fluxcd : adding repo example with some apps

fluxcd/repo/infrastructure/base/gatekeeper/resources/affinity-datascience.yaml

@@ -0,0 +1,47 @@
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: affinity-datascience
+spec:
+  applyTo:
+  - groups:
+    - ""
+    kinds:
+    - Pod
+    versions:
+    - v1
+  location: spec.affinity
+  match:
+    kinds:
+    - apiGroups:
+      - '*'
+      kinds:
+      - Pod
+    labelSelector:
+      matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values:
+        - disigas
+        - dilre
+        - difunds
+        - dicaplink
+        - dimatchdom
+        - dimatchname
+        - discoring
+        - dijal
+        - procol
+    namespaces:
+    - privateapi
+    scope: Namespaced
+  parameters:
+    assign:
+      value:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: InstanceUsage
+                operator: In
+                values:
+                - datascience

fluxcd/repo/infrastructure/base/gatekeeper/resources/block-latest-tags.yaml

@@ -0,0 +1,23 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: DisallowedTags
+metadata:
+  name: block-latest-tags
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+    namespaces:
+    - data-entry-management
+    - diffusion
+    - digital-marketing
+    - privateapi
+    - produits
+    - smartexchange
+    - vidocq
+    - flux-system
+    - infrastructure
+    scope: Namespaced
+  parameters:
+    tags: ["latest"]
+    exemptImages: []

fluxcd/repo/infrastructure/base/gatekeeper/resources/disallowed-tags.yaml

@@ -0,0 +1,80 @@
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: disallowedtags
+spec:
+  crd:
+    spec:
+      names:
+        kind: DisallowedTags
+      validation:
+        openAPIV3Schema:
+          type: object
+          properties:
+            exemptImages:
+              description: >-
+                Any container that uses an image that matches an entry in this list will be excluded
+                from enforcement. Prefix-matching can be signified with `*`. For example: `my-image-*`.
+                It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name)
+                in order to avoid unexpectedly exempting images from an untrusted repository.
+              type: array
+              items:
+                type: string
+            tags:
+              type: array
+              description: Disallowed container image tags.
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8sdisallowedtags
+
+        import data.lib.exempt_container.is_exempt
+
+        violation[{"msg": msg}] {
+            container := input_containers[_]
+            not is_exempt(container)
+            tags := [forbid | tag = input.parameters.tags[_] ; forbid = endswith(container.image, concat(":", ["", tag]))]
+            any(tags)
+            msg := sprintf("container <%v> uses a disallowed tag <%v>; disallowed tags are %v", [container.name, container.image, input.parameters.tags])
+        }
+
+        violation[{"msg": msg}] {
+            container := input_containers[_]
+            not is_exempt(container)
+            tag := [contains(container.image, ":")]
+            not all(tag)
+            msg := sprintf("container <%v> didn't specify an image tag <%v>", [container.name, container.image])
+        }
+
+        input_containers[c] {
+            c := input.review.object.spec.containers[_]
+        }
+        input_containers[c] {
+            c := input.review.object.spec.initContainers[_]
+        }
+        input_containers[c] {
+            c := input.review.object.spec.ephemeralContainers[_]
+        }
+      libs:
+        - |
+          package lib.exempt_container
+
+          is_exempt(container) {
+              exempt_images := object.get(object.get(input, "parameters", {}), "exemptImages", [])
+              img := container.image
+              exemption := exempt_images[_]
+              _matches_exemption(img, exemption)
+          }
+
+          _matches_exemption(img, exemption) {
+              not endswith(exemption, "*")
+              exemption == img
+          }
+
+          _matches_exemption(img, exemption) {
+              endswith(exemption, "*")
+              prefix := trim_suffix(exemption, "*")
+              startswith(img, prefix)
+          }

fluxcd/repo/infrastructure/base/gatekeeper/resources/gatekeeper-podmonitor.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: gatekeeper
+spec:
+  namespaceSelector:
+    matchNames:
+      - gatekeeper
+  selector:
+    matchExpressions:
+      - key: app
+        operator: In
+        values:
+          - gatekeeper
+  podMetricsEndpoints:
+    - port: metrics

fluxcd/repo/infrastructure/base/gatekeeper/resources/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: infrastructure
+resources:
+  - affinity-datascience.yaml
+  - block-latest-tags.yaml
+  - disallowed-tags.yaml
+  - ndots-dns.yaml
+  - toleration-datasience.yaml
+  - gatekeeper-podmonitor.yaml

fluxcd/repo/infrastructure/base/gatekeeper/resources/ndots-dns.yaml

@@ -0,0 +1,38 @@
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: ndots-dns
+spec:
+  applyTo:
+    - groups:
+        - ""
+      kinds:
+        - Pod
+      versions:
+        - v1
+  location: spec.dnsConfig
+  match:
+    kinds:
+      - apiGroups:
+          - '*'
+        kinds:
+          - Pod
+    namespaces:
+      - data-entry-management
+      - diffusion
+      - digital-marketing
+      - privateapi
+      - produits
+      - vidocq
+      - smartexchange
+      - identite-solvabilite
+      - alertes
+      - flux-system
+    scope: Namespaced
+  parameters:
+    assign:
+      value:
+        options:
+          - name: ndots
+            value: "1"
+          - name: no-aaaa

fluxcd/repo/infrastructure/base/gatekeeper/resources/toleration-datasience.yaml

@@ -0,0 +1,44 @@
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: toleration-datascience
+spec:
+  applyTo:
+  - groups:
+    - ""
+    kinds:
+    - Pod
+    versions:
+    - v1
+  location: spec.tolerations
+  match:
+    kinds:
+    - apiGroups:
+      - '*'
+      kinds:
+      - Pod
+    labelSelector:
+      matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values:
+        - disigas
+        - dilre
+        - difunds
+        - dicaplink
+        - dimatchdom
+        - dimatchname
+        - discoring
+        - dijal
+        - procol
+    namespaces:
+    - privateapi
+    scope: Namespaced
+  parameters:
+    assign:
+      value:
+      - effect: NoSchedule
+        key: InstanceUsage
+        operator: Equal
+        value: datascience
+