[Bug] update sample policies to include all container types in a pod

[JimBugwadia]

Kyverno Version

1.12

Kubernetes Version

1.29

Kubernetes Platform

Minikube

Description

A end user brought this up at KubeCon EU 2024. A number of sample policies target containers in a pod, but do not handle initContainers and ephemeralContainers.

Note that this is not an issue for any Pod Security Standard related policies, but applies to best practices and other security samples.

However, this may be something end users are oblivious of and hence end up using the sample policy which leaves a potential gap.

This can be handled easily as done in the following policy:

https://kyverno.io/policies/psp-migration/restrict-adding-capabilities/restrict-adding-capabilities/

      validate:
        message: >-
          Any capabilities added other than NET_BIND_SERVICE or CAP_CHOWN are disallowed.          
        foreach:
          - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
            deny:
              conditions:
                all:
                - key: "{{ element.securityContext.capabilities.add[] || '' }}"
                  operator: AnyNotIn
                  value:
                  - NET_BIND_SERVICE
                  - CAP_CHOWN
                  - ''

Here is a list of some of these policies:

• handle all container types: https://kyverno.io/policies/psp-migration/add-apparmor/add-apparmor/
• handle all container types: https://kyverno.io/policies/psp-migration/add-capabilities/add-capabilities/
• handle all container types: https://kyverno.io/policies/other/add-default-resources/add-default-resources/
• handle all container types: https://kyverno.io/policies/other/allowed-base-images/allowed-base-images/
• handle all container types: https://kyverno.io/policies/best-practices/require-pod-requests-limits/require-pod-requests-limits/

Steps to reproduce

1. Check samples like: https://kyverno.io/policies/psp-migration/add-apparmor/add-apparmor/

Expected behavior

1. Update all security and best practices related policies to handle all pod types.
2. Update test cases to handle initContainers

Screenshots

No response

Kyverno logs

No response

Slack discussion

No response

Troubleshooting

• I have read and followed the documentation AND the troubleshooting guide.
• I have searched other issues in this repository and mine is not recorded.

[dolisss]

@JimBugwadia I would like to contribute to this. Can you assign me this issue?