Merge pull request #125 from epasham/main

added policy library and included sample policies

library/general/allowedrepos/policy.yaml

@@ -0,0 +1,26 @@
+apiVersion: policy.jspolicy.com/v1beta1
+kind: JsPolicy
+metadata:
+  name: "allow-trusted-registries.infy.com"
+spec:
+  type: Validating
+  operations: ["CREATE", "UPDATE"]
+  resources: ["pods", "deployments", "daemonsets", "statefulsets"]
+  javascript: |
+    const registries = ["registry.k8s.io", "gcr.io"]
+
+    // Use template.spec if defined (for Deployments and StatefulSets), or use spec otherwise (for Pods)
+    podSpec = request.object?.spec?.template?.spec || request.object?.spec
+
+    podSpec?.containers?.forEach(function(container, index) {
+        if (!registries.includes(container.image.split('/')[0])) {
+            deny("Field spec.containers[" + index + "].image must be pulled from  " + registries.toString())
+        }
+    })
+
+    podSpec?.initContainers?.forEach(function(initContainer, index) {
+        let imageRegistry =  initContainer.image.split('/')[0] 
+        if (!registries.includes(initContainer.image.split('/')[0])) {
+            errors.push("Field spec.initContainers[" + index + "].image must match regex: " + registries.toString())
+        }
+    })

library/general/block-loadbalancer-services/policy.yaml

@@ -0,0 +1,12 @@
+apiVersion: policy.jspolicy.com/v1beta1
+kind: JsPolicy
+metadata:
+  name: "deny-service-type-loadbalancer.example.com"
+spec:
+  operations: ["CREATE", "UPDATE"]
+  resources: ["services"]
+  javascript: |
+    // This policy blocks Service of type LoadBalancer
+    if (request.object.spec.type === "LoadBalancer") {
+      deny(`${request.name} => service type ${request.object.spec.type} is not allowed!`);
+    }

library/general/block-nodeport-services/policy.yaml

@@ -0,0 +1,12 @@
+apiVersion: policy.jspolicy.com/v1beta1
+kind: JsPolicy
+metadata:
+  name: "deny-service-type-nodeport.infy.com"
+spec:
+  operations: ["CREATE", "UPDATE"]
+  resources: ["services"]
+  javascript: |
+    // This policy blocks Service of type NodePort
+    if (request.object.spec.type === "NodePort") {
+      deny(`${request.name} => service type ${request.object.spec.type} is not allowed!`);
+    }