{"id":27970041,"url":"https://github.com/kubearmor/policy-templates","last_synced_at":"2025-05-07T21:56:04.731Z","repository":{"id":36952133,"uuid":"391112186","full_name":"kubearmor/policy-templates","owner":"kubearmor","description":"Community curated list of System and Network policy templates for the KubeArmor and Cilium","archived":false,"fork":false,"pushed_at":"2025-03-25T17:27:07.000Z","size":2619,"stargazers_count":44,"open_issues_count":10,"forks_count":46,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-05-07T21:55:57.922Z","etag":null,"topics":["cilium","kubearmor","kubernetes-policy","network-policy","runtime-security","system-policy"],"latest_commit_sha":null,"homepage":"https://kubearmor.io/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kubearmor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.MD","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-07-30T15:30:56.000Z","updated_at":"2025-04-26T06:22:56.000Z","dependencies_parsed_at":"2024-03-25T08:56:10.578Z","dependency_job_id":"f5efc241-5e5c-47b6-9f0f-419b9c8ca203","html_url":"https://github.com/kubearmor/policy-templates","commit_stats":null,"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2Fpolicy-templates","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2Fpolicy-templates/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2Fpolicy-templates/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2Fpolicy-templates/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kubearmor","download_url":"https://codeload.github.com/kubearmor/policy-templates/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252961836,"owners_count":21832193,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cilium","kubearmor","kubernetes-policy","network-policy","runtime-security","system-policy"],"created_at":"2025-05-07T21:56:04.110Z","updated_at":"2025-05-07T21:56:04.719Z","avatar_url":"https://github.com/kubearmor.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"# Policies Libraries\nA community-owned library of Kubernetes System and Network policies\n\n[![Build Status](https://travis-ci.com/accuknox/KubeArmor.svg?branch=master)](https://travis-ci.com/accuknox/KubeArmor)\n[![Slack](https://img.shields.io/badge/Join%20Our%20Community-Slack-green)](https://join.slack.com/t/kubearmor/shared_invite/zt-1ltmqdbc6-rSHw~LM6MesZZasmP2hAcA)\n[![Discussions](https://img.shields.io/badge/Got%20Questions%3F-Chat-Violet)](https://github.com/kubearmor/KubeArmor/discussions)\n[![Contributions](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/kubearmor/policy-templates/issues)\n\n----\n## Policy Templates overview\n\nPlease follow the hierarchy while contribution\n\n```bash\n.\n├── mitre\n│   ├── network\n│   │   └── cnp-firewall-world-block.yaml\n│   ├── system\n│   │   └── ksp-postgres-allow.yaml\n│   │   └── ksp-privilage-pod-block.yaml\n├── pci-dss\n│   ├── network\n│   │   └── cnp-cardholder-data-block.yaml\n│   ├── system\n│   │   └── ksp-protect-cardholder-data-audit.yaml\n├── nist\n│   ├── network\n│   │   └── cnp-account-management-block.yaml\n│   ├── system\n│   │   └── ksp-remote-file-copy-block.yaml\n│   │   └── ksp-active-directory-audit.yaml\n├── cves\n│   ├── network\n│   │   └── cnp-CVE-2009-0932.yaml\n│   ├── system\n│   │   └── ksp-CVE-2021-29156.yaml\n│   │   └── ksp-CVE-2021-29442.yaml\n├── cis\n│   ├── system\n│   │   └── hsp-scheduler-pod-block.yaml\n...\n```\n\n📖 Documentation\n-----\n\nPlease navigate to https://kubearmor.gitbook.io for detailed documentation to **deploy** KubeArmor and create own **custom** templates.\nWe have also added a set of templates to help you understand how things work.\n\n💪 Contributions\n-----\n\nPolicy-templates is powered by major contributions from the community and an initiative from AccuKnox.\nRefer [Contribution](https://github.com/kubearmor/KubeArmor/blob/main/contribution/contribution_guide.md) for more info \n\n💬 Discussion\n-----\n\nGot questions / doubts / ideas to discuss?\nFeel free to open a discussion on [Github discussions](https://github.com/kubearmor/KubeArmor/discussions) board.\n\n👨‍💻 Test it yourself\n-----\n\n\u003e Assuming cluster is configured, this can be verified via using `kubectl config current-context` command. If not follow [this](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-access-for-kubectl)\n\n**Step #1:** Download and install `karmor` CLI binary on your local machine\n```sh\ncurl -sfL https://raw.githubusercontent.com/kubearmor/kubearmor-client/main/install.sh | sudo sh -s -- -b /usr/local/bin\n```\n\n**Step #2:** Install [KubeArmor](https://github.com/kubearmor/KubeArmor) using `karmor` CLI tool\n```sh\nkarmor install\n```\n\n**Step #3:** Deploy sample application on configured cluster, we'll use `nginx` as deployment here\n```sh\nkubectl apply -f https://k8s.io/examples/application/deployment.yaml\nkubectl get pods -l app=nginx\n```\n\n**Step #4:** Applying MITRE Policy to block system owner discovery command\n```sh\nkubectl apply -f https://raw.githubusercontent.com/kubearmor/policy-templates/main/mitre/system/ksp-mitre-system-owner-user-discovery.yaml\n```\n\n**Step #05:** Checking if system owner command is Blocked or not\n```sh\nkubectl exec -it --namespace default nginx-deployment-xxxxxxxxxx-xxxxx -- bash\nroot@nginx-deployment-687d8556b7-8wjmj:/# whoami\nbash: /usr/bin/whoami: Permission denied\n```\n\u003e Replace `nginx-deployment-xxxxxxxxxx-xxxxx` with pod name from Step #3. \u003cbr\u003e\n\u003e We can see the command didn't executed and instead we got Permission denied\n\n\n**Step #6:** Getting telemetry/alerts for KubeArmor\n```sh\nkubectl port-forward -n kube-system svc/kubearmor 32767:32767\n```\n\u003e Keep this terminal open, and in another terminal type\n```sh\nkarmor log\n```\n\n\n\n\u003c!---\n```\n- recommended-policies\n   - mitre (compliance type)\n     - host/workload\n       - mysql/generic/postgres/ (mention appropriate workload here)\n         - system/network-ingress/network-egress (policy type)\n           - policy-name.yaml\n```\n--\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubearmor%2Fpolicy-templates","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkubearmor%2Fpolicy-templates","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubearmor%2Fpolicy-templates/lists"}