chore(deps): update helm release kyverno-policies to v3.9.0

[renovate]

This PR contains the following updates:

Package	Update	Change
kyverno-policies (source)	minor	3.8.2 → 3.9.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🔍 Rendered manifest diff — this PR vs main (desired state)

1 changed · 11 added · 11 removed

Rendered with kustomize build + helm template (source of truth = git), so Helm-expanded workloads are included. Shows what Flux will apply — not a diff against live cluster state (drift is alerted on separately), and not CRD-defaulted / webhook-mutated output. Secret values are redacted; per-render noise (webhook caBundles, checksum/* annotations, render timestamps) is normalized out.

🟡 changed — helm.toolkit.fluxcd.io/v2/HelmRelease/security/kyverno-policies

--- a/helm.toolkit.fluxcd.io/v2/HelmRelease/security/kyverno-policies
+++ b/helm.toolkit.fluxcd.io/v2/HelmRelease/security/kyverno-policies
@@ -10,7 +10,7 @@
       sourceRef:
         kind: HelmRepository
         name: kyverno
-      version: 3.8.2
+      version: 3.9.0
   driftDetection:
     mode: enabled
   install:

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-capabilities

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-capabilities
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-capabilities
@@ -1,60 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: Adding capabilities beyond those listed in the policy must be disallowed.
-    policies.kyverno.io/minversion: 1.6.0
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Disallow Capabilities
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-capabilities
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: adding-capabilities
-    preconditions:
-      all:
-      - key: '{{ request.operation || ''BACKGROUND'' }}'
-        operator: NotEquals
-        value: DELETE
-    validate:
-      allowExistingViolations: true
-      deny:
-        conditions:
-          all:
-          - key: '{{ request.object.spec.[ephemeralContainers, initContainers, containers][].securityContext.capabilities.add[] }}'
-            operator: AnyNotIn
-            value:
-            - AUDIT_WRITE
-            - CHOWN
-            - DAC_OVERRIDE
-            - FOWNER
-            - FSETID
-            - KILL
-            - MKNOD
-            - NET_BIND_SERVICE
-            - SETFCAP
-            - SETGID
-            - SETPCAP
-            - SETUID
-            - SYS_CHROOT
-      failureAction: Audit
-      message: Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER, FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT) are disallowed.
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-host-namespaces

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-host-namespaces
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-host-namespaces
@@ -1,40 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access to shared information and can be used to elevate privileges. Pods should not be allowed access to host namespaces. This policy ensures fields which make use of these host namespaces are unset or set to `false`.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Disallow Host Namespaces
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-host-namespaces
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: host-namespaces
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must be unset or set to `false`.
-      pattern:
-        spec:
-          =(hostIPC): 'false'
-          =(hostNetwork): 'false'
-          =(hostPID): 'false'
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-host-path

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-host-path
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-host-path
@@ -1,39 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: HostPath volumes let Pods use host directories and volumes in containers. Using host resources can be used to access shared data or escalate privileges and should not be allowed. This policy ensures no hostPath volumes are in use.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod,Volume
-    policies.kyverno.io/title: Disallow hostPath
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-host-path
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: host-path
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
-      pattern:
-        spec:
-          =(volumes):
-          - X(hostPath): 'null'
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-host-ports

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-host-ports
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-host-ports
@@ -1,46 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum restricted to a known list. This policy ensures the `hostPort` field is unset or set to `0`.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Disallow hostPorts
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-host-ports
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: host-ports-none
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort must either be unset or set to `0`.
-      pattern:
-        spec:
-          =(ephemeralContainers):
-          - =(ports):
-            - =(hostPort): 0
-          =(initContainers):
-          - =(ports):
-            - =(hostPort): 0
-          containers:
-          - =(ports):
-            - =(hostPort): 0
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-host-process

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-host-process
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-host-process
@@ -1,49 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node. Privileged access to the host is disallowed in the baseline policy. HostProcess pods are an alpha feature as of Kubernetes v1.22. This policy ensures the `hostProcess` field, if present, is set to `false`.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Disallow hostProcess
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-host-process
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: host-process-containers
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess, spec.containers[*].securityContext.windowsOptions.hostProcess, spec.initContainers[*].securityContext.windowsOptions.hostProcess, and spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must either be undefined or set to `false`.
-      pattern:
-        spec:
-          =(ephemeralContainers):
-          - =(securityContext):
-              =(windowsOptions):
-                =(hostProcess): 'false'
-          =(initContainers):
-          - =(securityContext):
-              =(windowsOptions):
-                =(hostProcess): 'false'
-          containers:
-          - =(securityContext):
-              =(windowsOptions):
-                =(hostProcess): 'false'
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-privileged-containers

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-privileged-containers
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-privileged-containers
@@ -1,46 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: Privileged mode disables most security mechanisms and must not be allowed. This policy ensures Pods do not call for privileged mode.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Disallow Privileged Containers
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-privileged-containers
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: privileged-containers
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged and spec.initContainers[*].securityContext.privileged must be unset or set to `false`.
-      pattern:
-        spec:
-          =(ephemeralContainers):
-          - =(securityContext):
-              =(privileged): 'false'
-          =(initContainers):
-          - =(securityContext):
-              =(privileged): 'false'
-          containers:
-          - =(securityContext):
-              =(privileged): 'false'
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-proc-mount

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-proc-mount
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-proc-mount
@@ -1,46 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: The default /proc masks are set up to reduce attack surface and should be required. This policy ensures nothing but the default procMount can be specified. Note that in order for users to deviate from the `Default` procMount requires setting a feature gate at the API server.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Disallow procMount
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-proc-mount
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: check-proc-mount
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Changing the proc mount from the default is not allowed. The fields spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount, and spec.ephemeralContainers[*].securityContext.procMount must be unset or set to `Default`.
-      pattern:
-        spec:
-          =(ephemeralContainers):
-          - =(securityContext):
-              =(procMount): Default
-          =(initContainers):
-          - =(securityContext):
-              =(procMount): Default
-          containers:
-          - =(securityContext):
-              =(procMount): Default
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/disallow-selinux

--- a/kyverno.io/v1/ClusterPolicy/-/disallow-selinux
+++ b/kyverno.io/v1/ClusterPolicy/-/disallow-selinux
@@ -1,83 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: SELinux options can be used to escalate privileges and should not be allowed. This policy ensures that the `seLinuxOptions` field is undefined.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Disallow SELinux
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: disallow-selinux
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: selinux-type
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Setting the SELinux type is restricted. The fields spec.securityContext.seLinuxOptions.type, spec.containers[*].securityContext.seLinuxOptions.type, , spec.initContainers[*].securityContext.seLinuxOptions, and spec.ephemeralContainers[*].securityContext.seLinuxOptions.type must either be unset or set to one of the allowed values (container_t, container_init_t, or container_kvm_t).
-      pattern:
-        spec:
-          =(ephemeralContainers):
-          - =(securityContext):
-              =(seLinuxOptions):
-                =(type): container_t | container_init_t | container_kvm_t
-          =(initContainers):
-          - =(securityContext):
-              =(seLinuxOptions):
-                =(type): container_t | container_init_t | container_kvm_t
-          =(securityContext):
-            =(seLinuxOptions):
-              =(type): container_t | container_init_t | container_kvm_t
-          containers:
-          - =(securityContext):
-              =(seLinuxOptions):
-                =(type): container_t | container_init_t | container_kvm_t
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: selinux-user-role
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Setting the SELinux user or role is forbidden. The fields spec.securityContext.seLinuxOptions.user, spec.securityContext.seLinuxOptions.role, spec.containers[*].securityContext.seLinuxOptions.user, spec.containers[*].securityContext.seLinuxOptions.role, spec.initContainers[*].securityContext.seLinuxOptions.user, spec.initContainers[*].securityContext.seLinuxOptions.role, spec.ephemeralContainers[*].securityContext.seLinuxOptions.user, and spec.ephemeralContainers[*].securityContext.seLinuxOptions.role must be unset.
-      pattern:
-        spec:
-          =(ephemeralContainers):
-          - =(securityContext):
-              =(seLinuxOptions):
-                X(role): 'null'
-                X(user): 'null'
-          =(initContainers):
-          - =(securityContext):
-              =(seLinuxOptions):
-                X(role): 'null'
-                X(user): 'null'
-          =(securityContext):
-            =(seLinuxOptions):
-              X(role): 'null'
-              X(user): 'null'
-          containers:
-          - =(securityContext):
-              =(seLinuxOptions):
-                X(role): 'null'
-                X(user): 'null'
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/restrict-apparmor-profiles

--- a/kyverno.io/v1/ClusterPolicy/-/restrict-apparmor-profiles
+++ b/kyverno.io/v1/ClusterPolicy/-/restrict-apparmor-profiles
@@ -1,40 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: On supported hosts, the 'runtime/default' AppArmor profile is applied by default. The default policy should prevent overriding or disabling the policy, or restrict overrides to an allowed set of profiles. This policy ensures Pods do not specify any other AppArmor profiles than `runtime/default` or `localhost/*`.
-    policies.kyverno.io/minversion: 1.3.0
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod, Annotation
-    policies.kyverno.io/title: Restrict AppArmor
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: restrict-apparmor-profiles
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: app-armor
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Specifying other AppArmor profiles is disallowed. The annotation `container.apparmor.security.beta.kubernetes.io` if defined must not be set to anything other than `runtime/default` or `localhost/*`.
-      pattern:
-        =(metadata):
-          =(annotations):
-            =(container.apparmor.security.beta.kubernetes.io/*): runtime/default | localhost/*
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/restrict-seccomp

--- a/kyverno.io/v1/ClusterPolicy/-/restrict-seccomp
+++ b/kyverno.io/v1/ClusterPolicy/-/restrict-seccomp
@@ -1,52 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: The seccomp profile must not be explicitly set to Unconfined. This policy, requiring Kubernetes v1.19 or later, ensures that seccomp is unset or set to `RuntimeDefault` or `Localhost`.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Restrict Seccomp
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: restrict-seccomp
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: check-seccomp
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Use of custom Seccomp profiles is disallowed. The fields spec.securityContext.seccompProfile.type, spec.containers[*].securityContext.seccompProfile.type, spec.initContainers[*].securityContext.seccompProfile.type, and spec.ephemeralContainers[*].securityContext.seccompProfile.type must be unset or set to `RuntimeDefault` or `Localhost`.
-      pattern:
-        spec:
-          =(ephemeralContainers):
-          - =(securityContext):
-              =(seccompProfile):
-                =(type): RuntimeDefault | Localhost
-          =(initContainers):
-          - =(securityContext):
-              =(seccompProfile):
-                =(type): RuntimeDefault | Localhost
-          =(securityContext):
-            =(seccompProfile):
-              =(type): RuntimeDefault | Localhost
-          containers:
-          - =(securityContext):
-              =(seccompProfile):
-                =(type): RuntimeDefault | Localhost
-  validationFailureAction: Audit

🔴 removed — kyverno.io/v1/ClusterPolicy/-/restrict-sysctls

--- a/kyverno.io/v1/ClusterPolicy/-/restrict-sysctls
+++ b/kyverno.io/v1/ClusterPolicy/-/restrict-sysctls
@@ -1,40 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kubernetes-version: '>=1.25.0-0'
-    kyverno.io/kyverno-version: v1.18.2
-    policies.kyverno.io/category: Pod Security Standards (Baseline)
-    policies.kyverno.io/description: Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. This policy ensures that only those "safe" subsets can be specified in a Pod.
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/title: Restrict sysctls
-  labels:
-    app.kubernetes.io/component: kyverno
-    app.kubernetes.io/instance: kyverno-policies
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: kyverno-policies
-    app.kubernetes.io/part-of: kyverno-policies
-    app.kubernetes.io/version: 3.8.2
-    helm.sh/chart: kyverno-policies-3.8.2
-  name: restrict-sysctls
-spec:
-  background: true
-  failurePolicy: Fail
-  rules:
-  - match:
-      any:
-      - resources:
-          kinds:
-          - Pod
-    name: check-sysctls
-    validate:
-      allowExistingViolations: true
-      failureAction: Audit
-      message: Setting additional sysctls above the allowed type is disallowed. The field spec.securityContext.sysctls must be unset or not use any other names than kernel.shm_rmid_forced, net.ipv4.ip_local_port_range, net.ipv4.ip_unprivileged_port_start, net.ipv4.tcp_syncookies and net.ipv4.ping_group_range.
-      pattern:
-        spec:
-          =(securityContext):
-            =(sysctls):
-            - =(name): kernel.shm_rmid_forced | net.ipv4.ip_local_port_range | net.ipv4.ip_unprivileged_port_start | net.ipv4.tcp_syncookies | net.ipv4.ping_group_range
-  validationFailureAction: Audit

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-capabilities

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-capabilities
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-capabilities
@@ -0,0 +1,39 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: Adding capabilities beyond those listed in the policy must be disallowed.
+    policies.kyverno.io/minversion: 1.6.0
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Disallow Capabilities
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-capabilities
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: "(!has(object.spec.containers) || object.spec.containers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.capabilities) || \n  !has(c.securityContext.capabilities.add) || \n  c.securityContext.capabilities.add.all(cap, cap in ['AUDIT_WRITE', 'CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'FSETID', 'KILL', 'MKNOD', 'NET_BIND_SERVICE', 'SETFCAP', 'SETGID', 'SETPCAP', 'SETUID', 'SYS_CHROOT']))) &&\n(!has(object.spec.initContainers) || object.spec.initContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.capabilities) || \n  !has(c.securityContext.capabilities.add) || \n  c.securityContext.capabilities.add.all(cap, cap in ['AUDIT_WRITE', 'CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'FSETID', 'KILL', 'MKNOD', 'NET_BIND_SERVICE', 'SETFCAP', 'SETGID', 'SETPCAP', 'SETUID', 'SYS_CHROOT']))) &&\n(!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.capabilities) || \n  !has(c.securityContext.capabilities.add) || \n  c.securityContext.capabilities.add.all(cap, cap in ['AUDIT_WRITE', 'CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'FSETID', 'KILL', 'MKNOD', 'NET_BIND_SERVICE', 'SETFCAP', 'SETGID', 'SETPCAP', 'SETUID', 'SYS_CHROOT'])))"
+    message: Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER, FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT) are disallowed.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-namespaces

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-namespaces
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-namespaces
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access to shared information and can be used to elevate privileges. Pods should not be allowed access to host namespaces. This policy ensures fields which make use of these host namespaces are unset or set to `false`.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Disallow Host Namespaces
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-host-namespaces
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: (!has(object.spec.hostPID) || object.spec.hostPID == false) && (!has(object.spec.hostIPC) || object.spec.hostIPC == false) && (!has(object.spec.hostNetwork) || object.spec.hostNetwork == false)
+    message: Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must be unset or set to `false`.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-path

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-path
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-path
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: HostPath volumes let Pods use host directories and volumes in containers. Using host resources can be used to access shared data or escalate privileges and should not be allowed. This policy ensures no hostPath volumes are in use.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod,Volume
+    policies.kyverno.io/title: Disallow hostPath
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-host-path
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: '!has(object.spec.volumes) || object.spec.volumes.all(v, !has(v.hostPath))'
+    message: HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-ports

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-ports
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-ports
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum restricted to a known list. This policy ensures the `hostPort` field is unset or set to `0`.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Disallow hostPorts
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-host-ports
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: "(!has(object.spec.containers) || object.spec.containers.all(c, \n  !has(c.ports) || c.ports.all(p, !has(p.hostPort) || p.hostPort == 0))) &&\n(!has(object.spec.initContainers) || object.spec.initContainers.all(c, \n  !has(c.ports) || c.ports.all(p, !has(p.hostPort) || p.hostPort == 0))) &&\n(!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, \n  !has(c.ports) || c.ports.all(p, !has(p.hostPort) || p.hostPort == 0)))"
+    message: Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort must either be unset or set to `0`.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-process

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-process
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-host-process
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: HostProcess containers can access the host and should not be allowed. This policy ensures the `hostProcess` field is unset or set to `false`.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Disallow HostProcess
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-host-process
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: "(!has(object.spec.securityContext) || \n !has(object.spec.securityContext.windowsOptions) || \n !has(object.spec.securityContext.windowsOptions.hostProcess) || \n object.spec.securityContext.windowsOptions.hostProcess == false) &&\n(!has(object.spec.containers) || object.spec.containers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.windowsOptions) || \n  !has(c.securityContext.windowsOptions.hostProcess) || \n  c.securityContext.windowsOptions.hostProcess == false)) &&\n(!has(object.spec.initContainers) || object.spec.initContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.windowsOptions) || \n  !has(c.securityContext.windowsOptions.hostProcess) || \n  c.securityContext.windowsOptions.hostProcess == false)) &&\n(!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.windowsOptions) || \n  !has(c.securityContext.windowsOptions.hostProcess) || \n  c.securityContext.windowsOptions.hostProcess == false))"
+    message: HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess, spec.containers[*].securityContext.windowsOptions.hostProcess, spec.initContainers[*].securityContext.windowsOptions.hostProcess, and spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must be unset or set to `false`.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-privileged-containers

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-privileged-containers
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-privileged-containers
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: Privileged mode disables most security mechanisms and must not be allowed. This policy ensures Pods do not call for privileged mode.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Disallow Privileged Containers
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-privileged-containers
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: (!has(object.spec.containers) || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false)) && (!has(object.spec.initContainers) || object.spec.initContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false)) && (!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false))
+    message: Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged and spec.initContainers[*].securityContext.privileged must be unset or set to `false`.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-proc-mount

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-proc-mount
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-proc-mount
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: The default /proc masks are set up to reduce attack surface and should be required. This policy ensures the `procMount` field is unset or set to `Default`.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Disallow /proc Mount Type
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-proc-mount
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: "(!has(object.spec.containers) || object.spec.containers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.procMount) || \n  c.securityContext.procMount == 'Default')) &&\n(!has(object.spec.initContainers) || object.spec.initContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.procMount) || \n  c.securityContext.procMount == 'Default')) &&\n(!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.procMount) || \n  c.securityContext.procMount == 'Default'))"
+    message: The default /proc masks are set up to reduce attack surface. The fields spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount, and spec.ephemeralContainers[*].securityContext.procMount must be unset or set to `Default`.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-selinux

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-selinux
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/disallow-selinux
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: Setting custom SELinux options may be used to bypass discretionary access control and should not be allowed. This policy ensures SELinux options are restricted.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Disallow SELinux
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: disallow-selinux
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: "(!has(object.spec.securityContext) || \n !has(object.spec.securityContext.seLinuxOptions) || \n (!has(object.spec.securityContext.seLinuxOptions.type) || object.spec.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&\n (!has(object.spec.securityContext.seLinuxOptions.user) || object.spec.securityContext.seLinuxOptions.user == '') &&\n (!has(object.spec.securityContext.seLinuxOptions.role) || object.spec.securityContext.seLinuxOptions.role == '')) &&\n(!has(object.spec.containers) || object.spec.containers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.seLinuxOptions) || \n  (!has(c.securityContext.seLinuxOptions.type) || c.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&\n  (!has(c.securityContext.seLinuxOptions.user) || c.securityContext.seLinuxOptions.user == '') &&\n  (!has(c.securityContext.seLinuxOptions.role) || c.securityContext.seLinuxOptions.role == ''))) &&\n(!has(object.spec.initContainers) || object.spec.initContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.seLinuxOptions) || \n  (!has(c.securityContext.seLinuxOptions.type) || c.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&\n  (!has(c.securityContext.seLinuxOptions.user) || c.securityContext.seLinuxOptions.user == '') &&\n  (!has(c.securityContext.seLinuxOptions.role) || c.securityContext.seLinuxOptions.role == ''))) &&\n(!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.seLinuxOptions) || \n  (!has(c.securityContext.seLinuxOptions.type) || c.securityContext.seLinuxOptions.type in ['', 'container_t', 'container_init_t', 'container_kvm_t', 'container_engine_t']) &&\n  (!has(c.securityContext.seLinuxOptions.user) || c.securityContext.seLinuxOptions.user == '') &&\n  (!has(c.securityContext.seLinuxOptions.role) || c.securityContext.seLinuxOptions.role == '')))"
+    message: Setting custom SELinux options is disallowed. The fields spec.securityContext.seLinuxOptions, spec.containers[*].securityContext.seLinuxOptions, spec.initContainers[*].securityContext.seLinuxOptions, and spec.ephemeralContainers[*].securityContext.seLinuxOptions must be unset or restricted.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-apparmor-profiles

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-apparmor-profiles
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-apparmor-profiles
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: AppArmor profiles should be restricted to allowed values. This policy ensures AppArmor profiles are unset or set to allowed values.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Restrict AppArmor Profiles
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: restrict-apparmor-profiles
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: "(!has(object.metadata) || \n !has(object.metadata.annotations) ||\n object.metadata.annotations.filter(k, k.startsWith('container.apparmor.security.beta.kubernetes.io/')).all(k, \n   object.metadata.annotations[k] in ['', 'runtime/default', 'localhost/*'])) &&\n(!has(object.spec.securityContext) || \n !has(object.spec.securityContext.appArmorProfile) || \n !has(object.spec.securityContext.appArmorProfile.type) || \n object.spec.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost']) &&\n(!has(object.spec.containers) || object.spec.containers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.appArmorProfile) || \n  !has(c.securityContext.appArmorProfile.type) || \n  c.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost'])) &&\n(!has(object.spec.initContainers) || object.spec.initContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.appArmorProfile) || \n  !has(c.securityContext.appArmorProfile.type) || \n  c.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost'])) &&\n(!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.appArmorProfile) || \n  !has(c.securityContext.appArmorProfile.type) || \n  c.securityContext.appArmorProfile.type in ['RuntimeDefault', 'Localhost']))"
+    message: AppArmor profiles must be restricted. The fields metadata.annotations['container.apparmor.security.beta.kubernetes.io/*'], spec.securityContext.appArmorProfile.type, spec.containers[*].securityContext.appArmorProfile.type, spec.initContainers[*].securityContext.appArmorProfile.type, and spec.ephemeralContainers[*].securityContext.appArmorProfile.type must be unset or set to allowed values.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-seccomp

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-seccomp
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-seccomp
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: The seccomp profile must not be explicitly set to Unconfined. This policy, requiring Kubernetes v1.19 or later, ensures that seccomp is unset or set to `RuntimeDefault` or `Localhost`.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Restrict Seccomp
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: restrict-seccomp
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: "(!has(object.spec.securityContext) || \n !has(object.spec.securityContext.seccompProfile) || \n !has(object.spec.securityContext.seccompProfile.type) || \n object.spec.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost']) &&\n(!has(object.spec.containers) || object.spec.containers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.seccompProfile) || \n  !has(c.securityContext.seccompProfile.type) || \n  c.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost'])) &&\n(!has(object.spec.initContainers) || object.spec.initContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.seccompProfile) || \n  !has(c.securityContext.seccompProfile.type) || \n  c.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost'])) &&\n(!has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(c, \n  !has(c.securityContext) || \n  !has(c.securityContext.seccompProfile) || \n  !has(c.securityContext.seccompProfile.type) || \n  c.securityContext.seccompProfile.type in ['RuntimeDefault', 'Localhost']))"
+    message: Use of custom Seccomp profiles is disallowed. The fields spec.securityContext.seccompProfile.type, spec.containers[*].securityContext.seccompProfile.type, spec.initContainers[*].securityContext.seccompProfile.type, and spec.ephemeralContainers[*].securityContext.seccompProfile.type must be unset or set to `RuntimeDefault` or `Localhost`.

🟢 added — policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-sysctls

--- a/policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-sysctls
+++ b/policies.kyverno.io/v1beta1/ValidatingPolicy/-/restrict-sysctls
@@ -0,0 +1,38 @@
+apiVersion: policies.kyverno.io/v1beta1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    kyverno.io/kubernetes-version: '>=1.25.0-0'
+    kyverno.io/kyverno-version: v1.19.0
+    policies.kyverno.io/category: Pod Security Standards (Baseline)
+    policies.kyverno.io/description: Sysctls can disable security mechanisms or affect all containers on a host and should be restricted. This policy ensures only safe sysctls are allowed.
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/title: Restrict Sysctls
+  labels:
+    app.kubernetes.io/component: kyverno
+    app.kubernetes.io/instance: kyverno-policies
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kyverno-policies
+    app.kubernetes.io/part-of: kyverno-policies
+    app.kubernetes.io/version: 3.9.0
+    helm.sh/chart: kyverno-policies-3.9.0
+  name: restrict-sysctls
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+      - ''
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      - UPDATE
+      resources:
+      - pods
+  validationActions:
+  - Audit
+  validations:
+  - expression: '!has(object.spec.securityContext) ||  !has(object.spec.securityContext.sysctls) ||  object.spec.securityContext.sysctls.all(s, s.name in [''kernel.shm_rmid_forced'', ''net.ipv4.ip_local_port_range'', ''net.ipv4.tcp_syncookies'', ''net.ipv4.ping_group_range'', ''net.ipv4.ip_unprivileged_port_start'', ''net.ipv4.ip_local_reserved_ports'', ''net.ipv4.tcp_keepalive_time'', ''net.ipv4.tcp_fin_timeout'', ''net.ipv4.tcp_keepalive_intvl'', ''net.ipv4.tcp_keepalive_probes''])'
+    message: Sysctls must be restricted to safe values. The field spec.securityContext.sysctls[*].name must be one of the allowed safe sysctls.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.