
117+
---
118+
apiVersion: kyverno.io/v1
119+
kind: ClusterPolicy
120+
metadata:
121+
name: require-network-specification
122+
namespace: kyverno
123+
spec:
124+
validationFailureAction: audit
125+
rules:
126+
- name: check-network
127+
match:
128+
resources:
129+
kinds:
130+
- StellarNode
131+
validate:
132+
message: "StellarNode resources must explicitly specify the target network (Mainnet, Testnet, Futurenet, or Custom)"
133+
pattern:
134+
spec:
135+
network: "?*"
136+
137+
---
138+
apiVersion: kyverno.io/v1
139+
kind: ClusterPolicy
140+
metadata:
141+
name: require-node-type
142+
namespace: kyverno
143+
spec:
144+
validationFailureAction: audit
145+
rules:
146+
- name: check-node-type
147+
match:
148+
resources:
149+
kinds:
150+
- StellarNode
151+
validate:
152+
message: "StellarNode resources must specify a valid nodeType (Validator, Horizon, or SorobanRpc)"
153+
pattern:
154+
spec:
155+
nodeType: "?*"
156+
157+
---
158+
apiVersion: kyverno.io/v1
159+
kind: ClusterPolicy
160+
metadata:
161+
name: require-version-specification
162+
namespace: kyverno
163+
spec:
164+
validationFailureAction: audit
165+
rules:
166+
- name: check-version
167+
match:
168+
resources:
169+
kinds:
170+
- StellarNode
171+
validate:
172+
message: "StellarNode resources must specify an explicit version (e.g., 'v21.0.0')"
173+
pattern:
174+
spec:
175+
version: "?*"
176+
177+
---
178+
apiVersion: kyverno.io/v1
179+
kind: ClusterPolicy
180+
metadata:
181+
name: require-replica-count
182+
namespace: kyverno
183+
spec:
184+
validationFailureAction: audit
185+
rules:
186+
- name: check-replicas
187+
match:
188+
resources:
189+
kinds:
190+
- StellarNode
191+
validate:
192+
message: "StellarNode resources should specify replica count for high availability"
193+
pattern:
194+
spec:
195+
replicas: "?*"
196+
197+
---
198+
apiVersion: kyverno.io/v1
199+
kind: ClusterPolicy
200+
metadata:
201+
name: disallow-privileged-containers
202+
namespace: kyverno
203+
spec:
204+
validationFailureAction: audit
205+
rules:
206+
- name: check-privileged
207+
match:
208+
resources:
209+
kinds:
210+
- Pod
211+
selector:
212+
matchLabels:
213+
app.kubernetes.io/name: stellar-node
214+
validate:
215+
message: "Privileged containers are not allowed for security reasons"
216+
pattern:
217+
spec:
218+
containers:
219+
- securityContext:
220+
privileged: false
221+
222+
---
223+
apiVersion: kyverno.io/v1
224+
kind: ClusterPolicy
225+
metadata:
226+
name: require-security-context
227+
namespace: kyverno
228+
spec:
229+
validationFailureAction: audit
230+
rules:
231+
- name: check-security-context
232+
match:
233+
resources:
234+
kinds:
235+
- Pod
236+
selector:
237+
matchLabels:
238+
app.kubernetes.io/name: stellar-node
239+
validate:
240+
message: "Pods must define a security context with runAsNonRoot"
241+
pattern:
242+
spec:
243+
securityContext:
244+
runAsNonRoot: true
245+
246+
---
247+
apiVersion: kyverno.io/v1
248+
kind: ClusterPolicy
249+
metadata:
250+
name: require-pod-disruption-budget
251+
namespace: kyverno
252+
spec:
253+
validationFailureAction: audit
254+
rules:
255+
- name: check-pdb
256+
match:
257+
resources:
258+
kinds:
259+
- StellarNode
260+
validate:
261+
message: "StellarNode resources should define minAvailable or maxUnavailable for pod disruption budgets"
262+
pattern:
263+
spec:
264+
|(min_available | max_unavailable): "?*"
265+
266+
---
267+
apiVersion: kyverno.io/v1
268+
kind: ClusterPolicy
269+
metadata:
270+
name: require-storage-retention-policy
271+
namespace: kyverno
272+
spec:
273+
validationFailureAction: audit
274+
rules:
275+
- name: check-retention-policy
276+
match:
277+
resources:
278+
kinds:
279+
- StellarNode
280+
validate:
281+
message: "StellarNode resources must specify a storage retention policy (Retain, Delete, or Recycle)"
282+
pattern:
283+
spec:
284+
storage:
285+
retentionPolicy: "?*"

0 commit comments

Comments
 (0)