Restrict Binding System Groups in ValidatingPolicy

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4  name: restrict-binding-system-groups
 5  annotations:
 6    policies.kyverno.io/title: Restrict Binding System Groups in ValidatingPolicy
 7    policies.kyverno.io/category: Security, EKS Best Practices in vpol 
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: RoleBinding, ClusterRoleBinding, RBAC
10    kyverno.io/kyverno-version: 1.14.0
11    policies.kyverno.io/minversion: 1.14.0
12    kyverno.io/kubernetes-version: "1.30"
13    policies.kyverno.io/description: >-
14      Certain system groups exist in Kubernetes which grant permissions that
15      are used for certain system-level functions yet typically never appropriate
16      for other users. This policy prevents creating bindings to some of these
17      groups including system:anonymous, system:unauthenticated, and system:masters.
18spec:
19  validationActions: 
20    - Audit
21  evaluation:
22    background:
23      enabled: true  
24  matchConstraints:
25    resourceRules:
26      - apiGroups: ["rbac.authorization.k8s.io"]
27        apiVersions: ["v1"]
28        operations: ["CREATE", "UPDATE"]
29        resources: ["rolebindings", "clusterrolebindings"]
30  validations:
31    - expression: "object.subjects.all(subject, subject.name != 'system:anonymous')"
32      message: "Binding to system:anonymous is not allowed."
33    - expression: "object.subjects.all(subject, subject.name != 'system:unauthenticated')"
34      message: "Binding to system:unauthenticated is not allowed."
35    - expression: "object.subjects.all(subject, subject.name != 'system:masters')"
36      message: "Binding to system:masters is not allowed."
37