Merge pull request #735 from nirmata/add_policyviolation_clusterrole

Add rules to disallow default namespace for pod controllers.

samples/DisallowDefaultNamespace.md

@@ -11,6 +11,14 @@ apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
   name: disallow-default-namespace
+  annotations:
+    pod-policies.kyverno.io/autogen-controllers: none	
+    policies.kyverno.io/category: Workload Isolation
+    policies.kyverno.io/description: Kubernetes namespaces are an optional feature 
+      that provide a way to segment and isolate cluster resources across multiple 
+      applications and users. As a best practice, workloads should be isolated with 
+      namespaces. Namespaces should be required and the default (empty) namespace 
+      should not be used.
 spec:
   rules:
   - name: validate-namespace
@@ -33,4 +41,30 @@ spec:
       pattern:
         metadata:
           namespace: "?*"
+  - name: validate-podcontroller-namespace
+    match:
+      resources:
+        kinds:
+        - DaemonSet
+        - Deployment
+        - Job
+        - StatefulSet
+    validate:
+      message: "Using 'default' namespace is not allowed for podcontrollers"
+      pattern:
+        metadata:
+          namespace: "!default"
+  - name: require-podcontroller-namespace
+    match:
+      resources:
+        kinds:
+        - DaemonSet
+        - Deployment
+        - Job
+        - StatefulSet
+    validate:
+      message: "A namespace is required for podcontrollers"
+      pattern:
+        metadata:
+          namespace: "?*"
 ````

samples/best_practices/disallow_default_namespace.yaml

@@ -3,6 +3,7 @@ kind: ClusterPolicy
 metadata:
   name: disallow-default-namespace
   annotations:
+    pod-policies.kyverno.io/autogen-controllers: none	
     policies.kyverno.io/category: Workload Isolation
     policies.kyverno.io/description: Kubernetes namespaces are an optional feature 
       that provide a way to segment and isolate cluster resources across multiple 
@@ -31,4 +32,30 @@ spec:
       pattern:
         metadata:
           namespace: "?*"
+  - name: validate-podcontroller-namespace
+    match:
+      resources:
+        kinds:
+        - DaemonSet
+        - Deployment
+        - Job
+        - StatefulSet
+    validate:
+      message: "Using 'default' namespace is not allowed for podcontrollers"
+      pattern:
+        metadata:
+          namespace: "!default"
+  - name: require-podcontroller-namespace
+    match:
+      resources:
+        kinds:
+        - DaemonSet
+        - Deployment
+        - Job
+        - StatefulSet
+    validate:
+      message: "A namespace is required for podcontrollers"
+      pattern:
+        metadata:
+          namespace: "?*"