38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
|
apiVersion: kyverno.io/v1
|
||
|
|
kind: ClusterPolicy
|
||
|
|
metadata:
|
||
|
|
name: restrict-route-backends
|
||
|
|
annotations:
|
||
|
|
policies.kyverno.io/title: Restrict HTTPRoute cross-namespace backends
|
||
|
|
policies.kyverno.io/category: Gateway API
|
||
|
|
policies.kyverno.io/severity: medium
|
||
|
|
policies.kyverno.io/description: >-
|
||
|
|
Keep backendRefs in the route namespace. Cross-namespace backends require
|
||
|
|
ReferenceGrant and a reviewed exception path.
|
||
|
|
spec:
|
||
|
|
validationFailureAction: Audit
|
||
|
|
background: true
|
||
|
|
rules:
|
||
|
|
- name: deny-cross-namespace-backendrefs
|
||
|
|
match:
|
||
|
|
any:
|
||
|
|
- resources:
|
||
|
|
kinds:
|
||
|
|
- HTTPRoute
|
||
|
|
validate:
|
||
|
|
message: >-
|
||
|
|
HTTPRoute backendRefs must not set a different namespace than the
|
||
|
|
route. Use same-namespace Services only.
|
||
|
|
foreach:
|
||
|
|
- list: "request.object.spec.rules[].backendRefs[]"
|
||
|
|
preconditions:
|
||
|
|
all:
|
||
|
|
- key: "{{ element.namespace || '' }}"
|
||
|
|
operator: NotEquals
|
||
|
|
value: ""
|
||
|
|
deny:
|
||
|
|
conditions:
|
||
|
|
any:
|
||
|
|
- key: "{{ element.namespace }}"
|
||
|
|
operator: NotEquals
|
||
|
|
value: "{{ request.namespace }}"
|