You can prevent containers from running with the privileged: true parameter because such containers obtain superuser privileges on the node.
Fill out the configuration file
To ban running privileged containers, fill out the disallowPrivilegedContainers block in the values-policies.yaml file:
...
## policy bans running privileged containers (privileged: true)
disallowPrivilegedContainers:
enabled: true
## list of namespaces where the privileged container ban policy will apply
namespace:
- brix365
- brix365-dev
...
where:
- disallowPrivilegedContainers.enabled: Set to true to enable the policy. The false value disables it.
- disallowPrivilegedContainers.namespace: Specify the namespaces to which the policy will apply.
After configuring the security policy, install the kyverno-policies chart as described in Step 3 of Phase 2 in Install Kyverno.