policy-kargo-project-name-validation-apps-in-any-ns.yaml

{{ if .Values.kyvernoPolicies.validateKargoProjectName.enabled }}
{{- if .Capabilities.APIVersions.Has "kargo.akuity.io/v1alpha1/Project" }}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: kargo-project-name-validation-apps-in-any-ns
  annotations:
    argocd.argoproj.io/sync-wave: "1"
    policies.kyverno.io/title: Kargo Project Name Validation
    policies.kyverno.io/category: Kargo
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Kargo Project
    kyverno.io/kyverno-version: 1.12.0
    policies.kyverno.io/minversion: 1.12.0
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/description: >-
      This policy checks if the Kargo Project Name matches with the allowed destinations
      in the corresponding ArgoCD Project.
      Since the kargo project automatically creates a corresponding namespace,
      with this policy we can prevent that a namespace gets created
      which doesn't match the allowed destinations of the argocd project.
      It only works if argocd "application.resourceTrackingMethod: annotation" is set
spec:
  validationFailureAction: Enforce
  background: true
  rules:
  - name: check-kargo-project-name
    skipBackgroundRequests: true
    match:
      any:
      - resources:
          kinds:
          - kargo.akuity.io/*/Project
    preconditions:
      any:
      - key: "{{`{{ request.operation }}`}}"
        operator: NotEquals
        value: DELETE
    context:
    - name: app_namespace
      variable:
        jmesPath: request.object.metadata.annotations."argocd.argoproj.io/tracking-id" |  split(@, ':') | [0] | split(@, '_') | [0]
    - name: app
      variable:
        jmesPath: request.object.metadata.annotations."argocd.argoproj.io/tracking-id" |  split(@, ':') | [0] | split(@, '_') | [1]
    - name: argocd_project
      apiCall:
        method: GET
        urlPath: "/apis/argoproj.io/v1alpha1/namespaces/{{`{{app_namespace}}`}}/applications/{{`{{app}}`}}"
        jmesPath: spec.project
    - name: allowed_destination
      apiCall:
        method: GET
        urlPath: "/apis/argoproj.io/v1alpha1/namespaces/argocd/appprojects/{{`{{argocd_project}}`}}"
        jmesPath: spec.destinations[].namespace
    validate:
      message: >-
        Kyverno project '{{`{{request.object.metadata.name}}`}}' doesn't match the
        allowed destination '{{`{{allowed_destination}}`}}'
        of the argocd project '{{`{{argocd_project}}`}}'
        referenced in application '{{`{{app}}`}}'
        in namespace '{{`{{app_namespace}}`}}'
      deny:
        conditions:
          all:
          - key: "{{`{{request.object.metadata.name}}`}}"
            operator: AnyNotIn
            value: "{{`{{allowed_destination}}`}}"
{{- end }}
{{- end }}