ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/restrict-referencegrants.yaml

@@ -0,0 +1,31 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-referencegrants
+  annotations:
+    policies.kyverno.io/title: Deny ReferenceGrant by default
+    policies.kyverno.io/category: Gateway API
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/description: >-
+      ReferenceGrant is default-deny. Add a named PolicyException for reviewed
+      cross-namespace backend cases.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: deny-referencegrant
+      match:
+        any:
+          - resources:
+              kinds:
+                - ReferenceGrant
+      validate:
+        message: >-
+          ReferenceGrant is not allowed by default. Request a named
+          PolicyException after review.
+        deny:
+          conditions:
+            any:
+              - key: "{{ request.object.kind }}"
+                operator: Equals
+                value: ReferenceGrant