50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
apiVersion: templates.gatekeeper.sh/v1
|
|
kind: ConstraintTemplate
|
|
metadata:
|
|
annotations:
|
|
description: Denies NodePort, LoadBalancer service types, spec.externalIP field
|
|
metadata.gatekeeper.sh/title: Allowed service types
|
|
metadata.gatekeeper.sh/version: 1.0.0
|
|
name: d8deniedservicetypes
|
|
spec:
|
|
crd:
|
|
spec:
|
|
names:
|
|
kind: D8DeniedServiceTypes
|
|
validation:
|
|
openAPIV3Schema:
|
|
type: object
|
|
properties:
|
|
deniedTypes:
|
|
type: array
|
|
items:
|
|
type: string
|
|
targets:
|
|
- target: admission.k8s.gatekeeper.sh
|
|
rego: |
|
|
package d8.pod_security_standards.extended
|
|
|
|
violation[{"msg": msg}] {
|
|
service := input.review.object
|
|
service.kind == "Service"
|
|
denied := service.spec.type
|
|
denied == "NodePort"
|
|
msg := sprintf("Service type %v is not allowed.", [denied])
|
|
}
|
|
|
|
violation[{"msg": msg}] {
|
|
service := input.review.object
|
|
service.kind == "Service"
|
|
denied := service.spec.type
|
|
denied == "LoadBalancer"
|
|
msg := sprintf("Service type %v is not allowed.", [denied])
|
|
}
|
|
|
|
violation[{"msg": msg}] {
|
|
service := input.review.object
|
|
service.kind == "Service"
|
|
externalIPs := service.spec.externalIPs
|
|
count(externalIPs) > 0
|
|
msg := "Usage of externalIPs is not allowed."
|
|
}
|