From b66eddfdbdef573000119fb2fca5ba34f2ba1e2c Mon Sep 17 00:00:00 2001
From: Kjeld Schouten <info@kjeldschouten.nl>
Date: Sun, 20 Oct 2024 11:39:57 +0200
Subject: [PATCH] chore(clustertool): add more kyverno policies

---
 .../kyverno-policies/app/ensure-digest.yaml   | 43 +++++++++++++++++++
 .../kyverno-policies/app/kustomization.yaml   |  3 ++
 .../core/kyverno-policies/app/patch-gha.yaml  | 29 +++++++++++++
 .../kyverno-policies/app/safe-to-evict.yaml   | 29 +++++++++++++
 4 files changed, 104 insertions(+)
 create mode 100644 clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
 create mode 100644 clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml
 create mode 100644 clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml

diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
new file mode 100644
index 00000000000..6c0b374d70f
--- /dev/null
+++ b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
@@ -0,0 +1,43 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: resolve-image-to-digest
+  annotations:
+    policies.kyverno.io/title: Resolve Image to Digest
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/severity: medium
+    kyverno.io/kyverno-version: 1.6.0
+    policies.kyverno.io/minversion: 1.6.0
+    kyverno.io/kubernetes-version: "1.23"
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Image tags are mutable and the change of an image can result in the same tag.
+      This policy resolves the image digest of each image in a container and replaces
+      the image with the fully resolved reference which includes the digest rather than tag.
+spec:
+  background: false
+  rules:
+  - name: resolve-to-digest
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    preconditions:
+      all:
+      - key: "{{request.operation || 'BACKGROUND'}}"
+        operator: NotEquals
+        value: DELETE
+    mutate:
+      foreach:
+      - list: "request.object.spec.containers"
+        context:
+          - name: resolvedRef
+            imageRegistry:
+              reference: "{{ element.image }}"
+              jmesPath: "resolvedImage"
+        patchStrategicMerge:
+          spec:
+            containers:
+            - name: "{{ element.name }}"
+              image: "{{ resolvedRef }}"
diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml
index ef5ecf242e4..5116ecf4e7a 100644
--- a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml
+++ b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml
@@ -3,3 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - schematic-to-pod.yaml
+  - patch-gha.yaml
+  - ensure-digest.yaml
+  - safe-to-evict.yaml
diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml
new file mode 100644
index 00000000000..cdd96e2f9c5
--- /dev/null
+++ b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml
@@ -0,0 +1,29 @@
+apiVersion: kyverno.io/v2beta1
+kind: ClusterPolicy
+metadata:
+  name: update-dind-args
+  annotations:
+    pod-policies.kyverno.io/autogen-controllers: none
+    policies.kyverno.io/title: Update dind Container Args
+    policies.kyverno.io/category: Other
+    kyverno.io/kyverno-version: 1.10.0
+    policies.kyverno.io/minversion: 1.10.0
+    kyverno.io/kubernetes-version: "1.30"
+spec:
+  rules:
+    - name: update-dind-args-rule
+      match:
+        any:
+        - resources:
+            kinds:
+              - AutoscalingRunnerSet
+      mutate:
+        patchesJson6902: |
+              - op: replace
+                path: /spec/template/spec/containers/1/args
+                value:
+                  - dockerd
+                  - --host=unix:///var/run/docker.sock
+                  - --group=123
+                  - --registry-mirror=http://spegel-registry.kube-system.svc.cluster.local:5000
+                  - --insecure-registry=http://spegel-registry.kube-system.svc.cluster.local:5000
diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml
new file mode 100644
index 00000000000..2436aea6e2b
--- /dev/null
+++ b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml
@@ -0,0 +1,29 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-safe-to-evict
+  annotations:
+    policies.kyverno.io/title: Add Safe To Evict
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/subject: Pod,Annotation
+    policies.kyverno.io/minversion: 1.6.0
+    policies.kyverno.io/description: >-
+      The Kubernetes cluster autoscaler does not evict pods that
+      use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation
+      cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.
+spec:
+  rules:
+  - name: annotate-empty-dir
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    mutate:
+      patchStrategicMerge:
+        metadata:
+          annotations:
+            +(cluster-autoscaler.kubernetes.io/safe-to-evict): "true"
+        spec:
+          volumes:
+          - <(emptyDir): {}