72 lines
2.1 KiB
YAML
72 lines
2.1 KiB
YAML
{{- if .Values.clusterConfig.kyverno.enabled }}
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: whitelist-internal-ingresses
|
|
annotations:
|
|
policies.clusterConfig.kyverno.io/title: Concatenate Ingresss
|
|
policies.clusterConfig.kyverno.io/category: Other
|
|
policies.clusterConfig.kyverno.io/severity: medium
|
|
policies.clusterConfig.kyverno.io/subject: Ingress
|
|
policies.clusterConfig.kyverno.io/description: >-
|
|
Ingresses with the annotation "oceanbox.io/expose=internal" should be whitelisted.
|
|
If no whitelist exists, add the default values, otherwise append
|
|
whitelist to the already existing ones
|
|
spec:
|
|
mutateExistingOnPolicyUpdate: false
|
|
rules:
|
|
- name: ensure-haproxy-allowlist-exists
|
|
skipBackgroundRequests: true
|
|
match:
|
|
resources:
|
|
kinds:
|
|
- Ingress
|
|
annotations:
|
|
oceanbox.io/expose: internal
|
|
mutate:
|
|
patchStrategicMerge:
|
|
metadata:
|
|
annotations:
|
|
+(haproxy.org/allow-list): ""
|
|
- name: append-existing-haproxy-allowlist
|
|
skipBackgroundRequests: true
|
|
match:
|
|
resources:
|
|
kinds:
|
|
- Ingress
|
|
annotations:
|
|
oceanbox.io/expose: internal
|
|
preconditions:
|
|
any:
|
|
- key: "{{`{{request.object.metadata.annotations.\"haproxy.org/allow-list\"}}`}}"
|
|
operator: NotEquals
|
|
value: ""
|
|
mutate:
|
|
patchStrategicMerge:
|
|
metadata:
|
|
annotations:
|
|
{{- with .Values.clusterConfig.ingress_whitelist }}
|
|
haproxy.org/allow-list: "{{`{{ @ }}`}},{{ join "," . }}"
|
|
{{- end }}
|
|
- name: add-haproxy-allowlist
|
|
skipBackgroundRequests: true
|
|
match:
|
|
resources:
|
|
kinds:
|
|
- Ingress
|
|
annotations:
|
|
oceanbox.io/expose: internal
|
|
preconditions:
|
|
any:
|
|
- key: "{{`{{request.object.metadata.annotations.\"haproxy.org/allow-list\"}}`}}"
|
|
operator: Equals
|
|
value: ""
|
|
mutate:
|
|
patchStrategicMerge:
|
|
metadata:
|
|
annotations:
|
|
{{- with .Values.clusterConfig.ingress_whitelist }}
|
|
haproxy.org/allow-list: "{{ join "," . }}"
|
|
{{- end }}
|
|
{{- end }}
|