values.yaml

{{- $pkg := "kyvernoPolicies" }}

{{- if (get .Values $pkg).enabled }}
{{- include "values-secret" (dict "root" $ "package" (dict "values" (fromYaml (include "bigbang.overlays.kyverno-policies" .))) "name" "kyverno-policies" "defaults" (include "bigbang.defaults.kyverno-policies" .)) }}
{{- end }}

{{- define "bigbang.defaults.kyverno-policies" -}}

{{- $deployNodeAgent := (and .Values.addons.velero.enabled (dig "deployNodeAgent" false .Values.addons.velero.values)) }}

waitforready:
  imagePullSecrets:
  - name: private-registry

policies:

  {{- if or .Values.twistlock.enabled .Values.neuvector.enabled }}
  disallow-host-namespaces:
    exclude:
      any:
      {{- if .Values.twistlock.enabled }}
      # Twistlock, by default, does its own network monitoring. hostNetworking is enabled by default for this purpose
      # With hostNetworking enabled, Istio sidecar injection is disabled. If this function is disabled, Twistlock will
      # not be able to self monitor. If both Istio sidecar injection and TL monitoring are disabled, a security gap will
      # be created for network monitoring in Twistlock.  So, it is important to make sure at least one is enabled.
      - resources:
          namespaces:
          - twistlock
          names:
          - twistlock-defender-ds*
      {{- end }}
      {{- if .Values.neuvector.enabled }}
      # Neuvector needs access to host to inspect network traffic
      - resources:
          namespaces:
          - neuvector
          names:
          - neuvector-enforcer-pod*
      {{- end }}
  {{- end }}

  {{- $nodePortIngressGateways := list }}
  {{- range $name, $values := .Values.istio.ingressGateways }}
  {{- if eq $values.type "NodePort" }}
  {{- $nodePortIngressGateways = append $nodePortIngressGateways $name }}
  {{- end }}
  {{- end }}

  {{- range $name, $values := .Values.istio.values.ingressGateways }}
  {{- if eq (dig "k8s" "service" "type" "LoadBalancer" $values) "NodePort" }}
  {{- $nodePortIngressGateways = append $nodePortIngressGateways $name }}
  {{- end }}
  {{- end }}

  # Istio services (istio ingress) can create type: NodePort services
  disallow-nodeport-services:
    validationFailureAction: enforce
    {{- if $nodePortIngressGateways }}
    exclude:
      any:
      - resources:
          kinds:
          - Service
          names:
          {{- range $name := $nodePortIngressGateways }}
          - {{ $name }}
          {{- end }}
          namespaces:
          - "istio-system"
    {{- end }}