apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: cilium-networkpolicy-coverage
  annotations:
    policies.kyverno.io/title: CiliumNetworkPolicy namespace coverage
    policies.kyverno.io/category: Network Security
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: >-
      Audit namespaces that lack any CiliumNetworkPolicy. Stays Audit forever;
      never promote to Enforce (onboarding must not block on CNP admission).
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: require-namespaced-cilium-networkpolicy
      match:
        any:
          - resources:
              kinds:
                - Namespace
      exclude:
        any:
          - resources:
              names:
                - default
                - kube-system
                - kube-public
                - kube-node-lease
                - flux-system
                - flux-canary
                - kyverno
                - cert-manager
                - cilium-secrets
                - olm
                - operators
                - longhorn
                - openebs
                - intel-system
                - nfd
      context:
        - name: cnpcount
          apiCall:
            urlPath: "/apis/cilium.io/v2/namespaces/{{ request.object.metadata.name }}/ciliumnetworkpolicies"
            jmesPath: "items | length(@)"
      validate:
        message: >-
          Namespace {{ request.object.metadata.name }} has no CiliumNetworkPolicy
          resources. Add at least one namespaced CNP (clusterwide policies are not
          counted by this rule yet).
        deny:
          conditions:
            any:
              - key: "{{ cnpcount }}"
                operator: Equals
                value: 0