Initial commit

infrastructure/kyverno/policies/require-istio-ambient.yaml

@@ -0,0 +1,81 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-istio-ambient-mesh
+  annotations:
+    policies.kyverno.io/title: Require Istio Ambient Mesh Enrollment
+    policies.kyverno.io/category: Zero Trust
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/description: >-
+      Application namespaces must be enrolled in Istio ambient mesh via the
+      istio.io/dataplane-mode=ambient label for zero-trust mTLS enforcement.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: check-namespace-ambient-label
+      match:
+        any:
+          - resources:
+              kinds:
+                - Namespace
+      exclude:
+        any:
+          - resources:
+              names:
+                # Core Kubernetes
+                - kube-system
+                - kube-public
+                - kube-node-lease
+                - kyverno
+                - default
+                # Infrastructure
+                - istio-system
+                - cert-manager
+                - cnpg-system
+                - rook-ceph
+                - vault
+                - external-secrets
+                - redis-operator
+                - mariadb-system
+                - scylla-operator
+                - scylla-manager
+                - reloader
+                - checkov
+                - kiali-operator
+                - envoy-gateway-system
+                - tetragon
+                - prometheus
+                - crowdsec
+                - cilium-secrets
+                - gateway
+                - argocd
+                - netbird-operator
+                # Rancher (exact names)
+                - cattle-system
+                - cattle-fleet-system
+                - cattle-fleet-local-system
+                - cattle-capi-system
+                - cattle-turtles-system
+                - cattle-ui-plugin-system
+                - cattle-impersonation-system
+                - cattle-global-data
+                - cattle-local-user-passwords
+                - cattle-fleet-clusters-system
+                - fleet-default
+                - fleet-local
+                - local
+                # Rancher dynamic namespaces (wildcard)
+                - cattle-*
+                - fleet-*
+                - c-*
+                - p-*
+                - u-*
+                - user-*
+                - cluster-fleet-*
+      validate:
+        message: "Application namespaces must have istio.io/dataplane-mode=ambient for zero-trust mTLS."
+        pattern:
+          metadata:
+            labels:
+              istio.io/dataplane-mode: ambient