ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/restrict-gateway-client-label.yaml

@@ -0,0 +1,42 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-gateway-client-label
+  annotations:
+    policies.kyverno.io/title: Restrict Gateway client privilege label
+    policies.kyverno.io/category: Gateway API
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/description: >-
+      Only approved namespaces may set gateway.quorate.internal/allow-gateway-client.
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+    - name: gateway-client-label-namespace-allowlist
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      preconditions:
+        all:
+          - key: >-
+              {{ request.object.metadata.labels."gateway.quorate.internal/allow-gateway-client" || '' }}
+            operator: Equals
+            value: "true"
+      validate:
+        message: >-
+          gateway.quorate.internal/allow-gateway-client is only allowed on pods
+          in approved OIDC client namespaces (forgejo, forgejo-public, grafana,
+          longhorn, quay).
+        deny:
+          conditions:
+            all:
+              - key: "{{ request.namespace }}"
+                operator: AnyNotIn
+                value:
+                  - forgejo
+                  - forgejo-public
+                  - grafana
+                  - longhorn
+                  - quay