diff --git a/tetrate/tis0102/restrict-invalid-http-method.yaml b/tetrate/tis0102/restrict-invalid-http-method.yaml deleted file mode 100644 index bc67bca5..00000000 --- a/tetrate/tis0102/restrict-invalid-http-method.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - annotations: - policies.kyverno.io/category: Security - policies.kyverno.io/description: This policy ensures that HTTP methods specified in AuthorizationPolicy resources are valid. The policy validates that methods defined in spec.rules[].to[].operation.method[] are from the allowed set of HTTP methods. - policies.kyverno.io/severity: medium - policies.kyverno.io/title: Validate Authorization Policy HTTP Methods - name: validate-authz-policy-http-methods -spec: - background: true - rules: - - match: - any: - - resources: - kinds: - - AuthorizationPolicy - name: validate-http-methods - validate: - foreach: - - deny: - conditions: - all: - - key: '{{ element }}' - operator: NotIn - value: - - GET - - HEAD - - POST - - PUT - - DELETE - - CONNECT - - OPTIONS - - TRACE - - PATCH - list: request.object.spec.rules[*].to[*].operation.methods[*] - message: 'HTTP methods must be one of: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH' - validationFailureAction: Enforce \ No newline at end of file diff --git a/tetrate/tis0102/restrict-invalid-method-authorization-policy.yaml b/tetrate/tis0102/restrict-invalid-method-authorization-policy.yaml new file mode 100644 index 00000000..ab63ea93 --- /dev/null +++ b/tetrate/tis0102/restrict-invalid-method-authorization-policy.yaml @@ -0,0 +1,48 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + annotations: + policies.kyverno.io/category: Security + policies.kyverno.io/description: | + This policy ensures that in AuthorizationPolicy resources, the spec.rules[].to[].operation.method[] field contains only valid HTTP methods or properly formatted gRPC method names in the form /package.service/method. + policies.kyverno.io/severity: medium + policies.kyverno.io/title: Validate Authorization Policy Methods + name: validate-authorization-policy-methods +spec: + background: true + rules: + - match: + any: + - resources: + kinds: + - AuthorizationPolicy + name: validate-methods + validate: + foreach: + - elementScope: rules + foreach: + - elementScope: to + foreach: + - deny: + conditions: + all: + - key: '{{ element }}' + operator: AnyNotIn + value: + - GET + - POST + - PUT + - DELETE + - PATCH + - HEAD + - OPTIONS + - CONNECT + - TRACE + - key: '{{ regex_match(''^/[a-zA-Z0-9.]+/[a-zA-Z0-9]+$'', element) }}' + operator: Equals + value: false + list: to.operation.methods || [] + list: rules.to + list: request.object.spec.rules + message: Methods must be either valid HTTP methods (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, CONNECT, TRACE) or valid gRPC methods in the form /package.service/method + validationFailureAction: Enforce \ No newline at end of file diff --git a/tetrate/tis0102/restrict-invalid-method-virtualservice.yaml b/tetrate/tis0102/restrict-invalid-method-virtualservice.yaml new file mode 100644 index 00000000..eb37f062 --- /dev/null +++ b/tetrate/tis0102/restrict-invalid-method-virtualservice.yaml @@ -0,0 +1,38 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + annotations: + policies.kyverno.io/category: Security + policies.kyverno.io/description: Ensures that HTTP methods specified in VirtualService resources are from an allowed set + policies.kyverno.io/severity: medium + policies.kyverno.io/title: Validate VirtualService HTTP Methods + name: validate-vs-http-methods +spec: + background: true + rules: + - match: + any: + - resources: + kinds: + - VirtualService + name: validate-http-methods + validate: + foreach: + - deny: + conditions: + all: + - key: '{{ element }}' + operator: NotIn + value: + - GET + - HEAD + - POST + - PUT + - DELETE + - CONNECT + - OPTIONS + - TRACE + - PATCH + list: request.object.spec.http[*].match[*].method.type + message: 'The HTTP method must be one of: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH' + validationFailureAction: Enforce \ No newline at end of file