31 lines
928 B
YAML
31 lines
928 B
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: restrict-referencegrants
|
|
annotations:
|
|
policies.kyverno.io/title: Deny ReferenceGrant by default
|
|
policies.kyverno.io/category: Gateway API
|
|
policies.kyverno.io/severity: medium
|
|
policies.kyverno.io/description: >-
|
|
ReferenceGrant is default-deny. Add a named PolicyException for reviewed
|
|
cross-namespace backend cases.
|
|
spec:
|
|
validationFailureAction: Audit
|
|
background: true
|
|
rules:
|
|
- name: deny-referencegrant
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- ReferenceGrant
|
|
validate:
|
|
message: >-
|
|
ReferenceGrant is not allowed by default. Request a named
|
|
PolicyException after review.
|
|
deny:
|
|
conditions:
|
|
any:
|
|
- key: "{{ request.object.kind }}"
|
|
operator: Equals
|
|
value: ReferenceGrant
|