Back to Policies

Add Capabilities

In the earlier Pod Security Policy controller, it was possible to configure a policy to add capabilities to containers within a Pod. This made it easier to assign some basic defaults rather than blocking Pods or to simply provide capabilities for certain workloads if not specified. This policy mutates Pods to add the capabilities SETFCAP and SETUID so long as they are not listed as dropped capabilities first.

View on GitHub

Policy Definition 

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-capabilities
  annotations:
    policies.kyverno.io/title: Add Capabilities
    policies.kyverno.io/category: PSP Migration
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: 1.10.0
    kyverno.io/kubernetes-version: "1.24"
    pod-policies.kyverno.io/autogen-controllers: none
    policies.kyverno.io/description: In the earlier Pod Security Policy controller, it was possible to configure a policy to add capabilities to containers within a Pod. This made it easier to assign some basic defaults rather than blocking Pods or to simply provide capabilities for certain workloads if not specified. This policy mutates Pods to add the capabilities SETFCAP and SETUID so long as they are not listed as dropped capabilities first.
spec:
  rules:
    - name: add-setfcap-setuid
      match:
        any:
          - resources:
              kinds:
                - Pod
      preconditions:
        all:
          - key: "{{request.operation || 'BACKGROUND'}}"
            operator: AnyIn
            value:
              - CREATE
              - UPDATE
      mutate:
        foreach:
          - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
            preconditions:
              all:
                - key: SETFCAP
                  operator: AnyNotIn
                  value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
            patchesJson6902: |-
              - path: /spec/containers/{{elementIndex}}/securityContext/capabilities/add/-
                op: add
                value: SETFCAP
          - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
            preconditions:
              all:
                - key: SETUID
                  operator: AnyNotIn
                  value: "{{ element.securityContext.capabilities.drop[] || `[]` }}"
            patchesJson6902: |-
              - path: /spec/containers/{{elementIndex}}/securityContext/capabilities/add/-
                op: add
                value: SETUID

Related Policies

MutateMedium

Add Safe To Evict

The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.

Pod
MutateMedium

Add Safe To Evict

The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.

Pod
ValidateMedium

Require Read-Only Root Filesystem

A read-only root file system helps to enforce an immutable infrastructure strategy; the container only needs to write on the mounted volume that persists the state. An immutable root filesystem can also prevent malicious binaries from writing to the host system. This policy validates that containers define a securityContext with `readOnlyRootFilesystem: true`.

Pod