kubectl apply
    |
    v
API Server */} Authentication */} Authorization */} Mutating Admission
    |                                                      |
    v                                                      v
etcd <-- Validating Admission <-- Schema Validation <-- Webhook

# ConstraintTemplate: Definiert die Regel in Rego
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sallowedregistries
spec:
  crd:
    spec:
      names:
        kind: K8sAllowedRegistries
      validation:
        openAPIV3Schema:
          type: object
          properties:
            registries:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sallowedregistries

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not startswith(container.image, input.parameters.registries[_])
          msg := sprintf(
            "Container '%s' verwendet Image '%s' aus nicht erlaubter Registry. Erlaubt: %v",
            [container.name, container.image, input.parameters.registries]
          )
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          not startswith(container.image, input.parameters.registries[_])
          msg := sprintf(
            "Init-Container '%s' verwendet Image '%s' aus nicht erlaubter Registry. Erlaubt: %v",
            [container.name, container.image, input.parameters.registries]
          )
        }
---
# Constraint: Wendet die Regel an
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRegistries
metadata:
  name: nur-interne-registries
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
      - apiGroups: ["apps"]
        kinds: ["Deployment", "StatefulSet", "DaemonSet"]
    namespaces:
      - produktion
      - staging
  parameters:
    registries:
      - "harbor.unternehmen.de/"
      - "registry.unternehmen.de/"

# Kyverno ClusterPolicy: Nur erlaubte Container Registries
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: nur-erlaubte-registries
  annotations:
    policies.kyverno.io/title: Erlaubte Container Registries
    policies.kyverno.io/category: Supply Chain Security
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      Stellt sicher, dass nur Container-Images aus internen
      Registries deployed werden. Erfuellt BSI IT-Grundschutz
      APP.4.4.A14 (Schutz vor schadhaften Images).
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: validate-container-registry
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - produktion
                - staging
      validate:
        message: >-
          Image {{ request.object.spec.containers[].image }} stammt
          nicht aus einer erlaubten Registry.
          Erlaubt sind: harbor.unternehmen.de/ und registry.unternehmen.de/
        pattern:
          spec:
            containers:
              - image: "harbor.unternehmen.de/*"
            =(initContainers):
              - image: "harbor.unternehmen.de/*"
---
# Kyverno Mutating Policy: Automatisch Labels und Security Context setzen
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: security-defaults-erzwingen
spec:
  rules:
    - name: set-security-context
      match:
        any:
          - resources:
              kinds:
                - Pod
      mutate:
        patchStrategicMerge:
          spec:
            containers:
              - (name): "*"
                securityContext:
                  allowPrivilegeEscalation: false
                  readOnlyRootFilesystem: true
                  runAsNonRoot: true
                  capabilities:
                    drop:
                      - ALL

# Alle Policy Reports anzeigen
kubectl get polr -A

# Beispiel-Output:
# NAMESPACE    NAME                     PASS   FAIL   WARN   ERROR   SKIP
# produktion   polr-ns-produktion       142    3      0      0       0
# staging      polr-ns-staging          89     12     0      0       0

# Details zu einem Report
kubectl get polr polr-ns-produktion -n produktion -o yaml

# Policy Reports als JSON exportieren fuer Audit-Dokumentation
kubectl get polr -A -o json > policy-audit-report-$(date +%Y%m%d).json

# Alle Constraint-Violations anzeigen
kubectl get constraints -o json | \
  jq '.items[] | {name: .metadata.name, violations: .status.totalViolations}'

# Beispiel-Output:
# {"name": "nur-interne-registries", "violations": 3}
# {"name": "require-resource-limits", "violations": 7}

# Detail-Violations fuer einen Constraint
kubectl get k8sallowedregistries nur-interne-registries -o json | \
  jq '.status.violations[]'

# Kyverno: Audit Mode
spec:
  validationFailureAction: Audit  # Nicht Enforce
  background: true                # Bestehende Ressourcen pruefen

# Kyverno: Warn Mode fuer spezifische Namespaces
spec:
  validationFailureAction: Audit
  rules:
    - name: require-resource-limits
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: >-
          WARNUNG: Ab dem 01.04.2026 werden Pods ohne Resource Limits
          in Produktion blockiert. Bitte fuegen Sie requests und limits hinzu.
          Dokumentation: https://wiki.unternehmen.de/k8s/resource-limits
        pattern:
          spec:
            containers:
              - resources:
                  limits:
                    memory: "?*"
                    cpu: "?*"
                  requests:
                    memory: "?*"
                    cpu: "?*"

# GitHub Actions: Kyverno CLI fuer Pre-Deployment-Check
name: Policy Check
on:
  pull_request:
    paths:
      - 'k8s/**'

jobs:
  kyverno-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Kyverno CLI installieren
        run: |
          curl -LO https://github.com/kyverno/kyverno/releases/download/v1.12.0/kyverno-cli_v1.12.0_linux_x86_64.tar.gz
          tar -xzf kyverno-cli_v1.12.0_linux_x86_64.tar.gz
          sudo mv kyverno /usr/local/bin/

      - name: Policies gegen Manifeste pruefen
        run: |
          kyverno apply policies/ --resource k8s/manifeste/ \
            --detailed-results \
            --output policy-results.json

      - name: Ergebnis pruefen
        run: |
          FAILURES=$(jq '[.results[] | select(.result == "fail")] | length' policy-results.json)
          if [ "$FAILURES" -gt 0 ]; then
            echo "Policy-Verstoesse gefunden:"
            jq '.results[] | select(.result == "fail") | {policy: .policy, resource: .resource, message: .message}' policy-results.json
            exit 1
          fi
          echo "Alle Policies bestanden."