apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-istio-ambient-mesh
  annotations:
    policies.kyverno.io/title: Require Istio Ambient Mesh Enrollment
    policies.kyverno.io/category: Zero Trust
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      Application namespaces must be enrolled in Istio ambient mesh via the
      istio.io/dataplane-mode=ambient label for zero-trust mTLS enforcement.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: check-namespace-ambient-label
      skipBackgroundRequests: true
      match:
        any:
          - resources:
              kinds:
                - Namespace
      exclude:
        any:
          - resources:
              names:
                # Core Kubernetes
                - kube-system
                - kube-public
                - kube-node-lease
                - kyverno
                - default
                # Infrastructure
                - istio-system
                - cert-manager
                - cnpg-system
                - rook-ceph
                - vault
                - external-secrets
                - redis-operator
                - mariadb-system
                - scylla-operator
                - scylla-manager
                - reloader
                - checkov
                - kiali-operator
                - envoy-gateway-system
                - tetragon
                - prometheus
                - crowdsec
                - cilium-secrets
                - gateway
                - argocd
                - netbird-operator
                # Rancher (exact names)
                - cattle-system
                - cattle-fleet-system
                - cattle-fleet-local-system
                - cattle-capi-system
                - cattle-turtles-system
                - cattle-ui-plugin-system
                - cattle-impersonation-system
                - cattle-global-data
                - cattle-local-user-passwords
                - cattle-fleet-clusters-system
                - fleet-default
                - fleet-local
                - local
                # Rancher dynamic namespaces (wildcard)
                - cattle-*
                - fleet-*
                - c-*
                - p-*
                - u-*
                - user-*
                - cluster-fleet-*
      validate:
        allowExistingViolations: true
        message: "Application namespaces must have istio.io/dataplane-mode=ambient for zero-trust mTLS."
        pattern:
          metadata:
            labels:
              istio.io/dataplane-mode: ambient