Draft - Update Namespaces with labels using policies

components/cost-management/policies/.chainsaw-test/chainsaw-assert-clusterpolicy.yaml

@@ -0,0 +1,8 @@
+apiVersion: test.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: assert-policy
+spec:
+  assertions:
+    - policy: label-namespaces-tenant
+      exists: true

components/cost-management/policies/.chainsaw-test/chainsaw-test.yaml

@@ -0,0 +1,22 @@
+apiVersion: test.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: label-namespaces-tenant
+spec:
+  policies:
+    - policy.yaml
+  resources:
+    - resources/namespace-matching.yaml
+    - resources/namespace-nonmatching.yaml
+  results:
+    - kind: Namespace
+      name: demo-tenant # demo
+      policy: label-namespaces-tenant
+      rule: label-tenant-namespaces
+      result: pass
+      patchedResource: resources/expected-namespace-matching.yaml
+    - kind: Namespace
+      name: random-ns
+      policy: label-namespaces-tenant
+      rule: label-tenant-namespaces
+      result: skip

components/cost-management/policies/.chainsaw-test/resources/expected-namespace-matching.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: demo-tenant
+  labels:
+    product: "openshift"
+    env: "production"
+    team: "fin-ops"
+    cost-center: "team"

components/cost-management/policies/.chainsaw-test/resources/namespace-matching.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: demo-tenant

components/cost-management/policies/.chainsaw-test/resources/namespace-nonmatching.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: random-ns

components/cost-management/policies/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- update_namespace_labels.yaml
+- kyverno_rbac.yaml

components/cost-management/policies/kyverno_rbac.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno-read-kubearchiveconfig
+  labels:
+    rbac.kyverno.io/aggregate-to-admission-controller: "true"
+rules:
+- apiGroups:
+  - kubearchive.kubearchive.org
+  resources:
+  - kubearchiveconfigs
+  verbs:
+  - list
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno-manage-kubearchiveconfig
+  labels:
+    rbac.kyverno.io/aggregate-to-background-controller: "true"
+rules:
+- apiGroups:
+  - kubearchive.kubearchive.org
+  resources:
+  - kubearchiveconfigs
+  verbs:
+  - create
+  - get
+  - list
+  - delete
+  - update

components/cost-management/policies/update_namespace_labels.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: label-namespaces-tenant
+spec:
+  rules:
+    - name: label-tenant-namespaces
+      match:
+        resources:
+          kinds:
+            - Namespace
+          selector:
+            matchLabels:
+              konflux-ci.dev/type: tenant
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            labels:
+              product: "openshift" # Needs to be configured in the GitOps
+              env: "production"
+              team: "konflux-fin-ops" # Needs to be configured in the GitOps
+              cost-center: "konflux-team" # Needs to be configured in the GitOps
+              insights_cost_management_optimizations: "true"