Create kyverno policy to block access to signing server in staging

Create a policy to create an EgressFirewall in all the namespaces except
internal-services to prevent communication with the signing server in
namespaces other than internal-services.

KFLUXINFRA-2676

Signed-off-by: Hugo Arès <hares@redhat.com>

Author: hugares

argo-cd-apps/base/internal/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - cert-manager
   - konflux-support-ops
   - konflux-devlake
+  - policies

argo-cd-apps/base/internal/policies/appset.yaml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: policies
+spec:
+  generators:
+    - clusters:
+        values:
+          sourceRoot: components/policies
+          environment: ""
+  template:
+    metadata:
+      name: policies-{{nameNormalized}}
+    spec:
+      project: default
+      source:
+        path: '{{values.sourceRoot}}/{{values.environment}}'
+        repoURL: https://github.com/redhat-appstudio/infra-common-deployments.git
+        targetRevision: main
+      destination:
+        namespace: konflux-policies
+        name: in-cluster
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - ServerSideApply=true
+        retry:
+          limit: 50
+          backoff:
+            duration: 10s
+            factor: 2
+            maxDuration: 3m

argo-cd-apps/base/internal/policies/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- appset.yaml

components/policies/internal-staging/block-signing-server-access/.chainsaw-test/chainsaw-assert-clusterpolicy.yaml

@@ -0,0 +1,10 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: block-signing-server-access
+status:
+  conditions:
+  - reason: Succeeded
+    status: "True"
+    type: Ready
+

components/policies/internal-staging/block-signing-server-access/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,63 @@
+---
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: egressfirewall-created-in-all-ns-but-one
+spec:
+  concurrent: false
+  description: |
+    Tests that the ClusterPolicy for generating EgressFirewall is
+    is creating the EgressFirewall in all namespace expect in internal-services.
+  steps:
+    - name: setup-crd
+      try:
+        - apply:
+            file: resources/mock-egressfirewall-crd.yaml
+        - assert:
+            file: resources/mock-egressfirewall-crd.yaml
+    - name: setup-permissions
+      try:
+        - apply:
+            file: ../kyverno_rbac.yaml
+    - name: Apply Kyverno ClusterPolicy and assert it exists
+      try:
+        - apply:
+            file: ../block-signing-server-access.yaml
+        - assert:
+            file: chainsaw-assert-clusterpolicy.yaml
+    - name: create-test-namespace
+      try:
+        - apply:
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: test-ns
+    - name: verify-egress-firewall-created
+      try:
+        - assert:
+            resource:
+              apiVersion: k8s.ovn.org/v1
+              kind: EgressFirewall
+              metadata:
+                name: default
+                namespace: test-ns
+    - name: create-internal-services-namespace
+      try:
+        - apply:
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: internal-services
+    - name: verify-no-egress-firewall-in-internal-services
+      try:
+      - delete:
+          ref:
+            apiVersion: k8s.ovn.org/v1
+            kind: EgressFirewall
+            namespace: internal-services
+            name: default
+          expect:
+            - check:
+                ($error != null): true

components/policies/internal-staging/block-signing-server-access/.chainsaw-test/resources/mock-egressfirewall-crd.yaml

@@ -0,0 +1,47 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: egressfirewalls.k8s.ovn.org
+spec:
+  group: k8s.ovn.org
+  names:
+    kind: EgressFirewall
+    listKind: EgressFirewallList
+    plural: egressfirewalls
+    singular: egressfirewall
+    shortNames:
+      - egressfw
+  scope: Namespaced
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                egress:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      type:
+                        type: string
+                        enum:
+                          - Allow
+                          - Deny
+                      to:
+                        type: object
+                        properties:
+                          cidrSelector:
+                            type: string
+                          dnsName:
+                            type: string
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+      subresources:
+        status: {}

components/policies/internal-staging/block-signing-server-access/block-signing-server-access.yaml

@@ -0,0 +1,38 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: block-signing-server-access
+  annotations:
+    policies.kyverno.io/title: Block signing server access
+    policies.kyverno.io/category: Firewall
+    policies.kyverno.io/subject: EgressFirewall
+    policies.kyverno.io/description: >-
+      This policy automatically generates an EgressFirewall resource in all
+      namespaces except the 'internal-services' namespace to block access to the signing server.
+spec:
+  background: true
+  rules:
+    - name: generate-egress-firewall
+      match:
+        any:
+          - resources:
+              kinds:
+                - /v1/Namespace
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - internal-services
+      generate:
+        generateExisting: true
+        apiVersion: k8s.ovn.org/v1
+        kind: EgressFirewall
+        name: default
+        namespace: "{{request.object.metadata.name}}"
+        synchronize: true
+        data:
+          spec:
+            egress:
+              - to:
+                  dnsName: signserver.devel.redhat.com
+                type: Deny

components/policies/internal-staging/block-signing-server-access/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- block-signing-server-access.yaml
+- kyverno_rbac.yaml

components/policies/internal-staging/block-signing-server-access/kyverno_rbac.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno-admission:viewer-egressfirewall
+  labels:
+    rbac.kyverno.io/aggregate-to-admission-controller: "true"
+rules:
+- apiGroups:
+  - k8s.ovn.org
+  resources:
+  - egressfirewalls
+  verbs:
+  - list
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno-background:manage-egressfirewall
+  labels:
+    rbac.kyverno.io/aggregate-to-background-controller: "true"
+rules:
+- apiGroups:
+  - k8s.ovn.org
+  resources:
+  - egressfirewalls
+  verbs:
+  - create
+  - get
+  - list
+  - delete
+  - update

components/policies/internal-staging/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- block-signing-server-access