Curated ValidatingAdmissionPolicies for Kubernetes, written in CEL and severity-rated. There is no Kyverno or OPA to run: these are native Kubernetes objects. Install them with kubeapt, or apply them straight with kubectl.
A bundle is a versioned set of policies plus the bindings that switch them on. Label a namespace to activate one — start in warn, move to audit, then enforce. Compare both bundles →
Best practice validating admission bundle that enforces pod hardening, safer runtime defaults, and broader cluster guardrails (RBAC, secrets, exposure, and risky config restrictions) for a strong security baseline.
Pod Security Standards implemented as Validating Admission Policies, with the same levels (baseline and restricted).
Filter by type, severity, resource, product or bundle, or search the text — the search reaches the CEL too, even though the expression itself lives on each policy's own page. Open a card for the expression that enforces it, the message it rejects with, how to fix a violation, the full manifest, and the kubeapt validate line that checks a workload against it.
The Istio and NetworkPolicy entries are in the same list, marked Example: reference manifests to copy and adapt, not rules we enforce for you. They carry no severity and belong to no bundle. Filter them in or out under Type.
Filtering, search and paging need JavaScript. Without it every entry in the library is listed below at once, and every card still links to its own page.
Write access to certificate signing requests and to the authorization and authentication review APIs lets the holder issue client certificates and use the API server to test which permissions a stolen credential carries.
ValidatingAdmissionPolicy · 1 bundle CriticalPod write lets the holder run arbitrary images with any service account token in the cluster mounted, while exec, attach, port-forward and ephemeral container access opens a shell into running workloads and their credentials.
ValidatingAdmissionPolicy · 1 bundle CriticalImpersonation lets the holder send requests as any other user, group or service account, borrowing the permissions of cluster-admin identities without ever being granted those permissions in its own bindings.
ValidatingAdmissionPolicy · 1 bundle CriticalReading Secrets exposes the credentials they hold in every namespace, including service account tokens, TLS private keys and registry passwords, and the write verbs let those values be replaced with attacker-controlled ones.
ValidatingAdmissionPolicy · 1 bundle CriticalCreating the token subresource mints a working bearer token for any service account in the cluster, letting the holder act as the most privileged one and reuse that token from outside the cluster.
ValidatingAdmissionPolicy · 1 bundle CriticalA wildcard in apiGroups, resources or verbs hands over an entire API group, every resource type or every operation on them across the cluster, and silently widens to each CRD installed later.
ValidatingAdmissionPolicy · 1 bundle CriticalCredentials in a ConfigMap are stored unencrypted and readable by anyone holding the broad ConfigMap read permission most roles grant, and they leak further through logs, backups and manifests in source control.
ValidatingAdmissionPolicy · 1 bundle CriticalA privileged container disables almost all container isolation and gets full root access to the node devices, kernel interfaces and filesystem, which is a direct path to node and cluster takeover.
ValidatingAdmissionPolicy · 2 bundles CriticalA privileged ephemeral container disables almost all container isolation and gets full root access to the node devices, kernel interfaces and filesystem, which is a direct path to node and cluster takeover.
ValidatingAdmissionPolicy · 2 bundles CriticalA privileged init container disables almost all container isolation and gets full root access to the node devices, kernel interfaces and filesystem, which is a direct path to node and cluster takeover.
ValidatingAdmissionPolicy · 2 bundles CriticalA hostPath volume mounts node filesystem paths into the pod, exposing kubelet credentials, container runtime sockets and other workload data, and a writable mount lets an attacker alter node files to take over the node.
ValidatingAdmissionPolicy · 2 bundles CriticalPod write lets the holder run arbitrary images with any service account token in the namespace mounted, while exec, attach, port-forward and ephemeral container access opens a shell into running workloads and their credentials.
ValidatingAdmissionPolicy · 1 bundle CriticalImpersonation lets the holder send requests as any other user, group or service account, borrowing the permissions of far more privileged identities without ever being granted those permissions in its own bindings.
ValidatingAdmissionPolicy · 1 bundle CriticalReading Secrets exposes the credentials they hold in the namespace, including service account tokens, TLS private keys and registry passwords, and the write verbs let those values be replaced with attacker-controlled ones.
ValidatingAdmissionPolicy · 1 bundle CriticalCreating the token subresource mints a working bearer token for any service account in the namespace, letting the holder act as the most privileged one and reuse that token from outside the cluster.
ValidatingAdmissionPolicy · 1 bundle CriticalA wildcard in apiGroups, resources or verbs hands over an entire API group, every resource type or every operation on them within the namespace, and silently widens to each CRD installed later.
ValidatingAdmissionPolicy · 1 bundle HighWrite access to webhook configurations lets the holder delete or rewrite admission control itself, disabling every policy that guards the cluster and mutating arbitrary objects as they are admitted.
ValidatingAdmissionPolicy · 1 bundle HighReading or proxying nodes exposes kubelet endpoints and every workload placed on them, while write access to persistent volumes, storage classes and namespaces lets a caller mount host paths and stage pods outside guarded namespaces.
ValidatingAdmissionPolicy · 1 bundle HighGet on the node proxy subresource forwards requests straight to the kubelet API, exposing the pod inventory, container logs and runtime detail of every workload scheduled on that node.
ValidatingAdmissionPolicy · 1 bundle HighWrite, bind or escalate permission over RBAC objects lets the grantee author new roles and bindings for itself, turning a limited account into cluster-admin without stealing any other credential.
ValidatingAdmissionPolicy · 1 bundle HighCreating or replacing ServiceAccounts anywhere in the cluster lets an attacker re-create an identity that existing bindings already point at and take over its tokens, inheriting every permission bound to that name.
ValidatingAdmissionPolicy · 1 bundle HighWrite access to workload controllers becomes arbitrary pod creation through the controller, letting the holder run any image under any service account in the cluster and, with DaemonSets, land that container on every node.
ValidatingAdmissionPolicy · 1 bundle HighRoles like cluster-admin, admin and edit carry sweeping verbs across nearly every API resource, so one compromised subject in the binding gains full control of the cluster and every secret in it.
ValidatingAdmissionPolicy · 1 bundle HighLeaving privilege escalation enabled lets a process in the container gain more privileges than its parent through setuid binaries or file capabilities, turning a compromised unprivileged process into root inside the container.
ValidatingAdmissionPolicy · 2 bundles HighAn unmasked /proc strips the default masks and read-only paths the runtime applies, exposing kernel memory and tunables such as /proc/kcore and /proc/sys to the container and easing container escape.
ValidatingAdmissionPolicy · 2 bundles HighA Windows HostProcess container runs directly on the node in the host namespaces under a system account, exposing the host filesystem, registry and services and making node compromise trivial.
ValidatingAdmissionPolicy · 2 bundles HighLeaving privilege escalation enabled lets a process in the ephemeral container gain more privileges than its parent through setuid binaries or file capabilities, turning a compromised unprivileged process into root inside the container.
ValidatingAdmissionPolicy · 2 bundles HighAn unmasked /proc strips the default masks and read-only paths the runtime applies, exposing kernel memory and tunables such as /proc/kcore and /proc/sys to the ephemeral container and easing container escape.
ValidatingAdmissionPolicy · 2 bundles HighA Windows HostProcess ephemeral container runs directly on the node in the host namespaces under a system account, exposing the host filesystem, registry and services and making node compromise trivial.
ValidatingAdmissionPolicy · 2 bundles HighLeaving privilege escalation enabled lets a process in the init container gain more privileges than its parent through setuid binaries or file capabilities, turning a compromised unprivileged process into root inside the container.
ValidatingAdmissionPolicy · 2 bundles HighAn unmasked /proc strips the default masks and read-only paths the runtime applies, exposing kernel memory and tunables such as /proc/kcore and /proc/sys to the init container and easing container escape.
ValidatingAdmissionPolicy · 2 bundles HighA Windows HostProcess init container runs directly on the node in the host namespaces under a system account, exposing the host filesystem, registry and services and making node compromise trivial.
ValidatingAdmissionPolicy · 2 bundles HighA hostPath or local PersistentVolume hands pods a path on the node filesystem, so any workload that binds the claim can read or tamper with kubelet credentials and other tenants' data.
ValidatingAdmissionPolicy · 1 bundle HighSharing the host IPC namespace exposes the node shared memory segments, semaphores and message queues to the container, letting it read in-memory data and tamper with host processes and other pods that share it.
ValidatingAdmissionPolicy · 2 bundles HighHost networking removes network namespace isolation, letting the workload sniff all node traffic, bind directly to node ports and reach loopback-bound node services such as the kubelet and local metadata proxies.
ValidatingAdmissionPolicy · 2 bundles HighSharing the host PID namespace exposes every process on the node to the container, leaking credentials from process command lines and /proc and letting it signal or trace host and other tenant workloads.
ValidatingAdmissionPolicy · 2 bundles HighRunning in the host user namespace removes UID remapping, so container root is real root on the node and any escape or shared host resource is entered with full node privileges.
ValidatingAdmissionPolicy · 1 bundle HighVolume sources outside the allowed set, such as hostPath, gitRepo or flexVolume, mount node filesystem paths or run driver code on the node, opening a route to kubelet credentials and the container runtime socket.
ValidatingAdmissionPolicy · 2 bundles HighA Windows HostProcess pod runs its containers directly on the node in the host namespaces under a system account, exposing the host filesystem, registry and services and making node compromise trivial.
ValidatingAdmissionPolicy · 2 bundles HighWrite, bind or escalate permission over RBAC objects lets the grantee author new roles and bindings for itself, turning a limited account into full control of the namespace without stealing any other credential.
ValidatingAdmissionPolicy · 1 bundle HighCreating or replacing ServiceAccounts in the namespace lets an attacker re-create an identity that existing bindings already point at and take over its tokens, inheriting every permission bound to that name.
ValidatingAdmissionPolicy · 1 bundle HighWrite access to workload controllers becomes arbitrary pod creation through the controller, letting the holder run any image under any service account in the namespace and, with DaemonSets, land that container on every node.
ValidatingAdmissionPolicy · 1 bundle HighRoles like cluster-admin, admin and edit carry sweeping verbs across nearly every API resource, so one compromised subject in the binding gains full control of the namespace and its secrets.
ValidatingAdmissionPolicy · 1 bundle ModerateAn Allow rule with an empty namespaces selector matches every namespace in the cluster, and because AdminNetworkPolicy outranks NetworkPolicy it reopens paths that workload owners deliberately closed.
ValidatingAdmissionPolicy · 1 bundle ModerateSkipping certificate verification lets the kube-apiserver proxy aggregated API calls to whatever answers the service endpoint, so anything able to spoof or intercept that connection reads forwarded user identity and returns forged API responses.
ValidatingAdmissionPolicy · 1 bundle ModerateAn ALLOW rule with no from, to or when matches every request, so the workload accepts any caller inside or outside the mesh while still appearing to be under authorization control.
ValidatingAdmissionPolicy · 1 bundle ModerateAn Allow rule with an empty namespaces selector matches every namespace in the cluster, so any traffic that no NetworkPolicy or AdminNetworkPolicy decides falls back to being permitted rather than dropped.
ValidatingAdmissionPolicy · 1 bundle ModerateThe world entity covers every address outside the cluster, so a cluster-wide rule using it hands the selected pods unrestricted internet egress for exfiltration and command-and-control, or exposes them to any off-cluster source.
ValidatingAdmissionPolicy · 1 bundle ModerateThe world entity covers every address outside the cluster, so a rule using it hands the selected pods unrestricted internet egress for exfiltration and command-and-control, or exposes them to any off-cluster source.
ValidatingAdmissionPolicy · 1 bundle ModerateA ClusterPolicy left on Audit only records violations in a report, so the workloads it was written to block are admitted cluster-wide anyway and the protection exists only as a log entry.
ValidatingAdmissionPolicy · 1 bundle ModerateAn aggregated ClusterRole silently absorbs the rules of every ClusterRole carrying a matching label, so anyone able to create a labeled role grows its permissions with no review of the binding.
ValidatingAdmissionPolicy · 1 bundle ModerateWildcard or root non-resource paths grant every API server endpoint outside the resource model, so /logs serves node file contents and /debug/pprof heap dumps that carry in-flight credentials straight to the role holder.
ValidatingAdmissionPolicy · 1 bundle ModerateCreating PersistentVolumeClaims in any namespace can bind a volume that still holds data from another workload into an attacker-controlled pod, while delete destroys the backing data and unbounded provisioning exhausts the storage quota.
ValidatingAdmissionPolicy · 1 bundle ModerateBinding a ClusterRole to system:anonymous grants it cluster-wide to every unauthenticated caller that reaches the API server, and catch-all names like everyone or all-users leave nobody accountable for who exercises it.
ValidatingAdmissionPolicy · 1 bundle ModerateEvery pod that names no ServiceAccount runs as default, so a ClusterRoleBinding to it spreads cluster-wide permissions across unrelated workloads in that namespace and any single compromised container inherits them immediately.
ValidatingAdmissionPolicy · 1 bundle ModerateBinding a ClusterRole to a system group grants it cluster-wide to a whole population at once, and groups like system:authenticated or system:serviceaccounts cover every account in the cluster including ones an attacker controls.
ValidatingAdmissionPolicy · 1 bundle ModerateScripts stored in a ConfigMap and executed by a pod turn ConfigMap write access into code execution inside the container, bypassing image scanning, image signing and any review of what actually runs.
ValidatingAdmissionPolicy · 1 bundle ModerateAn Unconfined AppArmor profile strips the mandatory access controls over file, capability and mount operations in the container, widening what a compromised process can reach on the host.
ValidatingAdmissionPolicy · 2 bundles ModerateLinux capabilities beyond the baseline set, such as SYS_ADMIN, SYS_MODULE, SYS_PTRACE or NET_RAW, hand a container kernel level privileges it can use to mount filesystems, load modules and break out onto the node.
ValidatingAdmissionPolicy · 2 bundles ModerateAdded capabilities other than NET_BIND_SERVICE give a container kernel privileges such as raw socket access, process tracing and filesystem mounting, extending its reach past its namespace onto the node.
ValidatingAdmissionPolicy · 2 bundles ModerateA container that never drops ALL keeps the default runtime capability set, so code execution inside it inherits DAC_OVERRIDE, SETUID and NET_RAW for bypassing file permissions, regaining root and spoofing traffic.
ValidatingAdmissionPolicy · 2 bundles ModerateA hostPort binds the container port onto the node network interfaces, exposing it to anything that can reach the node, bypassing Service and NetworkPolicy controls and squatting on node component ports.
ValidatingAdmissionPolicy · 2 bundles ModerateAn image reference without a digest resolves through a mutable tag, so registry content can be replaced between pulls and the container silently starts running attacker-supplied code on the next restart or reschedule.
ValidatingAdmissionPolicy · 1 bundle ModerateUntagged and latest references float to whatever was pushed to the registry most recently, so a restart or reschedule can pull unreviewed or poisoned code into the container without any spec change.
ValidatingAdmissionPolicy · 1 bundle ModerateA writable container root filesystem lets an intruder drop tooling, overwrite application binaries, and rewrite configuration in place, leaving a foothold in the running pod that nothing in the image would reveal.
ValidatingAdmissionPolicy · 1 bundle ModerateA container running with GID 0 places its processes in the root group, which owns or can write many files in images and mounted host volumes, widening what a compromised process reaches.
ValidatingAdmissionPolicy · 1 bundle ModerateWith runAsNonRoot unset, the kubelet never rejects an image whose user is UID 0, so the container silently runs as root and any compromise gains root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateRunning a container as UID 0 gives every process the in-container root identity, so writable host mounts, setuid binaries and isolation weaknesses become exploitable with root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateAn Unconfined seccomp profile removes the syscall filter from the container, exposing the full kernel syscall surface including the obscure calls that container escape and privilege-escalation exploits depend on.
ValidatingAdmissionPolicy · 2 bundles ModerateA container with no seccomp profile enforced at pod or container level runs with no syscall filter, leaving the full kernel syscall surface reachable for container escape and privilege escalation.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux role label lets the container transition into domains outside the confined container role, weakening the mandatory access control that keeps a compromised process away from host files and devices.
ValidatingAdmissionPolicy · 2 bundles ModerateAn SELinux type outside the container domains, such as spc_t or unconfined_t, drops the kernel confinement that stops a container process from reading host files and reaching devices it does not own.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux user label replaces the confined context the runtime assigns to the container, granting a policy domain with transitions and file access the sandbox was never meant to allow.
ValidatingAdmissionPolicy · 2 bundles ModerateAn Allow entry for 0.0.0.0/0 leaves the OVN-Kubernetes egress firewall with no restriction at all, so any pod in the namespace can open connections to arbitrary internet hosts for command-and-control and data theft.
ValidatingAdmissionPolicy · 1 bundle ModerateAn Allow entry for 0.0.0.0/0 makes the namespace OpenShift SDN egress firewall permit every pod in it to reach any off-cluster address, so a compromised workload can stage tooling and exfiltrate data freely.
ValidatingAdmissionPolicy · 1 bundle ModerateAn Unconfined AppArmor profile strips the mandatory access controls over file, capability and mount operations in the ephemeral container, usually one attached with kubectl debug, widening what a compromised process can reach on the host.
ValidatingAdmissionPolicy · 2 bundles ModerateLinux capabilities beyond the baseline set, such as SYS_ADMIN, SYS_MODULE, SYS_PTRACE or NET_RAW, hand an ephemeral debug container kernel level privileges it can use to mount filesystems, load modules and break out onto the node.
ValidatingAdmissionPolicy · 2 bundles ModerateAdded capabilities other than NET_BIND_SERVICE give an ephemeral debug container kernel privileges such as raw socket access, process tracing and filesystem mounting, extending its reach past its namespace onto the node.
ValidatingAdmissionPolicy · 2 bundles ModerateAn ephemeral debug container that never drops ALL keeps the default runtime capability set, so code execution inside it inherits DAC_OVERRIDE, SETUID and NET_RAW for bypassing file permissions, regaining root and spoofing traffic.
ValidatingAdmissionPolicy · 2 bundles ModerateA hostPort binds the ephemeral container port onto the node network interfaces, exposing it to anything that can reach the node, bypassing Service and NetworkPolicy controls and squatting on node component ports.
ValidatingAdmissionPolicy · 2 bundles ModerateAn image reference without a digest resolves through a mutable tag, so registry content can be replaced between pulls and an ephemeral debug container attached with kubectl debug runs attacker-supplied code inside a live pod.
ValidatingAdmissionPolicy · 1 bundle ModerateUntagged and latest references float to whatever was pushed to the registry most recently, so an ephemeral debug container attached with kubectl debug can pull unreviewed or poisoned code into a live pod.
ValidatingAdmissionPolicy · 1 bundle ModerateA writable ephemeral container root filesystem lets an intruder drop tooling, overwrite application binaries, and rewrite configuration in place, leaving a foothold in the running pod that nothing in the image would reveal.
ValidatingAdmissionPolicy · 1 bundle ModerateAn ephemeral debug container running with GID 0 places its processes in the root group, which owns or can write many files in images and mounted host volumes, widening what a compromised process reaches.
ValidatingAdmissionPolicy · 1 bundle ModerateWith runAsNonRoot unset, the kubelet never rejects an image whose user is UID 0, so the ephemeral debug container silently runs as root and any compromise gains root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateRunning an ephemeral debug container as UID 0 gives every process the in-container root identity, so writable host mounts, setuid binaries and isolation weaknesses become exploitable with root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateAn Unconfined seccomp profile removes the syscall filter from the ephemeral container, typically attached with kubectl debug, exposing the full kernel syscall surface including the obscure calls that container escape and privilege-escalation exploits depend on.
ValidatingAdmissionPolicy · 2 bundles ModerateAn ephemeral container with no seccomp profile enforced at pod or ephemeral container level runs with no syscall filter, leaving the full kernel syscall surface reachable for container escape and privilege escalation.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux role label lets the ephemeral container transition into domains outside the confined container role, weakening the mandatory access control that keeps a compromised process away from host files and devices.
ValidatingAdmissionPolicy · 2 bundles ModerateAn SELinux type outside the container domains, such as spc_t or unconfined_t, drops the kernel confinement that stops an ephemeral container process from reading host files and reaching devices it does not own.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux user label replaces the confined context the runtime assigns to the ephemeral container, granting a policy domain with transitions and file access the sandbox was never meant to allow.
ValidatingAdmissionPolicy · 2 bundles ModerateA cluster-wide Allow to 0.0.0.0/0 or ::/0 gives every selected endpoint unrestricted outbound reach, the channel a compromised workload uses to contact command-and-control hosts, pull further tooling and exfiltrate data.
ValidatingAdmissionPolicy · 1 bundle ModerateSnippet and router-override annotations are folded straight into the shared ingress controller configuration, so anyone able to create an Ingress can hijack hosts from other namespaces, strip authentication, or run code inside the controller.
ValidatingAdmissionPolicy · 1 bundle ModerateA routed host missing from every TLS block is served over cleartext HTTP or with a default certificate that does not match it, exposing session cookies and credentials to anyone on the network path.
ValidatingAdmissionPolicy · 1 bundle ModerateAn Unconfined AppArmor profile strips the mandatory access controls over file, capability and mount operations in the init container, widening what a compromised process can reach on the host.
ValidatingAdmissionPolicy · 2 bundles ModerateLinux capabilities beyond the baseline set, such as SYS_ADMIN, SYS_MODULE, SYS_PTRACE or NET_RAW, hand an init container kernel level privileges it can use to mount filesystems, load modules and break out onto the node.
ValidatingAdmissionPolicy · 2 bundles ModerateAdded capabilities other than NET_BIND_SERVICE give an init container kernel privileges such as raw socket access, process tracing and filesystem mounting, extending its reach past its namespace onto the node.
ValidatingAdmissionPolicy · 2 bundles ModerateAn init container that never drops ALL keeps the default runtime capability set, so code execution inside it inherits DAC_OVERRIDE, SETUID and NET_RAW for bypassing file permissions, regaining root and spoofing traffic.
ValidatingAdmissionPolicy · 2 bundles ModerateA hostPort binds the init container port onto the node network interfaces, exposing it to anything that can reach the node, bypassing Service and NetworkPolicy controls and squatting on node component ports.
ValidatingAdmissionPolicy · 2 bundles ModerateAn image reference without a digest resolves through a mutable tag, so registry content can be replaced between pulls and the init container silently starts running attacker-supplied code on the next restart or reschedule.
ValidatingAdmissionPolicy · 1 bundle ModerateUntagged and latest references float to whatever was pushed to the registry most recently, so a restart or reschedule can pull unreviewed or poisoned code into the init container without any spec change.
ValidatingAdmissionPolicy · 1 bundle ModerateA writable init container root filesystem lets an intruder drop tooling, overwrite application binaries, and rewrite configuration in place, leaving a foothold in the running pod that nothing in the image would reveal.
ValidatingAdmissionPolicy · 1 bundle ModerateAn init container running with GID 0 places its processes in the root group, which owns or can write many files in images and mounted host volumes, widening what a compromised process reaches.
ValidatingAdmissionPolicy · 1 bundle ModerateWith runAsNonRoot unset, the kubelet never rejects an image whose user is UID 0, so the init container silently runs as root and any compromise gains root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateRunning an init container as UID 0 gives every process the in-container root identity, so writable host mounts, setuid binaries and isolation weaknesses become exploitable with root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateAn Unconfined seccomp profile removes the syscall filter from the init container, exposing the full kernel syscall surface including the obscure calls that container escape and privilege-escalation exploits depend on.
ValidatingAdmissionPolicy · 2 bundles ModerateAn init container with no seccomp profile enforced at pod or init container level runs with no syscall filter, leaving the full kernel syscall surface reachable for container escape and privilege escalation.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux role label lets the init container transition into domains outside the confined container role, weakening the mandatory access control that keeps a compromised process away from host files and devices.
ValidatingAdmissionPolicy · 2 bundles ModerateAn SELinux type outside the container domains, such as spc_t or unconfined_t, drops the kernel confinement that stops an init container process from reading host files and reaching devices it does not own.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux user label replaces the confined context the runtime assigns to the init container, granting a policy domain with transitions and file access the sandbox was never meant to allow.
ValidatingAdmissionPolicy · 2 bundles ModerateA webhook that fails open is bypassed by anyone who can make it unreachable, and an external URL endpoint sends every intercepted object off-cluster and lets whoever runs it rewrite workloads at admission time.
ValidatingAdmissionPolicy · 1 bundle ModerateA namespace that is not held to at least the baseline Pod Security Standard lets anyone able to create pods there run privileged, host-networked or hostPath workloads and break out to the node unchallenged.
ValidatingAdmissionPolicy · 1 bundle ModerateSelecting every pod with rules that name no peers and no ports unions an allow-all permission across the namespace, which cancels the effect of tighter policies and leaves lateral movement and outbound traffic unconstrained.
ValidatingAdmissionPolicy · 1 bundle ModerateAn Allow to 0.0.0.0/0 or ::/0 gives the selected endpoints unrestricted outbound reach, the channel a compromised workload uses to contact command-and-control hosts, pull further tooling and exfiltrate data.
ValidatingAdmissionPolicy · 1 bundle ModerateAn untainted control-plane node accepts ordinary workloads alongside etcd and the API server, putting tenant containers on the one host where control-plane certificates and static pod manifests sit on disk.
ValidatingAdmissionPolicy · 1 bundle ModerateAccepting plaintext connections lets anything that reaches the pod network talk to the service without proving a workload identity, and leaves service-to-service traffic readable and modifiable on the wire.
ValidatingAdmissionPolicy · 1 bundle ModerateA legacy AppArmor annotation set to unconfined leaves the named container with no mandatory access control profile, so its file, capability and mount operations run unrestricted against the host kernel.
ValidatingAdmissionPolicy · 2 bundles ModerateAn Unconfined AppArmor profile at pod level strips the mandatory access controls over file, capability and mount operations from every container that inherits it, widening what a compromised process can reach on the host.
ValidatingAdmissionPolicy · 2 bundles ModerateAn automounted service account token lands in every container filesystem, so any code execution or path traversal bug hands an attacker a live API credential for enumerating and acting on cluster resources.
ValidatingAdmissionPolicy · 1 bundle ModerateA pod running with GID 0 places its processes in the root group, which owns or can write many files in images and mounted host volumes, widening what a compromised process reaches.
ValidatingAdmissionPolicy · 1 bundle ModerateWith runAsNonRoot unset, the kubelet never rejects an image whose user is UID 0, so the pod silently runs as root and any compromise gains root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateRunning a pod as UID 0 gives every process the in-container root identity, so writable host mounts, setuid binaries and isolation weaknesses become exploitable with root file ownership and the full capability set.
ValidatingAdmissionPolicy · 2 bundles ModerateAn Unconfined seccomp profile at pod level removes the syscall filter from every container inheriting it, exposing the full kernel syscall surface including the obscure calls that container escape and privilege-escalation exploits depend on.
ValidatingAdmissionPolicy · 2 bundles ModerateA pod with no seccomp profile enforced at pod level, and containers that set none either, runs with no syscall filter, leaving the full kernel syscall surface reachable for container escape and privilege escalation.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux role label applied pod-wide lets containers transition into domains outside the confined container role, weakening the mandatory access control that keeps a compromised process away from host files and devices.
ValidatingAdmissionPolicy · 2 bundles ModerateAn SELinux type outside the container domains, such as spc_t or unconfined_t, drops the kernel confinement that stops pod containers from reading host files and reaching devices they do not own.
ValidatingAdmissionPolicy · 2 bundles ModerateA custom SELinux user label at pod level replaces the confined context the runtime assigns to every container, granting a policy domain with transitions and file access the sandbox was never meant to allow.
ValidatingAdmissionPolicy · 2 bundles ModerateA shared process namespace lets every container in the pod inspect and signal the others, reading secrets from sibling command lines and /proc environment files, so compromising one sidecar reaches them all.
ValidatingAdmissionPolicy · 1 bundle ModerateA sysctl outside the approved list reaches kernel tunables shared with the node, letting a pod weaken host network and memory protections for every workload on that node and destabilise the kubelet itself.
ValidatingAdmissionPolicy · 2 bundles ModerateA Policy left on Audit only records violations in a report, so the workloads it was written to block are still admitted into its namespace and the protection exists only as a log entry.
ValidatingAdmissionPolicy · 1 bundle ModerateCreating PersistentVolumeClaims in the namespace can bind a volume that still holds data from another workload into an attacker-controlled pod, while delete destroys the backing data and unbounded provisioning exhausts the storage quota.
ValidatingAdmissionPolicy · 1 bundle ModerateBinding a role to system:anonymous hands its namespace permissions to every unauthenticated caller that reaches the API server, and catch-all names like everyone or all-users leave nobody accountable for who exercises them.
ValidatingAdmissionPolicy · 1 bundle ModerateEvery pod that names no ServiceAccount runs as default, so a RoleBinding to it shares the granted namespace permissions across every unrelated workload there and one compromised container immediately gains them all.
ValidatingAdmissionPolicy · 1 bundle ModerateNaming system:authenticated, system:unauthenticated or system:serviceaccounts as a subject grants the role to every account in the cluster at once, so the namespace permissions extend to anyone who can reach the API server.
ValidatingAdmissionPolicy · 1 bundle ModerateA Route without a TLS section is published over plain HTTP at the router, so session cookies and credentials cross the network in cleartext and can be read or rewritten in transit.
ValidatingAdmissionPolicy · 1 bundle ModerateAdmin, debug, metrics and management listeners are usually unauthenticated, so publishing them on a LoadBalancer or NodePort hands outside callers internal telemetry, profiling and heap dumps, and sometimes live control over the workload.
ValidatingAdmissionPolicy · 1 bundle ModerateexternalIPs make every node claim the listed addresses and steer matching traffic into the selected pods, so any namespace able to create a Service can hijack and man-in-the-middle traffic destined for those IPs.
ValidatingAdmissionPolicy · 1 bundle ModerateA NodePort opens the same port on every node address, bypassing the ingress path with its TLS termination and authentication and leaving node-level firewalling as the only control between the workload and the wider network.
ValidatingAdmissionPolicy · 1 bundle ModerateAttaching several registry credentials to one ServiceAccount hands all of them to every pod that uses it, so one compromised workload exposes registry logins it never needed to pull its own image.
ValidatingAdmissionPolicy · 1 bundle ModerateA ServiceAccount that automounts by default puts its API token into every pod that references it, so any one compromised container yields a credential usable against the API server.
ValidatingAdmissionPolicy · 1 bundle ModerateA long-lived token Secret bound to a ServiceAccount never expires and is tied to no pod lifetime, so a single leaked value grants that identity permanent API access until someone notices and rotates it.
ValidatingAdmissionPolicy · 1 bundle ModerateA webhook that fails open is bypassed by anyone who can make it unreachable, and an external URL endpoint sends every reviewed object off-cluster and lets whoever runs it decide what admission accepts.
ValidatingAdmissionPolicy · 1 bundle LowA mutable ConfigMap can be rewritten by anyone with update access, silently changing application configuration, feature flags or trusted endpoints inside running pods with no new image and no deployment.
ValidatingAdmissionPolicy · 1 bundle LowRedirecting the liveness HTTP probe to another host makes the kubelet fetch an arbitrary URL from the node, reaching metadata and node-local endpoints closed to pods, while a hung container is never restarted.
ValidatingAdmissionPolicy · 2 bundles LowPointing the liveness TCP probe at another host makes the kubelet open connections from the node to an arbitrary address, probing endpoints closed to pods, while a hung container is never restarted.
ValidatingAdmissionPolicy · 2 bundles LowA postStart HTTP hook aimed at another host makes the kubelet call an arbitrary URL from the node each time a container starts, reaching internal endpoints closed to pods and triggering side effects there.
ValidatingAdmissionPolicy · 2 bundles LowNaming another host in a postStart TCP hook points container start at an off-pod address through a handler the kubelet does not support, so the hook fails and the container is killed.
ValidatingAdmissionPolicy · 2 bundles LowA preStop HTTP hook aimed at another host makes the kubelet call an arbitrary URL from the node whenever a container shuts down, reaching internal endpoints closed to pods and triggering side effects there.
ValidatingAdmissionPolicy · 2 bundles LowNaming another host in a preStop TCP hook points container shutdown at an off-pod address through a handler the kubelet does not support, so the hook fails and cleanup never runs.
ValidatingAdmissionPolicy · 2 bundles LowRedirecting the readiness HTTP probe to another host makes the kubelet fetch an arbitrary URL from the node, reaching metadata and node-local endpoints closed to pods, while Service traffic keeps reaching an unchecked container.
ValidatingAdmissionPolicy · 2 bundles LowPointing the readiness TCP probe at another host makes the kubelet open connections from the node to an arbitrary address, probing endpoints closed to pods, while Service traffic keeps reaching an unchecked container.
ValidatingAdmissionPolicy · 2 bundles LowRedirecting the startup HTTP probe to another host makes the kubelet fetch an arbitrary URL from the node, reaching metadata and node-local endpoints closed to pods, and a hung container passes its startup gate.
ValidatingAdmissionPolicy · 2 bundles LowPointing the startup TCP probe at another host makes the kubelet open connections from the node to an arbitrary address, probing endpoints closed to pods, and a hung container passes its startup gate.
ValidatingAdmissionPolicy · 2 bundles LowRedirecting the liveness HTTP probe to another host makes the kubelet fetch an arbitrary URL from the node, reaching metadata and node-local endpoints closed to pods, while a hung init container is never restarted.
ValidatingAdmissionPolicy · 2 bundles LowPointing the liveness TCP probe at another host makes the kubelet open connections from the node to an arbitrary address, probing endpoints closed to pods, while a hung init container is never restarted.
ValidatingAdmissionPolicy · 2 bundles LowA postStart HTTP hook aimed at another host makes the kubelet call an arbitrary URL from the node each time an init container starts, reaching internal endpoints closed to pods and triggering side effects there.
ValidatingAdmissionPolicy · 2 bundles LowNaming another host in a postStart TCP hook points init container start at an off-pod address through a handler the kubelet does not support, so the hook fails and the container is killed.
ValidatingAdmissionPolicy · 2 bundles LowA preStop HTTP hook aimed at another host makes the kubelet call an arbitrary URL from the node whenever an init container shuts down, reaching internal endpoints closed to pods and triggering side effects there.
ValidatingAdmissionPolicy · 2 bundles LowNaming another host in a preStop TCP hook points init container shutdown at an off-pod address through a handler the kubelet does not support, so the hook fails and cleanup never runs.
ValidatingAdmissionPolicy · 2 bundles LowRedirecting the readiness HTTP probe to another host makes the kubelet fetch an arbitrary URL from the node, reaching metadata and node-local endpoints closed to pods, while pod readiness rests on an unchecked init container.
ValidatingAdmissionPolicy · 2 bundles LowPointing the readiness TCP probe at another host makes the kubelet open connections from the node to an arbitrary address, probing endpoints closed to pods, while pod readiness rests on an unchecked init container.
ValidatingAdmissionPolicy · 2 bundles LowRedirecting the startup HTTP probe to another host makes the kubelet fetch an arbitrary URL from the node, reaching metadata and node-local endpoints closed to pods, and a hung init container passes its startup gate.
ValidatingAdmissionPolicy · 2 bundles LowPointing the startup TCP probe at another host makes the kubelet open connections from the node to an arbitrary address, probing endpoints closed to pods, and a hung init container passes its startup gate.
ValidatingAdmissionPolicy · 2 bundles LowClusterFirstWithHostNet pairs cluster DNS with host networking, so a workload that already bypasses pod network isolation can still resolve and reach every internal cluster service by name.
ValidatingAdmissionPolicy · 1 bundle LowAn fsGroup of 0 chowns every attached volume to the root group and gives pod processes root group membership, so volume contents and other root-group-owned files become writable by a compromised process.
ValidatingAdmissionPolicy · 1 bundle LowRunning under the namespace default ServiceAccount makes every workload share one identity, so any permission granted to it reaches all of them and API audit records cannot be traced back to a single pod.
ValidatingAdmissionPolicy · 1 bundle LowA pod with no labels cannot be selected by label, so NetworkPolicies and other selector-driven controls written for it never apply, and the workload runs unisolated and unattributable to any owner.
ValidatingAdmissionPolicy · 1 bundle LowWithout a Disk Encryption Set, disks provisioned from this class fall back to platform-managed keys that you cannot rotate, audit or revoke, so snapshots and disk copies stay readable to anyone with subscription-level access.
ValidatingAdmissionPolicy · 1 bundle LowWithout a Cloud KMS key, disks provisioned from this class fall back to Google-managed keys that you cannot rotate, audit or revoke, so snapshots and disk images stay readable to anyone with project-level access.
ValidatingAdmissionPolicy · 1 bundle LowWithout a Vault master key, volumes provisioned from this class fall back to Oracle-managed keys that you cannot rotate, audit or revoke, so backups and volume clones stay readable to anyone with tenancy-level access.
ValidatingAdmissionPolicy · 1 bundle LowVolumes provisioned from this class land on unencrypted EBS disks, so anyone able to read the raw block storage or a snapshot copied to another account recovers the data without any Kubernetes access.
ValidatingAdmissionPolicy · 1 bundle LowVolumes provisioned from this class land on unencrypted RBD images, so anyone with access to the Ceph pool, an image snapshot or the backing OSD disks reads the data without any Kubernetes access.
ValidatingAdmissionPolicy · 1 bundle LowVolumes provisioned from this class rely on provider-held keys that you cannot rotate or revoke, so the data on the underlying block storage and its snapshots stays readable outside your control.
ValidatingAdmissionPolicy · 1 bundle LowVolumes provisioned from this class are stored without LUKS encryption, so data sits in plaintext on the Linode block storage backend and is readable from a detached volume, a clone or the underlying host.
ValidatingAdmissionPolicy · 1 bundle LowVolumes provisioned from this class keep their replicas in plaintext on node disks, so anyone who can read a replica directory, a backup target or a removed disk recovers the data without any Kubernetes access.
ValidatingAdmissionPolicy · 1 bundle LowVolumes provisioned from this class are stored unencrypted across the Portworx cluster, so anyone with access to a backing node disk, a cloud snapshot or the storage fabric reads the data without any Kubernetes access.
ValidatingAdmissionPolicy · 1 bundle ExampleAllow only HTTP GET requests to the api-gateway workload on port 8080.
AuthorizationPolicy ExampleAllow requests to the public workload only from the same namespace.
AuthorizationPolicy ExampleAllow requests to the payments workload only from the specified service account principal.
AuthorizationPolicy ExampleDeny all requests to the blocked workload.
AuthorizationPolicy ExampleAllow all ingress and egress traffic between pods in the same namespace.
NetworkPolicy ExampleAllow egress traffic to the cloud metadata service at 169.254.169.254 on ports 80 and 443.
NetworkPolicy ExampleAllow DNS egress (TCP/UDP 53) to kube-dns/coredns in kube-system.
NetworkPolicy ExampleAllow egress traffic to kubelet on port 10250 within 10.0.0.0/8.
NetworkPolicy ExampleAllow egress traffic to the Kubernetes API server on 10.96.0.1:6443.
NetworkPolicy ExampleAllow egress traffic to the external IP 203.0.113.10/32.
NetworkPolicy ExampleDeny all ingress and egress traffic for all pods in the namespace.
NetworkPolicy ExampleEnforce STRICT mTLS across the entire mesh.
PeerAuthentication ExampleAllow both plaintext and mTLS traffic within the permissive namespace.
PeerAuthentication ExampleEnforce STRICT mTLS for the api-gateway workload except disable mTLS on port 8080.
PeerAuthentication ExampleEnforce STRICT mTLS for the payments workload.
PeerAuthentication ExampleValidate JWT issuer and required audience for the api-gateway workload.
RequestAuthentication ExampleValidate JWTs for the public workload using the configured issuer and JWKS.
RequestAuthenticationThe repository also ships a kube-apiserver audit policy. It is a single cluster-level configuration file rather than a catalogued rule, so it is not in the catalog above.
Downloading and applying YAML by hand works. kubeapt makes it repeatable: install a bundle, pin its version, scan a cluster for the gaps it would close, and validate before you enforce.