34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
|
apiVersion: kyverno.io/v1
|
||
|
|
kind: ClusterPolicy
|
||
|
|
metadata:
|
||
|
|
name: require-vso-secret-labels
|
||
|
|
annotations:
|
||
|
|
policies.kyverno.io/title: Require VSO ownership labels on VSO Secrets
|
||
|
|
policies.kyverno.io/category: Secrets
|
||
|
|
policies.kyverno.io/severity: medium
|
||
|
|
policies.kyverno.io/description: >-
|
||
|
|
Secrets that carry secrets.hashicorp.com/vso-ownerRefUID must also set
|
||
|
|
app.kubernetes.io/managed-by=hashicorp-vso so ownership stays consistent.
|
||
|
|
spec:
|
||
|
|
validationFailureAction: Audit
|
||
|
|
background: true
|
||
|
|
rules:
|
||
|
|
- name: vso-owner-implies-managed-by
|
||
|
|
match:
|
||
|
|
any:
|
||
|
|
- resources:
|
||
|
|
kinds:
|
||
|
|
- Secret
|
||
|
|
preconditions:
|
||
|
|
all:
|
||
|
|
- key: "{{ request.object.metadata.labels.\"secrets.hashicorp.com/vso-ownerRefUID\" || '' }}"
|
||
|
|
operator: NotEquals
|
||
|
|
value: ""
|
||
|
|
validate:
|
||
|
|
message: >-
|
||
|
|
Secrets with secrets.hashicorp.com/vso-ownerRefUID must set
|
||
|
|
app.kubernetes.io/managed-by to hashicorp-vso.
|
||
|
|
pattern:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/managed-by: hashicorp-vso
|