54 lines
1.8 KiB
YAML
54 lines
1.8 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: protect-shared-gateways
|
|
annotations:
|
|
policies.kyverno.io/title: Protect shared Gateway specs
|
|
policies.kyverno.io/category: Gateway API
|
|
policies.kyverno.io/severity: high
|
|
policies.kyverno.io/description: >-
|
|
Shared Gateways (internal, relay, and short) may only have their spec mutated
|
|
by Flux GitOps service accounts. Cilium status updates that do not change
|
|
spec are not evaluated. Admission-only (userInfo is not available in
|
|
background scans).
|
|
spec:
|
|
validationFailureAction: Audit
|
|
background: false
|
|
rules:
|
|
- name: shared-gateway-spec-gitops-only
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Gateway
|
|
names:
|
|
- gateway-internal
|
|
- gateway-relay
|
|
- gateway-short
|
|
namespaces:
|
|
- kube-system
|
|
operations:
|
|
- CREATE
|
|
- UPDATE
|
|
preconditions:
|
|
any:
|
|
- key: "{{ request.operation }}"
|
|
operator: Equals
|
|
value: CREATE
|
|
- key: "{{ request.object.spec }}"
|
|
operator: NotEquals
|
|
value: "{{ request.oldObject.spec }}"
|
|
validate:
|
|
message: >-
|
|
Shared Gateway specs may only be created or changed by Flux
|
|
(flux-system kustomize-controller / helm-controller). Other callers
|
|
fail this audit until reviewed.
|
|
deny:
|
|
conditions:
|
|
all:
|
|
- key: "{{ request.userInfo.username }}"
|
|
operator: AnyNotIn
|
|
value:
|
|
- system:serviceaccount:flux-system:kustomize-controller
|
|
- system:serviceaccount:flux-system:helm-controller
|
|
- system:serviceaccount:flux-system:flux-operator
|