feat: tetrate policies of TIS1402

Signed-off-by: Sanskar Sharma <[email protected]>

tetrate/TIS1402/enforce-valid-service-refs.yaml

@@ -0,0 +1,42 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: enforce-valid-service-refs
+  annotations:
+    policies.kyverno.io/title: Enforce Valid Service References
+    policies.kyverno.io/category: Istio Best Practices
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: HTTPRoute
+    policies.kyverno.io/description: >-
+      Ensures that backendRefs in HTTPRoute point to existing services within the same namespace.
+spec:
+  validationFailureAction: Enforce
+  rules:
+    - name: enforce-valid-service-refs
+      match:
+        any:
+          - resources:
+              kinds:
+              - HTTPRoute
+              operations:
+              - CREATE
+              - UPDATE
+      context:
+        - name: namespace
+          variable:
+            value: "{{ request.object.metadata.namespace }}"
+        - name: serviceNames
+          variable:
+            jmesPath: "request.object.spec.rules[*].backendRefs[?kind=='Service' || kind==null].name | []"
+        - name: existingServices
+          apiCall:
+            urlPath: "/api/v1/namespaces/{{ namespace }}/services"
+            jmesPath: "items[*].metadata.name"
+      validate:
+        message: "One or more referenced services do not exist in namespace '{{ namespace }}'. Referenced: '{{ serviceNames }}', Existing: '{{ existingServices }}'."
+        deny:
+          conditions:
+            any:
+              - key: "{{ serviceNames }}"
+                operator: AnyNotIn
+                value: "{{ existingServices }}"

tetrate/TIS1402/resource.yaml

@@ -0,0 +1,45 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: good-resource-1
+  namespace: test
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: existing-service  
+      namespace: test
+      port: 443
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: bad-resource-1
+  namespace: test
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: non-existing-service  
+      namespace: test
+      port: 443
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /