jakman85andClaude Opus 4.8
bb2e9fc931
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
49 lines
2.1 KiB
YAML
49 lines
2.1 KiB
YAML
# Serves: R-IDP-02 (every service authenticates against the IdP; no unauthenticated UI)
|
|
# Spec: docs/15-identity-and-access.md; docs/13 `auth.mode: oidc|forward-auth|native|none`.
|
|
#
|
|
# Every workload must declare which authentication mode it uses so the platform can
|
|
# wire the correct integration (native OIDC Keycloak client, oauth2-proxy forward-auth
|
|
# at the Gateway, a documented `native` exception e.g. Plex, or `none`). A missing
|
|
# auth declaration would let a bare management UI onto the network unprotected, which
|
|
# docs/15 forbids ("no management UI sits unauthenticated").
|
|
#
|
|
# Matches Pods; pod-controller autogen extends to Deployment/StatefulSet/etc.
|
|
# LABEL KEY is a PROPOSED contract owned jointly with WS-SEC/WS-GITOPS -- see
|
|
# platform/kyverno/labels.md. The VALUES are fixed by docs/13.
|
|
# NOTE: `none` is permitted by the enum (docs/13) but is "discouraged / internal-only";
|
|
# the ServiceDefinition-level policy additionally forbids `public` + `none`.
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: require-auth-mode-label
|
|
annotations:
|
|
policies.kyverno.io/title: Require auth-mode label on workloads
|
|
policies.kyverno.io/category: Identity
|
|
policies.kyverno.io/severity: medium
|
|
homelab.keithjackson.dev/requirements: R-IDP-02
|
|
policies.kyverno.io/description: >-
|
|
Pods in application namespaces must declare
|
|
homelab.keithjackson.dev/auth-mode = oidc | forward-auth | native | none.
|
|
spec:
|
|
validationFailureAction: Enforce
|
|
background: true
|
|
rules:
|
|
- name: require-auth-mode
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaceSelector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/app-namespace: "true"
|
|
validate:
|
|
message: >-
|
|
Pods in application namespaces must carry the label
|
|
homelab.keithjackson.dev/auth-mode set to one of
|
|
oidc | forward-auth | native | none (R-IDP-02, docs/15).
|
|
pattern:
|
|
metadata:
|
|
labels:
|
|
homelab.keithjackson.dev/auth-mode: "oidc | forward-auth | native | none"
|