Disallow LoadBalancer, NodePort and ExternalName services for PAAS

charts/kyverno-policies/templates/service-types.yaml

@@ -0,0 +1,59 @@
+# https://github.com/kyverno/policies/blob/main/other/restrict_loadbalancer.yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: service-types
+spec:
+  background: true
+  validationFailureAction: Enforce
+  rules:
+  - name: no-load-balancer
+    match:
+      any:
+      - resources:
+          kinds:
+          - Service
+    exclude:
+      any:
+      - resources:
+          namespaces:
+          - ingress-nginx
+    validate:
+      message: "Service of type LoadBalancer is not allowed."
+      pattern:
+        spec:
+          type: "!LoadBalancer"
+  - name: no-external-name
+    match:
+      any:
+      - resources:
+          kinds:
+          - Service
+          namespaceSelector:
+            matchExpressions:
+            - key: osc.edu/role
+              operator: In
+              values:
+              - paas
+    validate:
+      message: "Service of type ExternalName is not allowed."
+      pattern:
+        spec:
+          type: "!ExternalName"
+  - name: no-node-port
+    match:
+      any:
+      - resources:
+          kinds:
+          - Service
+          namespaceSelector:
+            matchExpressions:
+            - key: osc.edu/role
+              operator: In
+              values:
+              - paas
+    validate:
+      message: "Service of type NodePort is not allowed."
+      pattern:
+        spec:
+          type: "!NodePort"

tests/kyverno-policies/service-types/kyverno-test.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: service-types
+policies:
+  - policy.yaml
+resources:
+  - resources.yaml
+variables: variables.yaml
+results:
+  - policy: service-types
+    rule: no-load-balancer
+    resources:
+      - ingress-nginx/load-balancer-skip
+    kind: Service
+    result: skip
+  - policy: service-types
+    rule: no-load-balancer
+    resources:
+      - test/load-balancer-pass
+    kind: Service
+    result: pass
+  - policy: service-types
+    rule: no-load-balancer
+    resources:
+      - test/load-balancer-fail
+    kind: Service
+    result: fail
+  - policy: service-types
+    rule: no-external-name
+    resources:
+      - webservice/external-name-skip
+    kind: Service
+    result: skip
+  - policy: service-types
+    rule: no-external-name
+    resources:
+      - paas/external-name-pass
+    kind: Service
+    result: pass
+  - policy: service-types
+    rule: no-external-name
+    resources:
+      - paas/external-name-fail
+    kind: Service
+    result: fail
+  - policy: service-types
+    rule: no-node-port
+    resources:
+      - webservice/node-port-skip
+    kind: Service
+    result: skip
+  - policy: service-types
+    rule: no-node-port
+    resources:
+      - paas/node-port-pass
+    kind: Service
+    result: pass
+  - policy: service-types
+    rule: no-node-port
+    resources:
+      - paas/node-port-fail
+    kind: Service
+    result: fail

tests/kyverno-policies/service-types/resources.yaml

@@ -0,0 +1,134 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: load-balancer-skip
+  namespace: ingress-nginx
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: LoadBalancer
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: load-balancer-pass
+  namespace: test
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: load-balancer-fail
+  namespace: test
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: LoadBalancer
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: external-name-skip
+  namespace: webservice
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: ExternalName
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: external-name-pass
+  namespace: paas
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: external-name-fail
+  namespace: paas
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: ExternalName
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: node-port-skip
+  namespace: webservice
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: NodePort
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: node-port-pass
+  namespace: paas
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: node-port-fail
+  namespace: paas
+spec:
+  ports:
+  - name: http-port
+    port: 80
+    protocol: TCP
+    targetPort: http-port
+  selector:
+    app: web
+  type: NodePort

tests/kyverno-policies/service-types/variables.yaml

@@ -0,0 +1,11 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Values
+metadata:
+  name: values
+namespaceSelector:
+  - name: webservice
+    labels:
+      osc.edu/role: webservice
+  - name: paas
+    labels:
+      osc.edu/role: paas