ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/cilium-networkpolicy-coverage.yaml

@@ -0,0 +1,56 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: cilium-networkpolicy-coverage
+  annotations:
+    policies.kyverno.io/title: CiliumNetworkPolicy namespace coverage
+    policies.kyverno.io/category: Network Security
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/description: >-
+      Audit namespaces that lack any CiliumNetworkPolicy. Stays Audit forever;
+      never promote to Enforce (onboarding must not block on CNP admission).
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: require-namespaced-cilium-networkpolicy
+      match:
+        any:
+          - resources:
+              kinds:
+                - Namespace
+      exclude:
+        any:
+          - resources:
+              names:
+                - default
+                - kube-system
+                - kube-public
+                - kube-node-lease
+                - flux-system
+                - flux-canary
+                - kyverno
+                - cert-manager
+                - cilium-secrets
+                - olm
+                - operators
+                - longhorn
+                - openebs
+                - intel-system
+                - nfd
+      context:
+        - name: cnpcount
+          apiCall:
+            urlPath: "/apis/cilium.io/v2/namespaces/{{ request.object.metadata.name }}/ciliumnetworkpolicies"
+            jmesPath: "items | length(@)"
+      validate:
+        message: >-
+          Namespace {{ request.object.metadata.name }} has no CiliumNetworkPolicy
+          resources. Add at least one namespaced CNP (clusterwide policies are not
+          counted by this rule yet).
+        deny:
+          conditions:
+            any:
+              - key: "{{ cnpcount }}"
+                operator: Equals
+                value: 0