From cd482a4c6816f86d1129bbd0214fefadf2a835e0 Mon Sep 17 00:00:00 2001
From: Ruslan Piatrovich <Ruslan.Petrovich_ext@leroymerlin.ru>
Date: Thu, 8 Aug 2024 16:04:47 +0300
Subject: [PATCH] deny external services

---
 .../constraint-template.yml                   | 45 +++++++++++++++++++
 .../deny-external-services.yml                | 13 ++++++
 2 files changed, 58 insertions(+)
 create mode 100644 deny-external-services/constraint-template.yml
 create mode 100644 deny-external-services/deny-external-services.yml

diff --git a/deny-external-services/constraint-template.yml b/deny-external-services/constraint-template.yml
new file mode 100644
index 0000000..1906281
--- /dev/null
+++ b/deny-external-services/constraint-template.yml
@@ -0,0 +1,45 @@
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8sdeniedservicetypes
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sDeniedServiceTypes
+      validation:
+        openAPIV3Schema:
+          type: object
+          properties:
+            deniedTypes:
+              type: array
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package d8.pod_security_standards.extended
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          denied := service.spec.type
+          denied == "NodePort"
+          msg := sprintf("Service type %v is not allowed.", [denied])
+        }
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          denied := service.spec.type
+          denied == "LoadBalancer"
+          msg := sprintf("Service type %v is not allowed.", [denied])
+        }
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          externalIPs := service.spec.externalIPs
+          count(externalIPs) > 0
+          msg := "Usage of externalIPs is not allowed."
+        }
diff --git a/deny-external-services/deny-external-services.yml b/deny-external-services/deny-external-services.yml
new file mode 100644
index 0000000..efb468e
--- /dev/null
+++ b/deny-external-services/deny-external-services.yml
@@ -0,0 +1,13 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sDeniedServiceTypes
+metadata:
+  name: deny-nodeport-loadbalancer-externalips-services
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Service"]
+  parameters:
+    deniedTypes:
+      - "NodePort"
+      - "LoadBalancer"