Policy Editor
Edit and deploy OPA/Rego security policies
Policies
no-root-containers
image-registry
2F
resource-limits
network-policy
1F
pdb-required
no_root_containers.rego
Rego
Save
Test
Deploy
Disable
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
package kubernetes.admission import future.keywords.in deny[msg] { input.request.kind.kind == "Pod" container := input.request.object.spec.containers[_] container.securityContext.runAsUser == 0 msg := sprintf( "Container '%s' must not run as root (UID 0)", [container.name] ) } deny[msg] { input.request.kind.kind == "Pod" container := input.request.object.spec.containers[_] container.securityContext.runAsNonRoot == false msg := sprintf( "Container '%s' must set runAsNonRoot to true", [container.name] ) }