init

2024-12-13 14:22:21 +03:00
parent be33aa549e
commit f815f629ec
871 changed files with 193 additions and 138036 deletions
@@ -0,0 +1,49 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-namespace-ingress
+spec:
+  generateExisting: true
+  background: true
+  rules:
+    - name: add-network-policy
+      match:
+        any:
+          - resources:
+              kinds:
+                - Namespace
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-*
+                - d8-*
+                - aqua
+      generate:
+        kind: NetworkPolicy
+        apiVersion: networking.k8s.io/v1
+        namespace: "{{request.object.metadata.name}}"
+        name: restrict-namespace-ingress
+        synchronize: true
+        data:
+          metadata:
+            name: restrict-namespace-ingress
+          spec:
+            podSelector: {}
+            policyTypes:
+              - Ingress
+            ingress:
+              - from:
+                  - podSelector: {}
+              - from:
+                  - namespaceSelector:
+                      matchLabels:
+                        heritage: deckhouse
+              - from:
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: kube-system
+              - from:
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: aqua