deny external services

deny-external-services/constraint-template.yml

@@ -0,0 +1,45 @@
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8sdeniedservicetypes
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sDeniedServiceTypes
+      validation:
+        openAPIV3Schema:
+          type: object
+          properties:
+            deniedTypes:
+              type: array
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package d8.pod_security_standards.extended
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          denied := service.spec.type
+          denied == "NodePort"
+          msg := sprintf("Service type %v is not allowed.", [denied])
+        }
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          denied := service.spec.type
+          denied == "LoadBalancer"
+          msg := sprintf("Service type %v is not allowed.", [denied])
+        }
+
+        violation[{"msg": msg}] {
+          service := input.review.object
+          service.kind == "Service"
+          externalIPs := service.spec.externalIPs
+          count(externalIPs) > 0
+          msg := "Usage of externalIPs is not allowed."
+        }

deny-external-services/deny-external-services.yml

@@ -0,0 +1,13 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sDeniedServiceTypes
+metadata:
+  name: deny-nodeport-loadbalancer-externalips-services
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Service"]
+  parameters:
+    deniedTypes:
+      - "NodePort"
+      - "LoadBalancer"