add istio policies

nirmata · Feb 26, 2025 · 6641881 · 6641881
1 parent 6e5b71e
commit 6641881
Show file tree

Hide file tree

Showing 3 changed files with 86 additions and 38 deletions.
diff --git a/tetrate/tis0102/restrict-invalid-http-method.yaml b/tetrate/tis0102/restrict-invalid-http-method.yaml
diff --git a/tetrate/tis0102/restrict-invalid-method-authorization-policy.yaml b/tetrate/tis0102/restrict-invalid-method-authorization-policy.yaml
@@ -0,0 +1,48 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+    annotations:
+        policies.kyverno.io/category: Security
+        policies.kyverno.io/description: |
+            This policy ensures that in AuthorizationPolicy resources, the spec.rules[].to[].operation.method[] field contains only valid HTTP methods or properly formatted gRPC method names in the form /package.service/method.
+        policies.kyverno.io/severity: medium
+        policies.kyverno.io/title: Validate Authorization Policy Methods
+    name: validate-authorization-policy-methods
+spec:
+  background: true
+  rules:
+    - match:
+        any:
+          - resources:
+              kinds:
+                  - AuthorizationPolicy
+      name: validate-methods
+      validate:
+        foreach:
+          - elementScope: rules
+            foreach:
+              - elementScope: to
+                foreach:
+                  - deny:
+                      conditions:
+                          all:
+                              - key: '{{ element }}'
+                                operator: AnyNotIn
+                                value:
+                                  - GET
+                                  - POST
+                                  - PUT
+                                  - DELETE
+                                  - PATCH
+                                  - HEAD
+                                  - OPTIONS
+                                  - CONNECT
+                                  - TRACE
+                              - key: '{{ regex_match(''^/[a-zA-Z0-9.]+/[a-zA-Z0-9]+$'', element) }}'
+                                operator: Equals
+                                value: false
+                    list: to.operation.methods || []
+                list: rules.to
+            list: request.object.spec.rules
+        message: Methods must be either valid HTTP methods (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, CONNECT, TRACE) or valid gRPC methods in the form /package.service/method
+  validationFailureAction: Enforce
diff --git a/tetrate/tis0102/restrict-invalid-method-virtualservice.yaml b/tetrate/tis0102/restrict-invalid-method-virtualservice.yaml
@@ -0,0 +1,38 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+      policies.kyverno.io/category: Security
+      policies.kyverno.io/description: Ensures that HTTP methods specified in VirtualService resources are from an allowed set
+      policies.kyverno.io/severity: medium
+      policies.kyverno.io/title: Validate VirtualService HTTP Methods
+  name: validate-vs-http-methods
+spec:
+  background: true
+  rules:
+      - match:
+          any:
+            - resources:
+                kinds:
+                    - VirtualService
+        name: validate-http-methods
+        validate:
+          foreach:
+              - deny:
+                  conditions:
+                      all:
+                        - key: '{{ element }}'
+                          operator: NotIn
+                          value:
+                            - GET
+                            - HEAD
+                            - POST
+                            - PUT
+                            - DELETE
+                            - CONNECT
+                            - OPTIONS
+                            - TRACE
+                            - PATCH
+                list: request.object.spec.http[*].match[*].method.type
+          message: 'The HTTP method must be one of: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH'
+  validationFailureAction: Enforce