policy-kyverno-add-network-policy.yaml

# Use this policy to create NetworkPolicies in new namespaces.
# This policy requires the Kyverno policy enforcement point to be installed
# separately.  The policy is based off of a kyverno community policy 
# located here: https://kyverno.io/policies/best-practices/add_network_policy/
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-kyverno-add-network-policy
  annotations:
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
  remediationAction: inform
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-kyverno-add-network-policy
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: low
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: kyverno.io/v1
                kind: ClusterPolicy
                metadata:
                  name: add-networkpolicy
                  annotations:
                    policies.kyverno.io/title: Add Network Policy
                    policies.kyverno.io/category: Multi-Tenancy
                    policies.kyverno.io/subject: NetworkPolicy
                    policies.kyverno.io/description: >-
                      By default, Kubernetes allows communications across all Pods within a cluster.
                      The NetworkPolicy resource and a CNI plug-in that supports NetworkPolicy must be used to restrict
                      communications. A default NetworkPolicy should be configured for each Namespace to
                      default deny all ingress and egress traffic to the Pods in the Namespace. Application
                      teams can then configure additional NetworkPolicy resources to allow desired traffic
                      to application Pods from select sources. This policy will create a new NetworkPolicy resource
                      named `default-deny` which will deny all traffic anytime a new Namespace is created.      
                spec:
                  rules:
                  - name: default-deny
                    match:
                      resources:
                        kinds:
                        - Namespace
                    generate:
                      kind: NetworkPolicy
                      name: default-deny
                      namespace: "{{ `{{request.object.metadata.name}}` }}"
                      synchronize: true
                      data:
                        spec:
                          # select all pods in the namespace
                          podSelector: {}
                          # deny all traffic
                          policyTypes:
                          - Ingress
                          - Egress
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-kyverno-add-network-policy
placementRef:
  name: placement-policy-kyverno-add-network-policy
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
  - name: policy-kyverno-add-network-policy
    kind: Policy
    apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-kyverno-add-network-policy
spec:
  clusterConditions:
    - status: "True"
      type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      - {key: environment, operator: In, values: ["dev"]}