apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: protect-shared-gateways
  annotations:
    policies.kyverno.io/title: Protect shared Gateway specs
    policies.kyverno.io/category: Gateway API
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      Shared Gateways (internal, relay, and short) may only have their spec mutated
      by Flux GitOps service accounts. Cilium status updates that do not change
      spec are not evaluated. Admission-only (userInfo is not available in
      background scans).
spec:
  validationFailureAction: Audit
  background: false
  rules:
    - name: shared-gateway-spec-gitops-only
      match:
        any:
          - resources:
              kinds:
                - Gateway
              names:
                - gateway-internal
                - gateway-relay
                - gateway-short
              namespaces:
                - kube-system
              operations:
                - CREATE
                - UPDATE
      preconditions:
        any:
          - key: "{{ request.operation }}"
            operator: Equals
            value: CREATE
          - key: "{{ request.object.spec }}"
            operator: NotEquals
            value: "{{ request.oldObject.spec }}"
      validate:
        message: >-
          Shared Gateway specs may only be created or changed by Flux
          (flux-system kustomize-controller / helm-controller). Other callers
          fail this audit until reviewed.
        deny:
          conditions:
            all:
              - key: "{{ request.userInfo.username }}"
                operator: AnyNotIn
                value:
                  - system:serviceaccount:flux-system:kustomize-controller
                  - system:serviceaccount:flux-system:helm-controller
                  - system:serviceaccount:flux-system:flux-operator