deny external services

2024-08-08 16:04:47 +03:00
parent 8eaa7aa47b
commit cd482a4c68
2 changed files with 58 additions and 0 deletions
@@ -0,0 +1,45 @@
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8sdeniedservicetypes
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sDeniedServiceTypes
+      validation:
+        openAPIV3Schema:
+          type: object
+          properties:
+            deniedTypes:
+              type: array
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package d8.pod_security_standards.extended
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          denied := service.spec.type
+          denied == "NodePort"
+          msg := sprintf("Service type %v is not allowed.", [denied])
+        }
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          denied := service.spec.type
+          denied == "LoadBalancer"
+          msg := sprintf("Service type %v is not allowed.", [denied])
+        }
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          externalIPs := service.spec.externalIPs
+          count(externalIPs) > 0
+          msg := "Usage of externalIPs is not allowed."
+        }