How trailsamuel/k8s-policy-lab works
k8s-policy-lab is a learning lab that demonstrates how Kubernetes security controls evolve: a local kind cluster first accepts risky workloads, RBAC limits identities but permits a dangerous pod-creation action, and Kyverno admission policies reject unsafe objects. The documented workflow also includes repeatable policy tests and CIS Benchmark mapping. Paths and relationships below follow the README; source excerpts were unavailable, so undocumented implementation links are omitted.
Main entry points: privileged-pod.yaml Workload manifests · app-pod.yaml Application pod · 01-overpermissioned-role.yaml Over-permissioned role · kyverno-test.yaml Policy test suite
Components 16
Cluster Lab
- kind cluster
cluster/kind-config.yaml - Kubernetes API server
- Workload manifests
workloads/privileged-pod.yaml - Application pod
workloads/app-pod.yaml
Identity and RBAC
- dev and prod
rbac/00-namespaces.yaml - Over-permissioned role
rbac/01-overpermissioned-role.yaml - RBAC authorization
Admission Controls
- Kyverno admission
- Block privileged pods
policies/disallow-privileged.yaml - Block host namespaces
policies/disallow-host-namespaces.yaml - Block host paths
policies/disallow-host-path.yaml - Require non-root
policies/require-run-as-nonroot.yaml
Policy Assurance
- Policy test suite
tests/kyverno-test.yaml - Test resources
tests/bad-host-network.yaml - CIS control mapping
docs/cis-mapping.md
Other components
- Lab operator
Connections 17
- Lab operator → kind cluster: creates cluster
README.md - Lab operator → Workload manifests: applies manifests
README.md - Lab operator → Application pod: applies manifest
README.md - Workload manifests → Kubernetes API server: submits pod
README.md - Application pod → Kubernetes API server: submits pod
README.md - Lab operator → dev and prod: applies setup
README.md - Lab operator → Over-permissioned role: applies setup
README.md - Over-permissioned role → RBAC authorization: grants permissions
README.md - RBAC authorization → Kubernetes API server: authorizes requests
README.md - Kubernetes API server → Kyverno admission: checks admission
README.md - Kyverno admission → Block privileged pods: checks policy
README.md - Kyverno admission → Block host namespaces: checks policy
README.md - Kyverno admission → Block host paths: checks policy
README.md - Kyverno admission → Require non-root: checks policy
README.md - Lab operator → Policy test suite: runs tests
README.md - Policy test suite → Test resources: pairs resources
README.md - Lab operator → CIS control mapping: consults mapping
README.md