Best practice validating admission bundle that enforces pod hardening, safer runtime defaults, and broader cluster guardrails (RBAC, secrets, exposure, and risky config restrictions) for a strong security baseline.
$ kubeapt bundles install cenroq-best-practices…or download and apply it with kubectl alone:
mkdir -p /tmp/cenroq && curl -L https://github.com/cenroq/kubernetes-security-policies/releases/download/vap_cenroq-best-practices%40v0.2.0/cenroq-best-practices_v0.2.0.tar.gz | tar -xz -C /tmp/cenroq && kubectl apply -f /tmp/cenroq/cenroq-best-practices/policies.yaml -f /tmp/cenroq/cenroq-best-practices/bindings.yamlArchives: cenroq-best-practices_v0.2.0.tar.gz · cenroq-best-practices_v0.2.0.zip
Nothing is enforced until you label a namespace. Move one namespace at a time, and start with warn.
kubectl label ns <namespace> security.cenroq.io/warn=enabledkubectl label ns <namespace> security.cenroq.io/audit=enabledkubectl label ns <namespace> security.cenroq.io/enforce=enabledTo exclude a single policy from a mode, label the namespace <policy-name>.security.cenroq.io/warn=disabled.