Back to Policies

Audit Event on Delete

Kubernetes Events are limited in that the circumstances under which they are created cannot be changed and with what they are associated is fixed. It may be advantageous in many cases to augment these out-of-the-box Events with custom Events which can be custom designed to your needs. This policy generates an Event when a Secret has been deleted. It lists the userInfo of the actor performing the deletion.

View on GitHub

Policy Definition

apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
name: audit-event-on-delete
annotations:
policies.kyverno.io/title: Audit Event on Delete
policies.kyverno.io/category: Other
kyverno.io/kyverno-version: 1.10.0
policies.kyverno.io/minversion: 1.10.0
kyverno.io/kubernetes-version: "1.26"
policies.kyverno.io/subject: Secret
policies.kyverno.io/description: Kubernetes Events are limited in that the circumstances under which they are created cannot be changed and with what they are associated is fixed. It may be advantageous in many cases to augment these out-of-the-box Events with custom Events which can be custom designed to your needs. This policy generates an Event when a Secret has been deleted. It lists the userInfo of the actor performing the deletion.
spec:
background: false
rules:
- name: generate-event-on-delete
match:
any:
- resources:
kinds:
- Secret
operations:
- DELETE
generate:
apiVersion: v1
kind: Event
name: delete.{{ random('[a-z0-9]{12}') }}
namespace: "{{request.object.metadata.namespace}}"
synchronize: false
data:
firstTimestamp: "{{ time_now_utc() }}"
involvedObject:
apiVersion: v1
kind: Secret
name: "{{ request.name }}"
namespace: "{{ request.namespace }}"
uid: "{{request.oldObject.metadata.uid}}"
lastTimestamp: "{{ time_now_utc() }}"
message: The {{ request.name }} Secret was deleted by {{ request.userInfo | to_string(@) }}.
reason: Delete
source:
component: kyverno
type: Warning

Related Policies

GenerateMedium

Argo Cluster Secret Generation From Rancher CAPI Secret

This policy generates and synchronizes Argo CD cluster secrets from Rancher managed cluster.provisioning.cattle.io/v1 resources and their corresponding CAPI secrets. In this solution, Argo CD integrates with Rancher managed clusters via the central Rancher authentication proxy which shares the network endpoint of the Rancher API/GUI. The policy implements work-arounds for Argo CD issue https://github.com/argoproj/argo-cd/issues/9033 "Cluster-API cluster auto-registration" and Rancher issue https://github.com/rancher/rancher/issues/38053 "Fix type and labels Rancher v2 provisioner specifies when creating CAPI Cluster Secret".

Secret
GenerateMedium

Add Network Policy

By default, Kubernetes allows communications across all Pods within a cluster. The NetworkPolicy resource and a CNI plug-in that supports NetworkPolicy must be used to restrict communications. A default NetworkPolicy should be configured for each Namespace to default deny all ingress and egress traffic to the Pods in the Namespace. Application teams can then configure additional NetworkPolicy resources to allow desired traffic to application Pods from select sources. This policy will create a new NetworkPolicy resource named `default-deny` which will deny all traffic anytime a new Namespace is created.

NetworkPolicy
GenerateMedium

Add Network Policy

By default, Kubernetes allows communications across all Pods within a cluster. The NetworkPolicy resource and a CNI plug-in that supports NetworkPolicy must be used to restrict communications. A default NetworkPolicy should be configured for each Namespace to default deny all ingress and egress traffic to the Pods in the Namespace. Application teams can then configure additional NetworkPolicy resources to allow desired traffic to application Pods from select sources. This policy will create a new NetworkPolicy resource named `default-deny` which will deny all traffic anytime a new Namespace is created.

NetworkPolicy