Merge pull request #384 from utilitywarehouse/as-kyverno-canary

add kyverno canary policy and resource for alert

kyverno/deploy/kyverno-reports-controller-args-patch.yaml

@@ -13,5 +13,4 @@ spec:
             - --policyReports=false
             - --validatingAdmissionPolicyReports=false # Already default, but guarding future changes by explicitly setting
             - -v=0
-            - --backgroundScan=false
           name: controller

kyverno/policies/canary-resource.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kyverno-canary-resource

kyverno/policies/canary/canary.yaml

@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: canary-resources
+  annotations:
+    policies.kyverno.io/title: Canary rule to detect canary resources
+    policies.kyverno.io/category: Canary
+    policies.kyverno.io/description: >-
+      This is the canary rule which detects canary resources in the cluster.
+      This is to alert on stopped or missing background scan report alerts.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: detect-canary-configmap
+      match:
+        resources:
+          kinds:
+            - ConfigMap
+          names:
+            - kyverno-canary-resource
+      validate:
+        message: "Found kyverno canary configMap in the cluster"
+        deny: {}

kyverno/policies/canary/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - canary.yaml

kyverno/policies/canary/test/kyverno-test.yaml

@@ -0,0 +1,24 @@
+name: test-canary-rules
+policies:
+  - ../canary.yaml
+resources:
+  - test-canary.yaml
+variables: values.yaml
+results:
+  - policy: canary-resources
+    rule: detect-canary-configmap
+    kind: ConfigMap
+    resource: kyverno-canary-resource
+    result: fail
+
+  - policy: canary-resources
+    rule: detect-canary-configmap
+    kind: ConfigMap
+    resource: argocd-cmd-params-cm
+    result: skip
+
+  - policy: canary-resources
+    rule: detect-canary-configmap
+    kind: ServiceAccount
+    resource: kyverno-canary-resource
+    result: skip

kyverno/policies/canary/test/test-canary.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kyverno-canary-resource
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  application.namespaces: "*"
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kyverno-canary-resource

kyverno/policies/canary/test/values.yaml

@@ -0,0 +1,4 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Values
+globalValues:
+  request.operation: UPDATE

kyverno/policies/kustomization.yaml

@@ -2,9 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - argocd/
+  - canary/
   - certificates/
   - ingress/
   - namespaces/
   - pods/
   - serviceaccounts/
   - services/
+
+  - canary-resource.yaml