# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
# SPDX-License-Identifier: Apache-2.0
---
apiVersion: "kyverno.io/v1"
kind: "ClusterPolicy"
metadata:
  name: "disallow-host-namespaces"
  annotations:
    policies.kyverno.io/title: "Disallow Host Namespaces"
    policies.kyverno.io/subject: "Pod"
    policies.kyverno.io/description: >-
      Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access
      to shared information and can be used to elevate privileges.
      Pods should not be allowed access to host namespaces.
      This policy ensures fields which make use of these host namespaces are unset or set to `false`.
spec:
  background: true
  rules:
    - name: "disallow-host-namespaces"
      match:
        any:
          - resources:
              kinds:
                - "Pod"
      validate:
        message: >-
          Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
          spec.hostIPC, and spec.hostPID must be unset or set to `false`.
        pattern:
          spec:
            =(hostPID): "false"
            =(hostIPC): "false"
            =(hostNetwork): "false"
