apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: base64
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: secret-value-must-match-label
    match:
      resources:
        kinds:
        - Secret
    validate:
      deny:
        conditions:
        - key: "{{base64_decode(request.object.data.value)}}"
          operator: NotEquals
          value: "{{request.object.metadata.labels.value}}"
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: pattern-match
spec:
  validationFailureAction: enforce
  background: false
  rules:
    - match:
        all:
          - resources:
              kinds:
                - Namespace
      name: label-must-match-pattern
      validate:
        deny:
          conditions:
            all:
              - key: "{{pattern_match('prefix-*', request.object.metadata.labels.value)}}"
                operator: Equals
                value: false
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: path-canonicalize
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: disallow-mount-containerd-sock
    match:
      resources:
        kinds:
        - Pod
    validate:
      foreach:
      - list: "request.object.spec.volumes[]"
        preconditions:
          all:
          - key: "{{ element.hostPath.path }}"
            operator: NotEquals
            value: ""
        deny:
          conditions:
            any:
            - key: "{{ path_canonicalize(element.hostPath.path) }}"
              operator: Equals
              value: "/var/run/containerd/containerd.sock"
            - key: "{{ path_canonicalize(element.hostPath.path) }}"
              operator: Equals
              value: "/run/containerd/containerd.sock"
            # Allow variation in paths (to accommodate Windows) for local tests.
            - key: "{{ path_canonicalize(element.hostPath.path) }}"
              operator: Equals
              value: "\\var\\run\\containerd\\containerd.sock"
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: test-parse-json
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: test-json-parsing-jmespath
    match:
      resources:
        kinds:
         - ConfigMap
    validate:
      message: "Test JMESPath"
      deny:
        conditions:
        - key: "{{request.object.metadata.annotations.test | parse_json(@).a }}"
          operator: NotEquals
          value: b
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: test-parse-yaml
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: test-yaml-parsing-jmespath
    match:
      resources:
        kinds:
         - ConfigMap
    validate:
      message: "Test JMESPath"
      deny:
        conditions:
        - key: "{{request.object.metadata.annotations.test | parse_yaml(@).value }}"
          operator: NotEquals
          value: "a"
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: test-parse-yaml-array
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: test-yaml-parsing-jmespath
    match:
      resources:
        kinds:
         - ConfigMap
    validate:
      message: "Test JMESPath"
      deny:
        conditions:
        - key: a
          operator: NotIn
          value: "{{request.object.metadata.annotations.test | parse_yaml(@).array }}"
