Policy serving

.gitignore

@@ -0,0 +1,5 @@
+*.tz
+*.tgz
+*.vo
+*.vo.yaml
+.personal

policy-resources/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

policy-resources/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: policy-resources
+description: A Helm chart for gatekeeper policy-resources (CAUTION. do not use helm install. This is not a normal helm chart. It's only for the Decapod.)
+type: application
+version: 1.0.0
+appVersion: "1.0.0"
+
+home: https://github.com/openinfradev/helm-charts/policy-resources
+icon: https://open-policy-agent.github.io/gatekeeper/website/img/logo.svg
+keywords:
+- open policy agent
+- tks
+
+# dependencies:
+# - name: gatekeeper
+#   repository: https://open-policy-agent.github.io/gatekeeper/charts  
+#   version: 3.x.x

policy-resources/templates/constraintTemplate_k8sAllowedusersPerNamespaces.yaml

@@ -0,0 +1,49 @@
+{{- if .Values.policies.protectPerNamespace.enabled }}
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: protectpernamespace
+spec:
+  crd:
+    spec:
+      names:
+        kind: ProtectPerNamespace
+      validation:
+        openAPIV3Schema:
+          type: object
+          properties:
+            allowedGroup:
+              type: string
+              description: allowedGroup
+            allowedUsers:
+              type: array
+              description: allowedUsers
+              items: 
+                type: string
+            namespaces:
+              type: array
+              description: namespaces
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package protectpernamespace
+
+        violation[{"msg": msg}] {
+          not is_in_list(input.review.userInfo.username, input.parameters.allowedUsers)
+          not is_in_the_namespace(input.review.object.metadata.namespace, input.review.userInfo.username)
+          not is_in_list(input.parameters.allowedGroup, input.review.userInfo.groups)
+
+          msg := sprintf("user %v is not allowed to operate on the namespace '%v'\n",
+           [input.review.userInfo.username, input.review.object.metadata.namespace])
+        }
+
+        is_in_list(target, targetlist) {
+          target == targetlist[_]
+        } else = false
+
+        is_in_the_namespace(namespace, user) {
+          startswith(user, concat(":", ["system", "serviceaccount", namespace]))
+          }
+{{- end}}

policy-resources/templates/constraint_k8sAllowedusersPerNamespaces.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.policies.protectPerNamespace.enabled }}
+{{- $envAll := . }}
+{{- range .Values.policies.protectPerNamespace.constraints }}
+---
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: ProtectPerNamespace
+metadata:
+  name: {{.name | lower }}
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: "1"  
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: 
+        - Pods
+        - Configmaps
+        - Secrets
+        - Deployments
+        - Statefulsets
+        - Daemonsets
+        - Services
+        - Ingresses
+    namespaces:
+      {{- toYaml .parameters.namespaces | nindent 6 }}
+  parameters:
+    allowedUsers: 
+      {{- toYaml .parameters.allowedUsers | nindent 6 }}
+    allowedGroup: {{ .parameters.allowedGroup }}
+{{- end}}
+{{- end}}

policy-resources/values.yaml

@@ -0,0 +1,15 @@
+policies:
+  protectPerNamespace:
+    enabled: true
+    constraints:
+    - name: protectbytks
+      parameters:
+        namespaces: 
+        - "taco-system"
+        - "kube-system"
+        - "lma"
+        - "tks-msa"
+        allowedUsers: 
+        - "kubernetes-admin"
+        - "system:serviceaccount:kube-system:argocd-manager"
+        allowedGroup: "system:masters"