1.1.5-2.4_apps-must-have-certain-set-of-annotations.yaml

# Copyright 2024 Google LLC
#
# This is “Software” that is licensed under the “General Software” section of
# the Service Specific Terms (https://cloud.google.com/terms/service-terms) for
# usage in accordance with the following “Scope of Use”: This file may only be
# used on an Anthos cluster, including any associated ci/cd use. “Anthos
# cluster” is defined as “A Cluster (of any kind) registered to a fleet project
# where the Anthos API is enabled”.
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredAnnotations
metadata:
  name: pci-dss-v3.2.1-apps-must-have-certain-set-of-annotations
  labels:
    policycontroller.gke.io/bundleName: pci-dss-v3.2.1
  annotations:
    policycontroller.gke.io/bundleVersion: "202403.0"
    policycontroller.gke.io/constraintData: |-
      "{
        bundleName: 'pci-dss-v3.2.1',
        bundleDisplayName: 'PCI DSS v3.2.1',
        bundleLink: 'https://cloud.google.com/anthos-config-management/docs/how-to/using-pci-dss-v3',
        bundleVersion: '202403.0',
        bundleDescription: 'Use the PCI DSS v3.2.1 policy bundle with Policy Controller to evaluate the compliance of your cluster resources against some aspects of the Payment Card Industry (PCI) Data Security Standard (DSS) v3.2.1.',
        controlNumbers: '[1.1.5,2.4]',
        severity: 'UNSPECIFIED',
        description: 'Requires that all apps in the cluster have a `network-controls/date` annotation.',
        remediation: 'Every app in the cluster requires a `network-controls/date` annotation. Check the app's network-controls and add an `network-controls/date` annotation with the schema {YYYY-MM-DD}.',
        minimumTemplateLibraryVersion: '1.11.1',
        constraintHash: '91d0f6fd469a5fa021ec74640396f3220396b720ac97f9b6bd86774289c75a0a'
      }"
spec:
  enforcementAction: dryrun
  match:
    kinds:
      - apiGroups:
          - apps
        kinds:
          - ReplicaSet
          - Deployment
          - StatefulSet
          - DaemonSet
    excludedNamespaces:
      - kube-system
      - kube-node-lease
      - kube-public
      - gatekeeper-system
      - config-management-system
      - config-management-monitoring
      - resource-group-system
      - gke-connect
      - istio-system
      - asm-system
      - cert-manager
      - gke-system
      - capi-system
      - anthos-identity-service
      - vm-system
      - capi-kubeadm-bootstrap-system
      - gke-managed-metrics-server
      - gmp-system
      - gke-gmp-system
      - apigee
      - apigee-system
      - gke-managed-cim
  parameters:
    message: All apps must have a `network-controls/date` annotations.
    annotations:
      - key: network-controls/date
        # Matches YYYY-MM-DD
        allowedRegex: ^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])$