ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/restrict-route-backends.yaml

@@ -0,0 +1,38 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-route-backends
+  annotations:
+    policies.kyverno.io/title: Restrict HTTPRoute cross-namespace backends
+    policies.kyverno.io/category: Gateway API
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/description: >-
+      Keep backendRefs in the route namespace. Cross-namespace backends require
+      ReferenceGrant and a reviewed exception path.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: deny-cross-namespace-backendrefs
+      match:
+        any:
+          - resources:
+              kinds:
+                - HTTPRoute
+      validate:
+        message: >-
+          HTTPRoute backendRefs must not set a different namespace than the
+          route. Use same-namespace Services only.
+        foreach:
+          - list: "request.object.spec.rules[].backendRefs[]"
+            preconditions:
+              all:
+                - key: "{{ element.namespace || '' }}"
+                  operator: NotEquals
+                  value: ""
+            deny:
+              conditions:
+                any:
+                  - key: "{{ element.namespace }}"
+                    operator: NotEquals
+                    value: "{{ request.namespace }}"