Loading_
Loading_
Pod Security admission, default-deny network policy, RBAC baseline and resource governance in one applyable bundle.
# ─────────────────────────────────────────────────────────────────────────# AIInfraEngine — Kubernetes hardening baseline# Apply order matters: namespaces, then policy, then RBAC, then quotas.# kubectl apply -f k8s-hardening-baseline.yaml# ─────────────────────────────────────────────────────────────────────────apiVersion: v1kind: Namespacemetadata: name: workloads labels: # Pod Security admission — enforce the restricted profile. pod-security.kubernetes.io/enforce: restricted pod-security.kubernetes.io/enforce-version: latest pod-security.kubernetes.io/audit: restricted pod-security.kubernetes.io/warn: restricted aiinfraengine.io/managed: "true"---# ── Default deny all ingress ─────────────────────────────────────────────apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata: name: default-deny-ingress namespace: workloadsspec: podSelector: {} policyTypes: - Ingress---175 more lines behind the library licence
k8s-hardening-baseline.yaml · 5.2 KB · 3 dependencies documented
This one is behind the licence because it is the kind of script that does real damage when it is wrong — and the version above has already been broken and fixed by two engineers in a live estate.
A default Kubernetes cluster is permissive: pods can run as root, any pod can reach any other pod, and a missing resource limit can starve a node. This bundle closes those three gaps with the least disruptive settings that still count as hardened.
Pod Security admission is set to `restricted` in enforce mode for workload namespaces, with `baseline` warn on system namespaces so you see violations before enforcing there.
Network policy is default-deny for ingress with an explicit DNS egress allowance — the single most common cause of "network policy broke everything" is forgetting CoreDNS.
The platform turns any script into a governed automation — versioned, gated, audited and reversible.