ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/protect-shared-gateways.yaml

@@ -0,0 +1,54 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: protect-shared-gateways
+  annotations:
+    policies.kyverno.io/title: Protect shared Gateway specs
+    policies.kyverno.io/category: Gateway API
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/description: >-
+      Shared Gateways (internal, relay, and short) may only have their spec mutated
+      by Flux GitOps service accounts. Cilium status updates that do not change
+      spec are not evaluated. Admission-only (userInfo is not available in
+      background scans).
+spec:
+  validationFailureAction: Audit
+  background: false
+  rules:
+    - name: shared-gateway-spec-gitops-only
+      match:
+        any:
+          - resources:
+              kinds:
+                - Gateway
+              names:
+                - gateway-internal
+                - gateway-relay
+                - gateway-short
+              namespaces:
+                - kube-system
+              operations:
+                - CREATE
+                - UPDATE
+      preconditions:
+        any:
+          - key: "{{ request.operation }}"
+            operator: Equals
+            value: CREATE
+          - key: "{{ request.object.spec }}"
+            operator: NotEquals
+            value: "{{ request.oldObject.spec }}"
+      validate:
+        message: >-
+          Shared Gateway specs may only be created or changed by Flux
+          (flux-system kustomize-controller / helm-controller). Other callers
+          fail this audit until reviewed.
+        deny:
+          conditions:
+            all:
+              - key: "{{ request.userInfo.username }}"
+                operator: AnyNotIn
+                value:
+                  - system:serviceaccount:flux-system:kustomize-controller
+                  - system:serviceaccount:flux-system:helm-controller
+                  - system:serviceaccount:flux-system:flux-operator