apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-gateway-route-selectors
  annotations:
    policies.kyverno.io/title: Require Gateway allowedRoutes Selector
    policies.kyverno.io/category: Gateway API
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      Shared Gateways must not use allowedRoutes.namespaces.from: All. Prefer
      label Selectors (gateway.quorate.internal/allow-internal|public|short).
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: deny-from-all-on-shared-gateways
      match:
        any:
          - resources:
              kinds:
                - Gateway
              names:
                - gateway-internal
                - gateway-relay
                - gateway-short
              namespaces:
                - kube-system
      validate:
        message: >-
          Shared Gateway listeners must set allowedRoutes.namespaces.from to
          Selector (not All) with the platform attach labels.
        foreach:
          - list: "request.object.spec.listeners[]"
            deny:
              conditions:
                any:
                  - key: "{{ element.allowedRoutes.namespaces.from || 'All' }}"
                    operator: Equals
                    value: All