tommeramber

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kyverno-events-cleanup
  namespace: openshift-ops # Infra-only-namespace
spec:
  schedule: "*/10 * * * *"
  concurrencyPolicy: Forbid #do not allow the creation of new job before the previous one had finished
  jobTemplate:
    spec:

tommeramber

FROM registry.access.redhat.com/ubi8/ubi:latest
RUN rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm &&\
    yum install -y podman skopeo curl jq wget &&\
    yum clean all &&\
    rm -rf /var/cache/yum &&\
    wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-client-linux.tar.gz &&\
    tar xzvf openshift-client-linux.tar.gz -C /usr/local/bin/ &&\
    wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/oc-mirror.tar.gz &&\
    tar xzvf oc-mirror.tar.gz -C /usr/bin/
RUN mkdir -p /root/.docker/ &&\

tommeramber

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag   
spec:
  validationFailureAction: audit
  background: true
  rules:
  - name: require-image-tag
    match:

tommeramber

---
apiVersion: v1
kind: Namespace
metadata:
  name: kyverno
spec: {}
---
apiVersion: app.k8s.io/v1beta1
kind: Application
metadata:

tommeramber

oc apply -f ./config/istio/destinationrules-all.yaml 

oc apply -f ./config/istio/virtual-services-default.yaml

oc apply -f ./config/istio/virtual-service-userprofile-50-50.yaml

tommeramber

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: userprofile
spec:
  hosts:
  - userprofile
  http:
  - fault:
      abort:

tommeramber

package play

violation[msg] {
      input.kind == "Service"
      input.spec.type == "NodePort"
      msg := "User is not allowed to create service of type NodePort"
}


### Violation ###

tommeramber

apiVersion: template.openshift.io/v1
kind: Template
message: Login on https://${TENANT_NAME}-admin.${WILDCARD_DOMAIN} as ${ADMIN_USERNAME}/${ADMIN_PASSWORD}
metadata:
  annotations:
    description: 3scale API Management main system with PostgreSQL as System's database
    iconClass: icon-3scale
    openshift.io/display-name: 3scale API Management
    openshift.io/provider-display-name: Red Hat, Inc.
    tags: integration, api management, 3scale

tommeramber

apiVersion: maistra.io/v2
kind: ServiceMeshControlPlane
metadata:
  namespace: <Desired Service Mesh Control Plane NS>
  name: basic
spec:
  security:
    controlPlane:
      mtls: true
      tls: