It doesn't have to break Sitecore itself; it depends on how restrictive you want to be.
I've found that I have to allow unsafe-inline and unsafe-eval for script, and most other media needs to be "self"
The project I'm working on currently uses the following (it's quite loose - lots of media from other domains):
default-src * 'self' 'unsafe-inline' ; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' [remove various analytics] ; connect-src * ; upgrade-insecure-requests; block-all-mixed-content;
Seems to work okay, but you might want something more restrictive.
If so, a good option then would be to turn on your CSP in Report-Only mode. Set a policy something like:
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' ; upgrade-insecure-requests; block-all-mixed-content;
Use a service such as report-uri.com to record violations (or just monitor the console in Chrome's DevTools), and try using it for a while. Once you've got some violations, review, and adjust your policy.