ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
--- a/vendor/platform/kyverno/policies/tls-activation.yaml
+++ b/vendor/platform/kyverno/policies/tls-activation.yaml
@ -0,0 +1,102 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: tls-activation
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+  - name: tls-containers
+    match:
+      any:
+      - resources:
+          kinds:
+          - Secret
+          operations:
+          - CREATE
+          - UPDATE
+    preconditions:
+      all:
+      - key: '{{ length(certs) }}'
+        operator: GreaterThan
+        value: 0
+    context:
+    - name: certs
+      variable:
+        jmesPath: sort_by(items(request.object.data || `{}`, 'key', 'value')[?value != '' && (contains(`["tls.crt",
+          "ca.crt", "ssl.cert"]`, key) || contains(base64_decode(value), '-----BEGIN CERTIFICATE-----'))], &key)
+    - name: pods
+      apiCall:
+        urlPath: /api/v1/namespaces/{{ request.object.metadata.namespace }}/pods
+        jmesPath: 'items[?status.phase != `"Succeeded"` && status.phase != `"Failed"` && (spec.volumes[?secret.secretName
+          == ''{{ request.object.metadata.name }}'' || contains(projected.sources[].secret.name || `[]`, ''{{ request.object.metadata.name
+          }}'')] || spec.[containers, initContainers][][?env[].valueFrom.secretKeyRef[?name == ''{{ request.object.metadata.name
+          }}''] || envFrom[].secretRef[?name == ''{{ request.object.metadata.name }}'']])].{metadata: {name: metadata.name,
+          ownerReferences: metadata.ownerReferences, annotations: {"certificates.quorate.internal/activation": metadata.annotations."certificates.quorate.internal/activation"}},
+          spec: {volumes: spec.volumes, containers: spec.containers[].{name: name, volumeMounts: volumeMounts, env:
+          env[].valueFrom.secretKeyRef, envFrom: envFrom[].secretRef}, initContainers: spec.initContainers[].{name:
+          name, volumeMounts: volumeMounts, env: env[].valueFrom.secretKeyRef, envFrom: envFrom[].secretRef}}}'
+    - name: deployments
+      apiCall:
+        urlPath: /apis/apps/v1/namespaces/{{ request.object.metadata.namespace }}/deployments
+        jmesPath: items[?spec.paused != `true`].metadata.name
+    - name: replicas
+      apiCall:
+        urlPath: /apis/apps/v1/namespaces/{{ request.object.metadata.namespace }}/replicasets
+        jmesPath: items[?metadata.ownerReferences[?kind == 'Deployment' && contains(`{{ deployments }}`, name)]].metadata.name
+    - name: daemonsets
+      apiCall:
+        urlPath: /apis/apps/v1/namespaces/{{ request.object.metadata.namespace }}/daemonsets
+        jmesPath: items[?spec.updateStrategy.type != 'OnDelete'].metadata.name
+    - name: statefulsets
+      apiCall:
+        urlPath: /apis/apps/v1/namespaces/{{ request.object.metadata.namespace }}/statefulsets
+        jmesPath: items[?spec.updateStrategy.type != 'OnDelete' && (spec.updateStrategy.rollingUpdate.partition
+          || `0`) == `0`].metadata.name
+    validate:
+      message: TLS consumers need an eligible rollout controller or an explicit native reload mechanism.
+      foreach:
+      - list: pods
+        context:
+        - name: tlsVolumes
+          variable:
+            jmesPath: element0.spec.volumes[?secret.secretName == '{{ request.object.metadata.name }}' || contains(projected.sources[].secret.name
+              || `[]`, '{{ request.object.metadata.name }}')].name
+            default: []
+        - name: activation
+          variable:
+            jmesPath: parse_json(element0.metadata.annotations."certificates.quorate.internal/activation" || '{}')
+        - name: rollout
+          variable:
+            jmesPath: length(element0.metadata.ownerReferences[?(kind == 'ReplicaSet' && contains(`{{ replicas }}`,
+              name)) || (kind == 'DaemonSet' && contains(`{{ daemonsets }}`, name)) || (kind == 'StatefulSet' &&
+              contains(`{{ statefulsets }}`, name))] || `[]`) > `0`
+        foreach:
+        - list: element.spec.[containers, initContainers][]
+          preconditions:
+            all:
+            - key: '{{ rollout }}'
+              operator: Equals
+              value: false
+            any:
+            - key: '{{ element.volumeMounts[].name || `[]` }}'
+              operator: AnyIn
+              value: '{{ tlsVolumes }}'
+            - key: '{{ element.env[].name || `[]` }}'
+              operator: AnyIn
+              value:
+              - '{{ request.object.metadata.name }}'
+            - key: '{{ element.envFrom[].name || `[]` }}'
+              operator: AnyIn
+              value:
+              - '{{ request.object.metadata.name }}'
+          deny:
+            conditions:
+              all:
+              - key: '{{ activation."{{ element.name }}" || `""` }}'
+                operator: AnyNotIn
+                value:
+                - native
+                - controller
+                message: Pod {{ element0.metadata.name }}, container {{ element.name }} has no automatic certificate
+                  activation path.