[//]: # (Confidential document)
[//]: # (01/05/2025)
[//]: # (v 1.7.3)


# Kubernetes labs v1.7.3 
## Secuirty : Kyverno

Kyverno is a policy engine designed for Kubernetes. Policies are managed as Kubernetes resources and no new language is required to write policies.

Kyverno policies can validate, mutate, generate, and cleanup Kubernetes resources, and verify image signatures and artifacts to help secure the software supply chain.

The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline.


## Lab1 : Disallow Privileged Containers

 - Add the Kyverno Helm repository
 - Scan the new repository for charts
 - Show all available chart versions for Kyverno
 - Use Helm to create a Namespace and install Kyverno
 - Apply Disallow Privileged Containers in audit mode
 - List Policies, Cluster Policies, Policies report, Cluster Policies report 
 - run as non privileged container  (OK)
 - run as privileged container      (OK)
 - Apply Disallow Privileged Containers in enforce mode
 - run as non privileged container  (OK)
 - run as privileged container      (KO)

```
helm repo add kyverno https://kyverno.github.io/kyverno/
helm repo update
helm search repo kyverno -l
helm install kyverno kyverno/kyverno -n kyverno --create-namespace --set replicaCount=1
kubectl get pods -n kyverno
kubectl logs -l app.kubernetes.io/name=kyverno -n kyverno


kubectl apply -f manifests/disallow-privileged-containers.yaml

kubectl get policies -A
kubectl get clusterpolicies 
kubectl get policyreport -A
kubectl get clusterpolicyreport

kubectl create -f manifests/runasnonprivileged.yaml
kubectl create -f manifests/runasprivileged.yaml
kubectl describe po runasnonprivileged
kubectl describe po runasprivileged
kubectl get ev

kubectl delete po runasprivileged runasnonprivileged
kubectl apply -f manifests/disallow-privileged-containers-enforced.yaml

kubectl create -f manifests/runasnonprivileged.yaml
kubectl create -f manifests/runasprivileged.yaml
kubectl describe po runasnonprivileged
kubectl get ev

```

## Clean up
```
kubectl delete -f ./manifests
```