ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/audit-gateway-api-rbac.yaml

@@ -0,0 +1,87 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: audit-gateway-api-rbac
+  annotations:
+    policies.kyverno.io/title: Audit Gateway API mutating RBAC
+    policies.kyverno.io/category: Gateway API
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/description: >-
+      Report ClusterRoles and Roles that grant create/update/patch/delete on
+      gateway.networking.k8s.io resources outside the approved controller set.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: flag-unapproved-gateway-api-mutation
+      match:
+        any:
+          - resources:
+              kinds:
+                - ClusterRole
+                - Role
+      exclude:
+        any:
+          - resources:
+              names:
+                - cluster-admin
+                - admin
+                - edit
+                - system:*
+                - cilium-*
+                - cert-manager-*
+                - grafana-operator*
+                - victoriametrics-operator*
+                - flux-*
+                - cluster-reconciler-flux-system
+                - crd-controller-flux-system
+                - agentgateway-agentgateway-system
+                # Kyverno * does not match '.' — use olm.og* not olm.og.*
+                - olm.og*
+                - aggregate-olm*
+      # Count rules that explicitly mutate Gateway API kinds (no foreach — wildcard
+      # AnyIn on * false-positived every Role).
+      preconditions:
+        all:
+          - key: >-
+              {{ (request.object.rules || `[]`)[?
+                   apiGroups != null &&
+                   contains(apiGroups, 'gateway.networking.k8s.io') &&
+                   (
+                     contains(verbs, 'create') ||
+                     contains(verbs, 'update') ||
+                     contains(verbs, 'patch') ||
+                     contains(verbs, 'delete') ||
+                     contains(verbs, 'deletecollection') ||
+                     contains(verbs, '*')
+                   ) &&
+                   resources != null &&
+                   (
+                     contains(resources, 'gateways') ||
+                     contains(resources, 'gateways/status') ||
+                     contains(resources, 'httproutes') ||
+                     contains(resources, 'httproutes/status') ||
+                     contains(resources, 'httproutes/finalizers') ||
+                     contains(resources, 'grpcroutes') ||
+                     contains(resources, 'referencegrants') ||
+                     contains(resources, 'tlsroutes') ||
+                     contains(resources, 'tcproutes') ||
+                     contains(resources, 'gatewayclasses') ||
+                     contains(resources, 'gatewayclasses/status')
+                   )
+                 ] | length(@) }}
+            operator: GreaterThan
+            value: 0
+      validate:
+        message: >-
+          Role grants mutating verbs on gateway.networking.k8s.io resources
+          outside the approved controller set. Review and narrow or add to the
+          policy allowlist.
+        deny:
+          conditions:
+            any:
+              - key: "{{ request.object.kind }}"
+                operator: AnyIn
+                value:
+                  - Role
+                  - ClusterRole