chore(clustertool): add more kyverno policies

clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml

@@ -0,0 +1,43 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: resolve-image-to-digest
+  annotations:
+    policies.kyverno.io/title: Resolve Image to Digest
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/severity: medium
+    kyverno.io/kyverno-version: 1.6.0
+    policies.kyverno.io/minversion: 1.6.0
+    kyverno.io/kubernetes-version: "1.23"
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Image tags are mutable and the change of an image can result in the same tag.
+      This policy resolves the image digest of each image in a container and replaces
+      the image with the fully resolved reference which includes the digest rather than tag.
+spec:
+  background: false
+  rules:
+  - name: resolve-to-digest
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    preconditions:
+      all:
+      - key: "{{request.operation || 'BACKGROUND'}}"
+        operator: NotEquals
+        value: DELETE
+    mutate:
+      foreach:
+      - list: "request.object.spec.containers"
+        context:
+          - name: resolvedRef
+            imageRegistry:
+              reference: "{{ element.image }}"
+              jmesPath: "resolvedImage"
+        patchStrategicMerge:
+          spec:
+            containers:
+            - name: "{{ element.name }}"
+              image: "{{ resolvedRef }}"

clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml

@@ -3,3 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - schematic-to-pod.yaml
+  - patch-gha.yaml
+  - ensure-digest.yaml
+  - safe-to-evict.yaml

clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml

@@ -0,0 +1,29 @@
+apiVersion: kyverno.io/v2beta1
+kind: ClusterPolicy
+metadata:
+  name: update-dind-args
+  annotations:
+    pod-policies.kyverno.io/autogen-controllers: none
+    policies.kyverno.io/title: Update dind Container Args
+    policies.kyverno.io/category: Other
+    kyverno.io/kyverno-version: 1.10.0
+    policies.kyverno.io/minversion: 1.10.0
+    kyverno.io/kubernetes-version: "1.30"
+spec:
+  rules:
+    - name: update-dind-args-rule
+      match:
+        any:
+        - resources:
+            kinds:
+              - AutoscalingRunnerSet
+      mutate:
+        patchesJson6902: |
+              - op: replace
+                path: /spec/template/spec/containers/1/args
+                value:
+                  - dockerd
+                  - --host=unix:///var/run/docker.sock
+                  - --group=123
+                  - --registry-mirror=http://spegel-registry.kube-system.svc.cluster.local:5000
+                  - --insecure-registry=http://spegel-registry.kube-system.svc.cluster.local:5000

clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml

@@ -0,0 +1,29 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-safe-to-evict
+  annotations:
+    policies.kyverno.io/title: Add Safe To Evict
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/subject: Pod,Annotation
+    policies.kyverno.io/minversion: 1.6.0
+    policies.kyverno.io/description: >-
+      The Kubernetes cluster autoscaler does not evict pods that
+      use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation
+      cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.
+spec:
+  rules:
+  - name: annotate-empty-dir
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    mutate:
+      patchStrategicMerge:
+        metadata:
+          annotations:
+            +(cluster-autoscaler.kubernetes.io/safe-to-evict): "true"
+        spec:
+          volumes:
+          - <(emptyDir): {}