Sécurité Kubernetes par le Code : Bloquer les Images Vulnérables avec Trivy et Kyverno

Traditional security reviews happen at the end of the development cycle, delaying software releases and frustrating engineering teams. Policy as Code shifts security enforcement directly into the Kubernetes API admission controller phase, automatically rejecting any pod that attempts to run as root or contains critical unpatched CVEs.

Kyverno ClusterPolicy: Forbidding Root Execution

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: disallow-root-user
spec:
 validationFailureAction: Enforce
 background: true
 rules:
 - name: check-runAsNonRoot
 match:
 any:
 - resources:
 kinds:
 - Pod
 validate:
 message: "Running containers as root is strictly forbidden in production namespaces."
 pattern:
 spec:
 securityContext:
 runAsNonRoot: true
 containers:
 - securityContext:
 runAsNonRoot: true
 allowPrivilegeEscalation: false