Overview

UCS provides you with a preset policy definition library. With this library, you can create specific policy instances and delegate the task of defining policy instance details to individuals or teams with professional knowledge. This approach not only isolates concerns, but also separates the logic of policy instances from their definitions.

To help you better understand the working principle of a policy definition, each preset policy definition contains the following three parts: an example policy instance, which is used to show how to use the policy definition; a resource definition that violates the policy instance, which is used to describe the resource examples that do not meet the policy requirements; a resource definition that meets the policy instance, which is used to display resource examples that meet the policy requirements.

Each policy instance contains a match field, which defines the target object to which the policy instance is applied. The match field specifies the resource type, namespace, or other specific conditions to which the policy instance applies. This ensures that the policy instance takes effect only on the objects that meet these conditions.

Table 1 defines 16 security policies, which are used to ensure the security of clusters and resources. Table 2 defines 17 compliance policies, which are used to meet different compliance requirements.

**Table 1** Security policy definition
Policy Definition	Type	Level of Recommendation	Target Object	Parameter
k8spspvolumetypes	Security	L3	Pods	volumes: Array
k8spspallowedusers	Security	L3	Pods	exemptImages: String array runAsUser rule: String ranges min: Integer max: Integer runAsGroup rule: String ranges min: Integer max: Integer supplementalGroups rule: String ranges min: Integer max: Integer fsGroup rule: String ranges min: Integer max: Integer
k8spspselinuxv2	Security	L3	Pods	allowedSELinuxOptions: Object array, including four string objects: level, role, type, and user. exemptImages: String array
k8spspseccomp	Security	L3	Pods	allowedLocalhostFiles: Array allowedProfiles: Array exemptImages: String array
k8spspreadonlyrootfilesystem	Security	L3	Pods	exemptImages: String array
k8spspprocmount	Security	L3	Pods	exemptImages: String array procMount: String
k8spspprivilegedcontainer	Security	L3	Pods	exemptImages: String array
k8spsphostnetworkingports	Security	L3	Pods	exemptImages: String array hostNetwork max: Integer min: Integer
k8spsphostnamespace	Security	L3	Pods	None
k8spsphostfilesystem	Security	L3	Pods	allowedHostPaths pathPrefix: String
k8spspfsgroup	Security	L3	Pods	rule: The value is a string. MayRunAs, MustRunAs, and RunAsAny are supported. ranges max: Integer min: Integer
k8spspforbiddensysctls	Security	L3	Pods	allowedSysctls: Array forbiddenSysctls: Array
k8spspflexvolumes	Security	L3	Pods	allowedFlexVolumes: Array
k8spspcapabilities	Security	L3	Pods	allowedCapabilities: Array exemptImages: String array requiredDropCapabilities: Array
k8spspapparmor	Security	L3	Pods	allowedProfiles: Array exemptImages: String array
k8spspallowprivilegeescalationcontainer	Security	L3	Pods	exemptImages: String array

**Table 2** Definition of compliance policies
Policy Definition	Type	Level of Recommendation	Target Object	Parameter
k8srequiredprobes	Compliance	L1	Pods	probes: Array probeTypes: Array
k8srequiredlabels	Compliance	L1	Deployment	labels key/allowedRegex: Key-value pair array message: String
k8srequiredannotations	Compliance	L1	Pods	annotations key/allowedRegex: Key-value pair array message: String
k8sreplicalimits	Compliance	L1	Deployment, ReplicaSet, and CronJob	ranges min_replicas: Integer max_replicas: Integer
noupdateserviceaccount	Compliance	L1	Pods	allowedGroups: Array allowedUsers: Array
k8simagedigests	Compliance	L1	Pods	exemptImages: String array
k8sexternalips	Compliance	L1	Service	allowedIPs: String array
k8sdisallowedtags	Compliance	L1	Pods	tags: String array exemptImages: String array
k8srequiredresources	Compliance	L1	Pods	exemptImages: String array limits cpu memory requests cpu memory
k8scontainerratios	Compliance	L1	Pods	ratio: String cpuRatio: String exemptImages: String array
k8scontainerrequests	Compliance	L1	Pods	cpu: String memory: String exemptImages: String array
k8scontainerlimits	Compliance	L1	Pods	cpu: String memory: String exemptImages: String array
k8sblockwildcardingress	Compliance	L1	Ingress	None
k8sblocknodeport	Compliance	L1	Service	None
k8sblockloadbalancer	Compliance	L1	Pods	None
k8spspautomountserviceaccounttokenpod	Compliance	L1	Pods	None
k8sallowedrepos	Compliance	L1	Pods	repos: String array