Skip to content

Commit 13aa469

Browse files
racheljpgracheljpg
committed
Add VAP for azurecluster
1 parent 4852490 commit 13aa469

File tree

2 files changed

+246
-0
lines changed

2 files changed

+246
-0
lines changed

‎openshift/infrastructure-components-openshift.yaml

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11023,3 +11023,126 @@ spec:
1102311023
targetPort: webhook-server
1102411024
selector:
1102511025
cluster.x-k8s.io/provider: infrastructure-azure
11026+
---
11027+
apiVersion: admissionregistration.k8s.io/v1
11028+
kind: ValidatingAdmissionPolicy
11029+
metadata:
11030+
name: openshift-cluster-api-protect-azurecluster
11031+
spec:
11032+
failurePolicy: Fail
11033+
matchConstraints:
11034+
resourceRules:
11035+
- apiGroups:
11036+
- infrastructure.cluster.x-k8s.io
11037+
apiVersions:
11038+
- '*'
11039+
operations:
11040+
- DELETE
11041+
resources:
11042+
- azureclusters
11043+
paramKind:
11044+
apiVersion: config.openshift.io/v1
11045+
kind: Infrastructure
11046+
validations:
11047+
- expression: '!(oldObject.metadata.name == params.status.infrastructureName)'
11048+
message: InfraCluster resources with metadata.name corresponding to the cluster
11049+
infrastructureName cannot be deleted.
11050+
---
11051+
apiVersion: admissionregistration.k8s.io/v1beta1
11052+
kind: ValidatingAdmissionPolicyBinding
11053+
metadata:
11054+
name: openshift-cluster-api-protect-azurecluster
11055+
spec:
11056+
matchResources:
11057+
namespaceSelector:
11058+
matchLabels:
11059+
kubernetes.io/metadata.name: openshift-cluster-api
11060+
paramRef:
11061+
name: cluster
11062+
parameterNotFoundAction: Deny
11063+
policyName: openshift-cluster-api-protect-azurecluster
11064+
validationActions:
11065+
- Deny
11066+
---
11067+
apiVersion: admissionregistration.k8s.io/v1beta1
11068+
kind: ValidatingAdmissionPolicy
11069+
metadata:
11070+
name: openshift-cluster-api-protect-azureclusteridentities
11071+
spec:
11072+
failurePolicy: Fail
11073+
matchConstraints:
11074+
resourceRules:
11075+
- apiGroups:
11076+
- infrastructure.cluster.x-k8s.io
11077+
apiVersions:
11078+
- '*'
11079+
operations:
11080+
- DELETE
11081+
resources:
11082+
- azureclusteridentities
11083+
paramKind:
11084+
apiVersion: config.openshift.io/v1
11085+
kind: Infrastructure
11086+
validations:
11087+
- expression: '!(oldObject.metadata.name == params.status.infrastructureName)'
11088+
message: InfraCluster resources with metadata.name corresponding to the cluster
11089+
infrastructureName cannot be deleted.
11090+
---
11091+
apiVersion: admissionregistration.k8s.io/v1
11092+
kind: ValidatingAdmissionPolicyBinding
11093+
metadata:
11094+
name: openshift-cluster-api-protect-azureclusteridentities
11095+
spec:
11096+
matchResources:
11097+
namespaceSelector:
11098+
matchLabels:
11099+
kubernetes.io/metadata.name: openshift-cluster-api
11100+
paramRef:
11101+
name: cluster
11102+
parameterNotFoundAction: Deny
11103+
policyName: openshift-cluster-api-protect-azureclusteridentities
11104+
validationActions:
11105+
- Deny
11106+
---
11107+
apiVersion: admissionregistration.k8s.io/v1
11108+
kind: ValidatingAdmissionPolicy
11109+
metadata:
11110+
name: openshift-cluster-api-protect-azureclustersecrets
11111+
spec:
11112+
failurePolicy: Fail
11113+
matchConstraints:
11114+
resourceRules:
11115+
- apiGroups:
11116+
- ""
11117+
apiVersions:
11118+
- '*'
11119+
operations:
11120+
- DELETE
11121+
resources:
11122+
- secret
11123+
resourceNames:
11124+
- capz-manager-bootstrap-credentials
11125+
- capz-manager-cluster-credential
11126+
paramKind:
11127+
apiVersion: config.openshift.io/v1
11128+
kind: Infrastructure
11129+
validations:
11130+
- expression: '!(oldObject.metadata.name == params.status.infrastructureName)'
11131+
message: InfraCluster resources with metadata.name corresponding to the cluster
11132+
infrastructureName cannot be deleted.
11133+
---
11134+
apiVersion: admissionregistration.k8s.io/v1
11135+
kind: ValidatingAdmissionPolicyBinding
11136+
metadata:
11137+
name: openshift-cluster-api-protect-azureclustersecrets
11138+
spec:
11139+
matchResources:
11140+
namespaceSelector:
11141+
matchLabels:
11142+
kubernetes.io/metadata.name: openshift-cluster-api
11143+
paramRef:
11144+
name: cluster
11145+
parameterNotFoundAction: Deny
11146+
policyName: openshift-cluster-api-protect-azureclustersecrets
11147+
validationActions:
11148+
- Deny

‎openshift/manifests/0000_30_cluster-api_04_cm.infrastructure-azure.yaml

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11025,6 +11025,129 @@ data:
1102511025
targetPort: webhook-server
1102611026
selector:
1102711027
cluster.x-k8s.io/provider: infrastructure-azure
11028+
---
11029+
apiVersion: admissionregistration.k8s.io/v1beta1
11030+
kind: ValidatingAdmissionPolicy
11031+
metadata:
11032+
name: openshift-cluster-api-protect-azurecluster
11033+
spec:
11034+
failurePolicy: Fail
11035+
matchConstraints:
11036+
resourceRules:
11037+
- apiGroups:
11038+
- infrastructure.cluster.x-k8s.io
11039+
apiVersions:
11040+
- '*'
11041+
operations:
11042+
- DELETE
11043+
resources:
11044+
- azureclusters
11045+
paramKind:
11046+
apiVersion: config.openshift.io/v1
11047+
kind: Infrastructure
11048+
validations:
11049+
- expression: '!(oldObject.metadata.name == params.status.infrastructureName)'
11050+
message: InfraCluster resources with metadata.name corresponding to the cluster
11051+
infrastructureName cannot be deleted.
11052+
---
11053+
apiVersion: admissionregistration.k8s.io/v1beta1
11054+
kind: ValidatingAdmissionPolicyBinding
11055+
metadata:
11056+
name: openshift-cluster-api-protect-azurecluster
11057+
spec:
11058+
matchResources:
11059+
namespaceSelector:
11060+
matchLabels:
11061+
kubernetes.io/metadata.name: openshift-cluster-api
11062+
paramRef:
11063+
name: cluster
11064+
parameterNotFoundAction: Deny
11065+
policyName: openshift-cluster-api-protect-azurecluster
11066+
validationActions:
11067+
- Deny
11068+
---
11069+
apiVersion: admissionregistration.k8s.io/v1
11070+
kind: ValidatingAdmissionPolicy
11071+
metadata:
11072+
name: openshift-cluster-api-protect-azureclusteridentities
11073+
spec:
11074+
failurePolicy: Fail
11075+
matchConstraints:
11076+
resourceRules:
11077+
- apiGroups:
11078+
- infrastructure.cluster.x-k8s.io
11079+
apiVersions:
11080+
- '*'
11081+
operations:
11082+
- DELETE
11083+
resources:
11084+
- azureclusteridentities
11085+
paramKind:
11086+
apiVersion: config.openshift.io/v1
11087+
kind: Infrastructure
11088+
validations:
11089+
- expression: '!(oldObject.metadata.name == params.status.infrastructureName)'
11090+
message: InfraCluster resources with metadata.name corresponding to the cluster
11091+
infrastructureName cannot be deleted.
11092+
---
11093+
apiVersion: admissionregistration.k8s.io/v1
11094+
kind: ValidatingAdmissionPolicyBinding
11095+
metadata:
11096+
name: openshift-cluster-api-protect-azureclusteridentities
11097+
spec:
11098+
matchResources:
11099+
namespaceSelector:
11100+
matchLabels:
11101+
kubernetes.io/metadata.name: openshift-cluster-api
11102+
paramRef:
11103+
name: cluster
11104+
parameterNotFoundAction: Deny
11105+
policyName: openshift-cluster-api-protect-azureclusteridentities
11106+
validationActions:
11107+
- Deny
11108+
---
11109+
apiVersion: admissionregistration.k8s.io/v1
11110+
kind: ValidatingAdmissionPolicy
11111+
metadata:
11112+
name: openshift-cluster-api-protect-azureclustersecrets
11113+
spec:
11114+
failurePolicy: Fail
11115+
matchConstraints:
11116+
resourceRules:
11117+
- apiGroups:
11118+
- ""
11119+
apiVersions:
11120+
- '*'
11121+
operations:
11122+
- DELETE
11123+
resources:
11124+
- secret
11125+
resourceNames:
11126+
- capz-manager-bootstrap-credentials
11127+
- capz-manager-cluster-credential
11128+
paramKind:
11129+
apiVersion: config.openshift.io/v1
11130+
kind: Infrastructure
11131+
validations:
11132+
- expression: '!(oldObject.metadata.name == params.status.infrastructureName)'
11133+
message: InfraCluster resources with metadata.name corresponding to the cluster
11134+
infrastructureName cannot be deleted.
11135+
---
11136+
apiVersion: admissionregistration.k8s.io/v1
11137+
kind: ValidatingAdmissionPolicyBinding
11138+
metadata:
11139+
name: openshift-cluster-api-protect-azureclustersecrets
11140+
spec:
11141+
matchResources:
11142+
namespaceSelector:
11143+
matchLabels:
11144+
kubernetes.io/metadata.name: openshift-cluster-api
11145+
paramRef:
11146+
name: cluster
11147+
parameterNotFoundAction: Deny
11148+
policyName: openshift-cluster-api-protect-azureclustersecrets
11149+
validationActions:
11150+
- Deny
1102811151
kind: ConfigMap
1102911152
metadata:
1103011153
annotations:

0 commit comments

Comments
 (0)