48 lines
1.9 KiB
YAML
48 lines
1.9 KiB
YAML
# Serves: R-NET-01 (baseline must actually deny both directions)
|
|
# Spec: docs/03 "Deny all ingress and deny all egress by default".
|
|
#
|
|
# Catches a MALFORMED baseline: a NetworkPolicy claiming to be the default-deny
|
|
# baseline (label homelab.keithjackson.dev/baseline=default-deny) that does not
|
|
# actually cover BOTH Ingress and Egress is rejected. This is the "test the
|
|
# behavior, not the existence" guard for R-NET-01 at the manifest layer -- an
|
|
# object existing is not proof it denies (docs/14 principle 1).
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: validate-default-deny-shape
|
|
annotations:
|
|
policies.kyverno.io/title: Validate default-deny baseline shape
|
|
policies.kyverno.io/category: Network Isolation
|
|
policies.kyverno.io/severity: high
|
|
homelab.keithjackson.dev/requirements: R-NET-01
|
|
policies.kyverno.io/description: >-
|
|
A NetworkPolicy labelled as the default-deny baseline must set policyTypes
|
|
to include both Ingress and Egress. Rejects a baseline that silently leaves
|
|
a direction open.
|
|
spec:
|
|
validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
|
|
background: true
|
|
rules:
|
|
- name: baseline-must-deny-both-directions
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- NetworkPolicy
|
|
selector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
validate:
|
|
message: >-
|
|
A default-deny baseline NetworkPolicy must set spec.policyTypes to include
|
|
BOTH Ingress and Egress (R-NET-01, docs/03).
|
|
deny:
|
|
conditions:
|
|
any:
|
|
- key: Ingress
|
|
operator: AnyNotIn
|
|
value: "{{ request.object.spec.policyTypes || `[]` }}"
|
|
- key: Egress
|
|
operator: AnyNotIn
|
|
value: "{{ request.object.spec.policyTypes || `[]` }}"
|